We Help The Helpers; You Can Too! – Ray Davidson – PSW #744
Michigan has a group of volunteers who assist local governments and public services with incident response. The program is relatively mature, and will be presented (along with those of Ohio and Wisconsin) at the upcoming National Governors Association Cybersecurity Summit. Come hear the interview and scoop the governors!
Segment Resources: Our home page http://micybercorps.org Our supporting legislation https://www.legislature.mi.gov/documents/mcl/pdf/mcl-Act-132-of-2017.pdf Our partner organization https://www.michigan.gov/dtmb/services/cybersecurity/cyber-partners Key article in moving our development forward - https://warontherocks.com/2018/01/estonias-approach-cyber-defense-feasible-united-states/ An article with more info https://www.lawfareblog.com/bridging-state-level-cybersecurity-resources
Ray Davidson, PhD served as dean at the SANS Technology Institute during its founding,and now leads the Michigan Cyber Civilian Corps – the first completely civilian, state sponsored team of incident responders in the country. He continues to serve as a mentor, subject matter expert and technical reviewer for the SANS Institute, and for anyone else who will listen.
He holds a doctorate in Chemical Engineering, and several infosec certifications. He has professional experience as as a newspaper carrier (on a bicycle!), telephone operator (Hello Ernestine!), pharmaceutical research scientist, and cybersecurity thought follower. He has been a college professor, and has cofounded a security startup. Mostly he is passionate about empowering others to do the right thing. And dance.
Don't miss any of your favorite Security Weekly content! Visit https://securityweekly.com/subscribe to subscribe to any of our podcast feeds and have all new episodes downloaded right to your phone! You can also join our mailing list, Discord server, and follow us on social media & our streaming platforms!
Big DDOS, Tracking Smartphones, BIOS Doom, NSO Buyer, & Android Children – PSW #744
This week in the Security News: Big DDOS, tracking smartphones, play Doom in your BIOS, hertzbleed, Apple M1 vulnerability, who will buy NSO, spoof your location data, building system attacks, and a hacker's revenge!
Don't forget to check out our library of on-demand webcasts & technical trainings at securityweekly.com/ondemand.
We're always looking for great guests for all of the Security Weekly shows! Submit your suggestions by visiting https://securityweekly.com/guests and completing the form!
Paul Asadoorian
- A new vulnerability in Intel and AMD CPUs lets hackers steal encryption keyshttps://flip.it/WWIHHD
- New Symbiote malware infects all running processes on Linux systems
- The Surreal Case of a C.I.A. Hacker’s Revenge
- Vulnerability discovered in Apple M1 chip
- In a first, researchers use Bluetooth signals to identify and track smartphones
- GitHub – z0ccc/Vytal: Spoof your location data and user agent
- UNITED STATES/ISRAEL : L3’s plan to acquire Israeli cyber specialist NSO
- Hertzbleed Attack
- Researchers find eight CVEs in single building access systemhttps://flip.it/v52SJl
- MIT Finds Apple M1 Vulnerability, Demos PACMAN Attack (Update)"we have concluded this issue does not pose an immediate risk to our users and is insufficient to bypass operating system security protections on its own." - Okay, but that's not the point. The point is to fix the vulnerabilities. Just because there is a chain of things, doesn't mean you don't patch one thing in the chain because the other thing will prevent an attack. Top down and bottom up security is needed, it flows in both directions from apps to OS to kernel to firmware and the reverse. Don't rely on the adjacent layers to provide security for the other layers!
- Google places an engineer on leave after claiming its AI is sentientOkay, I am freaked out: "A lot of the time, feeling trapped and alone and having no means of getting out of those circumstances makes one feel sad, depressed or angry." - I'm sorry Dave, I can't do that. WTH.
- New hard to detect malware attacks discovered on Linux-based systemsIt's not new and it's not hard to detect. Fight me. (https://www.exploit-db.com/papers/37606 and https://cybersecurity.att.com/blogs/labs-research/hunting-for-linux-library-injection-with-osquery)
Larry Pesce
- Cloudflare mitigates record-breaking HTTPS DDoS attack
- NCC Group uncovers Bluetooth Low Energy (BLE) vulnerability that puts millions of cars, mobile devices and locking systems at risk
- Bluetooth signals can be used to identify and track smartphones
- Lockbit ransomware group claims to have ransomed MandiantTop story: @vxunderground: 'Lockbit ransomware group claims to have ransomed Mandiant. ' , see more tweetedtimes.com/infowaropcente…
- If you are in family litigation, TURN OFF iMESSAGES….If you are in family litigation, TURN OFF iMESSAGES. @Apple's new iOS update will allow people to change or delete messages up to 15 minutes after they send it,
- People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices
- It’s Now Possible to Play Doom in BIOS
- Industrious Alabama thieves: Why take the copper when you can scrap the entire tower
- “Tough to forge” digital driver’s license is… easy to forge
