Securit13 Podcast
Первый украинский подкаст об информационной безопасности

Ми тут вирішили згадати найголосніші події року, що вже майже минув. Приєднуйтесь!

Incident report on memory leak caused by Cloudflare parser bug
Vault 7: CIA Hacking Tools Revealed
NSA-leaking Shadow Brokers just dumped its most damaging release yet
Everything you need to know about the WannaCry / Wcry / WannaCrypt ransomware
New ransomware, old techniques: Petya adds worm capabilities
The MeDoc Connection
Threat Spotlight: Follow the Bad Rabbit
Equifax website hack exposes data for ~143 million US consumers
We have broken SHA-1 in practice
ROCA: Vulnerable RSA Key Generation
KRACK Attacks: Breaking WPA2
Hackers Can Easily Hijack This Dildo Camera and Livestream the Inside of Your Vagina (Or Butt)
MsMpEng: Remotely Exploitable Type Confusion in Windows 8, 8.1, 10, Windows Server, SCEP, Microsoft Security Essentials, and more.
Why 'blank' Gets You Root
Thousand-dollar iPhone X's Face ID wrecked by '$150 3D-printed mask'
Блокування веб-русурсів в Україні
МОН доручило вишам не користуватися сайтами з доменами “.ru” і “.ру”
Мінінформ оприлюднить доповнення до списку заборонених сайтів
#FuckResponsibleDisclosure Sean Brian Townsend

Music - KEYGEN MUSIC ~ One hour mix

Direct download: 91.mp3
Category:Technology -- posted at: 8:06pm CET

Самые громкие новости последних недель. Удивительное яблоко, #FuckResponsibleDisclosure, обновленно обещание от Джона и еще что-то. Не пропустите!

00:00:58 #FuckResponsibleDisclosure Sean Brian Townsend
00:07:26 Apple и все все все
Why 'blank' Gets You Root
As Apple fixes macOS root password hole, here's what went wrong
Repair file sharing after Security Update 2017-001 for macOS High Sierra 10.13.1
Thousand-dollar iPhone X's Face ID wrecked by '$150 3D-printed mask'
Zero-day iOS HomeKit vulnerability allowed remote access to smart accessories including locks, fix rolling out
00:12:50 John McAfee
Bitcoin Miner NiceHash Hacked, Possibly Losing $62 Million in Bitcoin$62-million-in-bitcoin/d/d-id/1330585
Сайт блокчейн-проекта Confido недоступен: все профили команды проекта оказались поддельными
00:15:17 CVE-2017-11937 | Microsoft releases an emergency update to fix a flaw in Malware Protection Engine
00:17:49 Uber Paid Hackers to Delete Stolen Data on 57 Million People
00:18:28 Intel Management Engine pwned by buffer overflow
00:18:52 Thousands of WordPress sites infected with a Keylogger and cryptocurrency miner scripts
Websites use your CPU to mine cryptocurrency even when you close your browser
00:19:09 Android flaw lets attack code slip into signed apps
00:19:24 Mailsploit: It's 2017, and you can spoof the 'from' in email to fool filters

Music - KEYGEN MUSIC ~ One hour mix

Direct download: 90_1.mp3
Category:Technology -- posted at: 12:20pm CET

Немного самых громких новостей последних недель вам в ленту. Тут и кролик, и Алиса, и сладкие истории на ночь.

ROCA: Vulnerable RSA Key Generation
Certificate expiry monitoring, KeyChest for HTTPS, TLS, Letsencrypt expiry and server status
Estonia government locks down ID smartcards: Refresh or else
Threat Spotlight: Follow the Bad Rabbit
BadRabbit Technical Analysis
Bad Rabbit: Not-Petya is back with improved ransomware
The Shadow Internet – Comae Technologies
Fake WhatsApp app in official Google Play Store downloaded by over a million Android users
Tor Project fixed TorMoil, a critical Tor Browser flaw that can leak users IP Address
Oracle Security Alert CVE-2017-10151
Dangerous liaisons
Equifax execs sold shares before mega-hack reveal. All above board – Equifax probe


Music - KEYGEN MUSIC ~ One hour mix

Direct download: 89_1.mp3
Category:Technology -- posted at: 9:06pm CET

И снова вместо 300 секунд наши неугомонные ведущие обсуждают новости и события. Присоединяйтесь!

A new Mirai-Like IoT Botnet is growing in a new mysterious campaign
Google launched Google Play Security Reward bug bounty program to protect apps in Play Store
Equifax website borked again, this time to redirect to fake Flash update
New Ransomware Not Just Encrypts Your Android But Also Changes PIN Lock
PUBLIC SECURITY ALERT: New Facebook attack - watch out for phishy messages that say you’re a “Trusted Contact” - Access Now
KRACK Attacks: Breaking WPA2
YouTube sin-bins account of KRACK WPA2 researcher
Malware hidden in vid app is so nasty, victims should wipe their Macs

Music - KEYGEN MUSIC ~ One hour mix

Direct download: 88_1.mp3
Category:Technology -- posted at: 8:46am CET

Intro / Outro Art Of Escapism - The Sands of Windhoek

В связи с повышением количества атак на цепь поставок (Supply chain), в том числе и обновления, программного обеспечения, наши ведушие Андрей, Алиса, Алексей и Тарас решили разобраться что же это такое и с чем его едят, рассмотреть примеры и варианты, а так же возможные пути защиты и предотвращения.

Supply chain
What Is a 'Supply Chain Attack?'
CCleanup: A Vast Number of Machines at Risk
Java security plagued by crappy docs, complex APIs, bad advice
Apple Mac fans told: Something smells EFI in your firmware
Reflections on Trusting Trust

Direct download: 87_2.mp3
Category:Technology -- posted at: 4:38pm CET

В качестве возвращения и начала нового сезона осень-зима 2017-2018, Андрей и Алиса кратенько прошлись по последним новостям

Взлом сайтів в доменій зоні * та помилка у CERT-UA
4G/5G Wireless Networks as Vulnerable as WiFi and putting SmartCities at Risk
Microsoft silently fixes security holes in Windows 10 – dumps Win 7, 8 out in the cold
FIN7 hacking group is switched to new techniques to evade detection
VPN logs helped unmask alleged 'net stalker, say feds
Russian spies used Kaspersky AV to hack NSA staffer, swipe exploit code – new claim
Sri Lanka police arrest two men over cyber theft at the Taiwan Bank
Microsoft Cortana Can Now Read Your Skype Messages to Make Chat Smarter
Warning: Millions Of P0rnHub Users Hit With Malvertising Attack
Disqus Hacked: More than 17.5 Million Users' Details Stolen in 2012 Breach
The iPhone's Constant Password Popups Are a Hacker's Dream

Music - KEYGEN MUSIC ~ One hour mix

Direct download: 87_1.mp3
Category:Technology -- posted at: 5:39pm CET

Intro / Outro Finest Cockles by Blah Blah Blah

Интервью с Максимом Тульевым о блокировках и будущем украинского интернета

Direct download: 83.mp3
Category:Technology -- posted at: 8:15am CET

Intro / Outro I Do Believe I've Had Enough by Zephaniah And The 18 Wheelers

Big 4 of the top security and privacy conferences: S&P ("Oakland"), NDSS, CCS and USENIX Security.

Наука не делается самостоятельно, a нужно учиться у передовых исследований, как они интегрируются с практикой, понимать их уровень, и себя показывать. По-этому, для того кто первый с украинским affiliation опубликует статью на этих конференциях - с меня можно пообещать "коньяк" :)

The Network and Distributed System Security Symposium (NDSS) 2017 by Internet Society -

> From the keynote speech by J. Alex Halderman:
"Want to Know if the Election was Hacked? Look at the Ballots" -
"Securing Digital Democracy" course -
Video -

> Web Security section:
"(Cross-)Browser Fingerprinting via OS and Hardware Level Features" by Yinzhi Cao et al. -
Websites to test your browser and device fingerprint: (now, cross-browser!)
"Fake Co-visitation Injection Attacks to Recommender Systems" by Guolei Yang et al. -

> User Authentication section:
"Cracking Android Pattern Lock in Five Attempts" by Guixin Ye at el. -
"Towards Implicit Visual Memory-Based Authentication" by  -

> TLS et al. (several papers on Diffie-Hellman and more)
"The Security Impact of HTTPS Interception" by Zakir Durumeric et al. -
"WireGuard: Next Generation Kernel Network Tunnel" by Claude Castelluccia et al. -  (by a single author, Jason Donenfeld!)
More on WireGuard:

> On Tor:
"The Effect of DNS on Tor's Anonymity" by Benjamin Greschbach et al. -
"Avoiding The Man on the Wire: Improving Tor's Security with Trust-Aware Path Selection" by Aaron Johnson et al.  -  (more on proper path selection for Tor, possible attacks on Astoria).

> Malware:
"Dial One for Scam: A Large-Scale Analysis of Technical Support Scams" - наша статья, получившая Distinguished Paper Award!
"MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models" by Enrico Mariconti et al. -
"A Broad View of the Ecosystem of Socially Engineered Exploit Documents" by Stevens Le Blond et al. - s (можно проводить много интересных исследований на базе данных из VirusTotal).

... and much more interesting works on SGX, virtualization, and binary reassembly, etc.

Plus, a DNS Privacy Workshop program -

Direct download: 82.mp3
Category:Technology -- posted at: 8:13am CET

Intro / Outro Semme Automatic Stay the Course

00:00:34 Слухи про блокировки в интернетах ДО их официальной блокировки
00:04:52 Давайте поговорим про фищинг
00:07:40 Google Docs users hit with sophisticated phishing attack
00:08:44 Recruiters considered really harmful: Devs on GitHub hit with booby-trapped fake job emails
00:09:47 Получили письмо из налоговой?
00:11:08 __blank в Edge
Researcher pwns Charles Darwin to demonstrate Microsoft Edge exploit
00:13:16 Захист від фішингу від Британської податкової
00:24:45 В Тернополе в торговом центре мужчина при свидетелях открыл банкомат и похитил оттуда полмиллиона (видео)
00:29:06 Prevent & report phishing attacks
00:31:53 Киберполиция Украины помогла ликвидировать киберсеть "Аваланш" (Avalanche), которая с 2009 года использовалась для распространения вредоносных программ, спама и фишинга -

Direct download: 81.mp3
Category:Technology -- posted at: 12:28am CET

Intro / Outro Lady We Knew by Cullah
Hackers Can Easily Hijack This Dildo Camera and Livestream the Inside of Your Vagina (Or Butt)
Squid: Optimising Web Delivery
Life and death for Windows: Vista support ends as Creators Update starts to roll out

Direct download: 80.mp3
Category:Technology -- posted at: 8:05pm CET