The Evolution of Purple Teaming – Jared Atkinson – PSW #812
Jared would like to discuss the evolution of purple teaming. Put bluntly, he believes traditional purple team approaches don’t test enough variations of attack techniques, delivering a false sense of detection coverage. He would like to talk about: The shortcomings of red team assessments and why most purple team assessments are too limited. How the testing landscape and requirements have changed (especially as organizations now look to validate vendor tools defense claims). How purple team assessments are evolving with the use of new frameworks like Atomic Testing. And the importance of building and selecting good test cases that cover the many ways attack techniques can be modified.
Jared is a security researcher who specializes in Digital Forensics and Incident Response. Recently, he has been building and leading private sector Hunt Operations capabilities. In his previous life, Jared lead incident response missions for the U.S. Air Force Hunt Team, detecting and removing Advanced Persistent Threats on Air Force and DoD networks. Passionate about PowerShell and the open source community, Jared is the lead developer of PowerForensics, Uproot, and maintains a DFIR focused blog at http://www.invoke-ir.com.
Security Weekly listeners: Cyber threats are evolving — is your organization keeping up? The 2023 Cybersecurity Year in Review is Here! Uncover the latest challenges and strategic responses in CRA's 2023 Cybersecurity Year in Review – sponsored by RSA Conference. From the impact of generative AI to the risks of ransomware to navigating new SEC rulings, get ahead for 2024 with your free copy. Download the report at securityweekly.com/yearinreview2023
We’re Old Now – PSW #812
The Exploit Prediction Scoring System is Awesome, or so some say, Reflections on InfoSec, Why some people don’t trust science, SSH-Snake, Back in the Driver’s seat, I Hacked My Internet Service Provider, States & Congress wrestle with cybersecurity, Combining AI with human brain cells, analyzing linux-firmware, detecting BLE SPAM, and The I in LLM.
Follow Security Weekly Productions on LinkedIn for exclusive show clips, insights, and updates across our organization! Stay connected with our hosts and fellow community members, and join the conversation that's shaping the future of cybersecurity.
Paul Asadoorian
- The Exploit Prediction Scoring System Is Awesome!
I disagree.
- Multiple vulnerabilities in Lantronix EDS-MD IoT gateway for medical d
- Beirut Airport Screens Hacked with Anti-Hezbollah Message
- SSH-Snake: Automated SSH-Based Network Traversal
- Reflections on InfoSec and the Development World – FreeRDP as a Case Study
- Lessons from Securing FreeRDP
- Over 11M SSH Servers are Vulnerable to new Terrapin Attacks
- I HACKED my Internet Service Provider’s router. So I could get rid of it.
- SSH ProxyCommand == unexpected code execution (CVE-2023-51385)
- Operation Triangulation: The last (hardware) mystery
- This Week In Security: Triangulation, ProxyCommand, And Barracuda
- This new malware exploit can take over your Google account even after a password reset — what you need to know
- Firmware prank causes LED curtain in Russia to display ‘Slava Ukraini’ — police arrest apartment owner
- How a Group of Train Hackers Exposed a Right-to-Repair Nightmare
- 4-year campaign backdoored iPhones using possibly the most advanced exploit ever
- 37C3: When Apple Ditches Lightning, Hack USB-C
- New Terrapin Flaw Could Let Attackers Downgrade SSH Protocol Security
- Wall of Flippers is the way to put a stop to Flipper Zero
I plan to test this out over the weekend at Shmoo, just got it running, though concerned it could be used against me!
- W^X in UEFI firmware and the linux boot chain.
- StarkeBlog – Introducing Linux Firmware DB
If you've ever wondered what it would look like to analyze all of the firmware in the linux-firmware repo, Nick has completed his take on this work. Nicely done.
- Tools of the Trade: Replay Attack with Flipper Zero
Good high-level overview. Keep in mind when you see some people unlocking cars with the Flipper, for most cars one of two things could be happening: 1) The video is completely fake and someone with the keyfob for the vehicle is unlocking it 2) They've captured one of the passcodes that was transmitted by the keyfob but not received by the vehicle, therefore the Flipper (for the ONE TIME) can transmit the correct unlock code.
- When to use /dev/random vs /dev/urandom
Sam Bowne
- Why some people don’t trust science—and how to change their minds
People who reject or distrust science are not especially well informed about it, but believe that they do understand the science. Giving them scientific information does not change their attitudes. Telling them what opinions are popular does help change their minds.
- Lecture: Back in the Driver’s Seat: Recovering Critical Data from Tesla Autopilot Using Voltage Glitching
We rooted Tesla Autopilot using voltage glitching. The attack enables us to extract arbitrary code and user data from the system. This achievement empowered custom modifications to the root file system and temporarily facilitated the activation of paid car features.
- States and Congress wrestle with cybersecurity after Iran attacks small town water utilities
Several water utilities in US states were hacked Iranian-backed attackers targeting a piece of equipment specifically because it was Israeli-made. With inaction in Congress, a handful of states passed legislation to step up scrutiny of cybersecurity, including New Jersey and Tennessee. But cybersecurity improvements are not likely soon.
- Cyborg computer combining AI and human brain cells really works
A new biohybrid computer combining a “brain organoid” and a traditional AI was able to perform a speech recognition task with 78% accuracy — demonstrating the potential for human biology to one day boost our computing capabilities. The system isn’t an improvement on the tech we already have — but it could prove to be a key stepping stone on the path to more advanced biocomputing systems in the future.
- 23andMe tells victims it’s their fault that their data was breached
23andMe said that “users negligently recycled and failed to update their passwords following these past security incidents, which are unrelated to 23andMe.”
“Therefore, the incident was not a result of 23andMe’s alleged failure to maintain reasonable security measures.” “This finger pointing is nonsensical. 23andMe knew or should have known that many consumers use recycled passwords and thus that 23andMe should have implemented some of the many safeguards available to protect against credential stuffing — especially considering that 23andMe stores personal identifying information, health information, and genetic information on its platform,” Zavareei said in an email. - NIST: If someone’s trying to sell you some secure AI, it’s snake oil
Predictive and generative AI systems remain vulnerable to a variety of attacks and anyone who says otherwise isn't being entirely honest. The researchers have focused on four specific security concerns: evasion, poisoning, privacy and abuse attacks. AI systems optimized for accuracy alone tend to underperform in terms of adversarial robustness and fairness. Conversely, an AI system optimized for adversarial robustness may exhibit lower accuracy and deteriorated fairness outcomes.
- THE I IN LLM STANDS FOR INTELLIGENCE
The curl maintainers are suffering from a flood of bogus AI-generated vulnerability reports for their bug bounty program. The improved language in the AI-generated reports requires the maintainers to work harder to detect their uselessness.
- We tried to quantify how harmful hospital ransomware attacks are for patients. Here’s what we found
From 2016 to 2021, we estimate that ransomware attacks killed between 42 and 67 Medicare patients. This should change how hospitals and policymakers think about the scope of this issue.
