Is Penetration Testing Dead? – PSW #767
While we most likely do not believe that penetration testing is dead it continues to evolve over time. What do penetration tests look like today? Have they become more or less specialized? What is the continuing value of penetration testing? With development and IT moving so fast, how have penetration tests adapted? This discussion will dive into the details of penetration testing today and provide you with a guide to make the most of this activity.
How To Get Started in Information Security – PSW #767
Without question, we need more people working in cybersecurity today. Our culture has come a long way to be more open and inviting to new folks, but we still have a lot of work to do. What can you do if you want to break into the field of cybersecurity today? While there is no shortage of resources our experienced hosts will offer their thoughts, opinions, and advice on how you can become the next cybersecurity pro!
Hacker Trivia – PSW #767
How well do you know your hacker history and trivia? See how you compare to our hosts as we tackle hacker trivia live on the air! Categories will include hacker movies, hacker history, and hacker tools.
Holiday Security News & The Holiday Hack Challenge 2022! – PSW #767
This week, we round out the Holiday Special 2022 with a special guest appearance by Ed Skoudis, where he joins to fill us in on the Holiday Hack Challenge! Then, an utterly chaotic session of security news to close out 2022!
Ed Skoudis has taught over 40,000 security professionals globally in penetration testing and incident handling. Ed currently serves as the President of the SANS Technology Institute college, supporting over 2,500 students earning their master’s degrees, bachelor’s degrees, and cyber security certificates. Ed is consistently one of the first authorities brought in to provide post-attack analysis on major breaches. Ed is also the founder of the SANS Penetration Testing Curriculum, the CEO and founder of the Counter Hack penetration testing firm, and the leader of the team that builds SANS NetWars and the SANS Holiday Hack Challenge. Ed is a keynote speaker and an Advisory Board member for RSA Conference. He is also on the board of directors for a community bank, a charity, and another college.
Paul Asadoorian
- Antivirus and EDR solutions tricked into acting as data wipers
Hence, by implementing the following five-step process, Yair could delete files in a directory he didn't have modification privileges.
Create a special path with the malicious file at C:tempWindowsSystem32driversndis.sys Hold its handle and force the EDR or AV to postpone the deletion until after the next reboot Delete the C:temp directory Create a junction C:temp → C: Reboot when prompted.
- Are home video surveillance systems safe?
Having installed a Eufy video doorbell, Paul logged in to the device’s web interface, where he analyzed the source code in the browser and showed that the camera sends a picture to the vendor’s server every time someone appears in the frame. This means that at least one of Eufy’s guarantees (“no clouds”) isn’t true.
Moore then tweeted several more times about some far more serious data protection issues. Apparently, Eufy’s “reliable” encryption uses a fixed key identical for all users. Worse, this key actually appeared in Eufy code posted by the company itself on GitHub. Later, the tech website The Verge, with reference to Moore and another security expert, confirmed the worst-case scenario: anyone online, it seems, can view the video stream simply by connecting to a unique address of the device.
- New Python malware backdoors VMware ESXi servers for remote access
A previously undocumented Python backdoor targeting VMware ESXi servers has been spotted, enabling hackers to execute commands remotely on a compromised system.
- EMBA
- NETGEAR Router Network Misconfiguration
- Desktop OpenSolaris fork OpenIndiana releases Hipster
- A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
- FBI’s Vetted Info Sharing Network ‘InfraGard’ Hacked – Krebs on Security
- Vulnerability Prioritisation – PwnDefend
