Podcasts about pen test partners

For Episode 34, we were joined by Warren Houghton for an in-depth discussion on how vulnerabilities in technology affect us all... whether it's your office, hotel or at home. Warren specializes in covert physical entry and exploiting technology controls, and is an expert in hardware hacking at Pen Test Partners - https://www.pentestpartners.com/ Warren gives some practical advice on how we can all protect ourselves from hacking and social engineering.

Part one of the process of figuring out the mystery of MH370 is finding explanations for the previously inexplicable things that happened. Part two is trying to verify whether those explanations hold water.In Episode 10, Andy and Jeff talked about a theory that MH370's specific vulnerabilities could've led to a hacking that not only allowed hijackers to take the plane north, but how it would've helped them cover their tracks.In Episode 22, they revisit this topic with a renowned ethical "white hat" hacker, Ken Munro of the Pen Test Partners in the UK. He talks about whether this Boeing 777 could've been hacked – and if he thinks it really was.Also, Andy shares his theory on what happened to MH370, an opinion accumulated after six months working on the Deep Dive podcast.Thanks to our Episode 22 sponsor, Finnished MKE. More information here: https://www.instagram.com/finnished_mke/Join this channel to get access to perks:https://www.youtube.com/channel/UCUXIrQ2rO5B_z-AEpjmKaAw/joinEven more information at our show page: https://www.deepdivemh370.com/p/22-the-hacking-of-mh370

Podcast: (CS)²AI Podcast Show: Control System Cyber SecurityEpisode: 106: Top Gun Meets the Cloud: Ken's Guide to Keeping Your Airplanes (and Data) SafePub date: 2024-02-01We are delighted to have Ken Munro joining us from the UK today! Ken is a Partner and Co-founder of Pen Test Partners. He is a seasoned technologist, the founder of multiple ventures, a pilot, a skier, and a dynamic and adventurous contributor to our community. Ken brings a wealth of experience and expertise that promises to enrich our understanding of the evolving landscape in cybersecurity. In today's discussion, we dive into his remarkable career journey and explore his perspective on OT and ICS-related cybersecurity.Join us for this informative session with Ken as he shares his valuable perspectives.Show Highlights:Ken discusses his cybersecurity industry journeyHow Ken's past Air Force experience relates to his current work in cybersecurityThe benefits of telling a story when communicating complex conceptsKen shares a story to highlight the importance of safety and security within the aviation industryKen talks about the unique systems on board planes and their vulnerabilitiesHow the isolated protocols used in older aircraft systems are more robust and stable than the modern systemsHow even simple display systems can cause airport outagesKen shares his concerns about cybersecurity risks within cloud management platforms for industrial control systemsHow including contractual language for liability in procurement contracts can protect organizations against cybersecurity risksKen shares his thoughts on the future of the cybersecurity industryLinks and resources:(CS)²AI Derek Harp on LinkedInKen Munro on LinkedInPen TestPartnersThe podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Podcast: (CS)²AI Podcast Show: Control System Cyber SecurityEpisode: 106: Top Gun Meets the Cloud: Ken's Guide to Keeping Your Airplanes (and Data) SafePub date: 2024-02-01We are delighted to have Ken Munro joining us from the UK today! Ken is a Partner and Co-founder of Pen Test Partners. He is a seasoned technologist, the founder of multiple ventures, a pilot, a skier, and a dynamic and adventurous contributor to our community. Ken brings a wealth of experience and expertise that promises to enrich our understanding of the evolving landscape in cybersecurity. In today's discussion, we dive into his remarkable career journey and explore his perspective on OT and ICS-related cybersecurity.Join us for this informative session with Ken as he shares his valuable perspectives.Show Highlights:Ken discusses his cybersecurity industry journeyHow Ken's past Air Force experience relates to his current work in cybersecurityThe benefits of telling a story when communicating complex conceptsKen shares a story to highlight the importance of safety and security within the aviation industryKen talks about the unique systems on board planes and their vulnerabilitiesHow the isolated protocols used in older aircraft systems are more robust and stable than the modern systemsHow even simple display systems can cause airport outagesKen shares his concerns about cybersecurity risks within cloud management platforms for industrial control systemsHow including contractual language for liability in procurement contracts can protect organizations against cybersecurity risksKen shares his thoughts on the future of the cybersecurity industryLinks and resources:(CS)²AI Derek Harp on LinkedInKen Munro on LinkedInPen TestPartnersThe podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

We are delighted to have Ken Munro joining us from the UK today! Ken is a Partner and Co-founder of Pen Test Partners. He is a seasoned technologist, the founder of multiple ventures, a pilot, a skier, and a dynamic and adventurous contributor to our community. Ken brings a wealth of experience and expertise that promises to enrich our understanding of the evolving landscape in cybersecurity. In today's discussion, we dive into his remarkable career journey and explore his perspective on OT and ICS-related cybersecurity.Join us for this informative session with Ken as he shares his valuable perspectives.Show Highlights:Ken discusses his cybersecurity industry journeyHow Ken's past Air Force experience relates to his current work in cybersecurityThe benefits of telling a story when communicating complex conceptsKen shares a story to highlight the importance of safety and security within the aviation industryKen talks about the unique systems on board planes and their vulnerabilitiesHow the isolated protocols used in older aircraft systems are more robust and stable than the modern systemsHow even simple display systems can cause airport outagesKen shares his concerns about cybersecurity risks within cloud management platforms for industrial control systemsHow including contractual language for liability in procurement contracts can protect organizations against cybersecurity risksKen shares his thoughts on the future of the cybersecurity industryLinks and resources:(CS)²AI Derek Harp on LinkedInKen Munro on LinkedInPen TestPartners

We're taking a trip to the movies this episode.

AI news is bad news, an online service to catch your cheating partner, and an IoT-enabled dick cage fails to keep a grip on its own security.All this and much much more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault, joined this week by Mark Stockley.Plus don't miss our featured interview with Alex Lawrence, principal security architect at Sysdig.Warning: This podcast may contain nuts, adult themes, and rude language. May? Who are we kidding...Episode links:199: A few tech cock-ups, and one cock lock-up - Smashing Security.Smart male chastity lock cock-up - Pen Test Partners.“My sexual urges are so out of control I'm considering buying a chastity cage” - Dear Deidre, The Sun.Maker of ‘smart' chastity cage left users' emails, passwords, and locations exposed - TechCrunch.Dispatch pauses AI sports writing program - Axios.Would Your Partner Cheat? These ‘Testers' Will Give You an Answer - The New York Times.Loyalty Test.Nitpick: Why don't induction hobs have knobs?Longevity… simplified - book by Dr Howard J Luks.Oxford Art Society Open Exhibition 2023.Carole Theriault art website.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)Sponsored by:Kolide – Kolide ensures that if your device isn't secure it can't access your cloud apps. It's Device Trust for Okta. Watch the demo today!Sysdig – Is your cloud secure? Not without runtime insights! Sysdig delivers the industry's ONLY complete, consolidated Cloud-Native Application Protection Platform (CNAPP) – powered by runtime insights – to prioritize critical risks and stay ahead of unknown threats. Learn how runtime insights reduces fatigue so developers can focus on delivering software and your security teams can focus on other demands.ClearVPN – Hide your IP address, browse without geo-restrictions, and stay private online with a 30 day free trial of its premium plan.SUPPORT THE SHOW:Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or

Podcast: (CS)²AI Podcast Show: Control System Cyber SecurityEpisode: 87: Cyber Security for Transportation, Part 3 : RailsPub date: 2023-07-04Today, we are excited to share a riveting panel discussion on cybersecurity for Rails! We are honored to introduce our esteemed panelists, three remarkable individuals with a wealth of knowledge and expertise. Their diverse backgrounds and extensive experience in their respective domains make them invaluable contributors to today's discussion.Miki Shifman holds the esteemed positions of CTO and Co-founder of Cylus, a company wholly dedicated to cybersecurity. With an impressive career spanning over 15 years, his expertise encompasses cybersecurity research and development, as well as communications and embedded systems. For the past six years, he has been at the helm of Cylus, focusing on rail cybersecurity and actively participating as a member of global standardization groups, advocating for awareness and best practices. Recognized as part of Forbes 30 under 30, Miki also enjoys indulging in the strategic game of chess.Omar Sherin is a partner at EY. He leads the OT cybersecurity efforts for the MENA region. With an impressive 20-year track record in cybersecurity and a wealth of practical knowledge, his expertise extends to national security and the establishment of resilient infrastructures, including those within the rail systems. Jo Dalton is a seasoned cybersecurity professional with 17 years of comprehensive industry experience. Her versatile background encompasses various facets of the field, from business compliance to operational components, along with the groundbreaking research conducted at Pen Test Partners. Today's enlightening panel discussion will provide a comprehensive view of the transportation industry, focusing on the scenarios within the rail sector. Stay tuned for a thought-provoking exploration that will give you a broader perspective on railway transportation security.Show highlights:How the connected world has changed things.The complexity of the rail industry.Why do we need more detailed standards?Global regulations for critical infrastructure.How old is the technology in rail?Challenges to be faced in the next three years.The typical life cycle of a rail safety system.The importance of having multiple companies working together.Cyber resilience in the rail industry.The need for industry-driven regulation of security.Links and resources:(CS)²AI Derek Harp on LinkedInOmar Sherin on LinkedInErnst & Young (EY)Jo Dalton on LinkedInPen Test PartnersMiki Shifman on LinkedInCylusThe podcast and artwork embedded on this page are from Derek Harp, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Today, we are excited to share a riveting panel discussion on cybersecurity for Rails! We are honored to introduce our esteemed panelists, three remarkable individuals with a wealth of knowledge and expertise. Their diverse backgrounds and extensive experience in their respective domains make them invaluable contributors to today's discussion.Miki Shifman holds the esteemed positions of CTO and Co-founder of Cylus, a company wholly dedicated to cybersecurity. With an impressive career spanning over 15 years, his expertise encompasses cybersecurity research and development, as well as communications and embedded systems. For the past six years, he has been at the helm of Cylus, focusing on rail cybersecurity and actively participating as a member of global standardization groups, advocating for awareness and best practices. Recognized as part of Forbes 30 under 30, Miki also enjoys indulging in the strategic game of chess.Omar Sherin is a partner at EY. He leads the OT cybersecurity efforts for the MENA region. With an impressive 20-year track record in cybersecurity and a wealth of practical knowledge, his expertise extends to national security and the establishment of resilient infrastructures, including those within the rail systems. Jo Dalton is a seasoned cybersecurity professional with 17 years of comprehensive industry experience. Her versatile background encompasses various facets of the field, from business compliance to operational components, along with the groundbreaking research conducted at Pen Test Partners. Today's enlightening panel discussion will provide a comprehensive view of the transportation industry, focusing on the scenarios within the rail sector. Stay tuned for a thought-provoking exploration that will give you a broader perspective on railway transportation security.Show highlights:How the connected world has changed things.The complexity of the rail industry.Why do we need more detailed standards?Global regulations for critical infrastructure.How old is the technology in rail?Challenges to be faced in the next three years.The typical life cycle of a rail safety system.The importance of having multiple companies working together.Cyber resilience in the rail industry.The need for industry-driven regulation of security.Links and resources:(CS)²AI Derek Harp on LinkedInOmar Sherin on LinkedInErnst & Young (EY)Jo Dalton on LinkedInPen Test PartnersMiki Shifman on LinkedInCylus

GuestsSteve Luczynski, Senior Manager / Critical Infrastructure Security, Accenture Federal Services [@Accenture] and Chairman of the Board for the Aerospace Village [@secureaerospace]On LinkedIn | https://www.linkedin.com/in/steveluczynski/On Twitter | https://twitter.com/cyberpilot22Henry Danielson, Adjunct Professor/Lecturer, Cal Poly College of Liberal Arts [@CalPolyCLA], Technical Advisor, California Polytechnic State University California Cybersecurity Institute [@CalPolyCCI], and Volunteer at Aerospace Village [@secureaerospace]On LinkedIn | https://www.linkedin.com/in/henry-danielson-43a61213/On Twitter | https://twitter.com/hdanielsonAt Cal Poly | https://cci.calpoly.edu/about-cci/staff____________________________Hosts:Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martinMarco Ciappelli, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining Society PodcastOn ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/marco-ciappelli____________________________This Episode's SponsorsBlackCloak | https://itspm.ag/itspbcweb____________________________Episode Notes"Discover the exciting world of the Aerospace Village at RSA Conference 2023, and dive into hands-on experiences with cybersecurity experts and cutting-edge technology." Welcome to ITSPmagazine's RSA Conference 2023 coverage, where we dive into the world of cybersecurity and engage with experts in a week full of fun and exciting activities. We're on the road to RSA Conference 2023 in San Francisco, and one event we can't miss is the Sandbox, specifically the Aerospace Village. In this podcast episode, we're joined by our good friends Steve Luczynski and Henry Danielson from the Aerospace Village to discuss what's in store for us at this year's conference.The Aerospace Village is a small nonprofit run by volunteers from around the world, aiming to build relationships between government, industry, security researchers, and hackers, inspire people to join the cybersecurity workforce, and promote awareness in the aviation and space sectors. This year, RSA Conference 2023 features a Sandbox where attendees can interact with the latest technical hands-on experiences, learn from experts, and explore what's happening in the cybersecurity world.In this episode, our guests discuss the various partners and activities in the Aerospace Village, such as CT Cubed's drone quadcopter simulation in AR and VR experience, IntelleGenesis's runway lighting scenario demonstration, and Boeing's continuous security level maintenance activity. You'll also get a chance to try out a real Airbus simulator, courtesy of pen test partners, to understand the potential vulnerabilities in electronic flight bags and their impact on pilot operations.Join us for an exciting, fun-filled week at RSA Conference 2023, where you can learn, network, and discover the latest trends in cybersecurity. Don't miss out on this unique opportunity to interact with experts, explore cutting-edge technologies, and immerse yourself in the world of aerospace cybersecurity. Be sure to listen, share, and subscribe to ITSPmagazine's podcast for more exciting episodes and insights from the RSA Conference 2023!____________________________ResourcesLearn more, explore the agenda, and register for RSA Conference: https://itspm.ag/rsa-cordbw____________________________Catch the video here: https://www.youtube.com/watch?v=Htvn7AkCJSsFor more RSAC Conference Coverage podcast and video episodes visit: https://www.itspmagazine.com/rsa-conference-usa-2023-rsac-san-francisco-usa-cybersecurity-event-coverageAre you interested in telling your story in connection with RSA Conference by sponsoring our coverage?

In our latest Electronic Specifier Insights podcast, we spoke to Ken Munro, Security writer & speaker, CVE board member at Pen Test Partners about the Counter hacking - the ethics of cyber security.

The News: Peloton's leaky API, which exposed private user data, was in the news alongside some other not-so-great news for the fitness brand this last week. The leaky API was first reported by Tech Crunch's Zach Whittaker, and you can read his story here. Analyst Take: It has most definitely not been a great few weeks for Peloton. With the recall of all Peloton Tread and Tread+ treadmills after the death of a child and some 70+ injuries after the brand first tried to shake off the concerns of the CPSC, and then later admitting it was wrong, Peloton was already in the spotlight. Adding to the Tread disaster is the that the Peloton API is leaking private customer data and it made a bad period for the brand reputation overall. Regarding concerns about the Peloton API, this is an important user data privacy issue. Peloton has a community of some 3 million plus members. When setting themselves up in the Peloton system, members can choose to keep their profiles private or make them public, so that their friends can see their stats, workouts, etc. User profiles also include things like height, weight, age, gender, you know …. personal details. Many users, myself included, prefer to have a private profile. That means you still enter in that information, but you keep your settings private, not public. Easy, right? Except when it doesn't work. The Peloton API vulnerability was disclosed by Jim Masters, a researcher at Pen Test Partners, a security consulting company and the bug allowed anyone to pull users' private information directly from Peloton's servers, even if a profile is set to private. Pen Test reported that the Peloton APIs required no authentication and that the information was simply available for anyone who went looking. This information included things I. mentioned earlier: User IDs, Instructor IDs, Group Membership, Workout Stats, Gender and Age, Height, Weight, and city where the user is located. Pen Test Partners published an article last week stating that they reported the issue to Peloton in January and provided a 90-day deadline to fix the bug. Pretty common operating procedure. Masters got a confirmation from the company that the notice was received. Two weeks later, Pen Test noticed that Peloton executed what they observed was a partial fix and said nothing about it. This partial fix meant fixing the API so that the data was no longer available to anyone, but instead only to anyone with a Peloton account. What? Pen Test Partners tried hard to connect with Peloton about this and were soundly ignored. It was only when Zach Whittaker, writing about the leak for Tech Crunch asked about it that the company decided it was probably a good idea to do something. Jim Masters published a blog post on this issue that he updated on May 5th following a conversation with Peloton's new CISO who advised the vulnerabilities were mostly fixed within seven days. My colleague Fred McClimans and I covered the leaky Peloton API as part of our Cybersecurity Shorts series of the Futurum Tech Webcast. There's more to the conversation, so check it out.

Lindsey O'Donnell-Welch talks to Ken Munro with Pen Test Partners about the biggest challenges around securing Internet of Things devices, and how regulatory efforts and consumer awareness are beginning to have a positive impact on the IoT security landscape.

April 2021  Bletchley Park’s latest temporary exhibition is called ‘Never Alone’ and asks ‘what happens when everything is connected?’ Based on an exhibition developed and designed by the National Science and Media Museum, ‘Never Alone’ explores the popularity and power of smart devices. There are now more devices connected to the internet than people on the planet. ‘Smart’ gadgets are becoming part of our lives, making us safer, bringing people together and making everyday tasks easier. In the exhibition, we explore the issues behind these gadgets. We discover some wartime objects and stories that show how concerns about privacy and surveillance aren’t unique to the internet age. You are invited to think about the decisions you make when you click ‘OK’, and to consider what being connected means to you. In this episode we meet two people who have loaned us objects for display, ethical hacker Ken Munro of Pen Test Partners and local museum professional Amy Doolan. We start by taking a tour of the exhibition in Hut 12. Image: ©Bletchley Park Trust 2021 #BPark, #Bletchleypark, #WW2,

Ken Munro is a penetration tester, security writer, speaker, and partner at Pen Test Partners. In this episode of Cybercrime Radio, he joins host Hillarie McClure to discuss shipping vessel cybersecurity, IoT vulnerabilities, and more. To learn more about Pen Test Partners, you can visit them at https://pentestpartners.com • For more on cybersecurity, visit us at https://cybersecurityventures.com/

On this episode of the Connected Aircraft Podcast, Ken Munro, founder of U.K.-based ethical hacking consulting and security services firm Pen Test Partners joins to discuss some of the latest research he’s been doing around connected electronic flight bags (EFB) and aircraft systems. Munro is a well known public speaker who has performed live demonstrations of vulnerabilities that have been exposed on Internet of Things (IoT) devices and systems. He is a security entrepreneur and industry maverick that has worked in infosec for over 15 years. He is a regular speaker at events held by industry bodies and associations and has spoken at the ISSA Dragon’s Den, (ISC)2 Chapter events and CREST (Council of Registered Ethical Security Testers) events, where he sits on the board, helping to establish standards in both member organizations and among individual penetration testers. We discuss some of the potential consequences of the manipulation of data used by pilots by a malicious hacker – and just how important the testing and assessment of EFB security is. Have suggestions or topics we should focus on in the next episode? Email the host, Woodrow Bellamy at wbellamy@accessintel.com, or drop him a line on Twitter @WbellamyIIIAC. Check out our publication Avionics International @AvionicsGlobal + www.aviationtoday.com. Join our Avionics International LinkedIn group to suggest topics we should cover in our podcast, publications and events. www.linkedin.com/AvionicsMag Register for our free upcoming Connected Aviation Intelligence webcast, Thursday, April 29th: https://www.gcasummit.com/aviation-intelligence/  

Ken Munro Security specialist and Partner at Pen Test Partners joined Sean on the show.

How many smart devices do you own? And how many of them do you actually need? This week we discuss how safe these IoT devices really are, and all the challenges that come with penetration testing with Ken Munro from Pen Test Partners. Join us as we uncover a whole host of potential vulnerabilities, from the hilarious to the downright terrifying.We also dive into all the latest news in WatchTower Weekly and offer up some 1Password tips in our #Ask1Password segment.WatchTower WeeklyGovernments around the world are increasingly using location data to manage the coronavirusApple Safari now blocks all third-party cookies by defaultZoom is a work-from-home privacy disasterZoom isn’t actually end-to-end encryptedZoom is leaking some user informationZoom macOS installs without your permissionSwearing Doll: My Friend CaylaFollow Ken Munro @TheKenMunroShowFollow Pen Test Partners @PenTestPartnersVisit pentestpartners.comSome Good News with John Krasinski#Ask1PasswordAsk us anything! Please use the #Ask1Password hashtag or send us an email at media@1password.com.Real or Not Real?A man once ate an entire airplane. Read more here.Follow Us…Visit 1password.comCheck out our blogTweet us @1PasswordFind us on Facebook or InstagramPlease get in touch using #Ask1Password and let us know what you think of the show, you can also leave us a review on iTunes or wherever you listen to podcasts.

Welcome to episode 76 of The Bitcoin Game, sponsored by eToro. I'm Rob Mitchell. Today's interview is with Andrew Tierney, otherwise known online as Cybergibbons. Andrew hacks everything from oil rigs at his day job, to Cryptocurrency hardware wallets and smart locks in his free time. We conducted this interview a bit before COVID-19 had taken over the planet, back in the good old days (a few weeks ago), when we were more worried about malware than going to the grocery store without an N95 mask. Andrew and I discuss hacking hardware wallets, general security, IoT devices, home routers, his day job as a hacker for hire, and other stuff too. I hope you enjoy! EPISODE LINKS Andrew's Twitter https://twitter.com/cybergibbons Andrew's Blog https://cybergibbons.com Pen Test Partners https://www.pentestpartners.com Bitfi Hardware Wallet Hack Article https://techcrunch.com/2018/08/30/john-mcafees-unhackable-bitfi-wallet-got-hacked-again Abe Snowman https://twitter.com/AbeSnowman Oversoft https://twitter.com/oversoftnl Saleem https://twitter.com/saleemrash1d Shadow Ops https://twitter.com/Shadow0pz Trezor https://trezor.io Ledger https://www.ledger.com BC Vault https://bc-vault.com/shop/bc-vault Multisig https://en.bitcoin.it/wiki/Multisignature Shamir's Secret Sharing https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing Secure Element (blog post) https://www.intrinsic-id.com/pros-cons-secure-elements Pen Test https://en.wikipedia.org/wiki/Penetration_test Caravan Multisig (Unchained Capital) https://unchained-capital.com/blog/the-caravan-arrives Rubber Ducky https://latesthackingnews.com/2017/06/16/20456 OpenWrt https://openwrt.org Tomato https://advancedtomato.com Ubiquiti Routers https://www.ui.com/products/#edgemax THE BITCOIN GAME IS SPONSORED BY ETORO Are you interested in getting into the cryptocurrency markets but don't know where to start building your portfolio? eToro has the answer for you. It's called CopyTrader. With CopyTrader, you can automatically copy every trade of eToro's top crypto traders at the exact price in real time. No need to study up on markets or develop your own strategies. Simply sign up and copy the trader of your choice. Any profits they make, you do too (proportional to your investment). With eToro, you get access to the world's most popular cryptocurrencies, with transparent trading fees, all in one easy-to-use app. Join now at b.tc/etorogame. While much of a Bitcoiner's time is spent in the world of digital assets, sometimes it's nice to own a physical representation of the virtual things you care about. For just the price of a cup of coffee or two (at Starbucks), you can own the world-famous Bitcoin Keychain. As Seen On The Guardian • TechCrunch • Engadget • Ars Technica • Popular Mechanics Infowars • Maxim • Inc. • Vice • RT • Bitcoin Magazine • VentureBeat PRI • CoinDesk • Washington Post • Forbes • Fast Company Bitcoin Keychains - BTCKeychain.com CREDITS All music in this episode was created by me, or is from a jam with me, Mike Coleman and Steve Lunn. The Bitcoin Game box art was created from an illustration by Rock Barcellos. Lightning Network tips: https://tippin.me/@TheBTCGame Bitcoin tipping address: 3AYvXZseExRn3Dum8z9tFUk9jtQK6KMU4g Note: We migrated our RSS feed (and primary content host) to Libsyn; SoundCloud is just a legacy feed.

In this episode, we look at the need to secure the internet of things, physical workspaces, and the products companies make. From planes to children’s toys to oil rigs, more connected devices are vulnerable to attack than ever before. Ken Munro is an internet-of things security researcher, penetration tester, and writer with two decades of experience in the security industry. He is also the founder of security services company Pen Test Partners. Munro helps expose the vulnerabilities in items we use every day, and he discusses some of the most important skills that cybersecurity experts can have, why companies are at risk for physical security breaches, and something he calls “supersystemic flaws.”  Business Lab is hosted by Laurel Ruma, director of Insights, the custom publishing division of MIT Technology Review. The show is a production of MIT Technology Review, with production help from Collective Next. Music is by Merlean, from Epidemic Sound. Ken Munro, on Twitter Ken Munro, Pen Test Partners “Kids Tracker Watches: CloudPets, exploiting athletes and hijacking reality TV,” Pen Test Partners Security Blog “Think you’ve had a breach? Top 5 things to do,” Pen Test Partners Security Blog  “Internet of Things Security,” a TEDx presentation by Ken Munro

If you think your maritime satellite terminal is safe from hackers, give Ken Munro a call to make sure. He’s probably already found a backdoor to your system on the internet.  Ken is the founder of Pen Test Partners, a network security consultancy firm, as well as a widely respected and very entertaining public speaker on all topics cybersecurty. His presentations include live hacks on local devices, hotel keycards, keyless cars and a range of Internet of Things (IoT) devices, including wearable children’s toys. Ken travels the world, sharing his disdain for device vendors that fail to secure their technologies in order to protect their potential customers.  We sat down with Ken following his keynote at the 2019 OilComm conference in Houston, Texas, to discuss his recent fascination with the commercial space industry, specifically due to what he sees as a concerning lack of security for satellite ground systems. Ken explains his recent work with the commercial satellite industry and shares some ideas on how satellite companies can help better secure their networks in the constantly evolving IoT ecosystem.   The episode also features a replay of the second half of Ken’s keynote at OilComm, which presented the results of a satellite terminal hack for the oil and gas industry. It’s a funny, enlightening, and at times, terrifying presentation packed with some good advice for those who are unsure of their ground systems’ cyber defenses.

Kicking off our new Smart Cities Smart People series is Ken Munro, ethical hacker and partner at Pen Test Partners. Ken has more than two decades of experience in the ethical hacking and security circuit, and gives his thoughts on what 5G can do for smart cities, his biggest pet peeves, and more! https://www.pentestpartners.com/

Three guesses whose been hitting the security-headlines again this week? Yup, it's no surprise we find ourselves talking Facebook privacy once more. (Other social networks are available.) We also admire the work of Pen Test Partners, as they trial fingerprint smart-locks to see how secure they really are.Joining us this week is the wonderful John Rampton. Founder of Calendar.com and Due, John walks us through using 1Password over his multiple businesses.We talked about...Facebook Suspends ‘Tens of Thousands’ of AppsFacebook & WhatsApp to Share Messages with U.K PoliceThe BBC asked Pen Test Partners to look into IoT ProductsFollow John Rampton on Twitter @johnramptonVisit calendar.comVisit johnrampton.comFind out more about 1Password BusinessWhat the phrase?!Long may your big jib draw • A Newfoundland wish of good fortune.Follow Us…Visit 1password.comCheck out our blogTweet us @1PasswordFind us on Facebook or InstagramPlease get in touch and let us know what you think of the show or leave us a review.

In this week's show, we chat about the prosecution leaking details in the Ghosn case, what the Monterey Car Week means for classics, VW has fired 204 employees as it demonstrates a tough stance on discipline, there is a new VW logo, Pen Test Partners find security holes in accredited smart trackers, the Science and Technology Committee makes some suggestions for hitting net-zero carbon stance, WRC Germany results, Opel Corsa-e rally car revealed, the news that Ferdinand Piech has suddenly died, a couple of cars drive around the Nurburgring quickly so Alan argues one matters whilst another doesn't, a brilliant Lunchtime Read and an ace And Finally. As ever, we really hope you enjoy the show and feel free to get in touch with news items and feedback!

On this IoT For All podcast episode, Ken Munro, Partner at Pen Test Partners, shares his experience finding and disclosing security vulnerabilities by breaking embedded IoT systems. Ken walks us through the testing and reporting process for security vulnerabilities and how liability is handled in cases where devices are tested and issues are found, especially when manufacturers choose to ignore said issues. He also addresses how companies without impregnable devices can be put out of business due to security failures and why security continues to be an afterthought. The episode concludes with a discussion about how companies are handling the growing threat of cybercriminals, what the catalyst will be to driving rapid change across the industry and how IoT device regulations in states like California and Massachusetts can be adopted nationwide. Finally, Ken answers the tough question of whether or not we should be scared of IoT. If you're interested in connecting with Ken, check out his LinkedIn! About Pen Test Partners: Pen Test Partners is a partnership of high-end penetration testers, cherry-picked for their wealth of knowledge and years of experience in the pen testing sector, with a passion to be the very best at what they do. Key Question and Topics from this Episode: (6:26) What is the device testing process like for PenTest Partners?  (7:49) How is liability handled in cases where devices are tested and issues are found but manufacturers are not open to change or feedback?  (8:48) Why is security an afterthought in IoT?  (10:27) What size companies are impacted the most when it comes to being put out of business due to security failures? (12:08) What is the reporting “process” when you find issues with devices?  (17:11) Outside of cost, what is contributing to the cause of these security vulnerabilities? (19:48) What can be done to fix security holes once a product is launched and out in the market, if anything?  (21:17) How wary should consumers be of products coming from smaller companies/startups? (23:06) How are IoT companies dealing with the growing threat of cybercriminals and the potential threat to their businesses? (25:15) What is it going to take to start driving change across the industry?  (26:58) How will IoT device regulations in states like California and Massachusetts be adopted by other states?   (36:02) What advice can be given to consumers when it comes to buying an IoT device? (31:58) Should we be scared of IoT?

Join Chris John Riley and Martin McKeay live from annual FIRST conference in Edinburgh, Scotland as they interview Ken Munro. Ken is a partner and founder at Pen Test Partners, LLP and was the opening keynote for the 31st Annual FIRST Conference.

Podcast: The CyberWireEpisode: Alarming vulnerabilities in automotive security systems — Research SaturdayPub date: 2019-03-30Notes from @BEERISAC: CPS/ICS Security Podcast Playlist:NB: In some cases, the car engine could be ‘killed’ whilst it was drivingResearchers at Pen Test Partners recently examined a variety of third-party automotive security systems and found serious security issues, potentially giving bad actors the ability to locate, disable or meddle with multiple vehicle systems. Ken Munro is a security researcher with Pen Test Partners, and he joins us to share their findings. The original research can be found here: https://www.pentestpartners.com/security-blog/gone-in-six-seconds-exploiting-car-alarms/ The CyberWire's Research Saturday is presented by Juniper Networks. Thanks to our sponsor Enveil, closing the last gap in data security.  The podcast and artwork embedded on this page are from The CyberWire, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Researchers at Pen Test Partners recently examined a variety of third-party automotive security systems and found serious security issues, potentially giving bad actors the ability to locate, disable or meddle with multiple vehicle systems. Ken Munro is a security researcher with Pen Test Partners, and he joins us to share their findings. The original research can be found here: https://www.pentestpartners.com/security-blog/gone-in-six-seconds-exploiting-car-alarms/

Researchers at Pen Test Partners recently examined a variety of third-party automotive security systems and found serious security issues, potentially giving bad actors the ability to locate, disable or meddle with multiple vehicle systems. Ken Munro is a security researcher with Pen Test Partners, and he joins us to share their findings. The original research can be found here: https://www.pentestpartners.com/security-blog/gone-in-six-seconds-exploiting-car-alarms/ The CyberWire's Research Saturday is presented by Juniper Networks. Thanks to our sponsor Enveil, closing the last gap in data security.  

Have you heard about sextortion?  We will talk about this type of blackmail scam and why it is so dangerous.   Android vs. iPhone, what is your choice? Today, we're going to talk about it from the resale value side What's up with GPS systems? Why are some experts not flying on  April 6?  I got some news and explanations for you. And we have a report out of the UK, The Guardian about how easy it is to steal modern cars.  We will discuss why that is.  Did you hear about the warning from Google this week? We will get to that and some other unexpected actions from Google   For more tech tips, news, and updates visit - CraigPeterson.com --- Transcript: Below is a rush transcript of this segment, it might contain errors. Airing date: 03/16/2019 Duckduckgo For Search - Google Advisory On Windows 7 - Cars Hacked Via Their Security Systems Craig 0:00  Hi, everybody, we're up to show number 998. Craig 0:12 Does that mean we have to do something special, coming up here in a couple more shows? I can't believe 1000 weeks worth of shows. I don't number my shows based on the, Craig 0:21 you know how many times I've appeared or how many times I've put podcasts up. Because I do, sometimes five. I've done as many as a dozen different podcasts in a week before. So I don't add them up like that. I'm talking about 1000 weeks on the air, on the radio. That is absolutely fantastic. It's frankly, it's just so exciting. I'm glad that it's happening. Well, today, we are going to be talking about sextortion. You might have seen this, I had one of the listeners reach out to me about this just a couple of weeks ago. And in fact, it happened to me, as well. We'll talk about Android vs. iPhone. This time, we're going to talk about it from the resale value side. GPS systems, April 6, I got some news for you. Some experts have decided they're not going to fly on April 6th, explain why. And we have a report out of the UK, The Guardian about modern cars much easier to steal than the old ones, and why? Google has a very big warning out this week that will get to. And Google did something else that was not expected by a lot of people. Google has quietly added Duck Duck Go as a search engine option for Chrome users. This is about 60 different markets globally in this is really big news. Because the chromium engine, of course, is made by Google. And you know, already the Google is very big in the search engine space. So, having them promote, which is what this effectively is doing. Having them promote competitors is a little bit of surprise to everybody out there. Now, chromium, I mentioned this a few weeks ago, which is the underlying technology for Google's Chrome browser is being adopted by Microsoft, they are completely shooting their own browser projects in the head. And they're building it all on top of chromium now, which I think makes a whole lot of sense. So does that mean Microsoft now is going to be using Duck Duck go, let me explain what this is? For those who are wondering, Duck Duck Go isn't just a kids game from 50 years ago, or probably longer than that, actually duck Duck go is a search engine. And it is designed with privacy in mind. I've had the founder of Duck Duck Go on my radio show before we talked a little bit about what he was doing. This was some years back when he was first getting started. And I'm actively promoted since then. And since using it, frankly. But people are saying, well, Duck Duck Go is the search engine to use because it is not tracking what you're searching for. It's just giving you kind of general advertisements, just like Google used to 10 years ago. And other people are saying, Well, why would I use Duck Duck go when Google has, frankly, better search engine technology, which it does, in many ways. Google has been able to invest a lot of money into its search engine technology and Duck Duck go just really can can't, at least not to the level that Google can. Now some people who are kind of skeptical, myself included are thinking that maybe Google did this with chromium in order to avoid some of the antitrust scrutiny. The anti-combines laws that are in Canada, UK much throughout the Commonwealth, but it is good news for people Craig 3:59 I use Duck Duck Go as my first go to choice when I'm searching online, it doesn't track you it, I kind of like it, it doesn't always give me the results that I really need or really want. So for those types of results, sometimes I'll end up going to Google and check there. And I use Bing for some types of searches to. I find bings image search to be a little bit better, in some ways than Google Search. Bing doesn't have the reverse image search that Google has. But you know, all in all, I think it's pretty good. There's another pro-privacy search engine out there called quant I've used that before q, w, a, n t and chromium Google now offers that is another default. So you might want to look at that Duck Duck Go and QUANT and QUANT, by the way, is only available as a default over in France, which is where QUANT is from. But you can always just go to Q U A N T dot com or Duck Duck Go dot com. And you can use it in almost any browser out there as a default, and it's been added in I'm looking through the list Canada, basically all of our neighbors, I don't see Mexico on here. That's kind of interesting. See the UK, US Venezuela is, you know, if they get power back down there, they'll be able to use it. Good old socialist countries, right. So anyways,   Craig 5:30 it's been growing for years, it's really quite good. And this Chromium instance, available on GitHub, if in case you're a developer is worth looking at. I also when we're talking about Chromium, I got to make sure I mentioned my other browser, my favorite browser for privacy. And that's the Epic browser. E-P-I-C. And I think on today's coaching call, we're going to end up talking a little bit about that Epic browser. Because a lot of people are kind of concerned and confused. And the Epic browser also uses Chromium as a code base, which I think is good, because Chromium is kind of those standard but it also just dropped a note down for myself. But it also has the types of security the DuckDuckGo has, in fact, it's kind of tied in hand in hand, it has VPN routes through it used to just be Indiana out routes through a whole bunch of different places. So check it out. E-P-I-C, browser.com. Epic browser.com online and use DuckDuckGo whenever you can, for your searches. If you want to try and keep things a little bit on the private side. And if you're very paranoid, your best bet mom depends on how paranoid right if you're like crazy paranoid, we're you know, we're not going to talk about that right now. I could help you out. But if you're more paranoid do the other thing I do, which just switches it up, use different search engines use different browsers use different machines when it comes to banking because I don't want many my banking information to be stolen. And I got to get back to some of what I'm doing some of it. Some of it I'm not if you're interested, let me know might be worth doing a masterclass about you know how to do this, how to do it for free even and keep your banking information safe. So I should write a little note about that. Well, we have a warning from Google, we're going to get into that right now. Craig 7:33 Well, our friends at Google have been paying attention to security for a while, if you have the latest versions of the Google Chrome browser, you're getting automatic updates. It's a technology that Firefox Mozilla people have been using for a long time. Craig 7:48 And these auto updates are absolutely fantastic. It can just save you a ton, not only of time but not having to apply the updates. But you know, security people can break in and drive-by download, you know, all the crap that happens when you're online. So Google has been very good about updating their Google Chrome browser, the Chromium underpinnings and you know, they get updated as well. But then the browser is really where they're most interested. Well, now, Google is warning people about Windows 7, you know, if you're listening for a while, that a month or so ago, Microsoft told you to ditch to drag Internet Explorer into that trash can and never use it again. You know that right? Number two now with Google out here is Google's recommending Windows 7 users to stop using Windows 7 upgrade immediately to Windows 10, if at all possible. And this is because of something called a kernel vulnerability. The kernel is the core part of the operating system. The kernel is where everything happens, really the kernel is how all of the processes talk to each other, how they can access hardware resources, like the disk, or the camera, the microphone, the speakers, everything on your computer ultimately goes through what's called the kernel. Craig 9:18 Wow. Well, the third analysis group is explained that Google's discovered two different security vulnerabilities, one in the Google Chrome browser. And the other one in Windows. The Chrome bug was already patched. But Windows 7 not yet fixed. Now this month, the Patch Tuesday from Microsoft has a doozy set of patches, a whole bunch of them, Microsoft is fixing all kinds of major flaws and vulnerabilities in their software. I don't think this particular fixes in that patch set. But it'll be out sometime, I'm sure Microsoft saying the vulnerability is in the Win32k.sis kernel driver. And it can be used as a security sandbox escape. Now, this is getting all rather technical, but sandboxes are where you set up a basically a way to execute software that nothing else can get access to. And it can't get access to anything else as well. So you use sandboxes for security. And having a major security problem with the security sandbox obviously is very big. So here's the statement we strongly believe this vulnerability may only be exploitable on Windows 7, due to recent exploit mitigation to added newer versions of Windows, Windows 10, and eight, all the Windows 10 has the most fixes. They've done a lot there. Craig 10:53 They're trying to make it as good as Mac OS. It'll be a while before they get there. But they're almost to the point that Unix was at 20 years ago. So you know, kudos to Microsoft. To date. Back to the quote to date, we have only observed active exploitation against Windows 7 32 bit systems. So the note from our friends at Google and their security research team is get rid of Windows 7 upgrade to Windows 10 as soon as you can. Microsoft says it is working on a fix. They are publicly disclosing the existence they're saying it is a serious vulnerability. So they're admitting it no big deal. There will see, By the way, Windows 7 is reaching the end of support the end of 2019, it's actually January 2020, read it however you want. But you've only got months left before Windows 7 will no longer get patches unless you pay Microsoft a king's ransom. In other words, our federal government will be spending a lot of software with Microsoft. I'm sure in the years ahead. It's still paying Microsoft to support Windows XP. Isn't that crazy? Let's talk about our new cars for a second Craig 12:19 We talked last week a little bit about our cars and insurance with autonomous vehicles. What does it mean? When are things going to get better? When are they going to get worse? Well, we have more smart in cars today. They have something called CAN bus which links up all of these computers throughout the machine throughout your car. You know, most cars nowadays and more modern ones, they don't even have a connection from your stereo to the speakers directly. There's no amplifier in there. It's all going over this network in your car, little land in the car. Well, that means that computers are there and they can be exploited. We have already seen that we saw a hack that went through the radio in some of the Chrysler products and allowed people to remote control Chrysler cars if they use this hack on their radios. So it is a concern. I'm not sure they've addressed it all well enough and not just talking about Chrysler here I'm talking about everybody gets me very concerned. There's been issues with BMW and others in the past as well. Well, there's a British infosec company called Pen Test Partners and they found that the Vipers Smart Start alarm and products from Pandora were riddled with flaws. And these flaws allowed them to have an attacker steal a car fitted with one of these devices. So if you have a Viper Smart alarm, the Smart Start alarm, which I do know people who have this. I'm gonna have to reach out, let them know individually case they're not listening today. But the Viper Smart Start alarm and products from Pandora allow cars to be hijacked. And now here's from a blog post about they're finding from Pen Test Partners. Before we contacted them, the manufacturers had inadvertently exposed about 3 million cars to theft and their users to hijack. Craig 14:28 This is a very, very big deal. This was really started because of Pandora's alarms. The company noticed that their security was advertised as being on hackable, which is a bad thing to say right? What's on the hackable. So I guess Pen Test Partners took that as a challenge. And they found an API, which is this application programming interface and some simple parameter manipulation that allowed them to be able to change the Viper Smart Start user's account password, registered email addresses, giving them full control over the app. And the car that the alarm system was installed on. All they had to do was send a regular web post request to the API with a parameter email redefined to one of their own choices, and that overrode the legitimate owner's email address, and now they had control over the account. So there you go. Okay, major issues using the apps ability to clone the key fob issue RF commands from a user mobile phone. And they dug into this little bit more, by the way, and they discovered a function in the Viper interface that remotely turned off the car's engine. So the pen or a big also allowed researchers to remotely enable the car's microphone so they could listen to eavesdrop the conversation on the occupants. And they also said the Mazda 6, the Range Rover Sport, the Kia, what is this, Course I guess. The Toyota Forerunner, Mitsubishi Pajero, Toyota Prius 50, and the Rav4 all appear to have undocumented functionality present in the alarm API to remotely adjust the cruise control speed. So it goes on and on car, security remains poor, and you don't need guns, you don't need lock picks, to steal modern cars, or to even to cause them to crash. I wonder if, if any of the crash investigators might look into this, if they realize, wait a minute, there's a remote controllable API in this car, maybe we should subpoena the court records from the manufacturer of the device and poke around a little bit and see if maybe someone manipulated it and told the car to floor it down a back road Street, we're going to have to get a little smarter about some of this stuff, right? Even though the criminal investigations. Well, let's talk about April 6 here. Wow, this is something I wasn't even aware of this until just this week. Craig 17:21 Of course, I was aware April 6 was coming people, okay. Don't give me a hard time about that. Because, you know, I gotta remember April 8, which is my anniversary, right? So I don't want to mess this up. April 6. Anyhow, I knew the 6th was coming. And it's certainly getting close. But this has to do with GPS systems. If you remember, 1999, if you were doing programming, if you were involved with computers back then, it was a scary time, many people kind of predicted the end of Western civilization. And they weren't totally wrong about that either. Western civilization could really have come to an end because of what was called the Y2K bug. And it was because of programmers like me, in the 70s and 60s that wrote software that said, Well, if I want to figure out the time between this date, and that date, all I have to do is use it two digit year, and those two-digit years, going to take up less space in the storage. And if you have a million records, times two more digits, which typically would be 2 bytes, then well, that's, you know, 2 million more bytes of data, which at the time was a whole lot of data. So we took shortcuts, and one of the shortcuts was storing the year as just the last two digits. So we didn't worry about the 19 part, we only worried about the 79 part or the 99 part. So there were a lot of predictions about software. And I knew a guy who started the company that was designing software to specifically look for this Y2K flaw and fix it. Of course, as it turned out, there were some problems, they were relatively minor. But most of the companies out there are certainly the ones that were in business realized that Y2K was coming and made some basic adjustments so that there wouldn't be a big problem. Many people expected, they're not to be another problem until maybe the year 10,000, right. So instead of Y2K, in the future, we're probably not going to be around. But in another 8000 years, we got another rollover. Well, that's not the case. Craig 19:43 I have been aware of what's called the 2038 problem. Because in the Unix world, there's a timestamp the Network Time Protocol uses and many machines user, which means by the way, Windows uses us to synchronize times, well, that particular clock is going to roll over in the year 2038. And that's most likely to affect embedded systems. Now, there are fixes already in place, and many versions of Unix that are out there Linux and some of these other derivatives that are have already taken this into account. And then, of course, there's bad programmers that really don't realize all of the implications of what they do. Craig 20:27 They've always existed and they'll always exist. In fact, I think in many ways, it's getting worse than it was before, you know, the bad programmers that is. Craig 20:34 But maybe that's because I'm just getting to be an old man, right? been doing this for too long. So we know that the Y2K problem was real. And in most cases, it was fixed, that 2038 problem is real. Most cases it will be fixed, although again, we're going to be affecting embedded systems and most, In other words, those that don't get the software update one was alive last time you upgraded the software in your car, or some other physical device to clock on your disk. Hopefully, none of it's going to be life-threatening, because some systems are using Unix that is embedded systems. Well, there's another one, this is the April 6 Craig 21:18 bug. And this has to do with the GPS and there are some security experts, including one guy over at RSA. And RSA does a whole ton of security work. They provide some of the algorithms that run public key systems. They have little key fobs, little devices that have a timer on them, you've seen them before. It's a little number that rolls over every minute or so. And you might use them with your banks, etc. Well, those guys are the guys that are now warning about this April 6 problem. They talked about it at a security conference just last week out in San Francisco. And he says that some of the older GPS systems are going to be in serious trouble. Because the computers in these GPS systems are going to have counters that flip back to zero. So they are going to literally run out of time reaching the end of their counters. And that really could cause some major major effect. This guy here. Bill Maliki's there's another guy he's a VP over Trend Micro, they do a lot of computer security, cybersecurity. We've used some of their stuff in the past, he told the media that he would not be flying on April 6 and suggests that it could be bad, it could be a lot worse than Y2K was because the effects are going to be more widespread, widespread because many more systems have integrated GPS into their operations. And many of these are embedded systems ports. He's talking about here, loading unloading containers automatically, using GPS to guide the cranes. Some of those systems could be affected in the cranes are going to shut down. Hopefully, public safety systems use GPS traffic monitoring systems for bridges, the bridges that raise and lower automatically the ones that change the lanes ever been on one of those roads were part of the day. This lane is northbound. The other part it's southbound, you know, 20 years ago, these GPS systems were really important primitive shape, and they were embedded. So the impact on this could be even greater governments have issued warnings to state and private sectors to update their technology. But some of these systems we not, we're not even aware of how some of these work that companies have gone out of business, there's no way to get an update. Nobody really realizes their GPS in there. Because you remember, GPS isn't just used to locate you. GPS is used to locate because it uses very fancy high-resolution timers. And the way it works to locate you is it listens for the satellites to send a clock signal. Craig 24:24 So each of the clocks will announce what time it is. And because the satellites are different distances from you, you will hear the time at different times. Right? You know, that if someone's yelling at you from across the room, have you here or you see a gunshot and range you will see the gunshot before you hear it. Right. Well, if someone fires that gun, right next to you, you're going to hear it instantly correct. So you know, that the the guy that fired the gun, and it took a second for that Soundwave to reach you, you know, that guy's further away than the guy who fired the gun. And immediately you heard it. Well, that's how GPS works using extremely high precision timers. So another thing people do with GPS signals is they use it to get a clock source. So many computers are using GPS receivers to figure out what time it is. So the systems are reverse traffic that controls bridges, etc, etc. Many of them are sinking their clocks and their timers up to GPS. And when it's an embedded system that hasn't been updated, we could have some serious serious problem couple of real quick things here before we go today. And of course, you'll find these articles and many more up on my website. http://CraigPeterson.com. I have also been doing a special podcast called It's A Security Thing, you're not going to find it unless you look for me because I haven't split it out yet. But in it, I'm talking about these types of security issues, things in the real world. This week. I was talking about a CPA firm what they did to respond to a cybersecurity event two weeks ago this happened, what they did right what they did wrong and you will find all kinds of these things are posting them almost daily. Now at my website, there's a special section, http://CraigPeterson.com. So make sure you have a look at it. We are writing all of these articles ourselves. These are not references to other articles. There might be links to other articles, but these are really great. If you're interested in cybersecurity and finding out more you'll find them on my home page again, http://CraigPeterson.com and it's all small businesses. It's all things that did right things that did wrong and what happened and they're all very, very current. So check it out. You really really should and wearing sending include some of those also in my weekly email. If you're not a subscriber /http://CraigPeterson.com/subscribe. Apple is crushing it on resale value in their laptops. But also the iPhones they destroy the Android iPhone X versus a Samsung Galaxy S9 Wow, iPhone X was 1000 bucks when it debuted, it's still worth 700 9 months later. So that's a drop of 30% the Samsung Galaxy S9 costs 720 but it was worth just $290 and drop 60%. So consider that too. When you're looking at the prices of devices what you should be mine and by the way, you should be buying the iPhone. Hey, have a great week. Make sure you check us out online. http://CraigPeterson.com. Take care everybody and we'll be chatting again next week. Bye-bye. ---  Related articles: 'Gps Systems Will Be Struck By Y2K-Like Bug On April 6': Security Expert Says He Will Not Fly On 'Day Zero' After Governments Warn Global Devices Will Reset Due To Calendar Glitch Google Recommends Windows 7 Users To Upgrade To Windows 10 If Possible, As A Kernel Vulnerability Allows For Local Privilege Escalation On The Operating System. No Guns Or Lockpicks Needed To Steal Modern Cars If They're Fitted With Hackable 'Smart' Alarms Sextortion Scammers Target Employees Google Has Quietly Added Duckduckgo As A Search Engine Option For Chrome Users - Privacy iPhone Crushes Androids On Resale Value --- More stories and tech updates at: www.craigpeterson.com Don't miss an episode from Craig. Subscribe and give us a rating: www.craigpeterson.com/itunes Follow me on Twitter for the latest in tech at: www.twitter.com/craigpeterson For questions, call or text: 855-385-5553

Interview with security researcher at Pen Test Partners, Ken Munro, on the firm's recent discovery of dangerous vulnerabilities in MiSafes GPS enabled child tracking smartwatches.

Don't let an internet-enabled sex toy make your most private moments oh-so-public. Samsung's wannabe-Android-killer is found lacking.  And did you hear about the firm that is micro-chipping its employees?  All this and more is discussed by computer security veterans Graham Cluley and Carole Theriault, joined this week by special guest John Hawes. Show notes: Vulnerable Wi-Fi dildo camera endoscope. Yes really - Pen Test Partners Samsung's Android Replacement Is a Hacker's Dream - Motherboard Companies start implanting microchips into workers' bodies - LA Times This episode of Smashing Security is made possible by the generous support of Recorded Future — the real-time threat intelligence company whose patented machine learning technology continuously analyzes technical, open, and dark web sources to give organizations unmatched insight into emerging threats. Sign up for free daily threat intelligence updates at recordedfuture.com/intel Follow the show on Twitter at @SmashinSecurity, or visit our website for more episodes. Remember: Subscribe on Apple Podcasts, or your favourite podcast app, to catch all of the episodes as they go live. Thanks for listening! Warning: This podcast may contain nuts, adult themes, and rude language. Special Guest: John Hawes.

If you want to understand the ways of a pen tester, Ken Munro is a good person to listen to. An info security veteran for over 15 years and founder of UK-based Pen Test Partners, his work in hacking into consumer devices — particularly coffee makers — has earned lots of respect from vendors. He’s also been featured on the BBC News. You quickly learn from Ken that pen testers, besides having amazing technical skills, are at heart excellent researchers. They thoroughly read the device documentation and examine firmware and coding like a good QA tester. You begin to wonder why tech companies, particularly the ones making  IoT gadgets, don’t run their devices past him first! There is a reason. According to Ken, when you’re small company under pressure to get product out, especially IoT things, you end up sacrificing security. It’s just the current economics of startups. This approach may not have been a problem in the past, but in the age of hacker ecosystems, and public tools such as wigle.net, you’re asking for trouble. The audio suffered a little from the delay in our UK-NYC connection, and let’s just say my Skype conferencing skills need work. Anyway, we join Ken as he discusses how he found major security holes in wireless doorbells and coffee makers that allowed him to get the PSK (pre-shared keys) of the WiFi network that’s connected to them. Transcript Inside Out Security: You’ve focused mostly on testing the IoT — coffee makers, doorbells, cameas –and it’s kind of stunning that there’s so much consumer stuff connected to the internet.  The Ring Doorbell and iKettle, were examples I think, where you obtained the WiFi PSKs (pre-shared keys). Could you talk more your work with these gadgets? Ken: Yeah, so where they're interesting to us is that in the past to get hold of decent research equipment to investigate, it used to be very expensive. But now that the Internet of Things has emerged. We're starting to see low-cost consumer goods with low-cost chip sets, with low-cost hardware, and low-cost software starting to emerge at a price point that the average Joe can go and buy and put into their house. A large company, if they buy technologies, has probably got the resources to think about assessing their security … And put some basic security measures around.  But average Joe hasn't. So what we wanted to do was try and look to see how good the security of these devices was, and almost without exception, the devices we've been looking at have all had significant security flaws! The other side of it as well, actually, it kind of worries me. Why would one need a wireless tea kettle? IOS: Right. I was going to ask you that. I was afraid to. Why do you think people are buying these things? The advantage is that you can, I guess, get your coffee while you're in the car and it'll be there when you get home? Ken: No. It doesn't work like that …Yeah, that's the crazy bit. In the case of the WiFi kettle, it only works over WiFi. So you've got to be in your house!   IOS: Okay. It's even stranger. Ken: Yeah, I don't know about you but my kitchen isn't very far away from the rest of my house. I'll just walk there, thanks.   IOS: Yeah. It seems that they were just so lacking in some basic security measures … they left some really key information unencrypted. What was the assumption? That it would be just used in your house and that it would be just impossible to someone to hack into it? Ken: You're making a big step there, which is assuming that the manufacturer gave any thought to an attack from a hacker at all. I think that's one of the biggest issues right now is there are a lot of manufacturers here and they're rushing new product to market, which is great. I love the innovation. I'm a geek. I like new tech. I like seeing the boundaries being pushed. But those companies that are rushing technologies to market with not really understanding the security risk. Otherwise, you're completely exposing people's homes, people's online lives by getting it wrong.   IOS: Right. I guess I was a little surprised. You mentioned in your blog something called wigle.net? Ken: Yeah, wigle is ….  awesome and that's why WiFi's such a dangerous place to go.   IOS: Right. Ken: Well, there's other challenges. It's just the model of WiFi -- which is great, don't get me wrong -- when you go home with your cell phone, your phone connects to your WiFi network automatically, right? Now, the reason I can do that is by sending what are called client probe requests. And that's your phone going, "Hey, WiFi router, are you there? Are you there? Are you there?" Of course, when you're out and about and your WiFi's on, it doesn't see your home WiFi router. But when you get home, it goes, "Are you there?" "Yeah, I'm here," and it does the encryption and all your traffic's nice and safe. What wigle does — I think it stands for wireless integrated geographic location engine, which is crazy …  security researchers have been out with wireless sniffers, scanners, and mapped all the GPS coordinates of all the wireless devices they see. And then they collate that onto wigle.net, which is a database of these which you can basically query a wireless network name … and work out where they are. So it's really easy. You can track people using the WiFi on their phones using wigle.net. You can find WiFi devices. A great example of that was how we find the iKettle, that you can search wigle.net for kettles. It's crazy!   IOS: Yeah, I know. I was stunned. I had not seen this before. I suspect some of the manufacturers would be surprised if they saw this. We see the same thing in the enterprise space or IT. I'm just sort of surprised that's just so many tools and hacking tools out there. But in any case, I think you mentioned that some of these devices start up as an access point and that, in that case, you know the default access name of the iKettle or whatever the device is, and then you could spot it. Is this the way the hackers work? Ken: No, that's right. The issue with an IoT WiFi device is that when you first put it up, you need to get through a process of connecting to it and connecting it to your home WiFi network. And that is usually a two-stage process. Usually. It depends. Some devices don't do this but most devices, say, the iKettle, will set itself up as an access point first or a client-to-client device, and then once you go in and configure it with your cell phone, it then switches into becoming a client on your WiFi network. And it's going through that set of processes where we also found issues and that's where you can have some real fun.   IOS: Right. I think you took the firmware of one of these devices and then was able to figure out, let's say, like a default password. Ken: Yeah. That's another way. It's a completely different attack. So that's not what we'll do in the iKettle. We didn't need to go near the firmware. But a real game changer with IoT devices is that the manufacturer is putting their hardware in the hands of their customers … Let's say you're a big online retailer. Usually you bring them in with application and you buy stuff. With the Internet of Things, you're actually putting your technology -- your kit, your hardware, your firmware, your software — into the hands of your consumers. If you know what you're doing, there's great things you can do to analyze the firmware. You can extract off from devices, and going through that process, you can see lots of useful data. It's a real game changer, unlike a web application where you can protect it with a firewall … But the Internet of Things, you put your chips into the hands of your customers and they can do stuff with that potentially, if they have got security right.   IOS: Right. Did you talk about they should have encrypted the firmware or protected it in some way? Is that right? Ken: Yeah. Again, that's good practice. In security, we talk about having layers of defense, what we call defense in depth so that if any one layer of the security chain is broken, it doesn't compromise the whole device. And a great example for getting that right would be to make sure you protect the firmware. So you can digitally sign the code so that only valid code can be loaded onto your device. That's a very common problem in design where manufacturers haven't looked at code signing and therefore we can upload rogue code. A good example of that was the Ring doorbell. Something that's attached to the outside of your house. You can unscrew it. You can walk off with it. And we found one bug whereby you can easily extract the WiFi key from the doorbell! Again, the manufacturer fixed that really quickly, which is great, exactly what we want to see, but our next step is looking at it and seeing if we can take the doorbell, upload a rogue code to it, and then put it back on your door. So we've actually got a back door on your network.   IOS: Right, I know. Very scary. Looking through your blog posts and there were a lot of consumer devices, but then there was one that was in a, I think, more of a borderline area and it was ironically a camera. It could potentially be a security camera. Was that the one where you got the firmware? Ken: Yeah, that was an interesting one. We've been looking at some consumer grade CCTV cameras, although we see these in businesses as well. And we've particularly been looking at the cameras themselves and also the digital video recorders, the DVRs where they record their content onto. So many times we find someone has accidentally put a CCTV camera on the public Internet. You've got a spy cam into somebody's organization! The DVR that records all the content, sometimes they put those on the Internet by mistake as well. Or you find the manufacturers built it so badly that ..  it goes on by itself, which is just crazy.   IOS: Yeah, there's some stunning implications, just having an outsider look into your security camera. But you showed you were able to, from looking at the...it was either the firmware or once you got into the device, you could then get into network. Was that right? Ken: Yeah, that's quite ironic really, isn't it? CCTV cams, you consider to be a security device. And what we found is not just the camera but also the DVR, if you put it on your network and ,,, it can create a backdoor onto your network as well. So you put on a security device that makes you less secure.   IOS: One of things you do in your assessments is wireless scanning and you use something, if I'm not mistaken, called Kismet? Ken: Kismet's a bit old now ... There are lots of tools around but the Aircrack suites is probably where it's at right now And that's a really good suite for wireless scanning and wireless g cracking.   IOS: Right. So I was wondering if you could just describe how you do a risk assessment. What would be the procedure using that particular tool? Ken: Sure. At its most basic, what you'd be looking to do, let's say you're looking at your home WiFi network. Basically, we need to make sure your WiFi is nice and safe. And security of a WiFi key  is how long and complex it is. It's very easy to grab an encrypted hash of your WiFi key by sitting outside with a WiFi antenna and a tool like Aircrack, which allows you to grab the key. What we then want to do is try and crack that offline. So once I've got your WiFi key, I'm on your network, and we find in a lot of cases that ISP WiFi routers, the default passwords just aren't complicated enough. And we looked at some of the ISPs in the U.K. and discovered that some of the preset keys, we could crack them on relatively straight-forward equipment in as little as a couple of days.   IOS: Okay. That is kind of mind-blowing because I was under the impression that those keys were encrypted in a way that would make it really difficult to crack. Ken: Yeah, you hope so but, again, it comes down to the length and complexity of the key. If you WiFi network key is  only say -- I don't know — eight characters long and it's not really going to stand up to a concerted attack for very long. So again, length and complexity is really important.   IOS: Yeah, actually we do see the same thing in the enterprise world and one of the first recommendations security pros make is the keys have to be longer and the passwords have to be longer than at least 8. Ken: We've been looking at some ... there's also the character set as well. We often find … the WiFi router often might only have lower case characters and maybe some numbers, and those numbers and characters are always in the same place in the key. And if you know where they are and you know they're always going to be lower case, you've reduced the complexity.   IOS: Right. Ken: So I'd really like to be seeing 12-, 15-, 20-character passwords. It's not a difficult thing. Every time you get a new smartphone or a new tablet, you have to go and get it from the router then but really I think people can cope with longer passwords that they don't use very often, don't you think?   IOS: No, I absolutely agree. We sort of recommend, and we've written about this, that you can...as an easy way to remember longer passwords, you can make up a mnemonic where each letter becomes part of a story. I don't know if you've heard of that technique. You can get a 10-character password that's easy to remember and therefore becomes a lot harder to decrypt. We've also written a little bit about some of the decrypting tool that are just easily available, and I think you mentioned one of them. Was it John the Ripper?   Ken: John is a password brute force tool and that's really useful. That's great for certain types of passwords. There are other tools for doing different types of password hashes but John is great. Yeah, it's been around for years. IOS: It's still free. Ken: But there are lots of other different types of tools that crack different types of password.   IOS: Okay. Do you get the sense that, just going back to some of these vendors who are making these devices, I think you said that they just probably are not even thinking about it and perhaps just not even aware of what's out there? Ken: Yeah, let's think about it. The majority of start-up entrepreneur organizations that are trying to bring a new IoT device to market, they've probably got some funding. And if they're building something, it's probably going to be going into production nine months ahead. Imagine you've got some funding from some investors, and just as you're about to start shipping, somebody finds a security bug in your product! What do you do? Do you stop shipping and your company goes bust? Or do you carry on and trying to deal with the fallout? I do sympathize with these organization, particularly if they had no one giving them any advice along the way to say, "Look, have you thought about security?" Because then they're backed into a corner. They've got no choice but to ship or their business goes bankrupt, and they've got no ability to fix the problem. And that’s probably what happened with the guys who made the WiFi kettle. Some clever guys had a good idea, got themselves into a position where they were committed, and then someone finds a bug and there's no way of backing out of shipping.   IOS: Right, yeah. Absolutely all true.  Although we like to preach something called Privacy by Design — at least it’s getting a lot more press than it did a couple years ago — which is just the people at the C-level suite should just be aware that you have to start building some of these privacy and security ideas into the software. Although it's high-sounding language. And you're right, when it comes to it, a lot of companies, especially start-ups, are really going to be forced to push these products out and then send out an update later, I guess is the idea. Or not. I don't know.   Ken: That's the chance, isn't it? So if you look at someone like Tesla, they've had some security bugs found last year and they have the ability to do over-the-Internet updates. So the cars can connect over WiFi and all their security bugs were fixed over the air in a two-week period! I thought that was fantastic. So they can update in the field ... if you figured out that, brilliant. But they don't have the ability to do updates once they're in the field. So then you end up in a real stick because you've got products you can only fix by recalling, which is a huge cost and terrible PR. So hats off to Tesla for doing it right. And the same goes for the Ring doorbell. The guys thought about it. They had a process whereby it got the updates really, really easy, it's easy to fix, and they updated the bug that we found within about two weeks. And that's the way it should be. They completely thought about security. They knew they couldn't be perfect from the beginning. "Let's put a cable in place, a mechanism, so we can fix anything that gets found in the field."   IOS: Yes. We're sort of on the same page. Varonis just sees the world where there will always be a way for someone to get into especially newer products and you have to have secondary defenses. And you've talked about some good remediations with longer passwords, and another one we like is two-factor authentication. Any thoughts on biometric authentication? Ken: Yes. Given the majority of IoT devices have being controlled by a smartphone, I think it's really key for organizations to think about how they've authenticated the customer to a smart device or, if they have a web app, the web interface as well, how they authenticate the customer to that. I'm a big fan of two-factor authentication. People get their passwords stolen in breaches all the time. And because they will reuse their passwords across multiple different systems, passwords stolen from one place and you find another place gets compromised. There was a great example, I think, some of the big data breaches ... they got a password stolen in one breach and then someone got their account hacked. It wasn't hacked. They just had reused the password!   IOS: Right. Ken: So I'm a real fan of two-factor authentication to prevent that happening. Whether it's a one-time SMS to your phone or a different way of doing it, I think two-factor authentication is fantastic for helping Average Joe deal with security more easily. No one's going to have an issue with, "Look, you've sent me an SMS to my phone". That's another layer of authentication. Great. Fantastic." I'm not so much a fan of biometrics by themselves and the reason for that is my concern about revocation. Just in case the biometric data is actually breached, companies get breached all the time, we've not just lost passwords because passwords we throw them away, we get new ones, but if we lose your biometic, we're in a bit more of a difficult position. But I do biometrics work brilliantly when they're combined with things like passwords. Biometric plus password is fantastic as a secure authentication.   IOS: Thanks for listening to the podcast. If you're interested in following Ken on Twitter, his handle is TheKenMunroShow or you can follow his blog at PenTestPartners.com. Thanks again.

This week on Security News, Paul, and Jack talk about how Sony, Microsoft, and other gadget makers violate Federal Warranty Laws, Pen Test Partners, FBI, warrant Canarys, and much more! Here on Security Weekly. Full Show Notes: http://wiki.securityweekly.com/wiki/index.php/Episode472#Security_News_-_7:00PM-8:00PM

This week on Security News, Paul, and Jack talk about how Sony, Microsoft, and other gadget makers violate Federal Warranty Laws, Pen Test Partners, FBI, warrant Canarys, and much more! Here on Security Weekly. Full Show Notes: http://wiki.securityweekly.com/wiki/index.php/Episode472#Security_News_-_7:00PM-8:00PM