Podcast appearances and mentions of Dan Kaminsky

Being at the core of the Internet places the DNS under a lot of pressure. New forms of DNS abuse emerge each year, disputes over domain names persist, and all the while, the Internet just keeps getting bigger. Mikhail Anisimov from ICANN talks about the coordinated effort involved in meeting these challenges and shares his views on DNS in Central Asia.As one of the organisations at the core of the Internet that works to coordinate the supply of Internet numbers and domain names, ICANN plays a vital role in helping to support and develop the DNS. Our guest Mikhail has been ICANN's Stakeholder Engagement Senior Manager for Eastern Europe and Central Asia since 2020, so we thought who better to talk to about DNS, DNSSEC, and its ongoing development in Central Asia.Show notes:02:18 - Wikipedia entry on DNS03:30 - You can learn lots about ICANN on their website04:10 – There's a list of all the root DNS servers and their operators on the IANA website. The RIPE NCC operates K-root.05:12 – Statdns has this useful list of DNS related RFCs08:40 – New gTLD program09:10 – FAQ on the next round of the new gTLD15:30 - The 8th Central Asian Internet Governance Forum took place on 21-22 June 2024.15:51 – ICANN's Domain Name Security Threat Information Collection and Reporting (DNSTICR) project16:02 - …and the broader Domain Abuse Activity Reporting (DAAR) project19:07 - Calling Time on DNSSEC by Geoff Huston22:19 – Dan Kaminsky in the Internet Hall of Fame28:00 – ICANN page on DNSSEC33:21 – The next Central Asia Peering and Interconnection Forum, CAPIF 3, takes place in Bishkek, Kyrgyzstan, from 24-25 September 2024.40:42 – Read Chris Buckridge's Fragmentation: Still the Internet's Big Bad here on RIPE Labs. Hosted on Acast. See acast.com/privacy for more information.

In this eye-opening episode of the podcast, I have the pleasure of engaging with Robert E. Lee, a seasoned expert in the field of information security. Our conversation plunges into the technical depths of cybersecurity, making it a treasure trove for those keen to understand the nuts and bolts of security protocols. We delve into the intricacies of TCP/IP and HTTP, unravel the techniques of effective port scanning, and confront the complex business challenges like account takeovers. This episode is a must-listen for anyone passionate about the inner workings of cybersecurity and looking for insights beyond the surface-level understanding.   Our discussion takes a critical turn as we explore the prevailing issues within the information security community, particularly the problem of groupthink and its impact on the sector's progression.   0:00 Intro 2:28 Robert's foray into infosec 12:56 Manual pen testing to automation 19:09 Portscan innovations 22:27 Sockstress 31:15 CIA triad and availability 35:25 Full disclosure 38:48 Dan Kaminsky, Jack Lewis and James Flom 41:32 Black hat vs white hat 43:43 Slow and minimalistic attacks 47:21 Selling Dyad Security 52:39 Hyper performant dynamic apps 57:21 Blue teaming vs red teaming 1:09:03 Banking and authentication 1:22:38 Conflicts of interest in red teaming 1:26:08 Amazon security 1:31:56 Twitter security and the bot problem 1:50:34 How infosec has changed and merit 2:12:06 Snap and OTP and fraud 2:17:30 Outro

This week we're talking to Cory Doctorow about his new book Chokepoint Capitalism - coauthored with Rebecca Giblin, his as yet unpublished next book The Internet Con: How to Seize the Means of Computation, and how corporate power is shaping our rights. Quick corrections! - GDPR compensation is in theory possible through court action: https://ico.org.uk/your-data-matters/data-protection-and-journalism/taking-your-case-to-court-and-claiming-compensation/ - GDPR Article 80(2) not Section 20 something as I stated! Links - Cory's website: https://craphound.com/ - Chokepoint Capitalism coauthored with Rebecca Giblin: https://doctorow.medium.com/what-is-chokepoint-capitalism-b885c4cb2719 - Giphy and Meta: https://privacyinternational.org/press-release/4911/uk-tribunal-agrees-metas-acquisition-giphy-harms-competition - Chokepoint Capitalism: the audiobook: https://www.kickstarter.com/projects/doctorow/chokepoint-capitalism-an-audiobook-amazon-wont-sell - How to leave dying social media platforms (without losing your friends): https://doctorow.medium.com/how-to-leave-dying-social-media-platforms-9fc550fe5ab - Cory on Mastodon: https://mamot.fr/@doctorow and https://mamot.fr/@pluralistic - PI on Mastodon: https://mastodon.xyz/@privacyint - Crad Kilodney documentary: https://vimeo.com/108567007 - Algorithms Exposed: https://cordis.europa.eu/project/id/825974 or https://algorithms.exposed/ - Bush V Gore election scandal: https://www.britannica.com/event/Bush-v-Gore - Goldacre report: https://www.gov.uk/government/publications/better-broader-safer-using-health-data-for-research-and-analysis - Amazon and NHS: https://privacyinternational.org/node/3298 - Rida Qadri: https://ridaqadri.net/research/ and some of her writing on tuyul apps: https://www.vice.com/en/article/7kvpng/delivery-drivers-are-using-grey-market-apps-to-make-their-jobs-suck-less - Oh for fuck's sake, not this fucking bullshit again : https://boingboing.net/2018/09/04/illegal-math.html - Dan Kaminsky's work on Colour blindness: https://dankaminsky.com/2010/12/15/dankam/ - How to get the most out of your Data Subject Access Request: https://privacyinternational.org/explainer/3845/71-tips-how-make-most-out-your-dsar

Hacker History sits down with Jonathan Leitschuh. We cover how he started out in robotics and found his way into security. Jonathan has reported vulnerabilities in things such as Gradle, Snyk, Zoom, and more! He's doing modern security at scale now in ways that few researchers are. Show Notes Jonathan's Twitter Jonathan's Zoom writeup explained […]

Just how severe is this DNS cache poisoning attack revealed this week? We'll break it down and explain why Linux is affected. Plus, the feature now removed from APT, more performance patches in the Kernel, and a big batch of project updates.

Just how severe is this DNS cache poisoning attack revealed this week? We'll break it down and explain why Linux is affected. Plus, the feature now removed from APT, more performance patches in the Kernel, and a big batch of project updates.

Just how severe is this DNS cache poisoning attack revealed this week? We'll break it down and explain why Linux is affected. Plus, the feature now removed from APT, more performance patches in the Kernel, and a big batch of project updates.

"By all extant metrics in security system review, this system should have failed instantaneously, at every possible layer.  And, to be fair, it has failed at other layers – BitCoin thefts have occurred, in the meta-code that surrounds the core technology itself. But the core technology actually works, and has continued to work, to a degree not everyone predicted. Time to enjoy being wrong. What the heck is going on here?" - Dan Kaminsky Today we read an excellent blast from the past by legend Dan Kaminsky who saw Bitcoin as an inevitable disaster that he couldn't wait to tear apart, only to be stopped at every tactic he used by code that "simply knew better." We lost Dan this past year from complications due to diabetes, and it's sad to lose such a major contributor to the security of the internet. RIP Dan, your contributions won't be forgotten. I Tried Hacking Bitcoin And I Failed: https://www.businessinsider.com/dan-kaminsky-highlights-flaws-bitcoin-2013-4 Don't forget your goodies from our awesome sponsors! 5% off the BitBox02 with code "GUY," your bank grade digital vault for your Bitcoin keys from Shiftcrypto.ch And secure your Bitcoin future by starting your automatic savings plan at SwanBitcoin.com/guy Learn more about your ad choices. Visit megaphone.fm/adchoices --- Send in a voice message: https://podcasters.spotify.com/pod/show/bitcoinaudible/message

"By all extant metrics in security system review, this system should have failed instantaneously, at every possible layer.  And, to be fair, it has failed at other layers – BitCoin thefts have occurred, in the meta-code that surrounds the core technology itself. But the core technology actually works, and has continued to work, to a degree not everyone predicted. Time to enjoy being wrong. What the heck is going on here?" - Dan Kaminsky Today we read an excellent blast from the past by legend Dan Kaminsky who saw Bitcoin as an inevitable disaster that he couldn't wait to tear apart, only to be stopped at every tactic he used by code that "simply knew better." We lost Dan this past year from complications due to diabetes, and it's sad to lose such a major contributor to the security of the internet. RIP Dan, your contributions won't be forgotten. I Tried Hacking Bitcoin And I Failed: https://www.businessinsider.com/dan-kaminsky-highlights-flaws-bitcoin-2013-4 Don't forget your goodies from our awesome sponsors! 5% off the BitBox02 with code "GUY," your bank grade digital vault for your Bitcoin keys from Shiftcrypto.ch And secure your Bitcoin future by starting your automatic savings plan at SwanBitcoin.com/guy Learn more about your ad choices. Visit megaphone.fm/adchoices

Matthew Dons was told five years ago that he had less than one year to live. 5 years later, he is still living with terminal cancer. The struggle has not gotten easier yet at the same time Matthew has gained a wealth of knowledge about health care costs, cancer treatment options, humanity and I would argue… life itself. Today on the program, recorded some weeks before his major surgery he is struggling to recover from currently, we talk about these past 5 years, and we also discuss the recent loss of the great Dan Kaminsky. In between there is podcasting, media, information, friendships and well.. the stuff life is made of. Listen in and enjoy.

The Toorcamp 2009 Episode: Everyone Tried, A Dream of CCCamp and Burning Man, Quaint Toorcon, I Was In, Silica, Missile Silos, Emmanuel, Two Kinds of People, Not Allowed, My Scariest Tour, The Police, Goodbye, I Can't Attend. My memories, hazed over 10 years, of Toorcamp 2009.  Dedicated to Dan Kaminsky, who attended the camp and who I enjoyed all the time I ever got with him.

In this week's TechnoSpotlight mini-episode we discuss a security video by Dan Kaminsky, a new book on AI by Kate Crawford, and a new book on data by Jer Thorp.Join to support the show and for exclusive content, including episode notes and scripts: patreon.com/kendallgilesFollow on Twitter: twitter.com/kendallgiles

We're back to talk about the ongoing tension between the Nation State and ascending Network States, also touching on the dichotomy between centralized, mechanical approaches to things like farming vs organic, holistic ones. We observed the passing Dan Kaminsky - RIP, and while we didn't talk about it on the show, after the show I wound up listening to Bankless podcast's Crypto Renaissance episode and found it had a lot of parallels to what we were talking about today, it was almost uncanny.References and LinksBrian Jackson's Tech Insights: Who took control of the Pentagon's IP space and why?Jesse's Conspiracy Theory as Post LiteracyDan Kaminsky RIPRobert Breedlove's: Sovereignism series, Part 1, Part 2 & Part 3

Recorded 3rd May 2021 Jim and Simon and Nick get together again to meander around the news nd some other stuff - this is an extra long show because somehow we ended up with 4 hours of audio! Anyway with some of the more off topic and meandering bits removed its down to a “mere” just over 2 hours (oops sorry about that). Also after such a massive edit the effort of making the show notes quite as tidy as usual was too much to face! So sorry, but all the links should still work even if it isn't in the usual tidy format... Oh and I don't mention it on the show but we are now available on a bucket more services including Amazon Music - just ask Alexa to play Essential Apple Podcast on Amazon Music... (also a considerable amount of monkeying around with Audacity to get the damn file down to the size required by Pinecast - one failing of Audacity is it tends not to tell you there are updates..) GIVEAWAYS & OFFERS Glenn Fleishman's book Take Control of Securing Your Mac can be found at takecontrolbooks.com along with many other titles by him, Joe Kissell, Jeff Carlson and others. Steve at Geeks Corner has a podcast which is usually a 5-15 min show of his thoughts on tech. Also keep an eye on his site or follow him on Twitter @GeekCorner_uk to watch for regular giveaways. Why not come and join the Slack community? You can now just click on this Slackroom Link to sign up and join in the chatter! Slacker @MacJim has a family friendly Flickr group for listeners to share photos because the Darkroom channel in the Slack has become so popular - if you're interested head over to to the Essential Apple Flickr and request an invitation. On this week's show: JAMES ORMISTON MacJim in the Slack In charge of the Essential Apple Flickr Also on Flickr as thesrpspaintshop Has videos on Vimeo NICK RILEY Big Show on the @spligosh on Twitter very occasionally. Sometimes appears on Bart Busschots' Let's Talk Apple Sutton Park Circuit church worship on YouTube APPLE Apple Q2 2021 Results - $89.58 Billion Revenue – MacStories Apple in Breach of EU Competition Law, European Commission Finds – MacRumors Apple Fined $12 Million in Russia for Violating Anti-Monopoly Rules With App Store – MacRumors AirDrop flaw exposes your phone number and email address - 9to5Mac iPad Pro 2021: Apple Confirms 2020 Magic Keyboard Will Work, But There's A Catch – Forbes iOS 14.5 App Tracking Transparency toggle mysteriously grayed out for some users – 9to5Mac Siri thinks you'll be able to add your Apple TV remote to Find My - 9to5Mac Here's how iPhone battery recalibration works in iOS 14.5 – 9to5Mac Apple iOS 14.5: Why The Latest Update Is Crucial For iPhone 11 – Forbes Parallels Desktop 16 for Mac now available for M1 Macs – Parallels Chipolo Takes Dig at AirTags When Advertising ONE Spot Item Tracker: 'No Accessory Needed' – MacRumors You Can Drill a Hole in an AirTag and Directly Attach It to a Keychain to Avoid Purchasing Those Accessories – Wccftech SuperDuper can now make bootable Big Sur backups – Six Colors – SixColors TECHNOLOGY Gravitricity battery generates first power at Edinburgh site – BBC The NYPD retires “Digidog” robot after public backlash – Ars Technica UTM and QEMU – YouTube QEMU SECURITY & PRIVACY Brace yourselves. Facebook has a new mega-leak on its hands — Ars Technica Computer security world in mourning over death of Dan Kaminsky, aged 42 – The Register * Prominent security expert Dan Kaminsky passes away at 42 – ZDNet Signal hacks Cellebrite device, reveals vulnerabilities and potential Apple copyright concerns – AppleInsider Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer – Signal Blog WORTH A CHIRP / ESSENTIAL TIPS Permissions Reset 2 JUST A SNIPPET For things that are not worth more than a flypast Even the Calibri Fonts Creator Is Glad Microsoft Will Have a New Defaut font – Wired NEMO'S HARDWARE STORE (2:08:03) QOBUZ Essential Apple Recommended Services: Pixel Privacy – a fabulous resource full of excellent articles and advice on how to protect yourself online. Doug.ee Blog for Andy J's security tips. Ghostery – protect yourself from trackers, scripts and ads while browsing. Simple Login – Email anonymisation and disposable emails for login/registering with 33mail.com – Never give out your real email address online again. AnonAddy – Disposable email addresses Sudo – get up to 9 “avatars” with email addresses, phone numbers and more to mask your online identity. Free for the first year and priced from $0.99 US / £2.50 UK per month thereafter... You get to keep 2 free avatars though. ProtonMail – end to end encrypted, open source, based in Switzerland. Prices start from FREE... what more can you ask? ProtonVPN – a VPN to go with it perhaps? Prices also starting from nothing! Comparitech DNS Leak Test – simple to use and understand VPN leak test. Fake Name Generator – so much more than names! Create whole identities (for free) with all the information you could ever need. Wire – free for personal use, open source and end to end encryted messenger and VoIP. Pinecast – a fabulous podcast hosting service with costs that start from nothing. Essential Apple is not affiliated with or paid to promote any of these services... We recommend services that we use ourselves and feel are either unique or outstanding in their field, or in some cases are just the best value for money in our opinion. Social Media and Slack You can follow us on: Twitter / Slack / EssentialApple.com / Soundcloud / Spotify / Facebook / Pinecast Also a big SHOUT OUT to the members of the Slack room without whom we wouldn't have half the stories we actually do – we thank you all for your contributions and engagement. You can always help us out with a few pennies by using our Amazon Affiliate Link so we get a tiny kickback on anything you buy after using it. If you really like the show that much and would like to make a regular donation then please consider joining our Patreon or using the Pinecast Tips Jar (which accepts one off or regular donations) And a HUGE thank you to the patrons who already do. Support The Essential Apple Podcast by contributing to their Tip Jar: https://tips.pinecast.com/jar/essential-apple-show This podcast is powered by Pinecast.

Picture of the Week. REvil hacks Apple supplier Quanta Computer. World-famous Scripps Health taken down. The Big Emotet Botnet Takedown. Emotet's 4,324,770 eMail addresses. Have I Been Pwned domain-wide notifications. QNAP. Gravity NNTP Newsreader updated to v3.0.11.0 Just a bit more about Dan Kaminsky. Closing the Loop. The Ransomware Task Force. We invite you to read our show notes at https://www.grc.com/sn/SN-817-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: itpro.tv/securitynow promo code SN30 vee.am/securitynow audible.com/securitynow or text securitynow to 500-500

Picture of the Week. REvil hacks Apple supplier Quanta Computer. World-famous Scripps Health taken down. The Big Emotet Botnet Takedown. Emotet's 4,324,770 eMail addresses. Have I Been Pwned domain-wide notifications. QNAP. Gravity NNTP Newsreader updated to v3.0.11.0 Just a bit more about Dan Kaminsky. Closing the Loop. The Ransomware Task Force. We invite you to read our show notes at https://www.grc.com/sn/SN-817-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: itpro.tv/securitynow promo code SN30 vee.am/securitynow audible.com/securitynow or text securitynow to 500-500

Picture of the Week. REvil hacks Apple supplier Quanta Computer. World-famous Scripps Health taken down. The Big Emotet Botnet Takedown. Emotet's 4,324,770 eMail addresses. Have I Been Pwned domain-wide notifications. QNAP. Gravity NNTP Newsreader updated to v3.0.11.0 Just a bit more about Dan Kaminsky. Closing the Loop. The Ransomware Task Force. We invite you to read our show notes at https://www.grc.com/sn/SN-817-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: itpro.tv/securitynow promo code SN30 vee.am/securitynow audible.com/securitynow or text securitynow to 500-500

Picture of the Week. REvil hacks Apple supplier Quanta Computer. World-famous Scripps Health taken down. The Big Emotet Botnet Takedown. Emotet's 4,324,770 eMail addresses. Have I Been Pwned domain-wide notifications. QNAP. Gravity NNTP Newsreader updated to v3.0.11.0 Just a bit more about Dan Kaminsky. Closing the Loop. The Ransomware Task Force. We invite you to read our show notes at https://www.grc.com/sn/SN-817-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: itpro.tv/securitynow promo code SN30 vee.am/securitynow audible.com/securitynow or text securitynow to 500-500

Picture of the Week. REvil hacks Apple supplier Quanta Computer. World-famous Scripps Health taken down. The Big Emotet Botnet Takedown. Emotet's 4,324,770 eMail addresses. Have I Been Pwned domain-wide notifications. QNAP. Gravity NNTP Newsreader updated to v3.0.11.0 Just a bit more about Dan Kaminsky. Closing the Loop. The Ransomware Task Force. We invite you to read our show notes at https://www.grc.com/sn/SN-817-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: itpro.tv/securitynow promo code SN30 vee.am/securitynow audible.com/securitynow or text securitynow to 500-500

Updates to the Linux kernel controversy: https://lwn.net/SubscriberLink/854645/334317047842b6c3/   @pageinSec on Twitter   Dan Kaminsky obit: https://www.theregister.com/2021/04/25/dan_kaminsky_obituary/   Spencer Geitzen: http://brakeingsecurity.com/2018-024-pacu-a-tool-for-pentesting-aws-environments   https://en.wikipedia.org/wiki/Milgram_experiment   https://lore.kernel.org/lkml/20210421130105.1226686-1-gregkh@linuxfoundation.org/   https://cse.umn.edu/cs/statement-cse-linux-kernel-research-april-21-2021 https://www.labbott.name/blog/2021/04/21/breakingtrust.html Seems like a number of patches were added (~190) and each had to be reviewed to ensure badness   https://twitter.com/UMNComputerSci/status/1384948683821694976 response to researchers   Linux Kernel mailing list: https://lore.kernel.org/linux-nfs/YH%2FfM%2FTsbmcZzwnX@kroah.com/   https://danielmiessler.com/blog/explaining-threats-threat-actors-vulnerabilities-and-risk-using-a-real-world-scenario/ https://twitter.com/SarahJamieLewis/status/1384871385537908736 @sarahJamieLewis shows the change they submitted in their paper: https://twitter.com/SarahJamieLewis/status/1384876050207940608 https://twitter.com/SarahJamieLewis/status/1330671897822982144/photo/1 https://twitter.com/SarahJamieLewis/status/1384880034146574341/photo/1 https://web.archive.org/web/20210421145121/https://www-users.cs.umn.edu/~kjlu/papers/crix.pdf (appears the researcher deleted this paper from their site.) https://web.archive.org/web/20210422144500/https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.pdf (researcher deleted this paper from their site.)“Throughout the study, we honestly did not think this is human research, so we did not apply for an IRB approval in the beginning. We apologize for the raised concerns. This is an important lesson we learned---Do not trust ourselves on determining human research; always refer to IRB whenever a study might be involving any human subjects in any form. We would like to thank the people who suggested us to talk to IRB after seeing the paper abstract.”   https://github.com/QiushiWu/qiushiwu.github.io NSF Grant application (thank you Page!) https://www.nsf.gov/awardsearch/showAward?AWD_ID=1931208&HistoricalAwards=false    NSF IRB requirements (from 2007): https://www.nsf.gov/pubs/2007/nsf07006/nsf07006.jsp Might be more recent - Human Subjects | NSF - National Science Foundation The researchers issued an apology today 25 April: https://lore.kernel.org/lkml/CAK8KejpUVLxmqp026JY7x5GzHU2YJLPU8SzTZUNXU2OXC70ZQQ@mail.gmail.com/ *thanks to Zach Whittacker’s security mailing list..*   https://twitter.com/argvee Thought provoking question for your show: is it realistically possible for an organization to build and scale a culture of code review that catches malicious insertions through (1) expert analysis; (2) adversarial mindset?   Co-author of : https://www.amazon.com/Building-Secure-Reliable-Systems-Implementing/dp/1492083127 Introduction of bugs (meaningful or otherwise) caused more work for devs.   Revert: https://lkml.org/lkml/2021/4/21/454 Quick overview of using deception in research from Duke’s IRB: Using Deception in Research | Institutional Review Board (duke.edu)   Is this better? Where’s the line on this? https://www.bleepingcomputer.com/news/security/emotet-malware-nukes-itself-today-from-all-infected-computers-worldwide/

Picture of the Week. REvil hacks Apple supplier Quanta Computer. World-famous Scripps Health taken down. The Big Emotet Botnet Takedown. Emotet's 4,324,770 eMail addresses. Have I Been Pwned domain-wide notifications. QNAP. Gravity NNTP Newsreader updated to v3.0.11.0 Just a bit more about Dan Kaminsky. Closing the Loop. The Ransomware Task Force. We invite you to read our show notes at https://www.grc.com/sn/SN-817-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: itpro.tv/securitynow promo code SN30 vee.am/securitynow audible.com/securitynow or text securitynow to 500-500

Picture of the Week. REvil hacks Apple supplier Quanta Computer. World-famous Scripps Health taken down. The Big Emotet Botnet Takedown. Emotet's 4,324,770 eMail addresses. Have I Been Pwned domain-wide notifications. QNAP. Gravity NNTP Newsreader updated to v3.0.11.0 Just a bit more about Dan Kaminsky. Closing the Loop. The Ransomware Task Force. We invite you to read our show notes at https://www.grc.com/sn/SN-817-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: itpro.tv/securitynow promo code SN30 vee.am/securitynow audible.com/securitynow or text securitynow to 500-500

Picture of the Week. REvil hacks Apple supplier Quanta Computer. World-famous Scripps Health taken down. The Big Emotet Botnet Takedown. Emotet's 4,324,770 eMail addresses. Have I Been Pwned domain-wide notifications. QNAP. Gravity NNTP Newsreader updated to v3.0.11.0 Just a bit more about Dan Kaminsky. Closing the Loop. The Ransomware Task Force. We invite you to read our show notes at https://www.grc.com/sn/SN-817-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: itpro.tv/securitynow promo code SN30 vee.am/securitynow audible.com/securitynow or text securitynow to 500-500

Picture of the Week. REvil hacks Apple supplier Quanta Computer. World-famous Scripps Health taken down. The Big Emotet Botnet Takedown. Emotet's 4,324,770 eMail addresses. Have I Been Pwned domain-wide notifications. QNAP. Gravity NNTP Newsreader updated to v3.0.11.0 Just a bit more about Dan Kaminsky. Closing the Loop. The Ransomware Task Force. We invite you to read our show notes at https://www.grc.com/sn/SN-817-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: itpro.tv/securitynow promo code SN30 vee.am/securitynow audible.com/securitynow or text securitynow to 500-500

Кіберзлочинці шантажують поліцію розкриттям мережі інформаторів. КНР викрила агентів ЦРУ через зламані бази даних. Пішов з життя легендарний хакер Ден Камінскі.

Picture of the Week. REvil hacks Apple supplier Quanta Computer. World-famous Scripps Health taken down. The Big Emotet Botnet Takedown. Emotet's 4,324,770 eMail addresses. Have I Been Pwned domain-wide notifications. QNAP. Gravity NNTP Newsreader updated to v3.0.11.0 Just a bit more about Dan Kaminsky. Closing the Loop. The Ransomware Task Force. We invite you to read our show notes at https://www.grc.com/sn/SN-817-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: itpro.tv/securitynow promo code SN30 vee.am/securitynow audible.com/securitynow or text securitynow to 500-500

Picture of the Week. REvil hacks Apple supplier Quanta Computer. World-famous Scripps Health taken down. The Big Emotet Botnet Takedown. Emotet's 4,324,770 eMail addresses. Have I Been Pwned domain-wide notifications. QNAP. Gravity NNTP Newsreader updated to v3.0.11.0 Just a bit more about Dan Kaminsky. Closing the Loop. The Ransomware Task Force. We invite you to read our show notes at https://www.grc.com/sn/SN-817-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: itpro.tv/securitynow promo code SN30 vee.am/securitynow audible.com/securitynow or text securitynow to 500-500

Picture of the Week. REvil hacks Apple supplier Quanta Computer. World-famous Scripps Health taken down. The Big Emotet Botnet Takedown. Emotet's 4,324,770 eMail addresses. Have I Been Pwned domain-wide notifications. QNAP. Gravity NNTP Newsreader updated to v3.0.11.0 Just a bit more about Dan Kaminsky. Closing the Loop. The Ransomware Task Force. We invite you to read our show notes at https://www.grc.com/sn/SN-817-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: itpro.tv/securitynow promo code SN30 vee.am/securitynow audible.com/securitynow or text securitynow to 500-500

Our interview is with Kevin Roose, author of Futureproof: 9 Rules for Humans in the Age of Automation that debunks most of the comforting stories we use to anaesthetize ourselves to the danger that artificial intelligence and digitization poses to our jobs. Luckily, he also offers some practical and very personal ideas for how to avoid being caught in the oncoming robot apocalypse.  In the news roundup, Dmitri Alperovitch and I take a few moments to honor Dan Kaminsky, an extraordinary internet security and even more extraordinarily decent man. He died too young, at 42, as Nicole Perlroth demonstrates in one of her career-best articles.  Maury Shenk and Mark MacCarthy lay out the EU's plan to charge Apple with anti-competitive behaviour in running its app store.  Under regulation-friendly EU competition law, the more austere U.S. version, it sure looks as though Apple is going to have trouble escaping unscathed.   Mark and I duke it out over Gov. DeSantis's Florida bill on content moderation reform. We agree that it will be challenged as a violation of the First Amendment and as preempted by federal Section 230. Mark thinks it will fail that test. I don't, especially if the challenge ends up in the Supreme Court, where Justice Thomas at least has already put out the “Welcome” mat.  Dmitri and I puzzle over the statement by top White House cyber official Anne Neuberger that the U.S. reprisals against Russia are so far not enough to deter further cyberattacks. We decide it's a “Kinsley gaffe”—where a top official inadvertently utters an inconvenient truth.  This Week in Information Operations: Maury explains that China may be hyping America's racial tensions not as a tactic to divide us but simply because it's an irresistible comeback to U.S. criticisms or Chinese treatment of ethnic minorities. And Dmitri explains why we shouldn't be surprised at Russia's integrated use of hacking and propaganda. The real question is why the US has been so bad at the same work. In shorter stories:  Mark covers the slooow rollout of an EU law forcing one-hour takedowns of terrorist content  Dmitri tells us about the evolution of ransomware into, full-service doxtortion as sensitive files of the Washington D.C. Police Department are leaked online  Dmitri also notes the inevitability of more mobile phone adtech tracking scandals, such as the compromise of U.S. military operations  Maury and I discuss the extent to which China's internet giants find themselves competing, not for consumers, but for government favor, as China uses antitrust law to cement its control of the tech sector  Finally, Dmitri and I unpack the latest delay in DOD's effort to achieve cybersecurity maturity through regulatory-style compliance, an effort Dmitri believes is doomed Download the 360th Episode (mp3)  You can subscribe to The Cyberlaw Podcast using iTunes, Google Play, Spotify, Pocket Casts, or our RSS feed. As always, The Cyberlaw Podcast is open to feedback. Be sure to engage with @stewartbaker on Twitter. Send your questions, comments, and suggestions for topics or interviewees to CyberlawPodcast@steptoe.com. Remember: If your suggested guest appears on the show, we will send you a highly coveted Cyberlaw Podcast mug! The views expressed in this podcast are those of the speakers and do not reflect the opinions of their institutions, clients, friends, families, or pets.

Dennis Fisher talks with Katie Moussouris, Rich Mogull, Kymberlee Price, and Thomas Ptacek about the unique and inspiring life and legacy of hacker Dan Kaminsky.

This week Dr. Doug talks Dan Kaminsky, Spectre, Badalloc, Cardassian Overlords, Apple patches, and the notorious Jason Wood returns for Expert Commentary!   Show Notes: https://securityweekly.com/swn119 Visit https://www.securityweekly.com/swn for all the latest episodes!   Follow us on Twitter: https://www.twitter.com/securityweekly Like us on Facebook: https://www.facebook.com/secweekly

Join Scott Young and Shaun Sturby from Optrics Engineering as they discuss the passing of well-known cybersecurity researcher Dan Kaminski at age 42, the Emotet trojan kill switch, the ParkMobile breach, the Name:Wreck DNS vulnerability and the new 802.11bf Wi-Fi standard. For more IT tips go to: > www.OptricsInsider.com Timecodes: 0:00 - Intro 0:20 - Today's 5 topics 1:01 - Topic 1: RIP Dan Kaminski 2:12 - Topic 2: Emotet Kill Switch 4:14 - Topic 3: ParkMobile breach 5:49 - Topic 4: Name:Wreck DNS Vulnerability 7:58 - Topic 5: 802.11bf Wi-Fi standard 12:47 - Closing remarks Links: > Prominent security expert Dan Kaminsky passes away at 42: > ‘EmoCrash' Exploit Stoppered Emotet For 6 Months > ParkMobile Breach Exposes License Plate Data, Mobile Numbers of 21M Users > NAME:WRECK DNS Vulnerabilities > Wi-Fi Devices as Physical Object Sensors --- Send in a voice message: https://anchor.fm/optrics-insider/message

This week Dr. Doug talks Dan Kaminsky, Spectre, Badalloc, Cardassian Overlords, Apple patches, and the notorious Jason Wood returns for Expert Commentary!   Visit https://www.securityweekly.com/swn for all the latest episodes! Show Notes: https://securityweekly.com/swn119

This week Dr. Doug talks Dan Kaminsky, Spectre, Badalloc, Cardassian Overlords, Apple patches, and the notorious Jason Wood returns for Expert Commentary!   Show Notes: https://securityweekly.com/swn119 Visit https://www.securityweekly.com/swn for all the latest episodes!   Follow us on Twitter: https://www.twitter.com/securityweekly Like us on Facebook: https://www.facebook.com/secweekly

Remembering Dan Kaminsky who was one of the greatest security researchers of our time plus details on a new Apple Airdrop vulnerability. ** Links mentioned on the show ** Remembering Dan Kaminsky https://www.nytimes.com/2021/04/27/technology/daniel-kaminsky-dead.html Apple AirDrop Bug Could Leak Your Personal Info to Anyone Nearby https://thehackernews.com/2021/04/apple-airdrop-bug-could-leak-your.html https://www.komando.com/security-privacy/apple-airdrop-security-flaw/787628/ ** Watch this episode on YouTube ** https://youtu.be/N6T6qcRfTBA ** […] The post Remembering Dan Kaminsky, Apple AirDrop Vulnerability appeared first on The Shared Security Show.

This week on the podcast, we mourn a Dan Kaminsky, a well-loved hacker responsible for identifying one of the biggest vulnerabilities in the history of the internet. Then, we continue our dive into web app security standards with a discussion on Same-Origin Policy and Cross Origin Resource Sharing (CORS) and how they help protect us against Cross Site Request Forgery (CSRF) attacks.

On this week's episode of the podcast I cover the sad news of Security Legend, Dan Kaminsky. I also cover a story about a Password Manager getting breach, the acquisition of Turbonomic and a story about possibly the worst software of all time plus much more. Reference Links: https://www.rorymon.com/blog/episode-174-passing-of-a-security-legend-password-manager-breached-turbonomic-acquisition-more/

Heute wieder viel Feedback und wir nehmen Abschied von Dan Kaminsky, einem der fittesten, lehrreichsten und unterhaltsamsten Menschen der internationalen Hackerszene der letzten 20 Jahre. Und ein weiteres Mal gelingt es uns nicht wirklich, nicht mehr über die Luca App zu reden, da bei dem Thema quasi täglich ein neues Fass aufgemacht wird. Dann sprechen wir noch über die aufkommenden Privacy Battles und nehmen zur Kenntnis, dass alle alle doofen Gesetze, vor denen wir in letzter Zeit nie müde geworden sind zu warnen, beschlossen wurden und beschließen damit die Sendung.

Luta Security founder, security entrepreneur, and vulnerability disclosure pioneer Katie Moussouris joins the Aperture Podcast to talk about influential researcher Dan Kaminsky, who died April 23 at 42 years old. Katie discusses the breadth of Dan's work as a researcher, and his friendship, empathy, and outreach within the security community. Katie also talks about her work advocating for pay, gender and employment equity, and how her mother persevered as a single mother earning significantly less than male counterparts. Katie also explains her return to her hacker roots uncovering two serious vulnerabilities in the audio-based social networking app, Clubhouse, and the state of vulnerability disclosure programs and bug bounties. 

Remembering two of our own: Dan Kaminsky, a security researcher best known for solving a fundamental flaw in DNS, and Bob Fass, WBAI radio personality and pioneer of free-form radio.  

Remembering two of our own: Dan Kaminsky, a security researcher best known for solving a fundamental flaw in DNS, and Bob Fass, WBAI radio personality and pioneer of free-form radio.  

Remembering Dan Kaminsky. Week before last was Patch Tuesday. Google's Project Zero responds to today's patch latency reality. Baking security into IoT UNethical security research. CloudFlare refuses to knuckle under to Patent Trolls. Closing The Loop. The Mystery of AS8003. We invite you to read our show notes at https://www.grc.com/sn/SN-816-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: extrahop.com/SECURITYNOW barracuda.com/securitynow plextrac.com/twit

Remembering Dan Kaminsky. Week before last was Patch Tuesday. Google's Project Zero responds to today's patch latency reality. Baking security into IoT UNethical security research. CloudFlare refuses to knuckle under to Patent Trolls. Closing The Loop. The Mystery of AS8003. We invite you to read our show notes at https://www.grc.com/sn/SN-816-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: extrahop.com/SECURITYNOW barracuda.com/securitynow plextrac.com/twit

Remembering Dan Kaminsky. Week before last was Patch Tuesday. Google's Project Zero responds to today's patch latency reality. Baking security into IoT UNethical security research. CloudFlare refuses to knuckle under to Patent Trolls. Closing The Loop. The Mystery of AS8003. We invite you to read our show notes at https://www.grc.com/sn/SN-816-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: extrahop.com/SECURITYNOW barracuda.com/securitynow plextrac.com/twit

On Security Now, Steve Gibson and Leo Laporte honor the passing of security researcher Dan Kaminksy, and Steve shares some personal stories and memories. For this story and more, check out Security Now: http://twit.tv/sn/816 Hosts: Steve Gibson and Leo Laporte You can find more about TWiT and subscribe to our podcasts at https://podcasts.twit.tv/

On Security Now, Steve Gibson and Leo Laporte honor the passing of security researcher Dan Kaminksy, and Steve shares some personal stories and memories. For this story and more, check out Security Now: http://twit.tv/sn/816 Hosts: Steve Gibson and Leo Laporte You can find more about TWiT and subscribe to our podcasts at https://podcasts.twit.tv/

Marina and int80 talk about how they came up with the idea for the Twitch livestream, what they’ve learned along the way, and future plans for the games. We also speak with int80 about his “hacker rapper” gig, Dual Core Music.This episode's Rapid Rundown comes with a rare content warning: We're discussing the life, impact, and passing of Dan Kaminsky. It gets pretty emotional, as you might expect. As Matt Blaze said, may his memory be a blessing.Enjoy the links below for more!Hacking Esports on Twitter and TwitchMore about Dual Core (also on Twitter)Duo's cartoon about the Kaminsky BugDan Kaminsky's New York Times obituaryDan's 2016 r00tz talk, "How the Internet Actually Works" is on YouTube, thanks to  the r00tz  channel.

@pageinSec on Twitter   Dan Kaminsky obit: https://www.theregister.com/2021/04/25/dan_kaminsky_obituary/   Spencer Geitzen: http://brakeingsecurity.com/2018-024-pacu-a-tool-for-pentesting-aws-environments   https://en.wikipedia.org/wiki/Milgram_experiment   https://lore.kernel.org/lkml/20210421130105.1226686-1-gregkh@linuxfoundation.org/   https://cse.umn.edu/cs/statement-cse-linux-kernel-research-april-21-2021 https://www.labbott.name/blog/2021/04/21/breakingtrust.html Seems like a number of patches were added (~190) and each had to be reviewed https://twitter.com/UMNComputerSci/status/1384948683821694976 response to researchers Linux Kernel mailing list: https://lore.kernel.org/linux-nfs/YH%2FfM%2FTsbmcZzwnX@kroah.com/ https://danielmiessler.com/blog/explaining-threats-threat-actors-vulnerabilities-and-risk-using-a-real-world-scenario/ https://twitter.com/SarahJamieLewis/status/1384871385537908736 @sarahJamieLewis shows the change they submitted in their paper: https://twitter.com/SarahJamieLewis/status/1384876050207940608 https://twitter.com/SarahJamieLewis/status/1330671897822982144/photo/1 https://twitter.com/SarahJamieLewis/status/1384880034146574341/photo/1 https://web.archive.org/web/20210421145121/https://www-users.cs.umn.edu/~kjlu/papers/crix.pdf (appears the researcher deleted this paper from their site.) https://web.archive.org/web/20210422144500/https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc.pdf (researcher deleted this paper from their site.)“Throughout the study, we honestly did not think this is human research, so we did not apply for an IRB approval in the beginning. We apologize for the raised concerns. This is an important lesson we learned---Do not trust ourselves on determining human research; always refer to IRB whenever a study might be involving any human subjects in any form. We would like to thank the people who suggested us to talk to IRB after seeing the paper abstract.” https://github.com/QiushiWu/qiushiwu.github.io NSF Grant application (thank you Page!) https://www.nsf.gov/awardsearch/showAward?AWD_ID=1931208&HistoricalAwards=false  NSF IRB requirements (from 2007): https://www.nsf.gov/pubs/2007/nsf07006/nsf07006.jsp Might be more recent - Human Subjects | NSF - National Science Foundation The researchers issued an apology today 25 April: https://lore.kernel.org/lkml/CAK8KejpUVLxmqp026JY7x5GzHU2YJLPU8SzTZUNXU2OXC70ZQQ@mail.gmail.com/ *thanks to Zach Whittacker’s security mailing list..*   https://twitter.com/argvee Thought provoking question for your show: is it realistically possible for an organization to build and scale a culture of code review that catches malicious insertions through (1) expert analysis; (2) adversarial mindset? Co-author of : https://www.amazon.com/Building-Secure-Reliable-Systems-Implementing/dp/1492083127   Introduction of bugs (meaningful or otherwise) caused more work for devs. Revert list of 190 patches (threaded): https://lkml.org/lkml/2021/4/21/454  Quick overview of using deception in research from Duke’s IRB: Using Deception in Research | Institutional Review Board (duke.edu) Is this better? Where’s the line on this? https://www.bleepingcomputer.com/news/security/emotet-malware-nukes-itself-today-from-all-infected-computers-worldwide/

25 avril 2021 Shamelessplug Hackfest novembre - Nouveauté à venir!!! … peut-être (Damien revient :) :) YAY Formation cybersécurité aux entreprises - Séminaire de Sherbrooke - 10 avril Hackfest Shop Join Hackfest Discord Hackfest Blog Dan Kaminsky Décès de Dan Kaminsky à 42 ans DNS poisoning https://www.kb.cert.org/vuls/id/800113 Sony XCP Rootkit https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal His wiki page: https://en.wikipedia.org/wiki/Dan_Kaminsky Shownotes and Links 20200310 - Les enjeux éthiques du passeport vaccinal À vomir Desjardins bloque encore une fois l'enquête! Précédent judiciaire dans la saga Exchange: le FBI exploite proactivement des failles de sécurité pour prévenir des cyberattaques 20210413 - FBI operation removed web shells from hacked Exchange servers across Les cyberattaques dans le milieu éducatif continuent, avec des rançons et des fuites de données personnelles significatives: Ransomware utilise 7zip sur les NAS QNAP TALOS dévoile 2 vulnérabilités dans une friteuse intelligente 20210423 - 10,000+ unpatched home alarm systems can be deactivated remotely Une cyberattaque dans les Pays-Bas a des conséquences sérieuses 20210419 - Comparution au comité de la Chambre des Communes Canada-Chine 20210419 - Panne Rogers - Mise à jour des équipements Ericsson manquée 20210331 - Wi-Fi devices set to become object sensors by 2024 under planned 802.11bf standard Le Japon accuse formellement la Chine d'avoir attaqué plus de 200 organisations de R&D La Federal Aviation Administration force une mise à jour des appareils de détection de collision GTS8000 de Garmin Les appareils VPN Pulse Secure activement exploités…patch dans 1 mois Canac victime Une autre arnaque sur Facebook Messenger Une histoire qui remonte au temps du début de l'humanité Cybersécurité des fermes Segment Vulnérabilité Disclaimer: On vous rappelle de toujours respecter les lois en vigueur, et en cas de doute, n'hésitez pas à consulter un professionnel du droit afin de toujours rencontrer vos obligations en tant que citoyens responsables. Preuve: http://www.assnat.qc.ca/fr/index.html Crew Patrick Mathieu Steve Waterhouse Guillaume Morissette Jacques Sauvé Crédits Montage audio par Hackfest Communication Music Sephira - The Master Work - Stranger At The Oasis Locaux virtuels par 8x8

In this segment of By Any Means Necessary, hosts Sean Blackmon and Jacquie Luqman are joined by Chris Garaffa, editor of Tech for the People for another edition of our weekly segment “Tech For The People.” They discuss the recent passing of influential information security researcher Dan Kaminsky, the revelation that the US Postal Service has been quietly running a “covert operations program” aimed at monitoring Americans' social media activity, and a study which found the “remarkable quantity” of personally identifiable information available on accused and convicted people on government websites constitute a form of “digital punishment.”

In this episode of By Any Means Necessary, hosts Sean Blackmon and Jacquie Luqman are joined by Jeff Cohen, Founder Emeritus of Fairness and Accuracy in Reporting (FAIR), to discuss his recent article in Common Dreams, “Media Evasions on Racism and the Role of Derek Chauvin,” why racial justice rhetoric recently adopted by Democrats and corporate media rings hollow, and efforts to use the conviction of Derek Chauvin to portray the crisis of racist police killing as the work of “a few bad apples.”In the second segment, Sean and Jacquie are joined by Christian Djimra Koumtog, Chad-born Poet, author and contributor to Face2Face Africa, to discuss the civil society groups calling for the dissolution of the newly-formed junta which took power after the death of longtime Chad President Idriss Déby, why he views France as responsible the imposition of his son, Mahamat Déby, and why so many are insisting Mahamat must step down within 90 days.In the third segment, Sean and Jacquie are joined by Chris Garaffa, editor of Tech for the People for another edition of our weekly segment “Tech For The People.” They discuss the recent passing of influential information security researcher Dan Kaminsky, the revelation that the US Postal Service has been quietly running a “covert operations program” aimed at monitoring Americans' social media activity, and a study which found the “remarkable quantity” of personally identifiable information available on accused and convicted people on government websites constitute a form of “digital punishment.”Later in the show, Sean and Jacquie are joined by Eleanor Goldfield, a creative activist, journalist, and co-host of the Common Censored podcast with Lee Camp, to discuss the international inquiry which found the government's treatment of Black people in the US amounts to crimes against humanity, the $1.6 million settlement the District of Columbia reached with the victims of its mass arrests and constitutional violations during the inauguration of Donald Trump in January 2017, and how the Democratic party weaponizes identity in the service of imperialism.

Skupina za ransomwarem REvil, která získala blueprinty Apple produktů teď Apple vydírá; report Sophosu mimo jiné o komunikačních kanálech využívaných malwarem; více než 96% zranitelností ve WordPress zveřejněných v roce 2020 bylo v themes nebo pluginech; definitivní konec Emotetu; zemřel Dan Kaminsky. Koukněte také na video: Ransomware s dopadem na Apple, novinky v komunikaci malwaru a konec Emotetu – SecurityCast Ep#56 - YouTube Sledujte nás na Twitteru: @jk0pr @ALEFSecurity a LinkedInu: ALEF CZ: https://www.linkedin.com/company/alef-distribution-cz-s-r-o-/?viewAsMember=true

Sad news in the infosec world, with news security researcher Dan Kaminsky died over the weekend at age 42. In 2005 he uncovered the Sony BMG Rootkit debacle, and in 2008 he found and disclosed design flaws in the fundamental infrastructure of the entire internet. He is widely remarked upon as a lovely, conscientious, compassionate and supportive member of the community who will be deeply missed.If you're a casual crypto investor wondering what happened to your portfolio over the weekend, a sell-off wiped $200B off the markets after reports suggested US President Biden may increase capital gains taxation rates. The sell-off caused Bitcoin to fall below US$50,000 while cryptocurrencies across the board generally saw large drops in value.Also in the US, Apple failed to have a court case dismissed over the definition of the word "Buy" in its iTunes Store. The case argues the word is misleading because access can be terminated at any time and is therefore not ownership. Two cases related to the argument are currently underway, with one focused on the question of misleading use of "Buy" while another relates to an AppleID that was terminated with US$25,000 worth of iTunes, App Store and other purchases in the account. Interesting arguments that are fundamental to our experience of digital stores of all stripes today.In space, astronauts have been sent to the International Space Station over the weekend on a reused SpaceX Falcon 9 rocket and Dragon capsule, marking a third successful launch for NASA in 11 months using SpaceX rockets and capsules. The launch took place Friday and arrived at the ISS on Saturday. The four astronauts will spend six months aboard the space station while the previous crew will return to Earth later this week aboard the Dragon capsule.Another shout out to our Martian friends, with news NASA's Mars Ingenuity helicopter has performed its third flight overnight. This time the drone flew 50 metres from its point of origin and then back again. The footage from the Perseverance rover only shows the first slice of the flight now that Ingenuity is starting to perform longer flight tests around the area. Ingenuity tests will run for another few weeks before the project concludes and Perseverance will move onto other missions on the red planet.Videogame history at the Oscars today, with the best short documentary award going to Colette, produced as an in-game feature of the VR game Medal of Honour: Above and Beyond. The film looks at the history of French resistance fighter Colette Marin-Catherine, one of the last surviving members of the French resistance. It is the first time a videogame has won any award at the Oscars, so congratulations to Respawn Entertainment, who also makes Apex Legends and in recent years also made Jedi: Fallen Order.In global esports results, the Mythic Dungeon Invitational global finals in World of Warcraft were won by Echo over the weekend. The Europeans won in dominant fashion, never dropping a dungeon on their route to victory. They defeated Perplexed in the final, a second European team showing big regional dominance.Closer to home, the E-League FIFA 21 tournament over the weekend saw Newcastle Jets top the ladder after two big days of matches, closely followed by Western Sydney Wanderers. In Valorant, the Order Army took out the Closed Qualifier Grand Final and wins first seeding in the Oceania Tour Stage 2 finals. See acast.com/privacy for privacy and opt-out information.

New Logo, CISA Pulse Secure VPN Orders, Ransomware Gangs + Stock Shorter Scams, Japanese NASA Hacked by China, Dan Kaminsky, LinkedIn Brittons and China/Russia, Codecov Fallout, Technology News, Content, Ideas & Analysis, Notes, Discovery, Recommendations, and the Aphorism of the Week… Support the show: https://danielmiessler.com/support/ See omnystudio.com/listener for privacy information.

The History of DEF CON Welcome to the History of Computing Podcast, where we explore the history of information technology. Because understanding the past prepares us for the innovations of the future! Todays episode is on the history of DEF CON. I have probably learned more about technology in my years attending Blackhat and DEF CON than from any other source other than reading and writing books. But DEF CON specifically expanded my outlook on the technology industry and made me think of how others might consider various innovations, and sometimes how they might break them. DEF CON also gave me an insight into the hacker culture that I might not have gotten otherwise. Not the hacker culture many think of, but the desire to just straight up tinkerate with everything. And I do mean everything, sometimes much to the chagrin of the Vegas casino or hotel hosting the event. The thing that I have always loved about DEF CON is that, while there is a little shaming of vendors here and there, there's also a general desire to see security research push the envelope of what's possible, making vendors better and making the world a more secure place. Not actually trying to back things in a criminal way. In fact, there's an ethos that surrounds the culture. Yes, you want to find sweet, sweet o days. But when you do, you disclose the vulnerability before you tell the world that you can bring down any Cisco firewall. DEF CON has played a critical role in the development and remediation of rootlets, trojans, viruses, forensics, threat hunting research, social engineering, botnet detection and defeat, keystroke logging, DoS attacks, application security, network security, and privacy. In 2018, nearly 28,000 people attended Def Con. And the conference shows no signs of slowing down. In fact, the number of people with tattoos of Jack, the skull and crossbones-esque logo, only seems to be growing. As does the number of people who have black badges, which give them free access to DEF CON for life. But where did it get its start? The name is derived from WarGames, a 1983 movie that saw Matthew Broderick almost start World War III by playing a simulation of a nuclear strike with a computer. This was obviously before his freewheeling days as Ferris Bueller. Over the next decade, Bulletin Board Networks had become a prime target for hackers in it for the lolz. Back then, Bullet Boards were kinda' like what Reddit is today. But you dialed a network and then routed through a hierarchical system, with each site having a coordinator. A lot of Fido hacking was trying to become an admin of each board. If this sounds a lot like the Internet of today, the response would be “ish”. So Jeff Moss, also known as Dark Tangent, was a member of a group of hackers that liked to try to take over these bulletin boards called “Platinum Net”. He started planning a party for a network that was shut down. He had graduated from Gonzaga University with a degree in Criminal Justice a few years earlier, and invited #hack to join him in Vegas. Moss had graduated from Gonzaga University in Criminal Justice and so why not have 100 criminals join him in Vegas at the Sands Hotel and Casino! He got a little help from Dead Addict, and the event was a huge success. The next year, Artimage, Pappy Ozendorph, Stealth, Zac Franken, and Noid threw in to help coordinate things and the attendees at the conference doubled to around 200. They knew they had something special cookie' up. Def Con two, which was held at the Sahara, got mentions by Business Week and the New York Times, as well as PC Magazine, which was big at the time. DEF CON 3 happened right after the Hackers movie at the Tropicana, and DEF CON 4 actually had the FBI show up to to tell the hackers all the things at the Monte Carlo. DEF CON 4 also saw the introduction of Black Hat, a conference that runs before DEF CON. DEF CON 5 though, saw ABC News ZDNet, Computer World, and saw people show up to the Aladdin from all over the world, which is how I heard of the conference. The conference continued to grow. People actually started waiting to release tools until DEF CON. DEF CON 6 was held at the Plaza and then it went to the Alexis Park Resort from DEF CON 7 to DEF CON 13. DEF CON 7 will always be remembered for the release of Back Orifice 2000, a plugin based remote admin tool (or RAT) that I regrettably had to remove from many a device throughout my career. Of course it had an option for IRC-based command and control, as did all the best stuff on the Silk Road. Over the next few years the conference grew and law enforcement agents started to show up. I mean, easy pickings, right? This led to a “spot the fed” contest. People would of course try to hack each other, which led to maybe the most well-known contest, the scavenger hunt. I am obviously a history nerd so I always loved the Hacker Jeapoardy contest. You can also go out to the desert to shoot automatic weapons, participate in scavenger hunts, pick all the locks, buy some shirts, and of course, enjoy all the types of beverages with all the types of humans. All of these mini-events associated with DEF CON have certainly helped make the event what it is today. I've met people from the Homebrew Computer Club, Anonymous, the Legion of Doom, ShadowCrew, the Cult of the Dead Cow, and other groups there. I also met legends like Captain Crunch, Kevin Poulsen, Kevin Mitnick, L0pht (of L0phtcrack, and many others. By DEF CON 7 in 2000, the conference was getting too big to manage. So the Goons started to take over various portions of the con. People like Cjunky, Agent X, CHS, Code24, flea, Acronym, cyber, Gattaca, Froggy, Lockheed, Londo, Major Malfunction, Mattrix, G Mark, JustaBill, helped me keep from getting by eyebrows shaved off and were joined by other goons over the years. Keep in mind there are a lot of younger script kiddies who show up and this crew helps keep them safe. My favorite goon might be Noid. This was around the time the wall of sheep appeared, showing passwords picked up on the network. DEF CON 11 saw a bit of hacktivism when the conference started raising money for the Electronic Frontier Foundation. By 2005 the conferences had grown enough that Cisco even tried to shut down a talk from Michael Lynn that could basically shut down the Internet as we know it. Those pages mentioning the talk had to be torn out of the books. In one of the funner moments I've seen Michell Madigan was run out of the con for trying to secretly record one of the most privacy oriented groups I've ever been a part of. Dan Kaminsky rose to prominence in 2008 when he found some serious flaws in DNS. He was one of the inaugural speakers at Def Con China 1 in 2018. 2008 also saw a judge order a subway card hacking talk be cancelled, preventing three MIT students from talking about how they hacked the Boston subway. 2012 saw Keith Alexander, then director of the NSA give the keynote. Will Smith dropped by in 2013, although it was just to prepare for a movie. Probably not Suicide Squad. He didn't stay log. Probably because Dark Tangent asked the feds to stay away for awhile. DARPA came to play in 2016 giving out a 2 million dollar prize to the team that could build an autonomous AI bot that could handle offense and defense in a Capture the Flag style competition. 2017 made the news because they hosted a voting machine hacking village. Cambridge Global Advisors was a sponsor. They have no connection with Cambridge Analytica. No matter how you feel about politics, the hallmark of any democracy is certifying a fair and, um, democratic election. Jimmy Carter knows. He was 92 then. 2019 saw 30,000 people show up in Vegas for DEF CON 27. At this point, DEF CON has been on the X-Files, Mr. Robot, and given a node in the movie Jason Bourne. It is a special event. Being surrounded by so many people with unbridled curiosity is truly inspiring. I doubt I would ever have written my first book on security if not for the opportunity they gave me to speak at DEF CON and Blackhat. Oh, recording this episode just reminded me - I need to go book my room for next year! If you want to learn more about DEF CON, we'll include a link to the documentary from 2013 about it in the show notes. https://www.youtube.com/watch?v=3ctQOmjQyYg

In an age of digital identity, how do we protect ourselves in an increasingly insecure world? In 2008, Dan Kaminsky identified a critical flaw in the internet’s Domain Name System (DNS) and led the largest synchronized fix to the internet’s infrastructure of all time. Today, he’s Chief Scientist and cofounder of White Ops. Topics include: the great cities of the world that were proven vulnerable, and burned to the ground, computer worms, why it’s easier than ever to hit the WHOLE world with an attack, crypto’s role in proliferating these attacks, evil hacking as a kind of mind control!, how – in the context of Mars – to start over and get security right, and building an elite team of security hackers dedicated to fighting crime and fixing bugs around the world.

Arcan and OpenBSD, running OpenBSD 6.3 on RPI 3, why C is not a low-level language, HardenedBSD switching back to OpenSSL, how the Internet was almost broken, EuroBSDcon CfP is out, and the BSDCan 2018 schedule is available. Headlines Towards Secure System Graphics: Arcan and OpenBSD Let me preface this by saying that this is a (very) long and medium-rare technical article about the security considerations and minutiae of porting (most of) the Arcan ecosystem to work under OpenBSD. The main point of this article is not so much flirting with the OpenBSD crowd or adding further noise to software engineering topics, but to go through the special considerations that had to be taken, as notes to anyone else that decides to go down this overgrown and lonesome trail, or are curious about some less than obvious differences between how these things “work” on Linux vs. other parts of the world. A disclaimer is also that most of this have been discovered by experimentation and combining bits and pieces scattered in everything from Xorg code to man pages, there may be smarter ways to solve some of the problems mentioned – this is just the best I could find within the time allotted. I’d be happy to be corrected, in patch/pull request form that is 😉 Each section will start with a short rant-like explanation of how it works in Linux, and what the translation to OpenBSD involved or, in the cases that are still partly or fully missing, will require. The topics that will be covered this time are: Graphics Device Access Hotplug Input Backlight Xorg Pledging Missing Installing OpenBSD 6.3 (snapshots) on Raspberry pi 3 The Easy way Installing the OpenBSD on raspberry pi 3 is very easy and well documented which almost convinced me of not writing about it, but still I felt like it may help somebody new to the project (But again I really recommend reading the document if you are interested and have the time). Note: I'm always running snapshots and recommend anybody to do it as well. But the snapshots links will change to the next version every 6 month, so I changed the links to the 6.3 version to keep the blog post valid over times. If you're familiar to the OpenBSD flavors, feel free to use the snapshots links instead. Requirements Due to the lack of driver, the OpenBSD can not boot directly from the SD Card yet, So we'll need an USB Stick for the installtion target aside the SD Card for the U-Boot and installer. Also, a Serial Console connection is required. I Used a PL2303 USB to Serial (TTL) adapter connected to my Laptop via USB port and connected to the Raspberry via TX, RX and GND pins. iXsystems https://www.ixsystems.com/blog/truenas-m-series-veeam-pr-2018/ Why Didn’t Larrabee Fail? Every month or so, someone will ask me what happened to Larrabee and why it failed so badly. And I then try to explain to them that not only didn't it fail, it was a pretty huge success. And they are understandably very puzzled by this, because in the public consciousness Larrabee was like the Itanic and the SPU rolled into one, wasn't it? Well, not quite. So rather than explain it in person a whole bunch more times, I thought I should write it down. This is not a history, and I'm going to skip a TON of details for brevity. One day I'll write the whole story down, because it's a pretty decent escapade with lots of fun characters. But not today. Today you just get the very start and the very end. When I say "Larrabee" I mean all of Knights, all of MIC, all of Xeon Phi, all of the "Isle" cards - they're all exactly the same chip and the same people and the same software effort. Marketing seemed to dream up a new codeword every week, but there was only ever three chips: Knights Ferry / Aubrey Isle / LRB1 - mostly a prototype, had some performance gotchas, but did work, and shipped to partners. Knights Corner / Xeon Phi / LRB2 - the thing we actually shipped in bulk. Knights Landing - the new version that is shipping any day now (mid 2016). That's it. There were some other codenames I've forgotten over the years, but they're all of one of the above chips. Behind all the marketing smoke and mirrors there were only three chips ever made (so far), and only four planned in total (we had a thing called LRB3 planned between KNC and KNL for a while). All of them are "Larrabee", whether they do graphics or not. When Larrabee was originally conceived back in about 2005, it was called "SMAC", and its original goals were, from most to least important: Make the most powerful flops-per-watt machine for real-world workloads using a huge array of simple cores, on systems and boards that could be built into bazillo-core supercomputers. Make it from x86 cores. That means memory coherency, store ordering, memory protection, real OSes, no ugly scratchpads, it runs legacy code, and so on. No funky DSPs or windowed register files or wacky programming models allowed. Do not build another Itanium or SPU! Make it soon. That means keeping it simple. Support the emerging GPGPU market with that same chip. Intel were absolutely not going to build a 150W PCIe card version of their embedded graphics chip (known as "Gen"), so we had to cover those programming models. As a bonus, run normal graphics well. Add as little graphics-specific hardware as you can get away with. That ordering is important - in terms of engineering and focus, Larrabee was never primarily a graphics card. If Intel had wanted a kick-ass graphics card, they already had a very good graphics team begging to be allowed to build a nice big fat hot discrete GPU - and the Gen architecture is such that they'd build a great one, too. But Intel management didn't want one, and still doesn't. But if we were going to build Larrabee anyway, they wanted us to cover that market as well. ... the design of Larrabee was of a CPU with a very wide SIMD unit, designed above all to be a real grown-up CPU - coherent caches, well-ordered memory rules, good memory protection, true multitasking, real threads, runs Linux/FreeBSD, etc. Larrabee, in the form of KNC, went on to become the fastest supercomputer in the world for a couple of years, and it's still making a ton of money for Intel in the HPC market that it was designed for, fighting very nicely against the GPUs and other custom architectures. Its successor, KNL, is just being released right now (mid 2016) and should do very nicely in that space too. Remember - KNC is literally the same chip as LRB2. It has texture samplers and a video out port sitting on the die. They don't test them or turn them on or expose them to software, but they're still there - it's still a graphics-capable part. But it's still actually running FreeBSD on that card, and under FreeBSD it's just running an x86 program called DirectXGfx (248 threads of it). News Roundup C Is Not a Low-level Language : Your computer is not a fast PDP-11. In the wake of the recent Meltdown and Spectre vulnerabilities, it's worth spending some time looking at root causes. Both of these vulnerabilities involved processors speculatively executing instructions past some kind of access check and allowing the attacker to observe the results via a side channel. The features that led to these vulnerabilities, along with several others, were added to let C programmers continue to believe they were programming in a low-level language, when this hasn't been the case for decades. Processor vendors are not alone in this. Those of us working on C/C++ compilers have also participated. What Is a Low-Level Language? Computer science pioneer Alan Perlis defined low-level languages this way: "A programming language is low level when its programs require attention to the irrelevant." While, yes, this definition applies to C, it does not capture what people desire in a low-level language. Various attributes cause people to regard a language as low-level. Think of programming languages as belonging on a continuum, with assembly at one end and the interface to the Starship Enterprise's computer at the other. Low-level languages are "close to the metal," whereas high-level languages are closer to how humans think. For a language to be "close to the metal," it must provide an abstract machine that maps easily to the abstractions exposed by the target platform. It's easy to argue that C was a low-level language for the PDP-11. They both described a model in which programs executed sequentially, in which memory was a flat space, and even the pre- and post-increment operators cleanly lined up with the PDP-11 addressing modes. Fast PDP-11 Emulators The root cause of the Spectre and Meltdown vulnerabilities was that processor architects were trying to build not just fast processors, but fast processors that expose the same abstract machine as a PDP-11. This is essential because it allows C programmers to continue in the belief that their language is close to the underlying hardware. C code provides a mostly serial abstract machine (until C11, an entirely serial machine if nonstandard vendor extensions were excluded). Creating a new thread is a library operation known to be expensive, so processors wishing to keep their execution units busy running C code rely on ILP (instruction-level parallelism). They inspect adjacent operations and issue independent ones in parallel. This adds a significant amount of complexity (and power consumption) to allow programmers to write mostly sequential code. In contrast, GPUs achieve very high performance without any of this logic, at the expense of requiring explicitly parallel programs. The quest for high ILP was the direct cause of Spectre and Meltdown. A modern Intel processor has up to 180 instructions in flight at a time (in stark contrast to a sequential C abstract machine, which expects each operation to complete before the next one begins). A typical heuristic for C code is that there is a branch, on average, every seven instructions. If you wish to keep such a pipeline full from a single thread, then you must guess the targets of the next 25 branches. This, again, adds complexity; it also means that an incorrect guess results in work being done and then discarded, which is not ideal for power consumption. This discarded work has visible side effects, which the Spectre and Meltdown attacks could exploit. On a modern high-end core, the register rename engine is one of the largest consumers of die area and power. To make matters worse, it cannot be turned off or power gated while any instructions are running, which makes it inconvenient in a dark silicon era when transistors are cheap but powered transistors are an expensive resource. This unit is conspicuously absent on GPUs, where parallelism again comes from multiple threads rather than trying to extract instruction-level parallelism from intrinsically scalar code. If instructions do not have dependencies that need to be reordered, then register renaming is not necessary. Consider another core part of the C abstract machine's memory model: flat memory. This hasn't been true for more than two decades. A modern processor often has three levels of cache in between registers and main memory, which attempt to hide latency. The cache is, as its name implies, hidden from the programmer and so is not visible to C. Efficient use of the cache is one of the most important ways of making code run quickly on a modern processor, yet this is completely hidden by the abstract machine, and programmers must rely on knowing implementation details of the cache (for example, two values that are 64-byte-aligned may end up in the same cache line) to write efficient code. Backup URL Hacker News Commentary HardenedBSD Switching Back to OpenSSL Over a year ago, HardenedBSD switched to LibreSSL as the default cryptographic library in base for 12-CURRENT. 11-STABLE followed suit later on. Bernard Spil has done an excellent job at keeping our users up-to-date with the latest security patches from LibreSSL. After recently updating 12-CURRENT to LibreSSL 2.7.2 from 2.6.4, it has become increasingly clear to us that performing major upgrades requires a team larger than a single person. Upgrading to 2.7.2 caused a lot of fallout in our ports tree. As of 28 Apr 2018, several ports we consider high priority are still broken. As it stands right now, it would take Bernard a significant amount of his spare personal time to fix these issues. Until we have a multi-person team dedicated to maintaining LibreSSL in base along with the patches required in ports, HardenedBSD will use OpenSSL going forward as the default cryptographic library in base. LibreSSL will co-exist with OpenSSL in the source tree, as it does now. However, MK_LIBRESSL will default to "no" instead of the current "yes". Bernard will continue maintaining LibreSSL in base along with addressing the various problematic ports entries. To provide our users with ample time to plan and perform updates, we will wait a period of two months prior to making the switch. The switch will occur on 01 Jul 2018 and will be performed simultaneously in 12-CURRENT and 11-STABLE. HardenedBSD will archive a copy of the LibreSSL-centric package repositories and binary updates for base for a period of six months after the switch (expiring the package repos on 01 Jan 2019). This essentially gives our users eight full months for an upgrade path. As part of the switch back to OpenSSL, the default NTP daemon in base will switch back from OpenNTPd to ISC NTP. Users who have localopenntpdenable="YES" set in rc.conf will need to switch back to ntpd_enable="YES". Users who build base from source will want to fully clean their object directories. Any and all packages that link with libcrypto or libssl will need to be rebuilt or reinstalled. With the community's help, we look forward to the day when we can make the switch back to LibreSSL. We at HardenedBSD believe that providing our users options to rid themselves of software monocultures can better increase security and manage risk. DigitalOcean http://do.co/bsdnow -- $100 credit for 60 days How Dan Kaminsky Almost Broke the Internet In the summer of 2008, security researcher Dan Kaminsky disclosed how he had found a huge flaw in the Internet that could let attackers redirect web traffic to alternate servers and disrupt normal operations. In this Hacker History video, Kaminsky describes the flaw and notes the issue remains unfixed. “We were really concerned about web pages and emails 'cause that’s what you get to compromise when you compromise DNS,” Kaminsky says. “You think you’re sending an email to IBM but it really goes to the bad guy.” As the phone book of the Internet, DNS translates easy-to-remember domain names into IP addresses so that users don’t have to remember strings of numbers to reach web applications and services. Authoritative nameservers publish the IP addresses of domain names. Recursive nameservers talk to authoritative servers to find addresses for those domain names and saves the information into its cache to speed up the response time the next time it is asked about that site. While anyone can set up a nameserver and configure an authoritative zone for any site, if recursive nameservers don’t point to it to ask questions, no one will get those wrong answers. We made the Internet less flammable. Kaminsky found a fundamental design flaw in DNS that made it possible to inject incorrect information into the nameserver's cache, or DNS cache poisoning. In this case, if an attacker crafted DNS queries looking for sibling names to existing domains, such as 1.example.com, 2.example.com, and 3.example.com, while claiming to be the official "www" server for example.com, the nameserver will save that server IP address for “www” in its cache. “The server will go, ‘You are the official. Go right ahead. Tell me what it’s supposed to be,’” Kaminsky says in the video. Since the issue affected nearly every DNS server on the planet, it required a coordinated response to address it. Kaminsky informed Paul Vixie, creator of several DNS protocol extensions and application, and Vixie called an emergency summit of major IT vendors at Microsoft’s headquarters to figure out what to do. The “fix” involved combining the 16-bit transaction identifier that DNS lookups used with UDP source ports to create 32-bit transaction identifiers. Instead of fixing the flaw so that it can’t be exploited, the resolution focused on making it take more than ten seconds, eliminating the instantaneous attack. “[It’s] not like we repaired DNS,” Kaminsky says. “We made the Internet less flammable.” DNSSEC (Domain Name System Security Extensions), is intended to secure DNS by adding a cryptographic layer to DNS information. The root zone of the internet was signed for DNSSEC in July 2010 and the .com Top Level Domain (TLD) was finally signed for DNSSEC in April 2011. Unfortunately, adoption has been slow, even ten years after Kaminsky first raised the alarm about DNS, as less than 15 percent of users pass their queries to DNSSEC validating resolvers. The Internet was never designed to be secure. The Internet was designed to move pictures of cats. No one expected the Internet to be used for commerce and critical communications. If people lose faith in DNS, then all the things that depend on it are at risk. “What are we going to do? Here is the answer. Some of us gotta go out fix it,” Kaminsky says. OpenIndiana Hipster 2018.04 is here We have released a new OpenIndiana Hipster snapshot 2018.04. The noticeable changes: Userland software is rebuilt with GCC 6. KPTI was enabled to mitigate recent security issues in Intel CPUs. Support of Gnome 2 desktop was removed. Linked images now support zoneproxy service. Mate desktop applications are delivered as 64-bit-only. Upower support was integrated. IIIM was removed. More information can be found in 2018.04 Release notes and new medias can be downloaded from http://dlc.openindiana.org. Beastie Bits EuroBSDCon - Call for Papers OpenSSH 7.7 pkgsrc-2018Q1 released BSDCan Schedule Michael Dexter's LFNW talk Tarsnap ad Feedback/Questions Bob - Help locating FreeBSD Help Alex - Convert directory to dataset Adam - FreeNAS Question Florian - Three Questions Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv iX Ad spot: iXsystems TrueNAS M-Series Blows Away Veeam Backup Certification Tests

Shortly after New Years we were hit with two security flaws that affect microprocessors called Meltdown and Spectre. These hardware flaws allow programs to steal data being processed on a computer. Both have both been around for quite some time and it’s unclear to what extent they have already been exploited. Desktop, laptop, and cloud computers may be affected by Meltdown, as for Spectre, it’s all of the above, and mobile. My guest this week is Dan Kaminsky, Chief Scientist at White Ops, a cybersecurity firm. Dan is one of the seven Recovery Key Shareholders who possess the ability to restore the DNS root keys, aka the keys to restore the internet. We talk about Meltdown and Spectre, Intel’s response, and whatever you do, don’t download the dancing fish… but first, our need for speed and the introduction to Meltdown and Spectre.

I spoke with Joshua Cooper Ramo in this podcast interview, partly about his latest book, The Seventh Sense and partly about his overall life and pursuit of excellence. Mr. Ramo started off as a journalist, working at Newsweek then for Time Inc back when, as he says, “it mattered who The Man of the Year was.”  He worked as both senior and as foreign editor at Time, and he wrote for them long enough ago (1997) that he wrote The Man Of the Year cover story on Andy Grove, one of the founders of Intel. From Time Inc he moved to China to pursue adventure in the world of business.  He became fluent in Chinese and fell in love with the culture. In China he worked for the former president of Goldman Sachs and eventually began working at his current company, Kissinger Associates, where he's now co-CEO. He lived in Beijing full time for a little over a decade and now splits his time between Beijing and New York.  Yes, he's a busy, pipe hittin' dude and I was super stoked to connect for this conversation. I found him through his first book, No Visible Horizon, a lovely story about his journey to aerobatic nationals as a pilot that reminded me of reading Ernest Gann's “Fate Is The Hunter”, another excellent and relatively unsung pilot book. Curious about what else he'd written, I found his third book, The Seventh Sense, which I read through with great enjoyment and then went on to read his second book, The Age of the Unthinkable.  Reading those two books gave me a look into the mind of a writer deeply immersed in international relations, intensely curious about connections in the modern age, and fascinated with networks in particular.   Both books deal with the unpredictable nature of an increasingly connected world, and as a business owner running a small enterprise in that world I found them entertaining and educational.  In fact, they forced me to re-evaluate our strategy at Paleo Treats and the way we're using our networks. In this interview we dive into the important points of a network, the difference between complex and complicated systems, what topology is and why it matters, and how emergent properties of networks are inevitable. I asked him how he curates and uses his curiosity, and he talked about his main theme in The Seventh Sense that “connection changes the nature of an object.” We do dive briefly into some flying stuff and how flying may move from unnatural to natural as you become a better pilot, but the majority of this interview deals with networks and how to understand and explore them in this incredibly connected world. Joshua talks about the importance of figuring out what tools you need in order to understand and investigate a problem.  He places the conversation in the context of historical cycles, the enduring nature of art, and the best kind of adventure you can have. Enjoy the show! Books Mentioned -No Visible Horizon -The Age of the Unthinkable -The Seventh Sense -Fate is the Hunter -China's Wings -The Rational Optimist For each podcast I do I end up writing a bunch of notes and questions.  While I don't always ask the questions, it's helpful to have them written down and reviewed before the show. Here are my notes for this interview: -You're a searcher, a seeker, and a story teller.  Tell me about that. -in Age if the Unthinkable you talk about the importance of relationships.  You seem very well connected to a number of different cohorts.  How did your learning of Chinese culture influence that?  Is there anything more important than building relationships when it comes to getting things done? (Planning to be Dan Kaminsky) -connection changes the nature of an object.  What does that mean? -how are the fourth revolution & the seventh sense tied together? -how do we cultivate the 7th sense?  -Clausewitz noted, “Many intelligence reports in war are contradictory; even more are false, and most are uncertain. . . . In short, most intelligence is false.”  How are you assessing a network accurately? -in Age of the Unthinkable you talk about the spymaster Farkash asking questions no one else asked and being amazed that Israel's actions had forced the enemy to evolve.  This evolution of both sides seems like a fundamental part of struggle.  Is anyone asking “How do we force our enemy to *devolve*?”  Examples of it working? -how many languages do you speak or you speak or understand?  Is it worth it to learn another language, or is there a universal language of networks? The standard visualization of a network is as a fish net, however, that is not what it might look like. When you talk about topology there is a deceptive notion that these things can be understood in nearly 3 dimensions. How else can someone visualize what a network might physically look like? Or does this require a new skill of four dimensional visualization? -can you talk a little about how blockchain ties together multiple networks (financial, legal, social?) -do we need to change to a network system without fallible leaders?  Our current leaders seem unable to solve problems for which there are fairly clear solutions. -how would you befriend a network?  Can you be friends with a network? -how would you addict a network?  -assessing trust in a network?  -assessing quality of expertise in the network?  use past predictions?  -let's talk about topology & networks.  As I understand it, topology basically refers to the way networks can be thought of in terms of connection time between nodes, regardless of physical distance.  If topology is 2 dimensional, is there a way to understand how a 3rd dimension would apply? -how can we find the edge of a network so we can “shake the blanket” and cause change?  Is it possible? -a group of almost successful (or even unsuccessful) people is far more powerful than a single lucky person; do networks remove the filter of luck, or offset the capriciousness of chance? -how does a small business use the seventh sense?  practical example? BACKGROUND Dad is a cardiologist being outdated/outgunned by Google search Mom is a high powered lawyer who wrote about the power of systems (specifically applied to law offices) -aerobatic pilot, No Visible Horizon -started as a journalist, a story teller in '93 at Newsweek -Time magazine in '96, hired by Walter Isaacson, the guy who wrote biographies about Steve Jobs, Ben Franklin, Albert Einstein, and Henry Kissinger -oversaw Time's digital operations while covering tech; has been pursuing this idea of tech & networks for a long time -moved to Beijing in 2002 & worked with John Thornton, former president of Goldman Sachs -from '03-until now he's worked at Kissinger Associates, where he's currently co-CEO -fluent in Mandarin (and Spanish?)   NOTES FROM OTHER INTERVIEWS HE'S DONE -how do we expand the network? -the sixth sense is a feeling for history -the seventh sense is a feeling for being enmeshed in networks -what happened in 1848?  Massive backlashes?  Industrial Revolution   IDEAS SPARKED -if I wanted to build my own network, how would I use the concepts in the book? -AI + social media posts?  to what end?  What is the goal?  Maximum engaged followers.  What is engaged?  Contributing useful content.  Can I define useful?  Content that triggers conversations or additions to the convo like pictures or video How can I let the Paleo Treats audience connect with each other and find their friends who are already in the network? What is our network strategy? And email centered around the idea of “Who can I introduce you to?” PODCASTING EQUIPMENT USED FOR THIS EPISODE  Finally, I love the technical geekery of podcasting and am psyched on spreading the word.  Here's the equipment I use to make mine: Mackie Onyx 1220i mixer ProAudioLA cables ElectroVoice RE20 Fethead inline preamp AKG K-240 headphones U-Control UCA222 splitter for Skype Avantone Mixcube Reaper DAW

“My favorite thing is just the dialogue that gets created, and having people understand a little bit more about their communities and the potential for them to slow down or halt directions that they may not want it to go in.” In this episode, we talk to Dan Kaminsky and Michael Higgins Jr of Social Justice Tours (www.socialjusticetours.com). Social Justice Tours uses tours as a medium to dig beneath the surface of what New Yorkers regularly see. We aim to engage New Yorkers in a critical dialogue about the past, present and future of our city, from the perspective of marginalized populations. The ultimate aim is to assist in movement building; that is to disperse information, expose injustice, and highlight inequality in a digestible, understandable way to encourage thought and inspire action. The group offers tours focusing on Trump’s influence in midtown, gentrification in Williamsburg, and the radical history of Lower Manhattan. In this episode, Rob Smith and Tyler McBrien take a tour on environmental justice in Gowanus. Produced by Interference Archive.

"My favorite thing is just the dialogue that gets created, and having people understand a little bit more about their communities and the potential for them to slow down or halt directions that they may not want it to go in." In this episode, we talk to Dan Kaminsky and Michael Higgins Jr of Social Justice Tours (www.socialjusticetours.com). Social Justice Tours uses tours as a medium to dig beneath the surface of what New Yorkers regularly see. We aim to engage New Yorkers in a critical dialogue about the past, present and future of our city, from the perspective of marginalized populations. The ultimate aim is to assist in movement building; that is to disperse information, expose injustice, and highlight inequality in a digestible, understandable way to encourage thought and inspire action. The group offers tours focusing on Trump's influence in midtown, gentrification in Williamsburg, and the radical history of Lower Manhattan. In this episode, Rob Smith and Tyler McBrien take a tour on environmental justice in Gowanus. Produced by Interference Archive.

The O’Reilly Security Podcast: Coarse-grained security, embracing the ephemeral, and empathy for everyone.In this episode, I talk with Dan Kaminsky, founder and chief scientist at White Ops. We discuss what a National Institutes of Health (NIH) for security would look like, the pros and cons of Docker and ephemeral solutions, and how the mere act of listening to people better can improve security for everyone.Here are some highlights: Creating an NIH for security research The hard truth is that there just are societal scale problems: cities burn, people need to transit from one location to another, we need food that doesn't poison us. The reality is that there are problems that affect all of us if they're present. The Internet is not a safe place right now, and, more importantly, the tools we’re using to interact with it are relatively broken. This is a problem, but we shouldn't be ashamed. I think we need to have a larger-scale response to the problems of the Internet. It has been a tremendous boon to our society. It is the heart of our economic growth. It's the greatest growth since the Industrial Revolution, but it's got some problems that we're not just going to guilt people out of. We've got to do some engineering work. We're going to have to share a lot more. The FBI has crime statistics, and it's incredibly useful on a societal scale. There needs to be this lack of shame that things are burning and say, ‘Yeah, this breach, here's what happened.’ Let's do some month-long investigations about what happened. Get that data out there and try to respond to it. This is not the first time we've had problems in an important tech, and it won't be the last time, but let's actually work on it. The reason I talk about the NIH is because they actually fund work on these sorts of problems, and things do get better. Coarse-grained security We've been trying to build these incredibly fine-grained security models based on the presumption that every little bit of a system potentially needs to talk to every other little bit of a system. You get what in Windows we call ‘ACL hell’ for the access control lists. They just get enormous. Linux has SELinux—all these very, very fine-grained systems and I don't think they work. I've become a real fan of coarse-grained security, where there are well-defined interfaces and known good state. For example—this is a real-world thing that happens in operations—you have a bunch of machines you know get compromised from time to time, and you know developers need to access them to figure out when they're not compromised to understand why they’re slow, why they’re crashing, why they’re unusable, whatever. How do you let your developers, who have very sensitive desktops, access these machines in the data center? You do things where the only signal that gets through is a keyboard, a mouse, a screen. In fact, that might literally be a remote desktop connection that goes to a device where that's all it transmits: keyboard, video, mouse. You don't let the developer desktop talk directly over IP to the machine you know probably got compromised. What you've done there is you've squeezed the signal down to really almost nothing; to a deeply well-defined interface. When the only thing it can do is what it's supposed to do operationally, you get some security properties that people can reason about. They can think about what the system is doing. A lot of security is just making computers behave like people think they're behaving. Getting rid of the goop There's alignment between what developers want and what security wants. Everyone wants the system to behave in a predictable manner. Now, as a deployment methodology, Docker’s got some really cool things. As a security mechanism, there's a lot of goop that we sort of paper over, stuff that's being shared between the one kernel and the many user spaces. No one quite knows what the goop is, what needs to be saved, what needs to be restored, what needs to be secured. No one quite knows all the states and all the information being exchanged between the isolated environment and the important kernel. That's a big deal; this is literally the scenario that means this is going to be rough to secure because that's where the hackers hide. When you don't know what you're tracking, they'll go find that. Embracing the ephemeral No one wants to go back to the way things worked in virtual machines. No one has enough disk space for that. But there are a bunch of really good properties in the virtual machine architecture. We don't need to do deployments like the old VMs, but we can use the properties of the actual hardware. I've been exploring that myself. I have this mechanism called Autoclave. Autoclave is basically doing a bunch of stunts between containers and VMs. I have full Linux and Windows environments booting up in less than a quarter of a second, fully functional, fully operational, fully ephemeral. You go in, you do whatever you're going to do, you leave, the thing's destroyed. The goal I want to get to is when you interact with a server, on connecting to it, a virtual machine spawns—you do your business, it leaves, it's okay. So, then there are these architectural stunts you can play where it's just, ‘I want you to do the same thing you did before. I want you to do it on every connection. I want you to do it efficiently, and I don't want you to throw away everything after.’ This is actually technically feasible. I've been playing with it, and I'm going to demonstrate it at the Security conference in New York next month. Empathy builds better solutions Empathy is actually caring about someone else's problems. Empathy is how you make things that don't suck. It is the process of putting your mind in someone else's life experience and thinking, ‘Okay, this is where you're coming from. What do you need?’ Because you know no one wants to get hacked. People have a budget for not suffering that. People don't want their houses to burn. People don't want their bank accounts emptied. It's not that we don't have buy-in, it's just that we have to change things so that the first thing you do when you get home doesn’t have to be figuring out how to keep your house from burning down tomorrow. That's where we are in security right now, and it's not okay. We should figure out how we can integrate in other people's lives.

The O’Reilly Security Podcast: Coarse-grained security, embracing the ephemeral, and empathy for everyone.In this episode, I talk with Dan Kaminsky, founder and chief scientist at White Ops. We discuss what a National Institutes of Health (NIH) for security would look like, the pros and cons of Docker and ephemeral solutions, and how the mere act of listening to people better can improve security for everyone.Here are some highlights: Creating an NIH for security research The hard truth is that there just are societal scale problems: cities burn, people need to transit from one location to another, we need food that doesn't poison us. The reality is that there are problems that affect all of us if they're present. The Internet is not a safe place right now, and, more importantly, the tools we’re using to interact with it are relatively broken. This is a problem, but we shouldn't be ashamed. I think we need to have a larger-scale response to the problems of the Internet. It has been a tremendous boon to our society. It is the heart of our economic growth. It's the greatest growth since the Industrial Revolution, but it's got some problems that we're not just going to guilt people out of. We've got to do some engineering work. We're going to have to share a lot more. The FBI has crime statistics, and it's incredibly useful on a societal scale. There needs to be this lack of shame that things are burning and say, ‘Yeah, this breach, here's what happened.’ Let's do some month-long investigations about what happened. Get that data out there and try to respond to it. This is not the first time we've had problems in an important tech, and it won't be the last time, but let's actually work on it. The reason I talk about the NIH is because they actually fund work on these sorts of problems, and things do get better. Coarse-grained security We've been trying to build these incredibly fine-grained security models based on the presumption that every little bit of a system potentially needs to talk to every other little bit of a system. You get what in Windows we call ‘ACL hell’ for the access control lists. They just get enormous. Linux has SELinux—all these very, very fine-grained systems and I don't think they work. I've become a real fan of coarse-grained security, where there are well-defined interfaces and known good state. For example—this is a real-world thing that happens in operations—you have a bunch of machines you know get compromised from time to time, and you know developers need to access them to figure out when they're not compromised to understand why they’re slow, why they’re crashing, why they’re unusable, whatever. How do you let your developers, who have very sensitive desktops, access these machines in the data center? You do things where the only signal that gets through is a keyboard, a mouse, a screen. In fact, that might literally be a remote desktop connection that goes to a device where that's all it transmits: keyboard, video, mouse. You don't let the developer desktop talk directly over IP to the machine you know probably got compromised. What you've done there is you've squeezed the signal down to really almost nothing; to a deeply well-defined interface. When the only thing it can do is what it's supposed to do operationally, you get some security properties that people can reason about. They can think about what the system is doing. A lot of security is just making computers behave like people think they're behaving. Getting rid of the goop There's alignment between what developers want and what security wants. Everyone wants the system to behave in a predictable manner. Now, as a deployment methodology, Docker’s got some really cool things. As a security mechanism, there's a lot of goop that we sort of paper over, stuff that's being shared between the one kernel and the many user spaces. No one quite knows what the goop is, what needs to be saved, what needs to be restored, what needs to be secured. No one quite knows all the states and all the information being exchanged between the isolated environment and the important kernel. That's a big deal; this is literally the scenario that means this is going to be rough to secure because that's where the hackers hide. When you don't know what you're tracking, they'll go find that. Embracing the ephemeral No one wants to go back to the way things worked in virtual machines. No one has enough disk space for that. But there are a bunch of really good properties in the virtual machine architecture. We don't need to do deployments like the old VMs, but we can use the properties of the actual hardware. I've been exploring that myself. I have this mechanism called Autoclave. Autoclave is basically doing a bunch of stunts between containers and VMs. I have full Linux and Windows environments booting up in less than a quarter of a second, fully functional, fully operational, fully ephemeral. You go in, you do whatever you're going to do, you leave, the thing's destroyed. The goal I want to get to is when you interact with a server, on connecting to it, a virtual machine spawns—you do your business, it leaves, it's okay. So, then there are these architectural stunts you can play where it's just, ‘I want you to do the same thing you did before. I want you to do it on every connection. I want you to do it efficiently, and I don't want you to throw away everything after.’ This is actually technically feasible. I've been playing with it, and I'm going to demonstrate it at the Security conference in New York next month. Empathy builds better solutions Empathy is actually caring about someone else's problems. Empathy is how you make things that don't suck. It is the process of putting your mind in someone else's life experience and thinking, ‘Okay, this is where you're coming from. What do you need?’ Because you know no one wants to get hacked. People have a budget for not suffering that. People don't want their houses to burn. People don't want their bank accounts emptied. It's not that we don't have buy-in, it's just that we have to change things so that the first thing you do when you get home doesn’t have to be figuring out how to keep your house from burning down tomorrow. That's where we are in security right now, and it's not okay. We should figure out how we can integrate in other people's lives.

In our 113th episode of the Steptoe Cyberlaw Podcast, Stewart Baker, Alan Cohn, and Maury Shenk discuss: United Kingdom: UK’s pending surveillance bill and GCHQ’s compliance regime for access to bulk personal data; Apple stops providing security patches to QuickTime on Windows; Federal judge rules FBI didn’t have proper warrant to hack child porn site; FISA Court troubled by surveillance excesses at FBI and NSA; and Chinese drone maker says that it may share data with local government. In our second half, we have a one-hour panel discussion with cryptographers and security professionals at the Annual International Conference on Cyber Engagement, the panelists include: Patrick Henry, a notable cryptographer with experience at GCHQ, NSA, and the private sector; Dan Kaminsky, the Chief Scientist at White Ops; Kiran Raj, who is Senior Counsel to the Deputy Attorney General; and Dr. Zulfikar Ramzan the CTO of RSA Security. The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

Materials Available here: https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Ryan-Castellucci-Cracking-Cryptocurrency-Brainwallets.pdf Cracking Cryptocurrency Brainwallets Ryan Castellucci Security Researcher, White Ops Imagine a bank that, by design, made everyone's password hashes and balances public. No two-factor authentication, no backsies on transfers. Welcome to "brainwallets", a way for truly paranoid cryptocurrency users to wager their fortunes on their ability to choose a good password or passphrase. Over the last decade, we've seen the same story play out dozens of times - a website is broken into, the user database is posted online, and most of the password hashes are cracked. Computers are now able make millions, billions or even trillions of guesses per second. Every eight character password you can type on a standard keyboard and every combination of five common english words could be tried in less than a day by today's botnets. Can people come up with passphrases able to stand up to that when money is on the line? Let's find out. For this talk, I will be releasing my high speed brainwallet cracker, "Brainflayer". I'll cover a history of brainwallets, safer passphrase-based wallet generation, passphrase security, in-the-wild cracking activity, and how I accidently stole 250 Bitcoins (and tracked down the owner to give them back). Ryan Castellucci has been interested in cryptography since childhood when his parents gave him a copy of "Codes, Ciphers and Secret Writing". He soon learned to program and wrote a tool to crack simple substitution ciphers. More recently, he co-spoke with Dan Kaminsky at DEF CON 22 and was a finalist in the 2014 Underhanded Crypto Contest. For his day job at White Ops, he finds new and exciting ways to tease out the subtle differences between bots and human-controlled web browsers. Twitter: @ryancdotorg Web: https://rya.nc

I want these * bugs off my * Internet Dan Kaminsky Chief Scientist, White Ops Are you interested in the gory details in fixing ugly bugs? No? Just like watching stuff blow up? Go to some other talk! But if you want to see what it takes to comprehensively end an entire bug class -- how you dive into a code base, what performance and usability and maintainability and debuggability constraints it takes to make a web browser more secure -- oh do I have some dirt for you.

In our seventieth episode of the Steptoe Cyberlaw Podcast, Stewart Baker, Michael Vatis, and Jason Weinstein discuss: this week in NSA: the USA Freedom bill takes effect; a New York Times article claims that the NSA’s cybersecurity monitoring is a privacy issue; failed MasterCard settlement with Target; Office of Personnel Management hack; US response to Russia’s censorship laws; Supreme Court ruling on online threats; and FBI asks for CALEA to be expanded to social media. In our second half we have an interview with Dan Kaminsky, Chief Scientist at WhiteOps and the cybersecurity researcher who found and helped fix a DNS security flaw. The views expressed in this podcast are those of the speakers and do not reflect the opinions of the firm.

Secure Random By Default Dan Kaminsky Chief Scientist, White Ops As a general rule in security, we have learned that the best way to achieve security is to enable it by default. However, across operating systems and languages, random number generation is always exposed via two separate and most assuredly unequal APIs -- insecure and default, and secure but obscure. Why not fix this? Why not make JavaScript and PHP and Java and Python and even libc rand() return strong entropy? What are the issues stopping us? Should we just shell back to /dev/urandom, or is there merit to userspace entropy gathering? How does fork() and virtualization impact the question? What of performance, and memory consumption, and headless machines? Turns out the above questions are not actually rhetorical. Just because a change might be a good idea doesn't mean it's a simple one. This will be a deep dive, but one that I believe will actually yield a fix for the repeated *real world* failures of random number generation systems. Dan Kaminsky has been a noted security researcher for over a decade, and has spent his career advising Fortune 500 companies such as Cisco, Avaya, and Microsoft.Dan spent three years working with Microsoft on their Vista, Server 2008, and Windows 7 releases. Dan is best known for his work finding a critical flaw in the Internet’s Domain Name System (DNS), and for leading what became the largest synchronized fix to the Internet’s infrastructure of all time. Of the seven Recovery Key Shareholders who possess the ability to restore the DNS root keys, Dan is the American representative. Dan is presently developing systems to reduce the cost and complexity of securing critical infrastructure.

Our first guest! In this episode we talk with Dan Kaminsky about The Fappening and who to blame, Overalls, The Nickelback Effect, The Strain, Death By Selfies and fried stuff

In this podcast, Matt and Cricket answer Leen Besselink's question about the viability of Dan Kaminsky's proposed use of a clever DNSCurve concept in DNSSEC, and Matt offers his high opinion of the Dutch people (surely risking retribution by his Swedish countrymen). Then they turn to Josh Baverstock's question about why the LOC record failed to catch on, despite its obvious utility to cruise missiles with stub resolvers

Jon Collins talks to Dan Kaminsky

Early in 2008, security researcher Dan Kaminsky located a gaping hole the basic underpinnings of the internet. This fundamental flaw in DNS security renders almost all DNS serves open to cache poisoning (US CERT VU#800113). As the vulnerability arises from flaws in the design of the DNS protocol, the issue affects nearly all vendors and nearly all products designed to work with DNS. In the intervening time, Dan has worked with a coalition of vendors to create a fix for this very serious and ubiquitous vulnerability. On July 8th, technology vendors from across the industry simultaneously released patches for their products in a combined effort of historic proportion.

Our monthly free webcast series rolls on with another talk about a major vulnerability. This webcast is entitled "Trust Doesn't Scale: Practical Hijacking On the World's Largest Network." The webcast is based on a remarkable presentation by Tony Kapela and Alexander Pilosov at the DEFCON security conference this August. To illustrate their BGP-based traffic-hijacking techniques, they intercepted all traffic from the notoriously hostile conference network and ran it through their servers. The process was almost completely invisible to DEFCON attendees. Their demonstration took advantage of a trust issue with Border Gateway Protocol (BGP), and it appears to be part of a larger security trend of major issues emerging in the bedrock protocols that support the Internet. Dan Kaminsky's DNS vulnerability relies on trust issues in DNS. In recent years major questions have been raised about SNMP and ICMP and at this writing there's word of a potentially major TCP exploit. Vulnerabilities like these raise significant questions about the business of security, the limits of patching, and the difficulties involved in securing a trust-based system.

1 hora e 4 minutos Eventos MEITSEC 2008 The Pwnie Awards Hackers to Face Off in Black Hat 'Iron Chef' Contest Audio do Webinar 1 da BlackHat USA Notícias Fusil the fuzzer is a Python library used to write fuzzing programs. How your GPS can dob you in DHS Official Considered Shock Collars For Air Travelers SUBSTITUTIVO (ao PLS 76/2000, PLS 137/2000 e PLC 89/2003) Tudo sobre o hype do DNS ISC ZDNET SC Magazine Information Week Matasano Arbor ASERT Audio do Press-Release do Dan Kaminsky

"Our networks are growing. Is our understanding of them? This talk will focus on the monitoring and defense of very large scale networks, describing mechanisms for actively probing them and systems that may evade our most detailed probes. We will analyze these techniques in the context of how IPv6 affects, or fails to affect them. A number of technologies will be discussed, including: * A temporal attack against IP fragmentation, using variance in fragment reassembly timers to evade Network Intrustion Detection Systems * A high speed DNS tunneling mechanism, capable of streaming video over a firewall-penetrating set of DNS queries * DNS poisoning attacks against networks that implement automated defensive network shunning, and other unexpected design constraints developers and deployers of security equipment should be aware of * Mechanisms for very high speed reconstruction of IPv4 and IPv6 network topologies, complete with visual representation of those topologies implemented in OpenGL. * Analysis of the potential for using name servers as IPv4->IPv6 gateways. * In addition, we'll briefly discuss the results of research against MD5, which allows two very different web pages to emit the same MD5 hash. Dan Kaminsky, also known as Effugas, is a Senior Security Consultant for Avaya's Enterprise Security Practice, where he works on large-scale security infrastructure. Dan's experience includes two years at Cisco Systems designing security infrastructure for large-scale network monitoring systems. He is best known for his work on the ultra-fast port scanner scanrand, part of the "Paketto Keiretsu", a collection of tools that use new and unusual strategies for manipulating TCP/IP networks. He authored the Spoofing and Tunneling chapters for "Hack Proofing Your Network: Second Edition", was a co-author of "Stealing The Network: How To Own The Box", and has delivered presentations at several major industry conferences, including Linuxworld, DefCon, and past Black Hat Briefings. Dan was responsible for the Dynamic Forwarding patch to OpenSSH, integrating the majority of VPN-style functionality into the widely deployed cryptographic toolkit. Finally, he founded the cross-disciplinary DoxPara Research in 1997, seeking to integrate psychological and technological theory to create more effective systems for non-ideal but very real environments in the field. Dan is based in Silicon Valley."

Jeff Moss, founder of Black Hat, invites Chief Information Security Officers from global corporations to join him on stage for a unique set of questions and answers. What do CISOs think of Black Hat, David Litchfield, Dan Kaminsky, Joe Grand, Johnny Long, Metasploit, and DEFCON? How many years before deperimeterization is a reality? Is security research more helpful or harmful to the economy? What privacy practices do CISOs personally use? These questions and others from the audience will be fielded by this panel of security visionaries. Scott Blake is Chief Information Security Officer for Liberty Mutual Insurance Group and is responsible for information security strategy and policy. Prior to joining Liberty, Scott was Vice President of Information Security for BindView Corporation where he founded the RAZOR security research team and directed security technology, market, and public affairs strategy. Scott has delivered many lectures on all aspects of information security and is frequently sought by the press for expert commentary. Since 1993, Scott has also worked as a security consultant, IT director, and network engineer. He holds an MA in Sociology from Brandeis University, a BA in Social Sciences from Simon's Rock College, and holds the CISM and CISSP security certifications. Pamela Fusco, CISSP, CISM, CHS-III, Chief Security Officer, Merck and Co., Inc. Pamela Fusco is an Executive Global Information Security Professional, for Merck and CO., Inc. She has accumulated over 19 years of substantial experience within the Security Industry. Her extensive background and expertise expand globally encompassing all facets of security inclusive of logical, physical, personal, facilities, systems, networks, wireless, and forensic investigations. Presently she leads a talented team of Compliance, Systems and Information Security Engineers operating a world-wide 24X7X365 SIRT (security incident response team). Andre Gold is currently Director of Information Security at Continental Airlines, one of the world's largest and most successful commercial and freight transportation providers. Before assuming his current role, Mr. Gold served as Technical Director of Internet Services, responsible for Continental's continental.com property, which contributes over a billion dollars a year in revenue for Continental. Prior to Continental Airlines, Inc. Mr. Gold worked as a consultant in the IT industry. Mr. Gold has a BBA in Computer Information Systems from the University of Houston-Downtown and received his commission in the Army from Wentworth Military Academy. In addition to his position at Continental, Mr. Gold servers on the Microsoft Chief Security Officer Council, the Skyteam Data Privacy and Security Subcommittee, as well as eEye Digital Security's Executive Advisory Council. Ken Pfeil is CSO at Capital IQ, a web-based information service company headquartered in New York City. His experience spans over two decades with companies such as Microsoft, Dell, Avaya, Identix, and Merrill Lynch. Ken is coauthor of the books "Hack Proofing Your Network - 2nd Edition" and "Stealing the Network - How to Own the Box," and a contributing author of "Security Planning and Disaster Recovery" and "Network Security - The Complete Reference." Justin Somaini is Director of Information Security at VeriSign Inc. where he is responsible for managing all aspects of network and information security for VeriSign. With over 10 years of Information Security and Corporate Audit experience, Justin has leveraged his knowledge of audit and large organizations to remediate global infrastructure problems and create a full risk identification and remediation Information Security group. Previously, Justin was the Director of Information Security Services for Charles Schwab Inc., where he was responsible for all aspects of Information Security Operations. Before that he was a Manager with PricewaterhouseCoopers LLP where he spent several years developing their attack and penetration leadership and audit practice.>

Jeff Moss, founder of Black Hat, invites Chief Information Security Officers from global corporations to join him on stage for a unique set of questions and answers. What do CISOs think of Black Hat, David Litchfield, Dan Kaminsky, Joe Grand, Johnny Long, Metasploit, and DEFCON? How many years before deperimeterization is a reality? Is security research more helpful or harmful to the economy? What privacy practices do CISOs personally use? These questions and others from the audience will be fielded by this panel of security visionaries. Scott Blake is Chief Information Security Officer for Liberty Mutual Insurance Group and is responsible for information security strategy and policy. Prior to joining Liberty, Scott was Vice President of Information Security for BindView Corporation where he founded the RAZOR security research team and directed security technology, market, and public affairs strategy. Scott has delivered many lectures on all aspects of information security and is frequently sought by the press for expert commentary. Since 1993, Scott has also worked as a security consultant, IT director, and network engineer. He holds an MA in Sociology from Brandeis University, a BA in Social Sciences from Simon's Rock College, and holds the CISM and CISSP security certifications. Pamela Fusco, CISSP, CISM, CHS-III, Chief Security Officer, Merck and Co., Inc. Pamela Fusco is an Executive Global Information Security Professional, for Merck and CO., Inc. She has accumulated over 19 years of substantial experience within the Security Industry. Her extensive background and expertise expand globally encompassing all facets of security inclusive of logical, physical, personal, facilities, systems, networks, wireless, and forensic investigations. Presently she leads a talented team of Compliance, Systems and Information Security Engineers operating a world-wide 24X7X365 SIRT (security incident response team). Andre Gold is currently Director of Information Security at Continental Airlines, one of the world's largest and most successful commercial and freight transportation providers. Before assuming his current role, Mr. Gold served as Technical Director of Internet Services, responsible for Continental's continental.com property, which contributes over a billion dollars a year in revenue for Continental. Prior to Continental Airlines, Inc. Mr. Gold worked as a consultant in the IT industry. Mr. Gold has a BBA in Computer Information Systems from the University of Houston-Downtown and received his commission in the Army from Wentworth Military Academy. In addition to his position at Continental, Mr. Gold servers on the Microsoft Chief Security Officer Council, the Skyteam Data Privacy and Security Subcommittee, as well as eEye Digital Security's Executive Advisory Council. Ken Pfeil is CSO at Capital IQ, a web-based information service company headquartered in New York City. His experience spans over two decades with companies such as Microsoft, Dell, Avaya, Identix, and Merrill Lynch. Ken is coauthor of the books "Hack Proofing Your Network - 2nd Edition" and "Stealing the Network - How to Own the Box," and a contributing author of "Security Planning and Disaster Recovery" and "Network Security - The Complete Reference." Justin Somaini is Director of Information Security at VeriSign Inc. where he is responsible for managing all aspects of network and information security for VeriSign. With over 10 years of Information Security and Corporate Audit experience, Justin has leveraged his knowledge of audit and large organizations to remediate global infrastructure problems and create a full risk identification and remediation Information Security group. Previously, Justin was the Director of Information Security Services for Charles Schwab Inc., where he was responsible for all aspects of Information Security Operations. Before that he was a Manager with PricewaterhouseCoopers LLP where he spent several years developing their attack and penetration leadership and audit practice.>

"The known topics for this year include: 1. The Worldwide SSL Analysis-There's a major flaw in the way many, many SSL devices operate. I'll discuss how widespread this flaw is, as well as announce results from this worldwide SSL scan. 2. Syntax Highlighting...on Hexdumps. Reverse Engineering efforts often require looking at hex dumps-without much context for whats being looked at. I will discuss a "bridge" position between AI and manual operation in which compression code is used to automatically visualize patterns in analyzed data. 3. Everything else "

The known topics for this year include: 1. The Worldwide SSL Analysis-There's a major flaw in the way many, many SSL devices operate. I'll discuss how widespread this flaw is, as well as announce results from this worldwide SSL scan. 2. Syntax Highlighting...on Hexdumps. Reverse Engineering efforts often require looking at hex dumps-without much context for whats being looked at. I will discuss a "bridge" position between AI and manual operation in which compression code is used to automatically visualize patterns in analyzed data. 3. Everything else "

Design bugs are really difficult to fix -- nobody ever takes a dependency on a buffer overflow, after all. Few things have had their design stretched as far as the web; as such, I've been starting to take a look at some interesting aspects of the "Web 2.0" craze. Here's a few things I've been looking at: Slirpie: VPN'ing into Protected Networks With Nothing But A Lured Web Browser. Part of the design of the web is that browsers are able to collect and render resources across security boundaries. This has a number of issues, but they've historically been mitigated with what's known as the Same Origin Policy, which attempts to restrict scripting and other forms of enhanced access to sites with the same name. But scripts are not acquired from names; they come from addresses. As RSnake of ha.ckers.org and Dan Boneh of Stanford University have pointed out, so-called "DNS Rebinding" attacks can break the link between the names that are trusted, and the addresses that are connected to, allowing an attacker to proxy connectivity from a client. I will demonstrate an extension of RSnake and Boneh's work, that grants full IP connectivity, by design, to any attacker who can lure a web browser to render his page. I will also discuss how the existence of attacks such as Slirpie creates special requirements for anyone intending to design or deploy Web Single Sign On technologies. Slirpie falls to some of them, but slices through the rest handily. p0wf: Passing Fingerprinting of Web Content Frameworks. Traditional OS fingerprinting has looked to identify the OS Kernel that one is communicating with, based on the idea that if one can identify the kernel, one can target daemons that tend to be associated with it. But the web has become almost an entirely separate OS layer of its own, and especially with AJAX and Web 2.0, new forms of RPC and marshalling are showing up faster than anyone can identify. p0wf intends to analyze these streams and determine just which frameworks are being exposed on what sites. LudiVu: A number of web sites have resorted to mechanisms known as CAPTCHAs, which are intended to separate humans from automated submission scripts. For accessibility reasons, these CAPTCHAs need to be both visual and auditory. They are usually combined with a significant amount of noise, so as to make OCR and speech recognition impossible. I was in the process of porting last year's dotplot similarity analysis code to audio streams for non-security related purposes, when Zane Lackey of iSec Partners proposed using this to analyze CAPTCHAs. It turns out that, indeed, Audio CAPTCHAs exhibit significant self-similarity that visualizes well in dotplot form. This will probably be the first Black Hat talk to use WinAMP as an attack tool. A number of other projects are also being worked on -- I've been sending billions of packets for a reason, after all, and they haven't been coming from WinAMP :) There will be some updates on the analysis tools discussed during Black Ops 2006 as well.

Design bugs are really difficult to fix -- nobody ever takes a dependency on a buffer overflow, after all. Few things have had their design stretched as far as the web; as such, I've been starting to take a look at some interesting aspects of the "Web 2.0" craze. Here's a few things I've been looking at: Slirpie: VPN'ing into Protected Networks With Nothing But A Lured Web Browser. Part of the design of the web is that browsers are able to collect and render resources across security boundaries. This has a number of issues, but they've historically been mitigated with what's known as the Same Origin Policy, which attempts to restrict scripting and other forms of enhanced access to sites with the same name. But scripts are not acquired from names; they come from addresses. As RSnake of ha.ckers.org and Dan Boneh of Stanford University have pointed out, so-called "DNS Rebinding" attacks can break the link between the names that are trusted, and the addresses that are connected to, allowing an attacker to proxy connectivity from a client. I will demonstrate an extension of RSnake and Boneh's work, that grants full IP connectivity, by design, to any attacker who can lure a web browser to render his page. I will also discuss how the existence of attacks such as Slirpie creates special requirements for anyone intending to design or deploy Web Single Sign On technologies. Slirpie falls to some of them, but slices through the rest handily. p0wf: Passing Fingerprinting of Web Content Frameworks. Traditional OS fingerprinting has looked to identify the OS Kernel that one is communicating with, based on the idea that if one can identify the kernel, one can target daemons that tend to be associated with it. But the web has become almost an entirely separate OS layer of its own, and especially with AJAX and Web 2.0, new forms of RPC and marshalling are showing up faster than anyone can identify. p0wf intends to analyze these streams and determine just which frameworks are being exposed on what sites. LudiVu: A number of web sites have resorted to mechanisms known as CAPTCHAs, which are intended to separate humans from automated submission scripts. For accessibility reasons, these CAPTCHAs need to be both visual and auditory. They are usually combined with a significant amount of noise, so as to make OCR and speech recognition impossible. I was in the process of porting last year's dotplot similarity analysis code to audio streams for non-security related purposes, when Zane Lackey of iSec Partners proposed using this to analyze CAPTCHAs. It turns out that, indeed, Audio CAPTCHAs exhibit significant self-similarity that visualizes well in dotplot form. This will probably be the first Black Hat talk to use WinAMP as an attack tool. A number of other projects are also being worked on -- I've been sending billions of packets for a reason, after all, and they haven't been coming from WinAMP :) There will be some updates on the analysis tools discussed during Black Ops 2006 as well.