Podcast appearances and mentions of haroon meer

Unraveling Cybersecurity Complexity: A Conversation with Haroon Meer Haroon Meer, an influential figure in the world of cybersecurity, takes center stage in this podcast interview. With a deep reservoir of knowledge and a track record of tackling complex security challenges, Haroon has established himself as a key player in the InfoSec domain. As the founder of Thinkst Applied Research, Haroon brings a wealth of practical experience to the table. Join us as we explore his professional journey, from early forays into cybersecurity to pioneering innovations that have reshaped how organizations approach security. Haroon Meer's insights go beyond the theoretical, offering a pragmatic understanding of cybersecurity issues and solutions. Dive into the intricacies of threat landscapes, security architectures, and the evolving dynamics of cyber threats as Haroon shares his perspectives on the current state of cybersecurity. With a focus on practicality and a knack for simplifying complex concepts, Haroon Meer's interview is a must-listen for anyone interested in the nuances of cybersecurity. Gain a deeper understanding of the challenges faced by security professionals and uncover valuable takeaways that can enhance your approach to securing digital environments. Join us as we explore the mind of a cybersecurity luminary, unraveling the layers of InfoSec intricacies with Haroon Meer in this enlightening podcast episode. Show Notes: https://securityweekly.com/vault-psw-14

Unraveling Cybersecurity Complexity: A Conversation with Haroon Meer Haroon Meer, an influential figure in the world of cybersecurity, takes center stage in this podcast interview. With a deep reservoir of knowledge and a track record of tackling complex security challenges, Haroon has established himself as a key player in the InfoSec domain. As the founder of Thinkst Applied Research, Haroon brings a wealth of practical experience to the table. Join us as we explore his professional journey, from early forays into cybersecurity to pioneering innovations that have reshaped how organizations approach security. Haroon Meer's insights go beyond the theoretical, offering a pragmatic understanding of cybersecurity issues and solutions. Dive into the intricacies of threat landscapes, security architectures, and the evolving dynamics of cyber threats as Haroon shares his perspectives on the current state of cybersecurity. With a focus on practicality and a knack for simplifying complex concepts, Haroon Meer's interview is a must-listen for anyone interested in the nuances of cybersecurity. Gain a deeper understanding of the challenges faced by security professionals and uncover valuable takeaways that can enhance your approach to securing digital environments. Join us as we explore the mind of a cybersecurity luminary, unraveling the layers of InfoSec intricacies with Haroon Meer in this enlightening podcast episode. Show Notes: https://securityweekly.com/vault-psw-14

Unraveling Cybersecurity Complexity: A Conversation with Haroon Meer Haroon Meer, an influential figure in the world of cybersecurity, takes center stage in this podcast interview. With a deep reservoir of knowledge and a track record of tackling complex security challenges, Haroon has established himself as a key player in the InfoSec domain. As the founder of Thinkst Applied Research, Haroon brings a wealth of practical experience to the table. Join us as we explore his professional journey, from early forays into cybersecurity to pioneering innovations that have reshaped how organizations approach security. Haroon Meer's insights go beyond the theoretical, offering a pragmatic understanding of cybersecurity issues and solutions. Dive into the intricacies of threat landscapes, security architectures, and the evolving dynamics of cyber threats as Haroon shares his perspectives on the current state of cybersecurity. With a focus on practicality and a knack for simplifying complex concepts, Haroon Meer's interview is a must-listen for anyone interested in the nuances of cybersecurity. Gain a deeper understanding of the challenges faced by security professionals and uncover valuable takeaways that can enhance your approach to securing digital environments. Join us as we explore the mind of a cybersecurity luminary, unraveling the layers of InfoSec intricacies with Haroon Meer in this enlightening podcast episode. Show Notes: https://securityweekly.com/vault-psw-14

Unraveling Cybersecurity Complexity: A Conversation with Haroon Meer Haroon Meer, an influential figure in the world of cybersecurity, takes center stage in this podcast interview. With a deep reservoir of knowledge and a track record of tackling complex security challenges, Haroon has established himself as a key player in the InfoSec domain. As the founder of Thinkst Applied Research, Haroon brings a wealth of practical experience to the table. Join us as we explore his professional journey, from early forays into cybersecurity to pioneering innovations that have reshaped how organizations approach security. Haroon Meer's insights go beyond the theoretical, offering a pragmatic understanding of cybersecurity issues and solutions. Dive into the intricacies of threat landscapes, security architectures, and the evolving dynamics of cyber threats as Haroon shares his perspectives on the current state of cybersecurity. With a focus on practicality and a knack for simplifying complex concepts, Haroon Meer's interview is a must-listen for anyone interested in the nuances of cybersecurity. Gain a deeper understanding of the challenges faced by security professionals and uncover valuable takeaways that can enhance your approach to securing digital environments. Join us as we explore the mind of a cybersecurity luminary, unraveling the layers of InfoSec intricacies with Haroon Meer in this enlightening podcast episode. Show Notes: https://securityweekly.com/vault-psw-14

In this Soap Box edition of the podcast Patrick Gray chats with Thinkst Canary founder Haroon Meer about his “decade of deception”, including: A history of Thinkst Canary including a recap of what they actually do A look at why they're still really the only major player in the deception game A look at what companies like Microsoft are doing with deception Why security startups should have conference booths

In this Risky Business News sponsor interview, Catalin Cimpanu talks with Haroon Meer, Founder and CEO at Thinkst, about the company's evolution over the past 15 years, its focus on hacker-like internal culture, and the UK NCSC's new deception network. Show notes Building a nation-scale evidence base for cyber deception Hacking as a pathway to building better Products

On today's Demo Day Trey Ford and RSnake sit down with Haroon Meer, the CEO of Thinkst and discuss his Canary product, which is a super simple honeypot and honeytoken product allowing customers to get extremely high signal to noise ratio and reduce dwell time.

On this week's show Patrick and Adam discuss the week's security news, including: FVEY protests China's widespread hacking of western politicians China bans western CPUs, Windows and databases Apple's leaky M-chip prefetcher Nigeria holds ex-IRS investigator hostage in Binance stoush Researchers bring Rowhammer to AMD Zen and DDR5 And much, much more. This week's show is brought to you by Thinkst Canary. Its founder Haroon Meer joins this week's show to make a passionate case that security vendors don't all have to go for explosive growth. Slow and steady with a focus on excellent and relevant products will win the race, he says. Show notes Justice Department indicts 7 accused in 14-year hack campaign by Chinese gov Parliament network breached in China-led cyberattack, Judith Collins reveals China blocks use of Intel and AMD chips in government computers Announcement of Safety and Reliability Evaluation Results (No. 1, 2023) Unpatchable vulnerability in Apple chip leaks secret encryption keys | Ars Technica How Ukraine is using mobile phones on 6ft poles to stop drones Russian military intelligence may have deployed wiper against multiple Ukrainian ISPs | CyberScoop US penalizes Russian fintech firms that helped others evade sanctions UN probing 58 alleged crypto heists by North Korea worth $3 billion Detained execs, a bold escape, and tax evasion charges: Nigeria takes aim at Binance The DOJ Puts Apple's iMessage Encryption in the Antitrust Crosshairs | WIRED Mark Zuckerberg told Facebook execs to 'figure out' how to track encrypted usage on rival apps like Snap and YouTube, unsealed documents show ‘Far-reaching' hack stole information from Python developers ZenHammer: Rowhammer Attacks on AMD Zen-based Platforms One Man's Army of Streaming Bots Reveals a Whole Industry's Problem Apex Legends hacker said he hacked tournament games ‘for fun' | TechCrunch

On this week's show Patrick and Adam discuss the week's security news, including: FVEY protests China's widespread hacking of western politicians China bans western CPUs, Windows and databases Apple's leaky M-chip prefetcher Nigeria holds ex-IRS investigator hostage in Binance stoush Researchers bring Rowhammer to AMD Zen and DDR5 And much, much more. This week's show is brought to you by Thinkst Canary. Its founder Haroon Meer joins this week's show to make a passionate case that security vendors don't all have to go for explosive growth. Slow and steady with a focus on excellent and relevant products will win the race, he says. Show notes Justice Department indicts 7 accused in 14-year hack campaign by Chinese gov Parliament network breached in China-led cyberattack, Judith Collins reveals China blocks use of Intel and AMD chips in government computers Announcement of Safety and Reliability Evaluation Results (No. 1, 2023) Unpatchable vulnerability in Apple chip leaks secret encryption keys | Ars Technica How Ukraine is using mobile phones on 6ft poles to stop drones Russian military intelligence may have deployed wiper against multiple Ukrainian ISPs | CyberScoop US penalizes Russian fintech firms that helped others evade sanctions UN probing 58 alleged crypto heists by North Korea worth $3 billion Detained execs, a bold escape, and tax evasion charges: Nigeria takes aim at Binance The DOJ Puts Apple's iMessage Encryption in the Antitrust Crosshairs | WIRED Mark Zuckerberg told Facebook execs to 'figure out' how to track encrypted usage on rival apps like Snap and YouTube, unsealed documents show ‘Far-reaching' hack stole information from Python developers ZenHammer: Rowhammer Attacks on AMD Zen-based Platforms One Man's Army of Streaming Bots Reveals a Whole Industry's Problem Apex Legends hacker said he hacked tournament games ‘for fun' | TechCrunch

In this Risky Business News sponsor interview Tom Uren talks to Haroon Meer of Thinkst Canary. They discuss how network attackers win, how their tactics have changed over time and what this means for network defenders.

In this Risky Business News sponsor interview Tom Uren talks to Haroon Meer of Thinkst Canary. They discuss how network attackers win, how their tactics have changed over time and what this means for network defenders.

In this week's edition of the show Patrick Gray and guest co-host Dmitri Alperovitch discuss: Major telco in Ukraine taken down by Russia Apple and Facebook go all in on e2ee Why 702 reauthorisation is looking a bit sketchy The USG wants your push notifications The year in review, plus some predictions for 2024 This week's show is brought to you by Thinkst Canary. Haroon Meer, Thinkst's founder, is this week's sponsor guest. He joins us to talk about APT groups pivoting to living-off-the-land techniques.

In this week's edition of the show Patrick Gray and guest co-host Dmitri Alperovitch discuss: Major telco in Ukraine taken down by Russia Apple and Facebook go all in on e2ee Why 702 reauthorisation is looking a bit sketchy The USG wants your push notifications The year in review, plus some predictions for 2024 This week's show is brought to you by Thinkst Canary. Haroon Meer, Thinkst's founder, is this week's sponsor guest. He joins us to talk about APT groups pivoting to living-off-the-land techniques.

This week we're joined by Haroon Meer from Thinkst — the makers of Canary and Canary Tokens. Haroon walks us through a network getting compromised, what it takes to deploy a Canary on your network, how they maintain low false-positive numbers, their thoughts and principles on building their business (major wisdom shared!), and how a Canary helps surface network attacks in real time.

This week we're joined by Haroon Meer from Thinkst — the makers of Canary and Canary Tokens. Haroon walks us through a network getting compromised, what it takes to deploy a Canary on your network, how they maintain low false-positive numbers, their thoughts and principles on building their business (major wisdom shared!), and how a Canary helps surface network attacks in real time.

In this Soap Box edition of the show, Thinkst Canary founder Haroon Meer joins us to talk about why the sudden pullback in venture funding in infosec is actually a good thing. He thinks this will give founders licence to slow down and actually focus on making good products, instead of trying to build a company around vapourware or a minimum viable product.

In this Soap Box edition of the show, Thinkst Canary founder Haroon Meer joins us to talk about why the sudden pullback in venture funding in infosec is actually a good thing. He thinks this will give founders licence to slow down and actually focus on making good products, instead of trying to build a company around vapourware or a minimum viable product.

On this week's show Patrick Gray and Adam Boileau discuss the week's security news, including: North Korea is ransomwaring hospitals with homegrown and Russian strains Russia proposes law greenlighting “patriotic hacks” It's 702 renewal time… again CISA releases ESXiArgs recovery script (yay!) UK mulls crimephone ban Much, much more This week's show is brought to you by Thinkst Canary. Haroon Meer is this week's sponsor guest and joins us to talk about Thinkst's latest release: the credit card canary. Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that's your thing. Show notes North Korean hackers extort health care organizations to fund further cyberattacks, US and South Korea say | CNN Politics Risky Biz News: US and UK sanction seven Trickbot members United States and United Kingdom Sanction Members of Russia-Based Trickbot Cybercrime Gang | U.S. Department of the Treasury Risky Biz News: Russia wants to absolve patriotic hackers from any criminal liability The FBI's Most Controversial Surveillance Tool Is Under Threat | WIRED Meet the Creator of North Korea's Favorite Crypto Privacy Service | WIRED CISA publishes recovery script for ESXiArgs ransomware as Florida courts, universities reel - The Record from Recorded Future News decrypt your crypted files in ESXi servers affected by CVE-2020-3992 / CryptoLocker attack Tonga is the latest Pacific Island nation hit with ransomware - The Record from Recorded Future News UK Proposes Making the Sale and Possession of Encrypted Phones Illegal UK High Court allows Bahraini activists to sue government over spyware - The Record from Recorded Future News Russian cybersecurity expert convicted of charges in $90M hack-to-trade case | CyberScoop Deepfake 'news anchors' appear in pro-China footage on social media, research group says - ABC News Geotargeting tools are allowing phishing campaigns to home in on potential victims - The Record from Recorded Future News This week's Reddit breach shows company's security is (still) woefully inadequate | Ars Technica Namecheap denies system breach after email service used to spread phishing scams - The Record from Recorded Future News Mysterious leak of Booking.com reservation data is being used to scam customers | Ars Technica DOM XSS vulnerability in Gartner Peer Insights widget patched | The Daily Swig Dota 2 Under Attack: How a V8 Bug Was Exploited in the Game - Avast Threat Labs OAuth ‘masterclass' crowned top web hacking technique of 2022 | The Daily Swig New XSS Hunter host Truffle Security faces privacy backlash | The Daily Swig 'No evidence of malicious access,' Toyota says about serious bug exploited by outside researcher - The Record from Recorded Future News A year after outcry, IRS still doesn't offer taxpayers alternative to ID.me | CyberScoop

On this week's show Patrick Gray and Adam Boileau discuss the week's security news, including: North Korea is ransomwaring hospitals with homegrown and Russian strains Russia proposes law greenlighting “patriotic hacks” It's 702 renewal time… again CISA releases ESXiArgs recovery script (yay!) UK mulls crimephone ban Much, much more This week's show is brought to you by Thinkst Canary. Haroon Meer is this week's sponsor guest and joins us to talk about Thinkst's latest release: the credit card canary. Links to everything that we discussed are below and you can follow Patrick or Adam on Mastodon if that's your thing. Show notes North Korean hackers extort health care organizations to fund further cyberattacks, US and South Korea say | CNN Politics Risky Biz News: US and UK sanction seven Trickbot members United States and United Kingdom Sanction Members of Russia-Based Trickbot Cybercrime Gang | U.S. Department of the Treasury Risky Biz News: Russia wants to absolve patriotic hackers from any criminal liability The FBI's Most Controversial Surveillance Tool Is Under Threat | WIRED Meet the Creator of North Korea's Favorite Crypto Privacy Service | WIRED CISA publishes recovery script for ESXiArgs ransomware as Florida courts, universities reel - The Record from Recorded Future News decrypt your crypted files in ESXi servers affected by CVE-2020-3992 / CryptoLocker attack Tonga is the latest Pacific Island nation hit with ransomware - The Record from Recorded Future News UK Proposes Making the Sale and Possession of Encrypted Phones Illegal UK High Court allows Bahraini activists to sue government over spyware - The Record from Recorded Future News Russian cybersecurity expert convicted of charges in $90M hack-to-trade case | CyberScoop Deepfake 'news anchors' appear in pro-China footage on social media, research group says - ABC News Geotargeting tools are allowing phishing campaigns to home in on potential victims - The Record from Recorded Future News This week's Reddit breach shows company's security is (still) woefully inadequate | Ars Technica Namecheap denies system breach after email service used to spread phishing scams - The Record from Recorded Future News Mysterious leak of Booking.com reservation data is being used to scam customers | Ars Technica DOM XSS vulnerability in Gartner Peer Insights widget patched | The Daily Swig Dota 2 Under Attack: How a V8 Bug Was Exploited in the Game - Avast Threat Labs OAuth ‘masterclass' crowned top web hacking technique of 2022 | The Daily Swig New XSS Hunter host Truffle Security faces privacy backlash | The Daily Swig 'No evidence of malicious access,' Toyota says about serious bug exploited by outside researcher - The Record from Recorded Future News A year after outcry, IRS still doesn't offer taxpayers alternative to ID.me | CyberScoop

Haroon Meer of Thinkst joins Dennis Fisher to talk about the state of the security industry, the value of treating customers with respect, and what the economic downturn could mean for the security community. 

In this edition of the Soap Box podcast Patrick Gray talks to Haroon Meer about Thinkst Canary's new sensitive command token. It's a great way to detect intruders on your Windows systems. Haroon also talks about how to use canaries strategically. Show notes Canaries as Network Motion Sensors Sensitive Command Token - So much offense in my defense

In this edition of the Soap Box podcast Patrick Gray talks to Haroon Meer about Thinkst Canary's new sensitive command token. It's a great way to detect intruders on your Windows systems. Haroon also talks about how to use canaries strategically. Show notes Canaries as Network Motion Sensors Sensitive Command Token - So much offense in my defense

On this week's show Patrick Gray and Adam Boileau discuss the week's security news, including: Conti's war against Costa Rica DoJ revises CFAA guidance Naughty kids get access to DEA portal A look at a Russian disinfo tool PyPI and PHP supply chain drama Much, much more This week's show is brought to you by Thinkst Canary. Its founder Haroon Meer will join us in this week's sponsor interview to talk about what might happen to infosec programs now the world economy is getting all funky. Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that's your thing. Show notes President Rodrigo Chaves says Costa Rica is at war with Conti hackers - BBC News Costa Ricans scrambled to pay taxes by hand after cyberattack took down country's collection system Costa Rican president claims collaborators are aiding Conti's ransomware extortion efforts K-12 school districts in New Mexico, Ohio crippled by cyberattacks - The Record by Recorded Future Greenland says health services 'severely limited' after cyberattack - The Record by Recorded Future Notorious cybercrime gang Conti 'shuts down,' but its influence and talent are still out there - The Record by Recorded Future 'Multi-tasking doctor' was mastermind behind 'Thanos' ransomware builder, DOJ says - The Record by Recorded Future Researchers warn of REvil return after January arrests in Russia - The Record by Recorded Future Researcher stops REvil ransomware in its tracks with DLL-hijacking exploit | The Daily Swig Bank refuses to pay ransom to hackers, sends dick pics instead • Graham Cluley GoodWill ransomware forces victims to donate to the poor and provides financial assistance to patients in need - CloudSEK Catalin Cimpanu on Twitter: "Report on a new ransomware strain named GoodWill that forces victims to perform acts of kindness to recover their files https://t.co/T0rhj5wjyC https://t.co/T92KPUJe61" / Twitter Water companies are increasingly uninsurable due to ransomware, industry execs say Department of Justice Announces New Policy for Charging Cases under the Computer Fraud and Abuse Act | OPA | Department of Justice download DEA Investigating Breach of Law Enforcement Data Portal – Krebs on Security Intelligence Update. A question of timing: examining the circumstances surrounding the Nauru Police Force hack and leak FSB's Fronton DDoS tool was actually designed for 'massive' fake info campaigns, researchers say Sonatype PiPI blog post Dvuln Labs - ServiceNSW's Digital Drivers Licence Security appears to be Super Bad New Bluetooth hack can unlock your Tesla—and all kinds of other devices | Ars Technica Researchers devise iPhone malware that runs even when device is turned off | Ars Technica New Research Paper: Pre-hijacking Attacks on Web User Accounts – Microsoft Security Response Center CISA issues directive for exploited VMware bug after IR team deployed to ‘large' org - The Record by Recorded Future Hackers are actively exploiting BIG-IP vulnerability with a 9.8 severity rating | Ars Technica Google, Apple, Microsoft Commit to Eliminating Passwords - Security Boulevard Thinkst Canary

Haroon Meer is the Founder of Thinkst Canary, a fast growing cybersecurity company that enables companies to put “honeypots” on their network to catch attackers in minutes. On today's episode, Jon Sakoda speaks with Haroon Meer about how growing up during the tail end of Apartheid influenced his leadership style and how he bootstrapped Thinkst Canary to success.You Need to Build a Better Mousetrap [9:09 - 12:27] - After spending 10 years in consulting, Haroon was itching to start a product company. Many cybersecurity consultants need to learn how to incorporate highly opinionated customer feedback into their product design. Listen to his philosophy of shifting away from being the “expert” in the room and his humble approach when listening to customers.Find Ideas In Unexpected Places [13:05 - 16:29] - Haroon decided he wanted to build a product and told his colleagues he was shifting away from consulting. When one colleague kept asking for his services, Haroon realized he found a huge problem to solve and founded Thinkst Canary. Listen to learn how tapping into the need of friendly customers can be the inspiration for your next startup idea.Don't Forget Who Pays the Bills [26:26 - 31:59] - When founders start raising VC funding, Haroon thinks it is easy to lose sight of the most important priorities. Some founders lose focus on making customers successful when trying to appease future investors. Listen to learn why bootstrapping your startup might be the best route in the beginning of a company's journey.

Thinkst founder and CEO Haroon Meer joins Ryan Naraine on the show to talk about building a successful cybersecurity company without venture capital investment, fast-moving attack surfaces and the never-ending battle to mitigate memory corruption issues.

(0:27) Running an agency is like leading geese while not knowing where you're going(5:45) Holidays While Remote: Having fun traditional office stuff is hard(9:11) Miscreants' Black Friday merch sales were so high that Sean became a folding master(11:56) The hardest part of having a newsletter is making it(15:05) Krit learned some interesting things from testing their design audit process(19:30) And Miscreants is launching a YouTube channel(23:55) Andrew and Sean might share an Airbnb for RSA(26:43) If Greg's happy, Andrew's happy(29:30) Andrew and Sean and the future of the pod Thanks for listening to Small Efforts, a podcast collaboration between Krit and Miscreants. Shoutout to the Hatch Team and Mary Vuong for producing and editing. Links: Andrew's Twitter: @AndrewAskins Krit: https://www.krit.com/  Miscreants: https://www.miscreants.co/  Sean's Twitter: @seanqsun Hatch Team: https://www.hatch.team/ Krit's InfoSec VC list: https://www.krit.com/infosec-vcs  Krit's Product People Interview with Haroon Meer: https://www.krit.com/blog/sweating-the-small-stuff-with-haroon-meer-founder-of-thinkst-canary  Malcolm Gladwell's book: https://www.amazon.com/Blink-Power-Thinking-Without/dp/0316010669  Mike Monnik's Infosec Black Friday List: https://github.com/0x90n/InfoSec-Black-Friday  For more information about the podcast, check out https://www.smalleffortspod.com/.

This isn't the normal weekly news episode of the show, if you're looking for the regular weekly Risky Business podcast, scroll one back in your podcast feed. This is a Soap Box edition, a wholly sponsored podcast brought to you in this instance by Thinkst Canary. For those who don't know, Thinkst makes hardware and virtual honeypots you can put on your network or into your cloud environments – they'll start chirping if an attacker interacts with them. They're a low cost and extremely effective detection tool. But you might not know that Thinkst also operates canarytokens.org where you can go set up a bunch of honeytokens for free. Hundreds of thousands of people are using canarytokens.org, but Thinkst doesn't charge anything for it, it's free to use. They'll even give you a docker container of the whole thing so you can run it yourself. Our guest today is Thinkst's founder and infosec legend Haroon Meer. He spent a chunk of his career at the South African security consultancy SensePost before founding Thinkst Applied Research and eventually launching Canary.Tools. In this interview we talk about what the industry is getting wrong, supply chain security, effective detections and more. But I started off by asking him why Thinkst hasn't tried to monetise canarytokens.org given how many people use it.

Before he even knew he wanted to be a hacker, Haroon Meer figured out “on a whim” that he could mess with all the high school computers by just changing one single character in a configuration file. With this newly acquired power, Haroon pranked his best friend using a quote from a classic Jean-Claude Van Damme 1980s movie. He also made his clueless computer science teacher really mad. See acast.com/privacy for privacy and opt-out information.

Before he even knew he wanted to be a hacker, Haroon Meer figured out “on a whim” that he could mess with all the high school computers by just changing one single character in a configuration file. With this newly acquired power, Haroon pranked his best friend using a quote from a classic Jean-Claude Van Damme 1980s movie. He also made his clueless computer science teacher really mad. See acast.com/privacy for privacy and opt-out information.

Today's Heavy Networking examines the role of deception and "canaries" in network security. A canary sits on a network segment (or multiple segments) and sounds the alarm if it comes under attack. Is this an effective security tool? How is it deployed and operated? What are the drawbacks? We discuss with guest Haroon Meer.

Today's Heavy Networking examines the role of deception and "canaries" in network security. A canary sits on a network segment (or multiple segments) and sounds the alarm if it comes under attack. Is this an effective security tool? How is it deployed and operated? What are the drawbacks? We discuss with guest Haroon Meer.

Today's Heavy Networking examines the role of deception and "canaries" in network security. A canary sits on a network segment (or multiple segments) and sounds the alarm if it comes under attack. Is this an effective security tool? How is it deployed and operated? What are the drawbacks? We discuss with guest Haroon Meer.

Today's Heavy Networking examines the role of deception and "canaries" in network security. A canary sits on a network segment (or multiple segments) and sounds the alarm if it comes under attack. Is this an effective security tool? How is it deployed and operated? What are the drawbacks? We discuss with guest Haroon Meer. The post Heavy Networking 576: Deception And Canaries In Network Security appeared first on Packet Pushers.

Today's Heavy Networking examines the role of deception and "canaries" in network security. A canary sits on a network segment (or multiple segments) and sounds the alarm if it comes under attack. Is this an effective security tool? How is it deployed and operated? What are the drawbacks? We discuss with guest Haroon Meer. The post Heavy Networking 576: Deception And Canaries In Network Security appeared first on Packet Pushers.

Today's Heavy Networking examines the role of deception and "canaries" in network security. A canary sits on a network segment (or multiple segments) and sounds the alarm if it comes under attack. Is this an effective security tool? How is it deployed and operated? What are the drawbacks? We discuss with guest Haroon Meer. The post Heavy Networking 576: Deception And Canaries In Network Security appeared first on Packet Pushers.

On this week’s show Patrick Gray and Adam Boileau discuss the week’s security news, including: USA floats new sanctions against Russia TikTok, WeChat get stay of execution Dependency confusion is ugh US indicts Lazarus crypto-thieves France ties Sandworm crew to Centreon intrusion MORE This week’s show is brought to you by Thinkst Canary. Thinkst’s founder Haroon Meer is this week’s sponsor guest and he joins us to have a very Haroon-style conversation. We talk about how security controls and detections often fall over when things happen that take place outside of our assumptions: trojaned software updates, attackers hiding in unconventional places like monitors, things like that. That’s a great conversation. Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing. Show notes Biden administration planning to sanction Russia for SolarWinds hacks - The Washington Post SolarWinds hackers targeted NASA, Federal Aviation Administration networks | TechCrunch SolarWinds hackers studied Microsoft source code for authentication and email | Reuters Centreon says only 15 entitites were targeted in recent Russian hacking spree | ZDNet France Ties Russia's Sandworm to a Multiyear Hacking Spree | WIRED Dax-Côte d’Argent hospital in France hit by ransomware attack | The Daily Swig FireEye links 0-day attacks on FTA servers & extortion campaign to FIN11 group | ZDNet China Hijacked an NSA Hacking Tool in 2014—and Used It for Years | WIRED Biden administration pauses Trump's plans to ban WeChat, TikTok - CyberScoop North Korean Hackers Accused Of ‘Biggest Cryptocurrency Theft Of 2020’—Their Heists Are Now Worth $1.75 Billion Feds Indict North Korean Hackers for Years of Heists and Scams | WIRED Dependency confusion attack mounted via PyPi repo exposes flawed package installer behavior | The Daily Swig Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies | by Alex Birsan | Feb, 2021 | Medium Microsoft warns enterprises of new 'dependency confusion' attack technique | ZDNet Microsoft starts removing Flash from Windows devices via new KB4577586 update | ZDNet Flash version distributed in China after EOL is installing adware | ZDNet Mexican Politician Removed Over Alleged Ties to Romanian ATM Skimmer Gang — Krebs on Security (2) The Riviera Maya Gang: Cash, Crime, Killing - YouTube Spike in ATM Skimming in Mexico? — Krebs on Security Proofpoint sues Facebook to get permission to use lookalike domains for phishing tests | ZDNet New malware found on 30,000 Macs has security pros stumped | Ars Technica Apple Is Going to Make It Harder to Hack iPhones With Zero-Click Attacks RIPE NCC discloses failed brute-force attack on its SSO service | ZDNet Lawmakers Demand Answers from Military on Muslim App Data BIND implements DNS-over-HTTPS to offer enhanced privacy | The Daily Swig Parler Says It’s Back | WIRED Security bugs left unpatched in Android app with one billion downloads | ZDNet Yandex said it caught an employee selling access to users' inboxes | ZDNet Prosecutor charges former phone company employee in SIM-swap scheme | Ars Technica Authorities arrest SIM swapping gang that targeted celebrities | ZDNet Data retention laws: Australian police given new metadata recommendations Prosecutors Suspend Government Spyware Used in WhatsApp Phishing Attacks Canary — know when it matters

Haroon Meer, founder of Thinkst, joins Dennis Fisher to talk about why a lot of security products don't work, the challenges of running a security company from South Africa, and doing well by doing good.

On this week’s show Patrick and Adam discuss the week’s security news, including: CISA director Chris Krebs fired Trump ramps up his disinformation campaign TikTok ban stalls BlackBerry discovers new hacker-for-hire crew DNS cache poisoning is back. But do we really care? Much, much more This week’s show is brought to you by Thinkst Canary. Thinkst’s founder Haroon Meer will be along in this week’s show to talk a bit about security product design. Canary has been remarkably restrained over the years. Instead of trying to use their success as a platform to launch a million other products, they’ve spent more time really working on design and usability. He’ll join us to talk through all of that. Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing. Show notes Patrick Gray on Twitter: "The final tweet. I LOVE it that Chris went down swinging. I've gotten to know him a little over the last year and a half, and yeah, he takes his job and mission extremely seriously. The USA has lost a true public servant." / Twitter Exclusive: Top official on U.S. election cybersecurity tells associates he expects to be fired | Reuters Lawmakers back CISA chief Krebs after report that he expects to be fired Trump goes to DEF CON to explain election loss - Risky Business After Trump tweets Defcon hacking video, voting security experts call BS | Ars Technica TikTok gets extensions on US sale order, ban enforcement The untold story of a cyberattack, a hospital and a dying woman | WIRED UK The ransomware landscape is more crowded than you think | ZDNet Video game company Capcom details attack, data breach by ransomware gang Recent ransomware wave targeting Israel linked to Iranian threat actors | ZDNet Australian government warns of possible ransomware attacks on health sector | ZDNet Microsoft says three APTs have targeted seven COVID-19 vaccine makers | ZDNet BlackBerry discovers new hacker-for-hire mercenary group | ZDNet Mac certificate check stokes fears that Apple logs every app you run | Ars Technica Apple lets some Big Sur network traffic bypass firewalls | Ars Technica How the U.S. Military Buys Location Data from Ordinary Apps Muslim Pro Stops Sharing Location Data After Motherboard Investigation The iOS Covid App Ecosystem Has Become a Privacy Minefield | WIRED Australia eyes payment card data for contact tracing - Risky Business Bumble Vulnerabilities Put Facebook Likes, Locations And Pictures Of 95 Million Daters At Risk Twitter hires influential hacker Peiter ‘Mudge’ Zatko as security boss SAD DNS: Researchers pull source code as DNS cache poisoning technique deemed ‘too dangerous’ | The Daily Swig SAD DNS Facebook link preview feature used as a proxy in website-scraping scheme | ZDNet FIN7 recruiter Andrii Kolpakov pleads guilty to role in global hacking scheme Hackers can use just-fixed Intel bugs to install malicious firmware on PCs | Ars Technica Citrix patches RCE flaw in SD-WAN Center that could lead to network takeover | The Daily Swig Google patches two more Chrome zero-days | ZDNet Chrome 87 released with fix for NAT Slipstream attacks, broader FTP deprecation | ZDNet

This is a sponsored podcast. Today we’re chatting with a very special guest, Haroon Meer. Haroon is the founder of Thinkst Canary. Some call it a deception company, but he doesn’t, as you’ll hear. He says Canary is a detection company and the distinction is important. In this interview we talk about where Canary came from and recap the last 20 years of Haroon’s security career. We go all the way back to his Sensepost days in 2001, right through to him working for actual royalty in Doha, with a brief detour through him creating an anonymous whistleblower platform for a major broadcaster. You may have heard of Haroon and not known why. This podcast explains why.

In this feature episode, we chat with the founder of Thinkst, Haroon Meer. We Talk about the origins of deception technology and how his technology is changing the way companies around the world are doing detection.Thinkst Canary Website: https://canary.tools/Thinkst Canary Love: https://canary.tools/loveThinkst: Twitter: https://twitter.com/ThinkstCanaryHaroon's Twitter: https://twitter.com/haroonmeerSponsored by Thinkst

Red team versus blue team. All should become a purple team!! Searching for a way around the rockstar mentality all too common within the infosec industry, as the proposal to build a team of teams is announced. Deception technology mixed with an actual true cost analysis of threat intelligence lending questionable returns. The roller coaster of topics reaches a pinnacle with a reflection on being allocentric within the security industry versus viewing security solely through the lens of industry growth. Topics include: * Charl shares his history, growth, and maturity within the industry. * Red team vs. blue team, and how everyone should be a purple team. * Deception technology, honeypots, forensics, and storytelling with data. * Getting around the rockstar mentality within infosec, and teamwork produces a higher ROI. * Demystifying the value of threat intelligence. Notable Quotes: "Think about what you do as something that matters and approach it in that way and the rest will follow." - Charl van der Walt Special shout outs to: * Haroon Meer (https://linkedin.com/in/haroonmeer) from Thinkst (https://www.thinkst.com) * Roelof Temmingh (https://linkedin.com/in/roeloftemmingh) from Vortimo (https://www.vortimo.com/). Special Guest: Charl van der Walt.

On this week’s show Patrick and Adam discuss the week’s security news, including: Azure resource constraints hit Europe Should we unleash surveillance on COVID-19, privacy be damned? Browser maintainers cease new releases South Korea-linked APT crew attacks World Health Organization Much, much more This week’s show is brought to you by Thinkst Canary. Thinkst’s Haroon Meer joins the show this week to talk about what he tells customers when they ask him if Thinkst could go rogue and own all their customers. You can subscribe to the new Risky Business newsletter, Seriously Risky Business, here. You can subscribe to our new YouTube channel here. Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing. Show notes 'Azure appears to be full': UK punters complain of capacity issues on Microsoft's cloud • The Register Coronavirus response: ITU unveils platform for reinforcing global telecoms infrastructure | The Daily Swig Coronavirus: US emergency funding for federal agencies targets home working security | The Daily Swig Playing the long game on remote access - Risky Business Google pauses Chrome and Chrome OS releases due to coronavirus outbreak | ZDNet Microsoft Pauses New Edge Browser Versions Due to Coronavirus Firefox to remove support for the FTP protocol | ZDNet Microsoft offers mitigations against unpatched Windows font handler security flaw | The Daily Swig Apple security updates - Apple Support Srsly Risky Biz: Tuesday, March 24 - Risky Business How Surveillance Could Save Lives Amid a Public Health Crisis | WIRED US, Israel, South Korea, and China look at intrusive surveillance solutions for tracking COVID-19 | ZDNet The Value and Ethics of Using Phone Data to Monitor Covid-19 | WIRED Exclusive: Elite hackers target WHO as coronavirus cyberattacks spike - Reuters Hackers breach FSB contractor and leak details about IoT hacking project | ZDNet China borrowing Russian tactics to spread coronavirus disinformation WhatsApp Is at the Center of Coronavirus Response | WIRED Hacker selling data of 538 million Weibo users | ZDNet FireEye warns about the proliferation of ready-made ICS hacking tools | ZDNet Monitoring ICS Cyber Operation Tools and Software Exploit Modules To Anticipate Future Threats | FireEye Inc Ransomware Gangs to Stop Attacking Health Orgs During Pandemic Maze ransomware attackers extort vaccine testing facility | SC Media Volunteers and vigilantes back hospital InfoSec - Risky Business With everyone working from home, VPN security is now paramount | ZDNet Zyxel Flaw Powers New Mirai IoT Botnet Strain — Krebs on Security Security Breach Disrupts Fintech Firm Finastra — Krebs on Security Most ransomware attacks take place during the night or over the weekend | ZDNet France warns of new ransomware gang targeting local governments | ZDNet Venture funding in security startups is falling. Don't blame the coronavirus. Here’s the Netflix account compromise Bugcrowd doesn’t want you to know about [Updated] | Ars Technica Bug bounty platforms step up as coronavirus forces businesses to implement work from home policies | The Daily Swig How Microsoft Dismantled the Infamous Necurs Botnet | WIRED Two Trend Micro zero-days exploited in the wild by hackers | ZDNet Google APP users won't be allowed to install apps from outside the Play Store | ZDNet Magecart hackers have spent weeks lurking on NutriBullet's website Site Isolation - The Chromium Projects (37) Cell phone tracking in the crisis - YouTube thinkst Thoughts...: If i run your software, can you hack me? Seriously Risky Business

Could you create a fake cyber security company and rack up industry awards overnight? How about fabricating a founder and scoring them impressive job offers? Haroon Meer did both of these recently for a presentation titled “The Products We Deserve” as an exploration and commentary on the state of the industry. Jack, Dave & Haroon take on snake oil in security during an hour long conversation to determine exactly how someone could create a great company amidst the pressures that threaten to pull one in the wrong direction.The catalyst for Haroon’s presentation and our discussion is his personal experience at Thinkst where he has focused on building a “bottoms-up”, product first company that has grown steadily since its inception without venture capital. His thoughts, from how to deal with industry analysts to “ball pit marketing” at conferences, come from Thinkst’s direct experience aiming to not only grow the company, but grow it in a way that is true to their own values. How Haroon and Thinkst navigate challenges such as having a strong presence for the company at the RSA Conference (sans shenanigans) is an exercise in creative problem solving versus rejecting the experience entirely or simply following the crowd. While it would be easy for an episode such as this to be bleak or even angry, Haroon’s thoughtful approach and optimism give us a portrait of how we might emerge from our awkward adolescence as an industry into a better future.

Haroon Meer is the CEO and Researcher at Thinkst. He is coming on the show to talk about why hackers should create companies, and some of the technical details behind Thinkst' tool Canary! To get started with Canary, visit: https://securityweekly.com/canary Full Show Notes: https://wiki.securityweekly.com/Episode601 Follow us on Twitter: https://www.twitter.com/securityweekly

This week, we welcome Haroon Meer, CEO and Researcher at our sponsor Thinkst, to talk about why hackers should create companies, and some of the technical details behind Thinkts' tool Canary! In the second segment, we welcome Gururaj Pandarangi, CEO and Co-Founder of Cloudneeti, to talk about how their SaaS product is delivering continuous cloud security and compliance assurance to businesses! In the Security News, serious vulnerabilities found in fujifilm x-ray devices, facebook could be fined 5 billion over privacy violations, preinstalled malware on bootleg streaming devices, hackers using SIM swapping to steal cryptocurrency, and how a 29 year old computer scientist created the algorithm that took the first ever picture of a black hole!   To learn more about Thinkst, visit: https://securityweekly.com/canary To learn more about CloudNeeti, visit: https://cloudneeti.com/securityweekly Full Show Notes: https://wiki.securityweekly.com/Episode601 Visit https://www.securityweekly.com/psw for all the latest episodes!   Visit https://securityweekly.com/acm to sign up for a demo or buy our AI Hunter! Follow us on Twitter: https://www.twitter.com/securityweekly Like us on Facebook: https://www.facebook.com/secweekly

This week, we welcome Haroon Meer, CEO and Researcher at our sponsor Thinkst, to talk about why hackers should create companies, and some of the technical details behind Thinkts' tool Canary! In the second segment, we welcome Gururaj Pandarangi, CEO and Co-Founder of Cloudneeti, to talk about how their SaaS product is delivering continuous cloud security and compliance assurance to businesses! In the Security News, serious vulnerabilities found in fujifilm x-ray devices, facebook could be fined 5 billion over privacy violations, preinstalled malware on bootleg streaming devices, hackers using SIM swapping to steal cryptocurrency, and how a 29 year old computer scientist created the algorithm that took the first ever picture of a black hole!   To learn more about Thinkst, visit: https://securityweekly.com/canary To learn more about CloudNeeti, visit: https://cloudneeti.com/securityweekly Full Show Notes: https://wiki.securityweekly.com/Episode601 Visit https://www.securityweekly.com/psw for all the latest episodes!   Visit https://securityweekly.com/acm to sign up for a demo or buy our AI Hunter! Follow us on Twitter: https://www.twitter.com/securityweekly Like us on Facebook: https://www.facebook.com/secweekly

Haroon Meer is the CEO and Researcher at Thinkst. He is coming on the show to talk about why hackers should create companies, and some of the technical details behind Thinkst' tool Canary! To get started with Canary, visit: https://securityweekly.com/canary Full Show Notes: https://wiki.securityweekly.com/Episode601 Follow us on Twitter: https://www.twitter.com/securityweekly

Find the full episode of this podcast (with links and images) on the CISO Series site right here: (https://cisoseries.com/im-humbled-to-tell-you-about-my-prestigious-award/) I'm not exactly sure what "humbling" means, but I'm going to use it to hopefully soften my braggadocio announcement. We discuss semantics and when it's OK to boast your accomplishments on this week's episode of CISO/Security Vendor Relationship Podcast. This show, like all the previous ones is hosted by me, David Spark (@dspark), founder of Spark Media Solutions and Mike Johnson. Our guest this week is Will Lin (@WilliamLin), partner and co-founder, ForgePoint Capital. Thanks to this week's sponsor, Praetorian As a professional services company, Praetorian helps enterprise customers solve complex cybersecurity problems. We are the security experts. On this week's episode How CISOs are digesting the latest security news In many industries we see VC investments following trends. This is hot and new, let's go and invest in it. A recent story on Forbes spotlights five trends in cybersecurity which comes off as catnip for VCs or at least those in those spaces looking for investments. Is trend hopping a lucrative way to succeed with cybersecurity investments? Why is everybody talking about this now? Peter Cohen, director at Countercept remarked on the hypocrisy of posting a photo of yourself on stage and referring to it as "humbling". People say this with zero idea of the definition. The use of humbled or humbling as a verb means that at one time you thought you were superior and now you realize you are not because essentially someone defeated you and put you in your place. I don't get the sense that's what people mean when they refer to an experience as "humbling." But do a search for the term on LinkedIn and you will see people use it ALL THE TIME. Some of the most popular posts on LinkedIn are achievement announcements. Where's the line between saying you're proud of something and would you honor it with me and coming off like a jackass? What's Worse?! We have two scenarios this week in honor of our VC guest. Hey, you're a CISO, what's your take on this? In a special VC edition of "Hey, you're a CISO, what's your take on this?" Much of what we talk about on this show is what we like and don't like about how security companies market themselves. In the news, the only role we hear VCs playing is financial. But given that VCs are seeing the inner workings of a startup, they can probably see firsthand why a company succeeds or fails. Given what VCs are privvy to that others of us are not, how can VCs help shape the way vendors market themselves? Ask a CISO Fernando Montenegro of 451 Research brought to my attention this tweet from Soldier of Fortran that caused a flurry of discussion. The tweet pointed out that many sites say they offer pricing, but when you go to the page it's just a lot of verbiage with a link to request a quote. Haroon Meer of Thinkst, producers of Canary deception devices and a former guest on this show, said they have pricing on their site even when experienced salesmen told them not to do it. Kyle Hanslovan of Huntress Labs, asked how he could provide transparent pricing when half of his clients are direct and the other half are distributors. Is there a happy medium here or is obfuscation the way to succeed with security selling?

Haroon Meer grew up in the tail end of Apartheid South Africa, but his future was far from bleak. After almost two decades in information security (and playing a lot of pool!), Haroon founded Thinkst, a start-up responsible for bringing Canary to the world, a cyber-security honeypot used by some of the biggest tech giants in the world including Slack and Etsy. In this interview we reflect on Haroon’s journey that saw him consulting NATO, sleeping on the Quantico base, and everything in between. What does it take to become an authority in one field? Haroon’s experience draws us closer to answering that question. The Transit Lounge chronicles the journeys of people who’ve had a considerable impact on the Muslim world. In season 1, we hear from successful entrepreneurs, academics, scholars and politicians. Hosted by Mohamad Zaoud, each episode explores the highs and lows of our guests, and tackles the question of our time - what does it take to find balance when living a contemporary Muslim life. Mohamad Zaoud is a brand enthusiast and consults businesses and NGOs on brand & growth strategies. He’s currently the Manager of Digital Growth – EMEA, and formerly Head of Marketing MENA, at Al Jazeera Media Network where he’s worked on flagship brands including Al Jazeera and AJ+.

We're fed up with vendors who think they can detect any breach, but we're not fed up with breach detection. On this week's episode: Are millennials excited or not excited about working in security? Supposedly, nine percent of all millennials are interested in a job of security. Is that good news/bad news/misrepresented news? (Read the story) Haroon Meer's amazingly open story of the money Thinkst spent at RSA 2018. Was it worth it? Great advice for anyone else sponsoring a big tech conference. (Read the story) Are you sponsoring Black Hat or another big tech conference? Pick up my book, Three Feet from Seven Figures: One-on-One Engagement Techniques to Qualify More Leads at Trade Shows. We talk about breach detection and the use of deception devices. When a breach happens, should you or shouldn't you blame the victim? How should security sales managers pump up their team for sales? Is letting people know that they're the only ones to fix their customers' problems the right tactic? This episode is sponsored by Thinkst, makers of Canary deception devices. Read how much their customers love their product here. As always, the show is hosted by me, David Spark (@dspark), founder, Spark Media Solutions and Mike Johnson, CISO, Lyft. Our guest this week is Haroon Meer (@haroonmeer), founder and researcher of Thinkst. We Want Your Input and Critiques For every episode we want input from listeners! Please contact me here or on LinkedIn and send me the following: “Ask a CISO” question. A vendor pitch you want us to critique. A hot security discussion (please provide a link). A quick security tip. A big industry story and what it means to security professionals. In all cases, we can or can’t mention you and your company name or keep you anonymous. Just let me know what you want. Listen and Subscribe to the CISO/Security Vendor Relationship Podcast So many ways to connect and listen to the podcast. iTunes Google Play Stitcher RSS Feed Sponsor the Podcast If your company would like to sponsor this podcast, please contact David Spark at Spark Media Solutions.

Key Points From This Episode:Learn more about phishing for awareness and what this entails.How Joe helps companies set up phishing engagements against their employees.Incident response and why phishing attempts are never going to be 100% effective.Assuring those who have been phished that their credentials aren’t necessarily useable.The difference between pen testing and red teaming in light of Haroon Meer’s work.Why less black box pen testing and more white box red teaming could be the way.How are organizations measuring both potential vulnerabilities and risk taking.Compliance versus privacy versus security: Why GDPR is winter and winter is coming.Learn more about national and international regulations for cyber security response.Find out more about the threats out there today (like IOT) that are terrifying Joe.Seriously, why would you need a Bluetooth controlled water heater in your home?Hear more about the $29 Amazon home router that Joe easily attacked.Why we need to go back to protecting people before protecting business.Joe gives a few simple steps toward better cyber security in the home.Learn more about using deceptive technologies and disinformation to secure yourself.Disinformation, trolls and bots and their influence on the on the US election.A current update on various state approaches to cyber security laws and bills.The positive movements that Joe is seeing in the field of cyber security today.And much more!

Thinkst founder Haroon Meer talks about building a security company from scratch without VC funding, using Canaries to pinpoint signs of intruder activity, advancements in security research, and the state of the bug bounty market.

For episode 275 we are once again joined by the one and only Haroon Meer ( @haroonmeer ) to follow up on his conversation from September 2016 titled "What will get us there". If you've not had a chance to listen to that show, you absolutely should do that first. Haroon shares his perspective including... "The cloud has won" Fundamentals are still hard, we're still largely failing at them Hackers make the best engineers when you give them a problem to solve Where do we go from here, into 2018, is there hope?

Haroon Meer joins us this week to talk about his journey from running South African flea market booths to founding one of the most innovative companies in information security. We discuss the differences between South African and US education, common pitfalls made by security product vendors, and the use of honeypots for detection. You can find Haroon on Twitter at @haroonmeer. Haroon chose to support hurricane relief efforts for Puerto Rico via the United for Puerto Rico charity.

JOHANNESBURG — For years, South African Haroon Me…

Founder of Thinkst, Haroon Meer talks with Kim Carter about network security. Topics include how attackers are gaining footholds into our networks, moving laterally, infilling malware and exfilling our precious data; why we care; and clear advice on what we software engineers can do about it. Areas of information security are merging, network security is […]

Founder of Thinkst, Haroon Meer talks with Kim Carter about Network Security. Topics include how attackers are gaining footholds into our networks, moving laterally, and exfilling our precious data, as well as why we care and what software engineers can do about it.

After leaving Sensepost, Haroon Meer set up Thinkst, an INFOSec research and consultancy organisation. To quote from the Thinkst site: Thinkst was founded to respond to the simple (but often repeated ) call in infosec today: We are not winning ...

How far can automation be taken? How much intelligence can be embodied in code? How generic can automated IT security assessment tools really be? This presentation will attempt to show which areas of attacks lend themselves to automation and which aspects should best be left for manual human inspection and analyses. SensePost will provide the audience a glimpse of BiDiBLAH - an attempt to automate a focussed yet comprehensive assessment. The tool provides automation for: * Finding networks and targets * Fingerprinting targets * Discovering known vulnerabilities on the targets * Exploiting the vulnerabilities found * Reporting Roelof Temmingh is the Technical Director of SensePost where his primary function is that of external penetration specialist. Roelof is internationally recognized for his skills in the assessment of web servers. He has written various pieces of PERL code as proof of concept for known vulnerabilities, and coded the world-first anti-IDS web proxy "Pudding". He has spoken at many International Conferences and in the past year alone has been a keynote speaker at SummerCon (Holland) and a speaker at The Black Hat Briefings. Roelof drinks tea and smokes Camels. Haroon Meer is currently SensePost's Director of Development (and coffee drinking). He specializes in the research and development of new tools and techniques for network penetration and has released several tools, utilities and white-papers to the security community. He has been a guest speaker at many Security forums including the Black Hat Briefings. Haroon doesnt drink tea or smoke camels. Charl van der Walt is a founder member of SensePost. He studied Computer Science at UNISA, Mathematics at the University of Heidelberg in Germany and has a Diploma in Information Security from the Rand Afrikaans University. He is an accredited BS7799 Lead Auditor with the British Institute of Standards in London. Charl has a number of years experience in Information Security and has been involved in a number of prestigious security projects in Africa, Asia and Europe. He is a regular speaker at seminars and conferences nationwide and is regularly published on internationally recognized forums like SecurityFocus. Charl has a dog called Fish.

How far can automation be taken? How much intelligence can be embodied in code? How generic can automated IT security assessment tools really be? This presentation will attempt to show which areas of attacks lend themselves to automation and which aspects should best be left for manual human inspection and analyses. SensePost will provide the audience a glimpse of BiDiBLAH - an attempt to automate a focussed yet comprehensive assessment. The tool provides automation for: * Finding networks and targets * Fingerprinting targets * Discovering known vulnerabilities on the targets * Exploiting the vulnerabilities found * Reporting Roelof Temmingh is the Technical Director of SensePost where his primary function is that of external penetration specialist. Roelof is internationally recognized for his skills in the assessment of web servers. He has written various pieces of PERL code as proof of concept for known vulnerabilities, and coded the world-first anti-IDS web proxy "Pudding". He has spoken at many International Conferences and in the past year alone has been a keynote speaker at SummerCon (Holland) and a speaker at The Black Hat Briefings. Roelof drinks tea and smokes Camels. Haroon Meer is currently SensePost's Director of Development (and coffee drinking). He specializes in the research and development of new tools and techniques for network penetration and has released several tools, utilities and white-papers to the security community. He has been a guest speaker at many Security forums including the Black Hat Briefings. Haroon doesnt drink tea or smoke camels. Charl van der Walt is a founder member of SensePost. He studied Computer Science at UNISA, Mathematics at the University of Heidelberg in Germany and has a Diploma in Information Security from the Rand Afrikaans University. He is an accredited BS7799 Lead Auditor with the British Institute of Standards in London. Charl has a number of years experience in Information Security and has been involved in a number of prestigious security projects in Africa, Asia and Europe. He is a regular speaker at seminars and conferences nationwide and is regularly published on internationally recognized forums like SecurityFocus. Charl has a dog called Fish.

It's all about the timing... Timing attacks have been exploited in the wild for ages, with the famous TENEX memory paging timing attack dating back to January of 1972. In recent times timing attacks have largely been relegated to use only by cryptographers and cryptanalysts. In this presentation SensePost analysts will show that timing attacks are still very much alive and kicking on the Internet and fairly prevalent in web applications (if only we were looking for them). The talk will cover SensePost-aTime (our new SQL Injection tool that operates purely on timing differences to extract data from injectable sites behind draconian firewall rulesets), our new generic (timing aware) web brute-forcer and lots of new twists on old favorites. If you are doing testing today, and are not thinking a lot about timing, chances are you are missing attack vectors right beneath your stop-watch!

It's all about the timing... Timing attacks have been exploited in the wild for ages, with the famous TENEX memory paging timing attack dating back to January of 1972. In recent times timing attacks have largely been relegated to use only by cryptographers and cryptanalysts. In this presentation SensePost analysts will show that timing attacks are still very much alive and kicking on the Internet and fairly prevalent in web applications (if only we were looking for them). The talk will cover SensePost-aTime (our new SQL Injection tool that operates purely on timing differences to extract data from injectable sites behind draconian firewall rulesets), our new generic (timing aware) web brute-forcer and lots of new twists on old favorites. If you are doing testing today, and are not thinking a lot about timing, chances are you are missing attack vectors right beneath your stop-watch!