Podcasts about ripple20

  • 38PODCASTS
  • 53EPISODES
  • 1h 6mAVG DURATION
  • ?INFREQUENT EPISODES
  • Jan 7, 2025LATEST

POPULARITY

20172018201920202021202220232024


Best podcasts about ripple20

Latest podcast episodes about ripple20

Licht op Legal
121. De Cyber Resilience Act: Wat houdt deze Europese verordening in en wat betekent dit voor bedrijven?

Licht op Legal

Play Episode Listen Later Jan 7, 2025 10:04


Dit is aflevering 121 van Licht op Legal. In deze aflevering gaat Michael Reker, advocaat Information Technology & Privacy bij Van Benthem & Keulen, in op de Cyber Resilience Act.De Cyber Resillience Act (afgekort CRA) is ingevoerd om de beveiliging van hardware en softwareproducten in de EU te verhogen om daarmee impact van beveiligingsincidenten te beperken (denk aan gevallen zoals de Ripple20-exploit of de Crowdstrike-update). De hoofddoelen van de CRA leiden vanaf december 2027 tot strengere producteisen op het gebied van beveiliging en een verplichte CE-markering voor alle producten met digitale elementen (hardware en software)​.In deze aflevering vertelt Michael op welke producten de Cyber Resilience Act van toepassing is en wat de belangrijkste verplichtingen zijn die de Cyber Resilience Act oplegt aan bijvoorbeeld producenten, importeurs en distributeurs van deze producten. Vervolgens legt Michael uit wat de verplichting tot CE-markering concreet betekent en wat bedrijven hiervoor moeten doen en gaat Michael in op de gevolgen van het niet voldoen aan de eisen van de Cyber Resilience Act. Michael sluit de podcast af met tips voor bedrijven die zich voorbereiden op de komst van de Cyber Resilience Act.Wilt u meer weten over de Cyber Resilience Act? Neem dan contact op met Michael Reker.Heeft u suggesties voor een onderwerp of wilt u dat onze experts hun licht laten schijnen op uw juridische vraagstuk? Stuur dan een mail naar lichtoplegal@vbk.nl. Licht op Legal kunt u via onze website, Spotify, Apple Podcasts of uw eigen favoriete podcastapp beluisteren.Dit is een podcast van Van Benthem & Keulen. U vindt ons op:vbk.nlLinkedInTwitterFacebookInstagram Hosted on Acast. See acast.com/privacy for more information.

Big DREAM School - The Art, Science, and Soul of Rocking OUR World Doing Simple Things Each Day
Bitcoin Mining for Climate Change Warriors - Margot Paez

Big DREAM School - The Art, Science, and Soul of Rocking OUR World Doing Simple Things Each Day

Play Episode Listen Later Jan 9, 2024 62:10 Transcription Available


Bitcoin for Climate Change Warriors with Margot PaezMargot Paez is a climate change physicist and PhD candidate in the civil engineering department at Georgia Institute of Technology. She has an MS in physics from GT and works on climate change statistical-based modeling, primarily in relation to water resources. Her previous research includes robotics and physics of living systems, astrobiology instrumentation, and web-based data management systems.She addresses the misconceptions and misinformation surrounding Bitcoin's environmental impact and emphasizes the need for accurate and unbiased research. Margot also discusses the funding and motivations behind certain environmental campaigns and the potential of Bitcoin mining to reduce methane emissions. She advocates for bridging the gap between environmentalists and the Bitcoin community to find sustainable solutions for the future.

Brakeing Down Security Podcast
April Wright and Alyssa Miller - IoT platforms, privacy and security, embracing standards

Brakeing Down Security Podcast

Play Episode Listen Later Feb 15, 2022 41:37


Alyssa Milller (@AlyssaM_InfoSec) April Wright (@Aprilwright)   Open Source issues (quick discussion, because I value your opinions, and supply chain is important in the IoT world too.) Log4j and OSS software management and profitability Free as in beer, but you pay for the cup… (license costs $$, not the software).  “If you make money using our software, you must buy a license” - not an end-user license   Open source conference at Whitehouse: https://www.zdnet.com/article/log4j-after-white-house-meeting-google-calls-for-list-of-critical-open-source-projects/ https://www.wsj.com/articles/white-house-convenes-open-source-security-summit-amid-log4j-risks-11642119406 “For too long, the software community has taken comfort in the assumption that open source software is generally secure due to its transparency and the assumption that many eyes were watching to detect and resolve problems,” said Kent Walker, chief legal officer at Google in a blog post published after the meeting. “But in fact, while some projects do have many eyes on them, others have few or none at all.”  Show was inspired by this Twitter conversation: https://twitter.com/aprilwright/status/1461724712455782400?t=Fv2tmSTXrn-SSjPCka3gxg&s=19   https://twitter.com/AlyssaM_InfoSec/status/1464661807751213056?t=CFy-hgcHo2a8NwowKYo0hg&s=19   IOT architecture (https://www.avsystem.com/blog/iot-ecosystem/) Open source IoT platforms: https://www.record-evolution.de/en/open-source-iot-platforms-making-innovation-count/   Cloud services - processing messages, register/de-register devices, pass messages to other devices/gateways Gateways -  Devices -  Mobile apps - SDKs -  integrations   Cloud services DO go offline, point of failure:https://www.datacenterdynamics.com/en/news/aws-us-east-1-outage-brings-down-services-around-the-world/ Connectivity and sharing mesh networks assumes you like your neighbors. Sidewalk Whitepaper: https://m.media-amazon.com/images/G/01/sidewalk/final_privacy_security_whitepaper.pdf   network vulnerabilities: https://fractionalciso.com/why-you-should-not-be-using-xfinitywifi-hotspots/  Stalking/privacy vs. tracking/surveillance   Fine GPS locations Nearby devices triangulate (via BLE, wifi, or 900mhz) We want to find our lost devices, but devices can be used for stalking https://www.autoevolution.com/news/police-claim-apple-has-unwillingly-created-the-most-convenient-stalking-device-179228.html   Just have an iPhone and you'll be able to find a stalking device, just install a 100MB app (Ring, Alexa, etc) to detect all devices in the area, or use the right ecosystem to find these items (or know every possible device that could be used to track someone)   What do companies want with that information?   What is a ‘happy medium' to allow you to find your dog, but not to track people? Device controls? Buzzers? (how loud can you make a noise in a small device?) Size issues, battery life, beaconing, self-identification (“Hi, I am a lost device…”) Is what Airtags doing enough to reduce the fear? Are we designing to edge cases? There are cheaper/easier ways to track someone (phones have a longer standby time than fetch/airtag/tile) How often do you lose your keys? Why is your dog not on a leash or properly trained? What will it take to make these kinds of devices more secure?  https://spectrum.ieee.org/why-iot-sensors-need-standards Will it take privacy protections to motivate IoT devices to design a better IoT device? Or force standards to be followed, like https://www.ioxtalliance.org/get-ioxt-certified? Or NIST standards: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-213-draft.pdf https://csrc.nist.gov/publications/detail/sp/800-213a/final - detailed specs Threat modeling, vulnerabilities in IoT networks and platforms   Does your Iot Platform give out SDKs for integrations or allowing 3rd party products or apps? https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain/   https://www.avsystem.com/blog/iot-ecosystem/ Old and outdated libraries, like TCP vulnerabilities (RIPPLE20)   https://www.businessinsider.com/iot-security-privacy   https://www.eurofins-cybersecurity.com/news/security-problems-iot-devices/ https://arxiv.org/ftp/arxiv/papers/1302/1302.0939.pdf - Security and Privacy Issues in Wireless Mesh Networks: A Survey   https://krebsonsecurity.com/2021/09/apple-airtag-bug-enables-good-samaritan-attack/   https://www.amazon.com/gp/help/customer/display.html?nodeId=GZ4VSNFMBDHLRJUK Opt-out of Amazon sidewalk Amazon Sidewalk discussion: https://www.silabs.com/support/training/amazon-sidewalk-development/amz-103-amazon-sidewalk-technology-architecture-and-infrastructure   Fetch:As one example, this week we announced Fetch, a compact, lightweight device that will clip to your pet's collar and help ensure they're safe. If your dog wanders outside a perimeter you've set using the Ring app, Fetch will let you know. In the future, expanding the Amazon Sidewalk network will provide customers with even more capabilities like real-time location information, helping you quickly reunite with your lost pet. For device makers, Fetch also serves as a reference design to demonstrate the potential that devices connected to a broad, reliable network can provide to their customers. https://www.aboutamazon.com/news/devices/introducing-amazon-sidewalk  

Brakeing Down Security Podcast
Alyssa Miller, April Wright, on IoT Privacy & Security, using tech for stalking, what could be done? Part1

Brakeing Down Security Podcast

Play Episode Listen Later Feb 7, 2022 34:12


(Please feel free to add anything you like… We want our guests to have as much input as possible) -brbr   Zoom is on…  https://us02web.zoom.us/j/88629788990?pwd=NFNBVlgwM0dDM0s2eUY3YnBITlRNdz09   Alyssa Milller (@AlyssaM_InfoSec) April Wright (@Aprilwright) Talk about side projects, podcasts, speaking events, etc (if you want to) Open Source issues (quick discussion, because I value your opinions, and supply chain is important in the IoT world too.) Log4j and OSS software management and profitability Free as in beer, but you pay for the cup… (license costs $$, not the software).  “If you make money using our software, you must buy a license” - not an end-user license   Open source conference at Whitehouse: https://www.zdnet.com/article/log4j-after-white-house-meeting-google-calls-for-list-of-critical-open-source-projects/ https://www.wsj.com/articles/white-house-convenes-open-source-security-summit-amid-log4j-risks-11642119406 “For too long, the software community has taken comfort in the assumption that open source software is generally secure due to its transparency and the assumption that many eyes were watching to detect and resolve problems,” said Kent Walker, chief legal officer at Google in a blog post published after the meeting. “But in fact, while some projects do have many eyes on them, others have few or none at all.”  Show was inspired by this Twitter conversation: https://twitter.com/aprilwright/status/1461724712455782400?t=Fv2tmSTXrn-SSjPCka3gxg&s=19   https://twitter.com/AlyssaM_InfoSec/status/1464661807751213056?t=CFy-hgcHo2a8NwowKYo0hg&s=19   IOT architecture (https://www.avsystem.com/blog/iot-ecosystem/) Open source IoT platforms: https://www.record-evolution.de/en/open-source-iot-platforms-making-innovation-count/   Cloud services - processing messages, register/de-register devices, pass messages to other devices/gateways Gateways -  Devices -  Mobile apps - SDKs -  integrations   Cloud services DO go offline, point of failure:https://www.datacenterdynamics.com/en/news/aws-us-east-1-outage-brings-down-services-around-the-world/ Connectivity and sharing mesh networks assumes you like your neighbors. Sidewalk Whitepaper: https://m.media-amazon.com/images/G/01/sidewalk/final_privacy_security_whitepaper.pdf   network vulnerabilities: https://fractionalciso.com/why-you-should-not-be-using-xfinitywifi-hotspots/  Stalking/privacy vs. tracking/surveillance   Fine GPS locations Nearby devices triangulate (via BLE, wifi, or 900mhz) We want to find our lost devices, but devices can be used for stalking https://www.autoevolution.com/news/police-claim-apple-has-unwillingly-created-the-most-convenient-stalking-device-179228.html   Just have an iPhone and you'll be able to find a stalking device, just install a 100MB app (Ring, Alexa, etc) to detect all devices in the area, or use the right ecosystem to find these items (or know every possible device that could be used to track someone)   What do companies want with that information?   What is a ‘happy medium' to allow you to find your dog, but not to track people? Device controls? Buzzers? (how loud can you make a noise in a small device?) Size issues, battery life, beaconing, self-identification (“Hi, I am a lost device…”) Is what Airtags doing enough to reduce the fear? Are we designing to edge cases? There are cheaper/easier ways to track someone (phones have a longer standby time than fetch/airtag/tile) How often do you lose your keys? Why is your dog not on a leash or properly trained? What will it take to make these kinds of devices more secure?  https://spectrum.ieee.org/why-iot-sensors-need-standards Will it take privacy protections to motivate IoT devices to design a better IoT device? Or force standards to be followed, like https://www.ioxtalliance.org/get-ioxt-certified? Or NIST standards: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-213-draft.pdf https://csrc.nist.gov/publications/detail/sp/800-213a/final - detailed specs Threat modeling, vulnerabilities in IoT networks and platforms   Does your Iot Platform give out SDKs for integrations or allowing 3rd party products or apps? https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain/   https://www.avsystem.com/blog/iot-ecosystem/ Old and outdated libraries, like TCP vulnerabilities (RIPPLE20)   https://www.businessinsider.com/iot-security-privacy   https://www.eurofins-cybersecurity.com/news/security-problems-iot-devices/ https://arxiv.org/ftp/arxiv/papers/1302/1302.0939.pdf - Security and Privacy Issues in Wireless Mesh Networks: A Survey   https://krebsonsecurity.com/2021/09/apple-airtag-bug-enables-good-samaritan-attack/   https://www.amazon.com/gp/help/customer/display.html?nodeId=GZ4VSNFMBDHLRJUK Opt-out of Amazon sidewalk Amazon Sidewalk discussion: https://www.silabs.com/support/training/amazon-sidewalk-development/amz-103-amazon-sidewalk-technology-architecture-and-infrastructure   Fetch:As one example, this week we announced Fetch, a compact, lightweight device that will clip to your pet's collar and help ensure they're safe. If your dog wanders outside a perimeter you've set using the Ring app, Fetch will let you know. In the future, expanding the Amazon Sidewalk network will provide customers with even more capabilities like real-time location information, helping you quickly reunite with your lost pet. For device makers, Fetch also serves as a reference design to demonstrate the potential that devices connected to a broad, reliable network can provide to their customers. https://www.aboutamazon.com/news/devices/introducing-amazon-sidewalk  

Brakeing Down Security Podcast
April Wright and Alyssa Miller- Open Source sustainabilty

Brakeing Down Security Podcast

Play Episode Listen Later Jan 24, 2022 26:49


Alyssa Milller (@AlyssaM_InfoSec) April Wright (@Aprilwright) 0. Open Source issues (quick discussion, because I value your opinions, and supply chain is important in the IoT world too.) Log4j and OSS software management and profitability Free as in beer, but you pay for the cup… (license costs $$, not the software).  “If you make money using our software, you must buy a license” - not an end-user license Open source conference at Whitehouse: https://www.zdnet.com/article/log4j-after-white-house-meeting-google-calls-for-list-of-critical-open-source-projects/ https://www.wsj.com/articles/white-house-convenes-open-source-security-summit-amid-log4j-risks-11642119406 “For too long, the software community has taken comfort in the assumption that open source software is generally secure due to its transparency and the assumption that many eyes were watching to detect and resolve problems,” said Kent Walker, chief legal officer at Google in a blog post published after the meeting. “But in fact, while some projects do have many eyes on them, others have few or none at all.”  Show was inspired by this Twitter conversation: https://twitter.com/aprilwright/status/1461724712455782400?t=Fv2tmSTXrn-SSjPCka3gxg&s=19 https://twitter.com/AlyssaM_InfoSec/status/1464661807751213056?t=CFy-hgcHo2a8NwowKYo0hg&s=19 IOT architecture (https://www.avsystem.com/blog/iot-ecosystem/) Open source IoT platforms: https://www.record-evolution.de/en/open-source-iot-platforms-making-innovation-count/ Cloud services - processing messages, register/de-register devices, pass messages to other devices/gateways Gateways -  Devices -  Mobile apps - SDKs -  integrations Cloud services DO go offline, point of failure: https://www.datacenterdynamics.com/en/news/aws-us-east-1-outage-brings-down-services-around-the-world/ Connectivity and sharing mesh networks assumes you like your neighbors. Sidewalk Whitepaper: https://m.media-amazon.com/images/G/01/sidewalk/final_privacy_security_whitepaper.pdf network vulnerabilities: https://fractionalciso.com/why-you-should-not-be-using-xfinitywifi-hotspots/  Stalking/privacy vs. tracking/surveillance Fine GPS locations Nearby devices triangulate (via BLE, wifi, or 900mhz) We want to find our lost devices, but devices can be used for stalking https://www.autoevolution.com/news/police-claim-apple-has-unwillingly-created-the-most-convenient-stalking-device-179228.html Just have an iPhone and you'll be able to find a stalking device, just install a 100MB app (Ring, Alexa, etc) to detect all devices in the area, or use the right ecosystem to find these items (or know every possible device that could be used to track someone) What do companies want with that information? What is a ‘happy medium' to allow you to find your dog, but not to track people? Device controls? Buzzers? (how loud can you make a noise in a small device?) Size issues, battery life, beaconing, self-identification (“Hi, I am a lost device…”) Is what Airtags doing enough to reduce the fear? Are we designing to edge cases? There are cheaper/easier ways to track someone (phones have a longer standby time than fetch/airtag/tile) How often do you lose your keys? Why is your dog not on a leash or properly trained? What will it take to make these kinds of devices more secure?  https://spectrum.ieee.org/why-iot-sensors-need-standards Will it take privacy protections to motivate IoT devices to design a better IoT device? Or force standards to be followed, like https://www.ioxtalliance.org/get-ioxt-certified? Or NIST standards: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-213-draft.pdf https://csrc.nist.gov/publications/detail/sp/800-213a/final - detailed specs Threat modeling, vulnerabilities in IoT networks and platforms Does your Iot Platform give out SDKs for integrations or allowing 3rd party products or apps? https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain/ https://www.avsystem.com/blog/iot-ecosystem/ Old and outdated libraries, like TCP vulnerabilities (RIPPLE20) https://www.businessinsider.com/iot-security-privacy https://www.eurofins-cybersecurity.com/news/security-problems-iot-devices/ https://arxiv.org/ftp/arxiv/papers/1302/1302.0939.pdf - Security and Privacy Issues in Wireless Mesh Networks: A Survey https://krebsonsecurity.com/2021/09/apple-airtag-bug-enables-good-samaritan-attack/ https://www.amazon.com/gp/help/customer/display.html?nodeId=GZ4VSNFMBDHLRJUK Opt-out of Amazon sidewalk     Amazon Sidewalk discussion: https://www.silabs.com/support/training/amazon-sidewalk-development/amz-103-amazon-sidewalk-technology-architecture-and-infrastructure Fetch: As one example, this week we announced Fetch, a compact, lightweight device that will clip to your pet's collar and help ensure they're safe. If your dog wanders outside a perimeter you've set using the Ring app, Fetch will let you know. In the future, expanding the Amazon Sidewalk network will provide customers with even more capabilities like real-time location information, helping you quickly reunite with your lost pet. For device makers, Fetch also serves as a reference design to demonstrate the potential that devices connected to a broad, reliable network can provide to their customers. https://www.aboutamazon.com/news/devices/introducing-amazon-sidewalk  

Optrics Insider
Optrics Insider - The Largest DDoS Attack, Blue Leaks, Dating App Data Breaches & Ripple 20

Optrics Insider

Play Episode Listen Later Dec 16, 2020 9:32


Join Scott Young and Shaun Sturby from Optrics Engineering as they discuss the largest DDoS (distributed denial of service) attack, blue leaks and dating app data breaches and Ripple 20. For more IT tips go to: > www.OptricsInsider.com Timecodes: 0:00 - Intro 0:20 - Today's 3 topics 0:30 - Topic 1: The Largest DDoS Attack on Amazon Web Service 2:29 - Topic 2: Blue Leaks & Dating App Data Breaches 5:43 - Topic 3: Ripple 20 8:36 - Closing remarks Learn more about the largest DDoS attack: > AWS Shield Threat Landscape report is now available Data Breaches - BlueLeaks and Dating apps: > ‘BlueLeaks' Exposes Files from Hundreds of Police Departments > Dating Apps Exposed 845 GB of Explicit Photos, Chats, and More Learn more about Ripple 20: > New Ripple20 Flaws Put Billions of Internet-Connected Devices at Risk of Hacking > Ripple20 - 19 Zero-Day Vulnerabilities Amplified by the Supply Chain #OptricsInsider #ITSecurityTips #cybersecurity #technews #infosec --- Send in a voice message: https://anchor.fm/optrics-insider/message

Root Causes: A PKI and Security Podcast
Root Causes 116: Ripple20 Exposes TCP/IP Vulnerabilities for IoT

Root Causes: A PKI and Security Podcast

Play Episode Listen Later Aug 30, 2020 14:17


Ripple20 is a recently announced set of documented vulnerabilities in the early Treck TCP/IP stack, a popular choice for early IoT devices. Our hosts are joined by guest Alan Grau, who explains the significance of these vulnerabilities, the difficulties in dealing with them, and how we can improve to avoid these problems in the future.

@BEERISAC: CPS/ICS Security Podcast Playlist
2020-032-Dr. Allan Friedman, SBOM, Software Transparency, and how the sausage is made - Part 2

@BEERISAC: CPS/ICS Security Podcast Playlist

Play Episode Listen Later Aug 24, 2020 59:09


Podcast: Brakeing Down Security PodcastEpisode: 2020-032-Dr. Allan Friedman, SBOM, Software Transparency, and how the sausage is made - Part 2Pub date: 2020-08-24Ms. Berlin: Tabletop D&D exercise     Blumira is hiring https://www.blumira.com/career/lead-backend-engineer/  Allan Friedman - Director of Cybersecurity Initiatives, NTIA, US Department of Commerce   NTIA.gov - National Telecommunications and Information Administration   https://www.ntia.gov/sbom  SBOM guidance   Healthcare SBOM PoC - https://www.ntia.gov/files/ntia/publications/ntia_sbom_healthcare_poc_report_2019_1001.pdf   Allan’s talk at Bsides San Francisco: https://www.youtube.com/watch?v=9j1KYLfklMQ Questions (more may be added during the show, depending on answers given) What is NTIA? What is SBOM? Why do we need one? Is it poor communications between vendors?  Is there any difference between “Software transparency” and “Software bill of materials”?   How do you make an SBOM? What data formats make sharing easier? What does a company do with an SBOM?   Where in the development (hardware or software) would you be creating an SBOM?   You mention in your BSSF talk about ‘how detailed it should be’. Can you give us an example of a high level SBOM, versus a more detailed one? Does it become a risk/reward effort concerning detail?   IoT device creators are working with their 3rd parties, who are working with their 3rd parties. Someone at home with a webcam cannot easily ask for an SBOM, so how do we convince device makers to want to ask for them?   How do you get your 3rd party that is a multi-national corporation to supply you with the information you need to ?   As we saw with RIPPLE20, many companies don’t know what they have. How would SBOM help keep another RIPPLE20 from happening?   Rob Graham’s blog post highlighted that vulns like HeartBleed would not have been stopped.      How does this help us track potential vulns?    Sharing information     Best way to share information about IoT components?    Could an information sharing org (ISAC) track these more readily?   vendor assessments:     Vendor does not have an SBOM, any specific questions we might ask that will allow an org to get more resolution into a potential vendor?   Interesting feedback from NTIA’s RFC   Other SBOM types (clonedx, openbom, FDA’s CBOM)   Companies are out there creating SBOM, other government agencies have SBOM implementations. How do we keep this from being the XKCD “927” issue? https://xkcd.com/927/   non-US implementations of SBOM?   How do we get our companies to implement these?    SBOM could easily be something that could give hackers a lot of information about your org and depending on the information contained, I could see why you might not want to get super specific… Thoughts? What is a ‘Bill of Materials’? “A bill of materials (BOM) is a comprehensive inventory of the raw materials, assemblies, subassemblies, parts and components, as well as the quantities of each, needed to manufacture a product. In a nutshell, it is the complete list of all the items that are required to build a product.” SBOM - Definition    As of November 2019, an estimated 126 different platforms - https://www.postscapes.com/internet-of-things-platforms/ NTIA did an RFC on “promoting the sharing of Supply Chain Security Risk Information” https://www.ntia.gov/federal-register-notice/2020/request-comments-promoting-sharing-supply-chain-security-risk     https://www.ntia.gov/federal-register-notice/2020/comments-promoting-sharing-supply-chain-security-risk-information-0   Secure and Trusted Communications Network Act of 2019 (Act) - Calling it “CBOM”   Other groups working on similar: FDA https://www.fda.gov/media/119933/download   SPDX: LInux Foundation:https://spdx.org/licenses/    OpenBOM https://medium.com/@openbom/friday-discussion-why-boms-are-essential-for-the-iot-platform-e2c4bd397afd   https://github.com/CycloneDX/specification   https://www.fda.gov/medical-devices/digital-health/cybersecurity   https://www.fda.gov/regulatory-information/search-fda-guidance-documents/guidance-content-premarket-submissions-software-contained-medical-devices   Medical device IR Playbook: https://www.mitre.org/sites/default/files/publications/pr-18-1550-Medical-Device-Cybersecurity-Playbook.pdf   Companies are helping to get “CBOM” for devices: ““It can take anywhere from six months to a year for a new medical device to get its 510(k) clearance from the FDA,” said MedCrypt CEO Mike Kijewski in a news release”  https://www.medicaldesignandoutsourcing.com/medcrypt-acquires-medisao-in-medtech-cybersecurity-deal/   SBOM doesn’t work in DevOps: https://cybersecurity.att.com/blogs/security-essentials/software-bill-of-materials-sbom-does-it-work-for-devsecops   Intoto software development: https://www.intotosystems.com/ 510k process: https://www.drugwatch.com/fda/510k-clearance/   Check out our Store on Teepub! https://brakesec.com/store Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com #AmazonSmile: https://brakesec.com/smile  #Brakesec Store!:https://www.teepublic.com/user/bdspodcast #Spotify: https://brakesec.com/spotifyBDS #Pandora: https://pandora.app.link/p9AvwdTpT3 #RSS: https://brakesec.com/BrakesecRSS #Youtube Channel:  http://www.youtube.com/c/BDSPodcast #iTunes Store Link: https://brakesec.com/BDSiTunes #Google Play Store: https://brakesec.com/BDS-GooglePlay Our main site:  https://brakesec.com/bdswebsite #iHeartRadio App:  https://brakesec.com/iHeartBrakesec #SoundCloud: https://brakesec.com/SoundcloudBrakesec Comments, Questions, Feedback: bds.podcast@gmail.com Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon https://brakesec.com/BDSPatreon #Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir #Player.FM : https://brakesec.com/BDS-PlayerFM #Stitcher Network: https://brakesec.com/BrakeSecStitcher #TuneIn Radio App: https://brakesec.com/TuneInBrakesecThe podcast and artwork embedded on this page are from Bryan Brake, Amanda Berlin, Brian Boettcher, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Brakeing Down Security Podcast
2020-032-Dr. Allan Friedman, SBOM, Software Transparency, and how the sausage is made - Part 2

Brakeing Down Security Podcast

Play Episode Listen Later Aug 24, 2020 57:42


Ms. Berlin: Tabletop D&D exercise     Blumira is hiring https://www.blumira.com/career/lead-backend-engineer/  Allan Friedman - Director of Cybersecurity Initiatives, NTIA, US Department of Commerce   NTIA.gov - National Telecommunications and Information Administration   https://www.ntia.gov/sbom  SBOM guidance   Healthcare SBOM PoC - https://www.ntia.gov/files/ntia/publications/ntia_sbom_healthcare_poc_report_2019_1001.pdf   Allan’s talk at Bsides San Francisco: https://www.youtube.com/watch?v=9j1KYLfklMQ Questions (more may be added during the show, depending on answers given) What is NTIA? What is SBOM? Why do we need one? Is it poor communications between vendors?  Is there any difference between “Software transparency” and “Software bill of materials”?   How do you make an SBOM? What data formats make sharing easier? What does a company do with an SBOM?   Where in the development (hardware or software) would you be creating an SBOM?   You mention in your BSSF talk about ‘how detailed it should be’. Can you give us an example of a high level SBOM, versus a more detailed one? Does it become a risk/reward effort concerning detail?   IoT device creators are working with their 3rd parties, who are working with their 3rd parties. Someone at home with a webcam cannot easily ask for an SBOM, so how do we convince device makers to want to ask for them?   How do you get your 3rd party that is a multi-national corporation to supply you with the information you need to ?   As we saw with RIPPLE20, many companies don’t know what they have. How would SBOM help keep another RIPPLE20 from happening?   Rob Graham’s blog post highlighted that vulns like HeartBleed would not have been stopped.      How does this help us track potential vulns?    Sharing information     Best way to share information about IoT components?    Could an information sharing org (ISAC) track these more readily?   vendor assessments:     Vendor does not have an SBOM, any specific questions we might ask that will allow an org to get more resolution into a potential vendor?   Interesting feedback from NTIA’s RFC   Other SBOM types (clonedx, openbom, FDA’s CBOM)   Companies are out there creating SBOM, other government agencies have SBOM implementations. How do we keep this from being the XKCD “927” issue? https://xkcd.com/927/   non-US implementations of SBOM?   How do we get our companies to implement these?    SBOM could easily be something that could give hackers a lot of information about your org and depending on the information contained, I could see why you might not want to get super specific… Thoughts? What is a ‘Bill of Materials’? “A bill of materials (BOM) is a comprehensive inventory of the raw materials, assemblies, subassemblies, parts and components, as well as the quantities of each, needed to manufacture a product. In a nutshell, it is the complete list of all the items that are required to build a product.” SBOM - Definition    As of November 2019, an estimated 126 different platforms - https://www.postscapes.com/internet-of-things-platforms/ NTIA did an RFC on “promoting the sharing of Supply Chain Security Risk Information” https://www.ntia.gov/federal-register-notice/2020/request-comments-promoting-sharing-supply-chain-security-risk     https://www.ntia.gov/federal-register-notice/2020/comments-promoting-sharing-supply-chain-security-risk-information-0   Secure and Trusted Communications Network Act of 2019 (Act) - Calling it “CBOM”   Other groups working on similar: FDA https://www.fda.gov/media/119933/download   SPDX: LInux Foundation:https://spdx.org/licenses/    OpenBOM https://medium.com/@openbom/friday-discussion-why-boms-are-essential-for-the-iot-platform-e2c4bd397afd   https://github.com/CycloneDX/specification   https://www.fda.gov/medical-devices/digital-health/cybersecurity   https://www.fda.gov/regulatory-information/search-fda-guidance-documents/guidance-content-premarket-submissions-software-contained-medical-devices   Medical device IR Playbook: https://www.mitre.org/sites/default/files/publications/pr-18-1550-Medical-Device-Cybersecurity-Playbook.pdf   Companies are helping to get “CBOM” for devices: ““It can take anywhere from six months to a year for a new medical device to get its 510(k) clearance from the FDA,” said MedCrypt CEO Mike Kijewski in a news release”  https://www.medicaldesignandoutsourcing.com/medcrypt-acquires-medisao-in-medtech-cybersecurity-deal/   SBOM doesn’t work in DevOps: https://cybersecurity.att.com/blogs/security-essentials/software-bill-of-materials-sbom-does-it-work-for-devsecops   Intoto software development: https://www.intotosystems.com/ 510k process: https://www.drugwatch.com/fda/510k-clearance/   Check out our Store on Teepub! https://brakesec.com/store Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com #AmazonSmile: https://brakesec.com/smile  #Brakesec Store!:https://www.teepublic.com/user/bdspodcast #Spotify: https://brakesec.com/spotifyBDS #Pandora: https://pandora.app.link/p9AvwdTpT3 #RSS: https://brakesec.com/BrakesecRSS #Youtube Channel:  http://www.youtube.com/c/BDSPodcast #iTunes Store Link: https://brakesec.com/BDSiTunes #Google Play Store: https://brakesec.com/BDS-GooglePlay Our main site:  https://brakesec.com/bdswebsite #iHeartRadio App:  https://brakesec.com/iHeartBrakesec #SoundCloud: https://brakesec.com/SoundcloudBrakesec Comments, Questions, Feedback: bds.podcast@gmail.com Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon https://brakesec.com/BDSPatreon #Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir #Player.FM : https://brakesec.com/BDS-PlayerFM #Stitcher Network: https://brakesec.com/BrakeSecStitcher #TuneIn Radio App: https://brakesec.com/TuneInBrakesec

@BEERISAC: CPS/ICS Security Podcast Playlist
2020-031-Allan Friedman, SBOM, software transparency, and knowing how the sausage is made

@BEERISAC: CPS/ICS Security Podcast Playlist

Play Episode Listen Later Aug 23, 2020 44:50


Podcast: Brakeing Down Security PodcastEpisode: 2020-031-Allan Friedman, SBOM, software transparency, and knowing how the sausage is madePub date: 2020-08-18  Ms. Berlin: Tabletop D&D exercise Blumira is hiring https://www.blumira.com/career/lead-backend-engineer/  Allan Friedman - Director of Cybersecurity Initiatives, NTIA, US Department of Commerce NTIA.gov - National Telecommunications and Information Administration https://www.ntia.gov/sbom  SBOM guidance Healthcare SBOM PoC - https://www.ntia.gov/files/ntia/publications/ntia_sbom_healthcare_poc_report_2019_1001.pdf Allan’s talk at Bsides San Francisco: https://www.youtube.com/watch?v=9j1KYLfklMQ Questions (more may be added during the show, depending on answers given) What is NTIA? What is SBOM? Why do we need one? Is it poor communications between vendors?  Is there any difference between “Software transparency” and “Software bill of materials”?   How do you make an SBOM? What data formats make sharing easier? What does a company do with an SBOM?   Where in the development (hardware or software) would you be creating an SBOM?   You mention in your BSSF talk about ‘how detailed it should be’. Can you give us an example of a high level SBOM, versus a more detailed one? Does it become a risk/reward effort concerning detail?   IoT device creators are working with their 3rd parties, who are working with their 3rd parties. Someone at home with a webcam cannot easily ask for an SBOM, so how do we convince device makers to want to ask for them?   How do you get your 3rd party that is a multi-national corporation to supply you with the information you need to ?   As we saw with RIPPLE20, many companies don’t know what they have. How would SBOM help keep another RIPPLE20 from happening?   Rob Graham’s blog post highlighted that vulns like HeartBleed would not have been stopped.  How does this help us track potential vulns?    Sharing information Best way to share information about IoT components?    Could an information sharing org (ISAC) track these more readily?   vendor assessments: Vendor does not have an SBOM, any specific questions we might ask that will allow an org to get more resolution into a potential vendor?   Interesting feedback from NTIA’s RFC   Other SBOM types (clonedx, openbom, FDA’s CBOM)   Companies are out there creating SBOM, other government agencies have SBOM implementations. How do we keep this from being the XKCD “927” issue? https://xkcd.com/927/   non-US implementations of SBOM?   How do we get our companies to implement these?    SBOM could easily be something that could give hackers a lot of information about your org and depending on the information contained, I could see why you might not want to get super specific… Thoughts? What is a ‘Bill of Materials’? “A bill of materials (BOM) is a comprehensive inventory of the raw materials, assemblies, subassemblies, parts and components, as well as the quantities of each, needed to manufacture a product. In a nutshell, it is the complete list of all the items that are required to build a product.” SBOM - Definition As of November 2019, an estimated 126 different platforms - https://www.postscapes.com/internet-of-things-platforms/ NTIA did an RFC on “promoting the sharing of Supply Chain Security Risk Information” https://www.ntia.gov/federal-register-notice/2020/request-comments-promoting-sharing-supply-chain-security-risk https://www.ntia.gov/federal-register-notice/2020/comments-promoting-sharing-supply-chain-security-risk-information-0 Secure and Trusted Communications Network Act of 2019 (Act) - Calling it “CBOM” Other groups working on similar: FDA https://www.fda.gov/media/119933/download   SPDX: LInux Foundation:https://spdx.org/licenses/    OpenBOM https://medium.com/@openbom/friday-discussion-why-boms-are-essential-for-the-iot-platform-e2c4bd397afd   https://github.com/CycloneDX/specification https://www.fda.gov/medical-devices/digital-health/cybersecurity https://www.fda.gov/regulatory-information/search-fda-guidance-documents/guidance-content-premarket-submissions-software-contained-medical-devices Medical device IR Playbook: https://www.mitre.org/sites/default/files/publications/pr-18-1550-Medical-Device-Cybersecurity-Playbook.pdf Companies are helping to get “CBOM” for devices: ““It can take anywhere from six months to a year for a new medical device to get its 510(k) clearance from the FDA,” said MedCrypt CEO Mike Kijewski in a news release”  https://www.medicaldesignandoutsourcing.com/medcrypt-acquires-medisao-in-medtech-cybersecurity-deal/ SBOM doesn’t work in DevOps: https://cybersecurity.att.com/blogs/security-essentials/software-bill-of-materials-sbom-does-it-work-for-devsecops Intoto software development: https://www.intotosystems.com/ 510k process: https://www.drugwatch.com/fda/510k-clearance/The podcast and artwork embedded on this page are from Bryan Brake, Amanda Berlin, Brian Boettcher, which is the property of its owner and not affiliated with or endorsed by Listen Notes, Inc.

Paul's Security Weekly
The Juicy Secrets - BSW #184

Paul's Security Weekly

Play Episode Listen Later Aug 18, 2020 55:19


This week, we welcome Jeff Costlow, Deputy CISO at ExtraHop, to discuss the challenges of detecting and patching Ripple20! Ripple 20 is a series of zero-day vulnerabilities in a widely used low-level TCP/IP software library developed by Treck, Inc. In the Leadership and Communications section, CISOs say new problem solving strategies required, How Remote Work is Reshuffling Your Security Priorities and Investments, Security Jobs With a Future -- And Ones on the Way Out and more!   Show Notes: https://wiki.securityweekly.com/bsw184 Visit https://securityweekly.com/extrahop to learn more about them!   Visit https://www.securityweekly.com/bsw for all the latest episodes! Follow us on Twitter: https://www.twitter.com/securityweekly Like us on Facebook: https://www.facebook.com/secweekly

Paul's Security Weekly TV
Ripple20: Finding Vulnerable Devices & Detecting Attacks - Jeff Costlow - BSW #184

Paul's Security Weekly TV

Play Episode Listen Later Aug 18, 2020 29:58


Jeff Costlow, Deputy CISO at ExtraHop, will discuss the challenges of detecting and patching Ripple20. Ripple 20 is a series of zero-day vulnerabilities in a widely used low-level TCP/IP software library developed by Treck, Inc. There are two primary attack vectors: Internet Protocol and Domain Name Services. Jeff will discuss ExtraHop's approach to detecting these devices and provide a quick demo of the solution.   This segment is sponsored by ExtraHop Networks. Visit https://securityweekly.com/ to learn more about them! Visit https://www.securityweekly.com/bsw for all the latest episodes! Show Notes: https://wiki.securityweekly.com/bsw184

Business Security Weekly (Audio)
The Juicy Secrets - BSW #184

Business Security Weekly (Audio)

Play Episode Listen Later Aug 18, 2020 55:19


This week, we welcome Jeff Costlow, Deputy CISO at ExtraHop, to discuss the challenges of detecting and patching Ripple20! Ripple 20 is a series of zero-day vulnerabilities in a widely used low-level TCP/IP software library developed by Treck, Inc. In the Leadership and Communications section, CISOs say new problem solving strategies required, How Remote Work is Reshuffling Your Security Priorities and Investments, Security Jobs With a Future -- And Ones on the Way Out and more!   Show Notes: https://wiki.securityweekly.com/bsw184 Visit https://securityweekly.com/extrahop to learn more about them!   Visit https://www.securityweekly.com/bsw for all the latest episodes! Follow us on Twitter: https://www.twitter.com/securityweekly Like us on Facebook: https://www.facebook.com/secweekly

Brakeing Down Security Podcast
2020-031-Allan Friedman, SBOM, software transparency, and knowing how the sausage is made

Brakeing Down Security Podcast

Play Episode Listen Later Aug 18, 2020 44:50


  Ms. Berlin: Tabletop D&D exercise Blumira is hiring https://www.blumira.com/career/lead-backend-engineer/  Allan Friedman - Director of Cybersecurity Initiatives, NTIA, US Department of Commerce NTIA.gov - National Telecommunications and Information Administration https://www.ntia.gov/sbom  SBOM guidance Healthcare SBOM PoC - https://www.ntia.gov/files/ntia/publications/ntia_sbom_healthcare_poc_report_2019_1001.pdf Allan’s talk at Bsides San Francisco: https://www.youtube.com/watch?v=9j1KYLfklMQ Questions (more may be added during the show, depending on answers given) What is NTIA? What is SBOM? Why do we need one? Is it poor communications between vendors?  Is there any difference between “Software transparency” and “Software bill of materials”?   How do you make an SBOM? What data formats make sharing easier? What does a company do with an SBOM?   Where in the development (hardware or software) would you be creating an SBOM?   You mention in your BSSF talk about ‘how detailed it should be’. Can you give us an example of a high level SBOM, versus a more detailed one? Does it become a risk/reward effort concerning detail?   IoT device creators are working with their 3rd parties, who are working with their 3rd parties. Someone at home with a webcam cannot easily ask for an SBOM, so how do we convince device makers to want to ask for them?   How do you get your 3rd party that is a multi-national corporation to supply you with the information you need to ?   As we saw with RIPPLE20, many companies don’t know what they have. How would SBOM help keep another RIPPLE20 from happening?   Rob Graham’s blog post highlighted that vulns like HeartBleed would not have been stopped.  How does this help us track potential vulns?    Sharing information Best way to share information about IoT components?    Could an information sharing org (ISAC) track these more readily?   vendor assessments: Vendor does not have an SBOM, any specific questions we might ask that will allow an org to get more resolution into a potential vendor?   Interesting feedback from NTIA’s RFC   Other SBOM types (clonedx, openbom, FDA’s CBOM)   Companies are out there creating SBOM, other government agencies have SBOM implementations. How do we keep this from being the XKCD “927” issue? https://xkcd.com/927/   non-US implementations of SBOM?   How do we get our companies to implement these?    SBOM could easily be something that could give hackers a lot of information about your org and depending on the information contained, I could see why you might not want to get super specific… Thoughts? What is a ‘Bill of Materials’? “A bill of materials (BOM) is a comprehensive inventory of the raw materials, assemblies, subassemblies, parts and components, as well as the quantities of each, needed to manufacture a product. In a nutshell, it is the complete list of all the items that are required to build a product.” SBOM - Definition As of November 2019, an estimated 126 different platforms - https://www.postscapes.com/internet-of-things-platforms/ NTIA did an RFC on “promoting the sharing of Supply Chain Security Risk Information” https://www.ntia.gov/federal-register-notice/2020/request-comments-promoting-sharing-supply-chain-security-risk https://www.ntia.gov/federal-register-notice/2020/comments-promoting-sharing-supply-chain-security-risk-information-0 Secure and Trusted Communications Network Act of 2019 (Act) - Calling it “CBOM” Other groups working on similar: FDA https://www.fda.gov/media/119933/download   SPDX: LInux Foundation:https://spdx.org/licenses/    OpenBOM https://medium.com/@openbom/friday-discussion-why-boms-are-essential-for-the-iot-platform-e2c4bd397afd   https://github.com/CycloneDX/specification https://www.fda.gov/medical-devices/digital-health/cybersecurity https://www.fda.gov/regulatory-information/search-fda-guidance-documents/guidance-content-premarket-submissions-software-contained-medical-devices Medical device IR Playbook: https://www.mitre.org/sites/default/files/publications/pr-18-1550-Medical-Device-Cybersecurity-Playbook.pdf Companies are helping to get “CBOM” for devices: ““It can take anywhere from six months to a year for a new medical device to get its 510(k) clearance from the FDA,” said MedCrypt CEO Mike Kijewski in a news release”  https://www.medicaldesignandoutsourcing.com/medcrypt-acquires-medisao-in-medtech-cybersecurity-deal/ SBOM doesn’t work in DevOps: https://cybersecurity.att.com/blogs/security-essentials/software-bill-of-materials-sbom-does-it-work-for-devsecops Intoto software development: https://www.intotosystems.com/ 510k process: https://www.drugwatch.com/fda/510k-clearance/

Business Security Weekly (Video)
Ripple20: Finding Vulnerable Devices & Detecting Attacks - Jeff Costlow - BSW #184

Business Security Weekly (Video)

Play Episode Listen Later Aug 17, 2020 29:58


Jeff Costlow, Deputy CISO at ExtraHop, will discuss the challenges of detecting and patching Ripple20. Ripple 20 is a series of zero-day vulnerabilities in a widely used low-level TCP/IP software library developed by Treck, Inc. There are two primary attack vectors: Internet Protocol and Domain Name Services. Jeff will discuss ExtraHop's approach to detecting these devices and provide a quick demo of the solution.   This segment is sponsored by ExtraHop Networks. Visit https://securityweekly.com/ to learn more about them! Visit https://www.securityweekly.com/bsw for all the latest episodes! Show Notes: https://wiki.securityweekly.com/bsw184

Tenable Research Podcast
Automate all the things

Tenable Research Podcast

Play Episode Listen Later Aug 13, 2020 27:26


Our guest this month is Luke Tamagna-Darr and he tells us about some of the automation projects his team is working on, including predicting CVSS vectors when they are missing from vulnerability descriptions. As always, Satnam walks us through the latest vulnerability news as well as the work Tenable Research has done to identify devices impacted by Ripple20.Show ReferencesMicrosoft’s August 2020 Patch Tuesday Addresses 120 CVEs (CVE-2020-1337)Zero-Day Remote Code Execution Vulnerability in vBulletin DisclosedRipple20: More Vulnerable Devices Discovered, Including New VendorsCVE-2020-10713: “BootHole” GRUB2 Bootloader Arbitrary Code Execution VulnerabilityCVE-2020-3452: Cisco Adaptive Security Appliance and Firepower Threat Defense Path Traversal Vulnerability

This Week in Enterprise Tech (Video LO)
TWiET 403: Forbidden Whaling - Automation and orchestration of your DevOps World with F5 Networks

This Week in Enterprise Tech (Video LO)

Play Episode Listen Later Jul 25, 2020 79:36


Tor 0day: Stopping Tor ConnectionsNorth Korea's Lazarus Group Developing Cross-Platform Malware FrameworkDoes First Amendment let ISPs sell Web-browsing data? Judge is skepticalAmazon Met With Startups About Investing, Then Launched Competing ProductsRipple20's Effects Could Impact IoT Cybersecurity for Years to ComeFBI nabs Nigerian business scammer who allegedly cost victims millionsWhy everyone is talking about the A.I. text generator released by an Elon Musk backed lab?Cloudflare DNS goes down, taking a large piece of the internet with itTwitter Breach a Reminder of Need to Protect Corporate Social Media UseChallenges with DevOps and end-to-end integration with Hitesh Patel, senior director of product management for automation, orchestration and ecosystems with F5 Networks Hosts: Louis Maresca, Curt Franklin, and Brian McHenry Guest: Hitesh Patel Download or subscribe to this show at https://twit.tv/shows/this-week-in-enterprise-tech. Sponsors: securityscorecard.com/twit bit.ly/salesforceforservice ZipRecruiter.com/twiet

All TWiT.tv Shows (MP3)
This Week in Enterprise Tech 403: Forbidden Whaling

All TWiT.tv Shows (MP3)

Play Episode Listen Later Jul 25, 2020 79:36


Tor 0day: Stopping Tor ConnectionsNorth Korea's Lazarus Group Developing Cross-Platform Malware FrameworkDoes First Amendment let ISPs sell Web-browsing data? Judge is skepticalAmazon Met With Startups About Investing, Then Launched Competing ProductsRipple20's Effects Could Impact IoT Cybersecurity for Years to ComeFBI nabs Nigerian business scammer who allegedly cost victims millionsWhy everyone is talking about the A.I. text generator released by an Elon Musk backed lab?Cloudflare DNS goes down, taking a large piece of the internet with itTwitter Breach a Reminder of Need to Protect Corporate Social Media UseChallenges with DevOps and end-to-end integration with Hitesh Patel, senior director of product management for automation, orchestration and ecosystems with F5 Networks Hosts: Louis Maresca, Curt Franklin, and Brian McHenry Guest: Hitesh Patel Download or subscribe to this show at https://twit.tv/shows/this-week-in-enterprise-tech. Sponsors: securityscorecard.com/twit bit.ly/salesforceforservice ZipRecruiter.com/twiet

This Week in Enterprise Tech (Video HI)
TWiET 403: Forbidden Whaling - Automation and orchestration of your DevOps World with F5 Networks

This Week in Enterprise Tech (Video HI)

Play Episode Listen Later Jul 25, 2020 79:36


Tor 0day: Stopping Tor ConnectionsNorth Korea's Lazarus Group Developing Cross-Platform Malware FrameworkDoes First Amendment let ISPs sell Web-browsing data? Judge is skepticalAmazon Met With Startups About Investing, Then Launched Competing ProductsRipple20's Effects Could Impact IoT Cybersecurity for Years to ComeFBI nabs Nigerian business scammer who allegedly cost victims millionsWhy everyone is talking about the A.I. text generator released by an Elon Musk backed lab?Cloudflare DNS goes down, taking a large piece of the internet with itTwitter Breach a Reminder of Need to Protect Corporate Social Media UseChallenges with DevOps and end-to-end integration with Hitesh Patel, senior director of product management for automation, orchestration and ecosystems with F5 Networks Hosts: Louis Maresca, Curt Franklin, and Brian McHenry Guest: Hitesh Patel Download or subscribe to this show at https://twit.tv/shows/this-week-in-enterprise-tech. Sponsors: securityscorecard.com/twit bit.ly/salesforceforservice ZipRecruiter.com/twiet

This Week in Enterprise Tech (Video HD)
TWiET 403: Forbidden Whaling - Automation and orchestration of your DevOps World with F5 Networks

This Week in Enterprise Tech (Video HD)

Play Episode Listen Later Jul 25, 2020 79:36


Tor 0day: Stopping Tor ConnectionsNorth Korea's Lazarus Group Developing Cross-Platform Malware FrameworkDoes First Amendment let ISPs sell Web-browsing data? Judge is skepticalAmazon Met With Startups About Investing, Then Launched Competing ProductsRipple20's Effects Could Impact IoT Cybersecurity for Years to ComeFBI nabs Nigerian business scammer who allegedly cost victims millionsWhy everyone is talking about the A.I. text generator released by an Elon Musk backed lab?Cloudflare DNS goes down, taking a large piece of the internet with itTwitter Breach a Reminder of Need to Protect Corporate Social Media UseChallenges with DevOps and end-to-end integration with Hitesh Patel, senior director of product management for automation, orchestration and ecosystems with F5 Networks Hosts: Louis Maresca, Curt Franklin, and Brian McHenry Guest: Hitesh Patel Download or subscribe to this show at https://twit.tv/shows/this-week-in-enterprise-tech. Sponsors: securityscorecard.com/twit bit.ly/salesforceforservice ZipRecruiter.com/twiet

This Week in Enterprise Tech (MP3)
TWiET 403: Forbidden Whaling - Automation and orchestration of your DevOps World with F5 Networks

This Week in Enterprise Tech (MP3)

Play Episode Listen Later Jul 25, 2020 79:36


Tor 0day: Stopping Tor ConnectionsNorth Korea's Lazarus Group Developing Cross-Platform Malware FrameworkDoes First Amendment let ISPs sell Web-browsing data? Judge is skepticalAmazon Met With Startups About Investing, Then Launched Competing ProductsRipple20's Effects Could Impact IoT Cybersecurity for Years to ComeFBI nabs Nigerian business scammer who allegedly cost victims millionsWhy everyone is talking about the A.I. text generator released by an Elon Musk backed lab?Cloudflare DNS goes down, taking a large piece of the internet with itTwitter Breach a Reminder of Need to Protect Corporate Social Media UseChallenges with DevOps and end-to-end integration with Hitesh Patel, senior director of product management for automation, orchestration and ecosystems with F5 Networks Hosts: Louis Maresca, Curt Franklin, and Brian McHenry Guest: Hitesh Patel Download or subscribe to this show at https://twit.tv/shows/this-week-in-enterprise-tech. Sponsors: securityscorecard.com/twit bit.ly/salesforceforservice ZipRecruiter.com/twiet

Brakeing Down Security Podcast
2020-028-Shlomi Oberman, RIPPLE20, supply chain security discussion, software bill of materials

Brakeing Down Security Podcast

Play Episode Listen Later Jul 24, 2020 60:51


Whitepaper: https://www.jsof-tech.com/ripple20/ [blog] Build your own custom TCP/IP stack: https://www.saminiir.com/lets-code-tcp-ip-stack-1-ethernet-arp/ Another custom TCP/IP stack: https://github.com/tass-belgium/picotcp RIPPLE 20 Whitepaper: https://drive.google.com/file/d/1d3NNVCRPVFk0-V0HUO5CxWWVn9pYIvmF/view?usp=sharing  Agenda: Part 1: Background on the report Why is it called RIPPLE20? What’s the RIPPLE about?  Communications with Treck (and it’s Japanese counterpart) Were you surprised about the reaction? Positive or negative? Types of systems affected? IoT Embedded systems SCADA What precipitated the research? What difficulties did you face in finding these vulns? Deadlines?  What tools were used for analysis? (I think you mentioned Forescout --brbr) What kind of extensibility are we talking about? TCP sizes?  What did JSOF gain by doing this?  What were the initial benefits of using the TCP/IP stack? Speed? Size? Do these vulns affect other TCP/IP stacks?  Did Treck give you access to source? Any specific requirements set by Treck? Any items that were off-limits?  Updates since the report was released? Are your vulns such that they can be detected online? Part 2: Supply chain issues What should companies do when they don’t know what’s in their own tech stack? https://csrc.nist.gov/CSRC/media/Projects/Supply-Chain-Risk-Management/documents/briefings/Workshop-Brief-on-Cyber-Supply-Chain-Best-Practices.pdf   Software bill of materials: https://en.wikipedia.org/wiki/Software_bill_of_materials PicoTCP link above does not release all code, because they use binary blobs that make proper code review next to impossible “Unfortunately we can't release all the code, a.o. because some parts depend on code or binaries that aren't GPL compatible, some parts were developed under a commercial contract, and some consist of very rough proof-of-concept code. If you want to know more about the availability under the commercial license, or the possibility of using our expert services for porting or driver development, feel free to contact us at picotcp@altran.com.” BLoBs = https://en.wikipedia.org/wiki/Proprietary_device_driver Vendor Contact How many organizations are affected by these vulnerabilities?  Are some devices and systems more vulnerable than others?  How many are you still investigating to see if they are affected?   What’s the initial email look like when you tell a company “you’re vulnerable to X”? Who are you dealing with initially? What is your delivery when you’re routed to non-technical people? How did you tailor your initial response when you learned of the position of the person? Lessons Learned: What would you have done differently next time? Any additional tooling that you’d have used? BlackHat talk: 05 August What should companies do to reduce or mitigate the chances of the types of vulnerabilities found by your org? https://cambridgewirelessblog.wordpress.com/2016/05/18/supply-chain-security-and-compliance-for-embedded-devices-iot/   https://blog.shi.com/solutions/embedded-hardware-supply-chain-attacks-embedded-system-attacks-how-to-stay-safe/   http://www.intrinsic-id.com/wp-content/uploads/2018/02/2016-A-Platform-Solution-for-Secure-Supply-Chain-and-Chip-Cycle-Management-Computer-Volume-49-Issue-8-Aug.-2016-Joseph-P.-Skudlarek-Tom-Katsioulas-Michael-Chen-%E2%80%93-Mentor-Graphics..pdf https://www.supplychainservices.com/blog/major-security-risks-windows-embedded-users https://www.bbc.com/news/business-32716802#:~:text=Japanese%20car%20giants%20Toyota%20and,March%202003%20and%20November%202007.   Check out our Store on Teepub! https://brakesec.com/store Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com #Brakesec Store!:https://www.teepublic.com/user/bdspodcast #Spotify: https://brakesec.com/spotifyBDS #Pandora: https://pandora.app.link/p9AvwdTpT3 #RSS: https://brakesec.com/BrakesecRSS #Youtube Channel:  http://www.youtube.com/c/BDSPodcast #iTunes Store Link: https://brakesec.com/BDSiTunes #Google Play Store: https://brakesec.com/BDS-GooglePlay Our main site:  https://brakesec.com/bdswebsite #iHeartRadio App:  https://brakesec.com/iHeartBrakesec #SoundCloud: https://brakesec.com/SoundcloudBrakesec Comments, Questions, Feedback: bds.podcast@gmail.com Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon https://brakesec.com/BDSPatreon #Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir #Player.FM : https://brakesec.com/BDS-PlayerFM #Stitcher Network: https://brakesec.com/BrakeSecStitcher #TuneIn Radio App: https://brakesec.com/TuneInBrakesec

Brakeing Down Security Podcast
2020-027-RIPPLE20 Report, supply chain security, responsible disclosure, software development, and vendor care.

Brakeing Down Security Podcast

Play Episode Listen Later Jul 16, 2020 48:34


Whitepaper: https://www.jsof-tech.com/ripple20/ [blog] Build your own custom TCP/IP stack: https://www.saminiir.com/lets-code-tcp-ip-stack-1-ethernet-arp/ Another custom TCP/IP stack: https://github.com/tass-belgium/picotcp RIPPLE 20 Whitepaper: https://drive.google.com/file/d/1d3NNVCRPVFk0-V0HUO5CxWWVn9pYIvmF/view?usp=sharing  Agenda: Part 1: Background on the report Why is it called RIPPLE20? What’s the RIPPLE about?  Communications with Treck (and it’s Japanese counterpart) Were you surprised about the reaction? Positive or negative? Types of systems affected? IoT Embedded systems SCADA What precipitated the research? What difficulties did you face in finding these vulns? Deadlines?  What tools were used for analysis? (I think you mentioned Forescout --brbr) What kind of extensibility are we talking about? TCP sizes?  What did JSOF gain by doing this?  What were the initial benefits of using the TCP/IP stack? Speed? Size? Do these vulns affect other TCP/IP stacks?  Did Treck give you access to source? Any specific requirements set by Treck? Any items that were off-limits?  Updates since the report was released? Are your vulns such that they can be detected online? Part 2: Supply chain issues What should companies do when they don’t know what’s in their own tech stack? https://csrc.nist.gov/CSRC/media/Projects/Supply-Chain-Risk-Management/documents/briefings/Workshop-Brief-on-Cyber-Supply-Chain-Best-Practices.pdf   Software bill of materials: https://en.wikipedia.org/wiki/Software_bill_of_materials PicoTCP link above does not release all code, because they use binary blobs that make proper code review next to impossible “Unfortunately we can't release all the code, a.o. because some parts depend on code or binaries that aren't GPL compatible, some parts were developed under a commercial contract, and some consist of very rough proof-of-concept code. If you want to know more about the availability under the commercial license, or the possibility of using our expert services for porting or driver development, feel free to contact us at picotcp@altran.com.” BLoBs = https://en.wikipedia.org/wiki/Proprietary_device_driver Vendor Contact How many organizations are affected by these vulnerabilities?  Are some devices and systems more vulnerable than others?  How many are you still investigating to see if they are affected?   What’s the initial email look like when you tell a company “you’re vulnerable to X”? Who are you dealing with initially? What is your delivery when you’re routed to non-technical people? How did you tailor your initial response when you learned of the position of the person? Lessons Learned: What would you have done differently next time? Any additional tooling that you’d have used? BlackHat talk: 05 August What should companies do to reduce or mitigate the chances of the types of vulnerabilities found by your org? https://cambridgewirelessblog.wordpress.com/2016/05/18/supply-chain-security-and-compliance-for-embedded-devices-iot/   https://blog.shi.com/solutions/embedded-hardware-supply-chain-attacks-embedded-system-attacks-how-to-stay-safe/   http://www.intrinsic-id.com/wp-content/uploads/2018/02/2016-A-Platform-Solution-for-Secure-Supply-Chain-and-Chip-Cycle-Management-Computer-Volume-49-Issue-8-Aug.-2016-Joseph-P.-Skudlarek-Tom-Katsioulas-Michael-Chen-%E2%80%93-Mentor-Graphics..pdf https://www.supplychainservices.com/blog/major-security-risks-windows-embedded-users https://www.bbc.com/news/business-32716802#:~:text=Japanese%20car%20giants%20Toyota%20and,March%202003%20and%20November%202007.   Check out our Store on Teepub! https://brakesec.com/store Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com #Brakesec Store!:https://www.teepublic.com/user/bdspodcast #Spotify: https://brakesec.com/spotifyBDS #Pandora: https://pandora.app.link/p9AvwdTpT3 #RSS: https://brakesec.com/BrakesecRSS #Youtube Channel:  http://www.youtube.com/c/BDSPodcast #iTunes Store Link: https://brakesec.com/BDSiTunes #Google Play Store: https://brakesec.com/BDS-GooglePlay Our main site:  https://brakesec.com/bdswebsite #iHeartRadio App:  https://brakesec.com/iHeartBrakesec #SoundCloud: https://brakesec.com/SoundcloudBrakesec Comments, Questions, Feedback: bds.podcast@gmail.com Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon https://brakesec.com/BDSPatreon #Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir #Player.FM : https://brakesec.com/BDS-PlayerFM #Stitcher Network: https://brakesec.com/BrakeSecStitcher #TuneIn Radio App: https://brakesec.com/TuneInBrakesec    

Tenable Research Podcast
10/10 Would Patch Again

Tenable Research Podcast

Play Episode Listen Later Jul 16, 2020 34:33


Satnam starts us off with a veritable parade of vulnerabilities maxing out CVSS severity. Ripple20, PAN OS, BIG-IP, SIGRed, RECON - lots to cover and Satnam breaks it all down for us. As a bit of a palate cleanser, we talk to Tony Huffman and Tyler Coumbes about how Threat Automation works in products.Show ReferencesCVE-2020-11896, CVE-2020-11897, CVE-2020-11901: Ripple20 Zero-Day Vulnerabilities in Treck TCP/IP Libraries DisclosedCVE-2020-2021: Palo Alto Networks PAN-OS Vulnerable to Critical Authentication Bypass Vulnerabilityhttps://twitter.com/RyanLNewington/status/1278074919092289537?s=20 CVE-2017-7391: Vulnerability in Magento Mass Import (MAGMI) Plugin Exploited in the WildCVE-2020-5902: Critical Vulnerability in F5 BIG-IP Traffic Management User Interface (TMUI) Actively ExploitedCVE-2020-6287: Critical Vulnerability in SAP NetWeaver Application Server JAVA Disclosed (RECON)Microsoft’s July 2020 Patch Tuesday Addresses 123 CVEs Including Wormable Windows DNS Server RCE (CVE-2020-1350) (SIGRed)CVE-2020-1350: Wormable Remote Code Execution Vulnerability in Windows DNS Server Disclosed (SIGRed)Tenable Research Discloses Multiple Vulnerabilities in Plex Media Server

Security Stories
9: Creating more opportunities for others, with Andy Ellis

Security Stories

Play Episode Play 30 sec Highlight Listen Later Jul 13, 2020 88:28


In this episode we chat to Andy Ellis, who, on the very day we interviewed him, was celebrating his 20th anniversary as the Chief Security Officer for Akamai. We cover many topics - from taking down the "booth babe" culture at RSA, to fighting for more representation and diversity on cyber panels, to how he eliminated the password at his organization and built a Zero Trust network, before that became a thing. Andy also shares one of the most interesting Star Wars theories we've ever heard, and has a fascinating take on heroes vs villains, and how the two overlap depending on who's telling the story. He then talks about why he hires librarians and journalists in his security team, and also, exactly how hard it is to train lizards. (The last two topics aren't related, btw!)You can read Akamai's "State of the Internet" report here: https://www.akamai.com/uk/en/resources/our-thinking/state-of-the-internet-report/In the studio, Hazel and Ben are joined (virtually) again by Noureen Njoroge. Following the interview with Andy, Noureen talks incredibly passionately about her advocacy roles for women and minorities in cybersecurity, and some of the mentoring work that she does. For anyone who wants to know more about what they can do to give more opportunities for others - don't miss this section.For our 'Emerging Threats' feature, we cover Ripple20: a set of 19 critical vulnerabilities impacting a TCP/IP software stack, used by wide variety of vendors and installed on millions of systems: enterprise network, consumer devices, but also IIoT. More details can be read about this in our blog: https://blogs.cisco.com/security/ripple20-critical-vulnerabilities-might-be-putting-your-iot-ot-devices-at-risk And finally we have our 'On this Day' feature, which is when we jump into the DeLorean and head back in time to explore a significant security event. This time we’re travelling back to 2001 to talk about Sircam, which was a notable worm that spread by email. The series of unfortunate events often started with a couple of lines of text that began ‘I send you this file in order to have your advice’.If you'd like to know more about the advocacy roles for women and minorites that Noureen is involved in, as well as access a wealth of cybersecurity resources, you can check them out at https://cybersecmentorship.org

Security Now (Video HD)
SN 773: Ripple20 Too

Security Now (Video HD)

Play Episode Listen Later Jul 1, 2020 111:43


Congress wants to kill encryption & face recognition.New information about Ripple20The Facial Recognition and Biometric Technology Moratorium Act wants to kill face recognitionThe Lawful Access to Encrypted Data Act wants to kill encryptionMichigan State's legislative House passed the "Microchip Protection Act"Apple forces the industry down to one-year web browser certificate lifespansSafari to eschew 16 new web API's for the sake of user privacyApple also got on the DoH & DoT bandwagonMozilla + Comcast + DoH: Strange BedfellowsDon't forget about VirusTotalWe invite you to read our show notes at https://www.grc.com/sn/SN-773-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: Melissa.com/twit OpenShift.com/SecurityNow expressvpn.com/securitynow

All TWiT.tv Shows (Video HD)
Security Now 773: Ripple20 Too

All TWiT.tv Shows (Video HD)

Play Episode Listen Later Jul 1, 2020 111:43


Congress wants to kill encryption & face recognition.New information about Ripple20The Facial Recognition and Biometric Technology Moratorium Act wants to kill face recognitionThe Lawful Access to Encrypted Data Act wants to kill encryptionMichigan State's legislative House passed the "Microchip Protection Act"Apple forces the industry down to one-year web browser certificate lifespansSafari to eschew 16 new web API's for the sake of user privacyApple also got on the DoH & DoT bandwagonMozilla + Comcast + DoH: Strange BedfellowsDon't forget about VirusTotalWe invite you to read our show notes at https://www.grc.com/sn/SN-773-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: Melissa.com/twit OpenShift.com/SecurityNow expressvpn.com/securitynow

Security Now (Video LO)
SN 773: Ripple20 Too

Security Now (Video LO)

Play Episode Listen Later Jul 1, 2020 111:43


Congress wants to kill encryption & face recognition.New information about Ripple20The Facial Recognition and Biometric Technology Moratorium Act wants to kill face recognitionThe Lawful Access to Encrypted Data Act wants to kill encryptionMichigan State's legislative House passed the "Microchip Protection Act"Apple forces the industry down to one-year web browser certificate lifespansSafari to eschew 16 new web API's for the sake of user privacyApple also got on the DoH & DoT bandwagonMozilla + Comcast + DoH: Strange BedfellowsDon't forget about VirusTotalWe invite you to read our show notes at https://www.grc.com/sn/SN-773-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: Melissa.com/twit OpenShift.com/SecurityNow expressvpn.com/securitynow

All TWiT.tv Shows (Video HI)
Security Now 773: Ripple20 Too

All TWiT.tv Shows (Video HI)

Play Episode Listen Later Jul 1, 2020 111:43


Congress wants to kill encryption & face recognition.New information about Ripple20The Facial Recognition and Biometric Technology Moratorium Act wants to kill face recognitionThe Lawful Access to Encrypted Data Act wants to kill encryptionMichigan State's legislative House passed the "Microchip Protection Act"Apple forces the industry down to one-year web browser certificate lifespansSafari to eschew 16 new web API's for the sake of user privacyApple also got on the DoH & DoT bandwagonMozilla + Comcast + DoH: Strange BedfellowsDon't forget about VirusTotalWe invite you to read our show notes at https://www.grc.com/sn/SN-773-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: Melissa.com/twit OpenShift.com/SecurityNow expressvpn.com/securitynow

Security Now (MP3)
SN 773: Ripple20 Too

Security Now (MP3)

Play Episode Listen Later Jul 1, 2020 111:43


Congress wants to kill encryption & face recognition.New information about Ripple20The Facial Recognition and Biometric Technology Moratorium Act wants to kill face recognitionThe Lawful Access to Encrypted Data Act wants to kill encryptionMichigan State's legislative House passed the "Microchip Protection Act"Apple forces the industry down to one-year web browser certificate lifespansSafari to eschew 16 new web API's for the sake of user privacyApple also got on the DoH & DoT bandwagonMozilla + Comcast + DoH: Strange BedfellowsDon't forget about VirusTotalWe invite you to read our show notes at https://www.grc.com/sn/SN-773-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: Melissa.com/twit OpenShift.com/SecurityNow expressvpn.com/securitynow

All TWiT.tv Shows (MP3)
Security Now 773: Ripple20 Too

All TWiT.tv Shows (MP3)

Play Episode Listen Later Jul 1, 2020 111:43


Congress wants to kill encryption & face recognition.New information about Ripple20The Facial Recognition and Biometric Technology Moratorium Act wants to kill face recognitionThe Lawful Access to Encrypted Data Act wants to kill encryptionMichigan State's legislative House passed the "Microchip Protection Act"Apple forces the industry down to one-year web browser certificate lifespansSafari to eschew 16 new web API's for the sake of user privacyApple also got on the DoH & DoT bandwagonMozilla + Comcast + DoH: Strange BedfellowsDon't forget about VirusTotalWe invite you to read our show notes at https://www.grc.com/sn/SN-773-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: Melissa.com/twit OpenShift.com/SecurityNow expressvpn.com/securitynow

Radio Leo (Video LO)
Security Now 773: Ripple20 Too

Radio Leo (Video LO)

Play Episode Listen Later Jul 1, 2020 111:43


Congress wants to kill encryption & face recognition.New information about Ripple20The Facial Recognition and Biometric Technology Moratorium Act wants to kill face recognitionThe Lawful Access to Encrypted Data Act wants to kill encryptionMichigan State's legislative House passed the "Microchip Protection Act"Apple forces the industry down to one-year web browser certificate lifespansSafari to eschew 16 new web API's for the sake of user privacyApple also got on the DoH & DoT bandwagonMozilla + Comcast + DoH: Strange BedfellowsDon't forget about VirusTotalWe invite you to read our show notes at https://www.grc.com/sn/SN-773-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: Melissa.com/twit OpenShift.com/SecurityNow expressvpn.com/securitynow

Security Now (Video HI)
SN 773: Ripple20 Too

Security Now (Video HI)

Play Episode Listen Later Jul 1, 2020 111:43


Congress wants to kill encryption & face recognition.New information about Ripple20The Facial Recognition and Biometric Technology Moratorium Act wants to kill face recognitionThe Lawful Access to Encrypted Data Act wants to kill encryptionMichigan State's legislative House passed the "Microchip Protection Act"Apple forces the industry down to one-year web browser certificate lifespansSafari to eschew 16 new web API's for the sake of user privacyApple also got on the DoH & DoT bandwagonMozilla + Comcast + DoH: Strange BedfellowsDon't forget about VirusTotalWe invite you to read our show notes at https://www.grc.com/sn/SN-773-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: Melissa.com/twit OpenShift.com/SecurityNow expressvpn.com/securitynow

Radio Leo (Video HI)
Security Now 773: Ripple20 Too

Radio Leo (Video HI)

Play Episode Listen Later Jul 1, 2020 111:43


Congress wants to kill encryption & face recognition.New information about Ripple20The Facial Recognition and Biometric Technology Moratorium Act wants to kill face recognitionThe Lawful Access to Encrypted Data Act wants to kill encryptionMichigan State's legislative House passed the "Microchip Protection Act"Apple forces the industry down to one-year web browser certificate lifespansSafari to eschew 16 new web API's for the sake of user privacyApple also got on the DoH & DoT bandwagonMozilla + Comcast + DoH: Strange BedfellowsDon't forget about VirusTotalWe invite you to read our show notes at https://www.grc.com/sn/SN-773-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: Melissa.com/twit OpenShift.com/SecurityNow expressvpn.com/securitynow

Radio Leo (Video HD)
Security Now 773: Ripple20 Too

Radio Leo (Video HD)

Play Episode Listen Later Jul 1, 2020 111:43


Congress wants to kill encryption & face recognition.New information about Ripple20The Facial Recognition and Biometric Technology Moratorium Act wants to kill face recognitionThe Lawful Access to Encrypted Data Act wants to kill encryptionMichigan State's legislative House passed the "Microchip Protection Act"Apple forces the industry down to one-year web browser certificate lifespansSafari to eschew 16 new web API's for the sake of user privacyApple also got on the DoH & DoT bandwagonMozilla + Comcast + DoH: Strange BedfellowsDon't forget about VirusTotalWe invite you to read our show notes at https://www.grc.com/sn/SN-773-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: Melissa.com/twit OpenShift.com/SecurityNow expressvpn.com/securitynow

All TWiT.tv Shows (Video LO)
Security Now 773: Ripple20 Too

All TWiT.tv Shows (Video LO)

Play Episode Listen Later Jul 1, 2020 111:43


Congress wants to kill encryption & face recognition.New information about Ripple20The Facial Recognition and Biometric Technology Moratorium Act wants to kill face recognitionThe Lawful Access to Encrypted Data Act wants to kill encryptionMichigan State's legislative House passed the "Microchip Protection Act"Apple forces the industry down to one-year web browser certificate lifespansSafari to eschew 16 new web API's for the sake of user privacyApple also got on the DoH & DoT bandwagonMozilla + Comcast + DoH: Strange BedfellowsDon't forget about VirusTotalWe invite you to read our show notes at https://www.grc.com/sn/SN-773-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: Melissa.com/twit OpenShift.com/SecurityNow expressvpn.com/securitynow

Technically Podcast
Episode 01 : June 27, 2020

Technically Podcast

Play Episode Listen Later Jun 29, 2020 22:12


Our first episode of our new podcast! Show Notes: Docker Cryptojacking: https://unit42.paloaltonetworks.com/cryptojacking-docker-images-for-mining-monero/ https://www.binarydefense.com/threat_watch/docker-images-containing-cryptojacking-malware-distributed-via-docker-hub/ BlueLeaks: https://krebsonsecurity.com/2020/06/blueleaks-exposes-files-from-hundreds-of-police-departments/ Ripple20: https://thehackernews.com/2020/06/new-critical-flaws-put-billions-of.html Apple ARM CPUs: https://www.techradar.com/news/intel-cpu-woes-forced-apple-to-design-own-processor-claims-ex-employee Amazon Buys Zoox: https://zoox.com/wp-content/uploads/2018/12/Safety_Report_12Dec2018.pdf https://www.usatoday.com/story/money/2020/06/27/amazon-is-buying-self-driving-startup-zoox/112021444/ Fugaku Supercomputer: https://www.pcmag.com/news/japans-arm-based-fugaku-system-now-the-worlds-fastest-supercomputer Intel AI Degree: https://www.abc15.com/news/business/intel-set-to-debut-artificial-intelligence-degree-program-in-valley

AT&T ThreatTraq
Ripple20; VirusTotal AI; Markley Quiz; O365 Phishing; Internet Weather

AT&T ThreatTraq

Play Episode Listen Later Jun 26, 2020 31:06


Ripple20; VirusTotal AI; Markley Quiz; O365 Phishing; Internet Weather

The CyberPHIx: Meditology Services Podcast
The CyberPHIx Roundup: Industry News & Trends, 6/24/20

The CyberPHIx: Meditology Services Podcast

Play Episode Listen Later Jun 24, 2020 14:31


The CyberPHIx Roundup is your quick source for keeping up with the latest cybersecurity news, trends and industry leading practices, specifically for the healthcare industry. In this episode, our host Brian Selfridge highlights the following topics trending in healthcare cybersecurity this week: Arrest of a hacker charged with UPMC health system hack in 2014; discussion of attacker motives, methods of sale of healthcare data, and “bad guy business drivers” in healthcare Medical device and IoT alerts from Homeland Security including six prominent manufacturers vulnerabilities and the “Ripple20” vulnerabilities affecting millions of IoT and IoMT devices Healthcare organization adaptations to the “new normal”; an analysis of post-COVID business models and technologies that are causing security and risk teams to adjust their approaches. Trends covered include communication with remote workforce, collaboration tools, telehealth technology, incident response, and more

Brakeing Down Security Podcast
2020-024-Bit of news, Ripple20 vulns, IoT Security, windows error codes, captchas used for evil, Marine Momma

Brakeing Down Security Podcast

Play Episode Listen Later Jun 24, 2020 49:51


https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/   https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3 https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4657 https://www.blumira.com/logmira-windows-logging-policies-for-better-threat-detection/   How would we map this against the MITRE matrix? Are there any MITRE attack types that are so similar that one attack can be two different things in the matrix?   https://www.us-cert.gov/ics/advisories/icsa-20-168-01 https://www.zdnet.com/article/ripple20-vulnerabilities-will-haunt-the-iot-landscape-for-years-to-come/   https://www.tenable.com/blog/cve-2020-11896-cve-2020-11897-cve-2020-11901-ripple20-zero-day-vulnerabilities-in-treck-tcpip https://arstechnica.com/information-technology/2020/06/to-evade-detection-hackers-are-requiring-targets-to-complete-captchas/   Check out our Store on Teepub! https://brakesec.com/store Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com #Brakesec Store!:https://www.teepublic.com/user/bdspodcast #Spotify: https://brakesec.com/spotifyBDS #Pandora: https://pandora.app.link/p9AvwdTpT3 #RSS: https://brakesec.com/BrakesecRSS #Youtube Channel:  http://www.youtube.com/c/BDSPodcast #iTunes Store Link: https://brakesec.com/BDSiTunes #Google Play Store: https://brakesec.com/BDS-GooglePlay Our main site:  https://brakesec.com/bdswebsite #iHeartRadio App:  https://brakesec.com/iHeartBrakesec #SoundCloud: https://brakesec.com/SoundcloudBrakesec Comments, Questions, Feedback: bds.podcast@gmail.com Support Brakeing Down Security Podcast by using our #Paypal: https://brakesec.com/PaypalBDS OR our #Patreon https://brakesec.com/BDSPatreon #Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir #Player.FM : https://brakesec.com/BDS-PlayerFM #Stitcher Network: https://brakesec.com/BrakeSecStitcher #TuneIn Radio App: https://brakesec.com/TuneInBrakesec

Security Now (Video HD)
SN 772: Ripple20

Security Now (Video HD)

Play Episode Listen Later Jun 24, 2020 127:14


Zoom encryption, Windows 10 printer error.Ripple20: a set of 19 TCP/IP vulnerabilities that could let remote attackers gain control over your deviceRussian government lifts its failed ban on TelegramZoom: everybody gets optional end to end encryptionGoogle removed 106 malicious Chrome extensions collecting sensitive user dataWindows 10 update breaks printingVLC Media Player 3.0.11 fixes severe remote code execution flawNetgear in the doghouseDDoS is alive and well... and growingHow to get the new Edge for Windows 7We invite you to read our show notes at https://www.grc.com/sn/SN-772-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: GetRoman.com/SECURITYNOW extrahop.com/SECURITYNOW Wasabi.com offer code SECURITYNOW

MorphusCast
MorphusCast #3 - Ripple20 Traz À Tona Riscos E Preocupações Com A Cadeia De Suprimentos

MorphusCast

Play Episode Listen Later Jun 24, 2020 22:10


Semanalmente, Joel Teixeira e Renato Marinho trarão os assuntos mais quentes e, ocasionalmente, alguns nomes de peso, do universo da segurança da informação. No terceiro episódio dessa nova temporada, falamos sobre as vulnerabilidades, denominadas Ripple20, que afetam milhões de dispositivos de diferentes produtos, tais como impressoras, bombas de infusão e dispositivos industriais de múltiplos fabricantes, tais como HP, Schneider Electric, Intel, Rockwell Automation, Caterpillar, Baxter em múltiplas indústrias. *Disponível também no YouTube: https://www.youtube.com/watch?v=5UhwVAu_zfs&feature=youtu.be -------- ACOMPANHE OS NOSSOS CANAIS: https://www.instagram.com/morphusecurity https://www.linkedin.com/company/morphusecurity https://www.facebook.com/morphustecnologia NOSSO BLOG DE CONTEÚDO: https://www.medium.com/morphusblog -------- INFORMAÇÕES: https://www.morphus.com.br https://www.morphuslabs.com

Security Now (MP3)
SN 772: Ripple20

Security Now (MP3)

Play Episode Listen Later Jun 24, 2020 127:14


Zoom encryption, Windows 10 printer error.Ripple20: a set of 19 TCP/IP vulnerabilities that could let remote attackers gain control over your deviceRussian government lifts its failed ban on TelegramZoom: everybody gets optional end to end encryptionGoogle removed 106 malicious Chrome extensions collecting sensitive user dataWindows 10 update breaks printingVLC Media Player 3.0.11 fixes severe remote code execution flawNetgear in the doghouseDDoS is alive and well... and growingHow to get the new Edge for Windows 7We invite you to read our show notes at https://www.grc.com/sn/SN-772-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: GetRoman.com/SECURITYNOW extrahop.com/SECURITYNOW Wasabi.com offer code SECURITYNOW

Security Now (Video LO)
SN 772: Ripple20

Security Now (Video LO)

Play Episode Listen Later Jun 24, 2020 127:14


Zoom encryption, Windows 10 printer error.Ripple20: a set of 19 TCP/IP vulnerabilities that could let remote attackers gain control over your deviceRussian government lifts its failed ban on TelegramZoom: everybody gets optional end to end encryptionGoogle removed 106 malicious Chrome extensions collecting sensitive user dataWindows 10 update breaks printingVLC Media Player 3.0.11 fixes severe remote code execution flawNetgear in the doghouseDDoS is alive and well... and growingHow to get the new Edge for Windows 7We invite you to read our show notes at https://www.grc.com/sn/SN-772-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: GetRoman.com/SECURITYNOW extrahop.com/SECURITYNOW Wasabi.com offer code SECURITYNOW

Security Now (Video HI)
SN 772: Ripple20

Security Now (Video HI)

Play Episode Listen Later Jun 24, 2020 127:14


Zoom encryption, Windows 10 printer error.Ripple20: a set of 19 TCP/IP vulnerabilities that could let remote attackers gain control over your deviceRussian government lifts its failed ban on TelegramZoom: everybody gets optional end to end encryptionGoogle removed 106 malicious Chrome extensions collecting sensitive user dataWindows 10 update breaks printingVLC Media Player 3.0.11 fixes severe remote code execution flawNetgear in the doghouseDDoS is alive and well... and growingHow to get the new Edge for Windows 7We invite you to read our show notes at https://www.grc.com/sn/SN-772-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. You can submit a question to Security Now! at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: GetRoman.com/SECURITYNOW extrahop.com/SECURITYNOW Wasabi.com offer code SECURITYNOW

Tierra de Hackers
Episodio 6 - Fake news, espionaje, CIA, malware, Palantir, Ripple20, exposición de datos e Intel

Tierra de Hackers

Play Episode Listen Later Jun 22, 2020 96:53


Campaña masiva de desinformación Rusa al descubierto. ¿Objetivo? Desestabilizar el mundo. - Lamphone: el ataque que permite convertir una bombilla en un dispositivo espía de escucha. Un informe publicado por un senador estadounidense saca los colores a la CIA, sus medidas de seguridad en entredicho. Ripple20, el compendio de vulnerabilidades que permite obtener control total de millones de dispositivos IoT y de control industrial. El sistema nacional de sanidad británico, vende toda la información de los pacientes a empresas dedicadas a espionaje por el módico precio de un euro. Negocios legales en múltiples países sirven como tapadera de grupos cibercriminales y malware. Aplicaciones de citas online exponen fotos y audios eróticos junto con datos personales de millones usuarios. Nuevos ataques mejorados que comprometen totalmente los procesadores Intel.

WIRED Security: News, Advice, and More
A Legion of Bugs Puts Hundreds of Millions of IoT Devices at Risk

WIRED Security: News, Advice, and More

Play Episode Listen Later Jun 22, 2020 8:13


The so-called Ripple20 vulnerabilities affect equipment found in data centers, power grids, and more.

Tierra de Hackers
Episodio 6 - Fake news, espionaje, CIA, malware, Palantir, Ripple20, exposición de datos e Intel

Tierra de Hackers

Play Episode Listen Later Jun 22, 2020 96:53


Campaña masiva de desinformación Rusa al descubierto. ¿Objetivo? Desestabilizar el mundo. - Lamphone: el ataque que permite convertir una bombilla en un dispositivo espía de escucha. Un informe publicado por un senador estadounidense saca los colores a la CIA, sus medidas de seguridad en entredicho. Ripple20, el compendio de vulnerabilidades que permite obtener control total de millones de dispositivos IoT y de control industrial. El sistema nacional de sanidad británico, vende toda la información de los pacientes a empresas dedicadas a espionaje por el módico precio de un euro. Negocios legales en múltiples países sirven como tapadera de grupos cibercriminales y malware. Aplicaciones de citas online exponen fotos y audios eróticos junto con datos personales de millones usuarios. Nuevos ataques mejorados que comprometen totalmente los procesadores Intel.

ALEF SecurityCast
Ep#12 - přehled týdne 13. - 19. 6. 2020

ALEF SecurityCast

Play Episode Listen Later Jun 22, 2020 8:02


Proběhl doposud největší DDoS útok v historii ve velikosti 2,3 Tbps, výpadek T-Mobile v USA byl způsobený selháním optických obvodů, ne útoky DDoS, 19 zranitelností kolektivně pojmenovaných jako Ripple20 ovlivňují IoT Zařízení ve všech průmyslových odvětvích, Zoom oznámil zavedení end-to-end šifrování pro všechny uživatele a další.

Mostly Security
132: Flipping Star

Mostly Security

Play Episode Listen Later Jun 20, 2020 48:20


Games, networks, filtering, and bees to start. Jon did a quantum podcast, Excalidraw is cool, and Words Matter. Ripple20 has only 19 vulns (Intel's affected), phishing private notes for bitcoin, and theft of a master key. For fun try Inspriobot, read More Pages Than You Want about programming languages, and enjoy Space Parallax from the 21st century! 0:00 - Intro 4:12 - Cloudflare Filtering 5:51 - Mason Bees 15:13 - Quantum Podcast 16:35 - Excalidraw 17:55 - Return of Trunk 21:04 - Ripple20 25:25 - Intel Advisory 28:24 - Privnote, Phished 34:34 - South African Bank 38:33 - Inspirobot 40:59 - ACM on Programming Languages 45:04 - Space Parallax

The Internet of Things Podcast - Stacey On IoT
Episode 273: Ripple20 and Helium goes global

The Internet of Things Podcast - Stacey On IoT

Play Episode Listen Later Jun 18, 2020 56:32


This week’s show features a guest co-host, Chris Albrecht, editor at The Spoon. We kick off the show discussing the latest IoT security vulnerability Ripple20 and why you need a software Bill of Materials for your connected products. We then focus on COVID-19 contract tracing, using wireless signals to monitor patients remotely, Intel’s updated robotic … Continue reading Episode 273: Ripple20 and Helium goes global

The CyberWire
Ripple20 flaws in the IoT supply chain. Operation In(ter)ception looks for intelligence, and cash, too. Sino-Indian tensions. A look at Secondary Infektion. How not to influence reviewers.

The CyberWire

Play Episode Listen Later Jun 17, 2020 21:51


Ripple20 vulnerabilities are reported in the IoT software supply chain. North Korean operators go for intelligence, but also for cash, and they’re phishing in LinkedIn’s pond. Sino-Indian tensions find expression in cyberspace. A long look at the Russian influence operation, Secondary Infektion. Joe Carrigan from JHU ISI on why older adults share more misinformation online. Our guest Will LaSala from OneSpan tracks the increase in online banking fraud during COVID-19. And the strange case of the bloggers who angered eBay may have more indictments on the way. For links to all of today's stories check out our CyberWire daily news brief: https://www.thecyberwire.com/newsletters/daily-briefing/9/117

Risky Business
Risky Business #588 -- Catastrophic bugs to plague ICS for years

Risky Business

Play Episode Listen Later Jun 16, 2020


On this week’s show Patrick and Adam discuss the week’s security news, including: Facebook commissioned custom 0day to de-cloak child sex predator IP stack bugs to plague IoT, ICS for years Sandworm was doxxed by the NSA and hardly anyone noticed Congress demands answers on 2015 Juniper NetScreen back door investigation Amazon, Microsoft join moratorium on sale of facial recognition to police Much, much more This week’s show is brought to you by Signal Sciences. And instead of having one of their staff on the show, they nominated one of their customers to appear instead. So in this week’s sponsored segment we’re going to hear from Keith Hoodlet. Keith is currently the Senior Manager of Application Experience at Thermo Fisher Scientific, a $137 billion company. He built their appsec program and he’ll be along later on to talk through all of that. It’s a rapid-fire interview about how he was able to get started and make a dent quickly. Keith used to co-host the Application Security Weekly podcast and he’s worked for Bugcrowd and Veracode. He’s a cool guy, it’s a great interview, make sure you stick around for that one. You can subscribe to the new Risky Business newsletter, Seriously Risky Business, here. You can subscribe to our new YouTube channel here. Links to everything that we discussed are below and you can follow Patrick or Adam on Twitter if that’s your thing. Show notes Facebook Helped the FBI Hack a Child Predator - VICE gov.uscourts.insd.77308.131.0.pdf Ripple20 vulnerabilities will haunt the IoT landscape for years to come | ZDNet Exclusive: Sandworm's Exim hacks reveal wider Russian activity - Risky Business Driving Discord through Disinformation and Disruption – Stranded on Pylos Wyden seeks details on spies' data protection after scathing CIA audit on Vault 7 leaks wyden-cybersecurity-lapses-letter-to-dni.pdf Congress asks Juniper for the results of its 2015 NSA backdoor investigation | ZDNet Wyden House Juniper Letter Juniper 'fesses up to TWO attacks from 'unauthorised code' • The Register Amazon Won’t Let Police Use Its Facial-Recognition Tech for One Year | WIRED Microsoft Won’t Sell Facial Recognition To American Cops After Protests (5) Richard Grenell on Twitter: "They should now be barred from federal government contracts - there should be consequences for not selling technology to police departments. @realDonaldTrump" / Twitter Research shows human rights activists in India were targeted with spyware Italian company exposed as a front for malware operations | ZDNet US intelligence bill takes aim at commercial spyware makers | TechCrunch Text - S.3905 - 116th Congress (2019-2020): Intelligence Authorization Act for Fiscal Year 2021 | Congress.gov | Library of Congress Dating Apps Exposed 845 GB of Explicit Photos, Chats, and More | WIRED South African bank to replace 12m cards after employees stole master key | ZDNet Intel will soon bake anti-malware defenses directly into its CPUs | Ars Technica Arm CPUs impacted by rare side-channel attack | ZDNet Twitter bans 32k accounts pushing Chinese, Russian, and Turkish propaganda | ZDNet COVID-19 Tracking Apps ‘A Privacy Trash Fire’ As Norway Nixes Its Own Zoom Promises To Do Better After Banning Tiananmen Square Protests—Then Builds Tech To Help China’s Censorship Chinese users saw Zoom as a window through the 'Great Firewall' - Reuters Coder-Turned-Kingpin Paul Le Roux Gets His Comeuppance | WIRED Stalkerware detection rates are improving across antivirus products | ZDNet Lamphone attack lets threat actors recover conversations from your light bulb | ZDNet Hackers breached A1 Telekom, Austria's largest ISP | ZDNet Google email domains spoofed by SMTP exploit in G Suite | The Daily Swig Former eBay Employees Sent Cockroaches, Bloody Pig Mask to Mass. Couple In Harassment Campaign: US Attorney – NBC Boston