Hacking Humans

Hacking Humans episodes:

• 04.18.2024

  Is change presenting a window of opportunity for attackers?

  Trevin Edgeworth, Red Team Practice Director at Bishop Fox, is discussing how change, like M&A, staff, tech, lack of clarity or even self-promotion within and around security environments presents windows of opportunity for attackers. Joe and Dave share some listener...

  
• 04.16.2024

  Encore: Unix (noun) [Word Notes]

  A family of multitasking, multi-user computer operating systems that derive from the original Unix system built by Ken Thompson and Dennis Ritchie in the 1960s.

  
• 04.11.2024

  Could AI's doomsday be deferred?

  Dr. Robert Blumofe, CTO at Akamai, sits down to talk about the AI doomsday versus a "very bad day" scenario. Dave shares a story from The Knowledge Project Podcast, where the host talks to Adam Robinson, a multifaceted individual known...

  
• 04.09.2024

  Encore: deep packet inspection (DPI) (noun) [Word Notes]

  A network monitoring and filtering technique that examines both the header information and the payload of every packet traversing a network access point.

  
• 04.04.2024

  Cyber crime chronicles featuring scams, spies, and cartel schemes.

  This week we are joined by Maria Varmazis, host of the N2K daily space show, T-Minus. Maria shares an interesting story about Apple users reporting that they are being targeted in elaborate phishing attacks that involve's a bug in Apple’s password...

  
• 04.02.2024

  Encore: rootkit (noun) [Word Notes]

  A clandestine set of applications designed to give hackers access and control over a target device.

  
• 03.28.2024

  Exploring emerging trends in online scamming.

  Graham Cluley joins to discuss trends he’s been seeing lately in online scams. N2K's very own Gina Johnson shares some insights on a discussion a few episode ago on why people need a prescription for oxygen in the US. Joe...

  
• 03.26.2024

  Encore: tactics, techniques and procedures (TTPs) (noun) [Word Notes]

  A set of behaviors that precisely describes a cyber adversary attack campaign.

  
• 03.21.2024

  Job seeker beware: Spotting sneaky scammers on job boards.

  This week we are joined by Maria Varmazis, host of the N2K daily space show, T-Minus. She shares the story on scammers posing as recruiters on LinkedIn to get you to fall for an age old phishing scam. Dave and...

  
• 03.19.2024

  Encore: cyber threat intelligence (CTI) (noun) [Word Notes]

  Information used by leadership to make decisions regarding the cybersecurity posture of their organization.

  
• 03.14.2024

  Cyberattack chaos and the impact on families.

  This week we are joined by N2K CyberWire's very own Catherine Murphy, and she is sharing her family's experiences with Lurie Children's Hospital's recent cybersecurity incident. Dave shares a story on the dangers of Googling airline customer service numbers when...

  
• 03.12.2024

  Encore: identity theft (noun) [Word Notes]

  In this case Identity is the set of credentials, usually electronic that vouch for who you are and theft is to steal. The theft of a person's identity for purposes of fraud.

  
• 03.07.2024

  New tools, old problems.

  This week we are joined by Maria Varmazis, host of the N2K daily space show, T-Minus. She discusses how AI is being used as a possible solution to one of the oldest scams in the book in Japan. Dave and...

  
• 03.05.2024

  Encore: Monte Carlo Simulation (noun) [Word Notes]

  A probability simulation technique used to understand the impact of risk and uncertainty in complex problems.

  
• 02.29.2024

  Navigating the post-password landscape.

  Mike Kosak, Principal Intelligence Analyst at LastPass, is discussing passkeys, threat actors, and Volt Typhoon. Joe shares a new free certification you could get if you are looking to get into the field. Joe also shares a terrifying story about...

  
• 02.27.2024

  Encore: Virtual Private Network (VPN) (noun) [Word Notes]

  A software, hardware or hybrid encryption layer between two devices on the network that makes the traffic between the sites opaque to the other devices on the same network.

  
• 02.22.2024

  Scamming the innocent.

  This week we are joined by Maria Varmazis, host of the N2K daily space show, T-Minus. She brings us a scary story from a woman who never thought she'd ever be scammed. Dave and Joe shares some follow up before...

  
• 02.20.2024

  Encore: smishing (SMS phishing) (noun) [Word Notes]

  From the intrusion kill-chain model, the delivery of a “lure” via a text message to a potential victim by pretending to be some trustworthy person or organization in order to trick the victim into revealing sensitive information. Smishing is a portmanteau word made of two other words, the acronym “SMS” and the...

  
• 02.15.2024

  Looking forward in 2024.

  Aaron Walton, Threat Intel Analyst from Expel is discussing some things to look out for in 2024. Joe and Dave share some listener follow up from Mateusz, who shares some positive news with us. Dave's story is about a romance...

  
• 02.13.2024

  Encore: port mirroring (noun) [Word Notes]

  A network switch configuration setting that forwards a copy of each incoming and outgoing packet to a third switch port. Also known as SPAN or Switched Port Analyzer, RAP or Roving Analysis Port, and TAP or Test Access Point. When network managers and security investigators want...

  
• 02.08.2024

  Scamming just isn't what it used to be.

  This week, we are joined by host of N2K's T-Minus Space Daily podcast, Maria Varmazis, she sits down with Joe and Dave to discuss sextorion materials that were found on popular social media apps such as, TikTok, Instagram, Snapchat and...

  
• 02.06.2024

  Encore: Network Time Protocol (NTP) attack (noun) [Word Notes]

  A reflection or amplification distributed denial-of-service attack in which hackers query Internet network time protocol servers, NTP servers for short, for the correct time, but spoof the destination address of their target victims.

  
• 02.01.2024

  Quiz scam nightmare.

  Jaeson Schultz, Technical Leader from Cisco Talos, is discussing "Spammers abuse Google Forms’ quiz to deliver scams." Dave's story discusses the disturbing new trick up a scammers sleeve to get you to fall for their schemes. Joe has two...

  
• 01.30.2024

  Encore: smishing (SMS phishing) (noun) [Word Notes]

  From the intrusion kill-chain model, the delivery of a “lure” via a text message to a potential victim by pretending to be some trustworthy person or organization in order to trick the victim into revealing sensitive information. Smishing is a portmanteau word made of two other words, the acronym “SMS” and the...

  
• 01.25.2024

  Phishing for mail.

  Abhilash Garimella from Bolster joins to discuss a USPS phishing campaign abusing freemium dynamic DNS and SaaS providers. Dave and Joe share some follow up, one was from listener Mike who wrote in to tell us about a breach at...

  
• 01.23.2024

  Encore: port mirroring (noun) [Word Notes]

  A network switch configuration setting that forwards a copy of each incoming and outgoing packet to a third switch port. Also known as SPAN or Switched Port Analyzer, RAP or Roving Analysis Port, and TAP or Test Access Point. When network managers and security investigators want...

  
• 01.18.2024

  It's the intricate deceptions that get you.

  This week we are joined by the host of T-Minus, N2Ks very own Maria Varmazis brings her own story and discusses with Dave and Joe. We start off with Joe, and he brings in the story of Andy Cohen and...

  
• 01.16.2024

  Encore: Network Detection and Response (NDR) (noun) [Word Notes]

  NDR tools provide anomaly detection and potential attack prevention by collecting telemetry across the entire intrusion kill chain on transactions across the network, between servers, hosts, and cloud-workloads, and running machine learning algorithms against this compiled and very large data set. NDR is an extension of the EDR, or endpoint detection and response idea that emerged in...

  
• 01.11.2024

  Password Perils: The threat of credential stuffing exploits.

  Frank Riccardi sits down to discuss how cybercriminals exploit people’s fondness for reused passwords to launch credential stuffing attacks. Dave and Joe share a bit of follow up, one from a listener named Steve who shares some push back from...

  
• 01.09.2024

  Encore: shadow IT (noun) [Word Notes]

  Technology, software and hardware deployed without explicit organizational approval. In the early days of the computer era from the 1980s through the 2000s security and information system practitioners considered shadow IT as completely negative. Those unauthorized systems were nothing more than a hindrance that created...

  
• 01.04.2024

  The DNA dilemma: Unraveling a 23AndMe breach.

  Alethe Denis from Bishop Fox is talking with Dave and Joe with her take on the 23AndMe breach. Dave and Joe share some follow up from listener Michael, who writes in to share thoughts on our catch of the day...

  
• 12.28.2023

  Stolen personality?

  Matt Lewis from the NCC Group joins to discuss how cybercriminals can decode your personality through AI conversations to launch targeted attacks at you. Dave and Joe share some follow up from listener Sydney, who writes in to share her...

  
• 12.24.2023

  The grinch who hacked Christmas. [Hacking humans goes to the movies]

  Thanks for joining us again for another episode of a fun project brought to you by the team of Hacking Humans, the CyberWire's social engineering podcast. Hacking Humans co-host Dave Bittner is joined by Rick Howard in this series where...

  
• 12.21.2023

  Reeling in some phishing trends.

  Adam Bateman, Co-Founder & CEO at Push Security, is sharing some of the latest phishing trends his team has been observing. Dave and Joe share some listener follow up from Michael, who writes in with a new idea, calling it...

  
• 12.19.2023

  chaos engineering (noun) [Word Notes]

  The resilience discipline of controlled stress test experimentation in continuous integration/continuous delivery environments, CI/CD environments, to uncover systemic weaknesses. CyberWire Glossary link: https://thecyberwire.com/glossary/chaos-engineering Audio reference link: Farnam Street, 2009. Richard Feynman Teaches you the Scientific Method [Website]. Farnam Street. URL https://fs.blog/mental-model-scientific-method/

  
• 12.14.2023

  Shielding your inbox.

  Seth Blank, CTO of Valimail, joins to discuss the implications on email security on behalf of DMARC. Joe and Dave share some follow up regarding Meta, who is the parent company to Facebook and Instagram, and how they are now...

  
• 12.12.2023

  Encore: remote access Trojan or RAT (noun)

  From the intrusion kill chain model, a program that provides command and control services for an attack campaign. While the first ever deployed RAT is unknown, one early example is Back Orifice made famous by the notorious hacktivist group called “The Cult of the Dead Cow,” or cDc, Back Orifice was...

  
• 12.07.2023

  Small, medium, and large phishing trends of 2023.

  Mike Price from ZeroFox sits down to discuss what 2023 phishing trends mean for the broader industry as we quickly approach 2024. Dave and Joe share a serious write in from listener Michelle who shares her pleads for her aunt,...

  
• 12.05.2023

  zero knowledge proof (noun)

  A mathematical method by which one party (the prover) can prove to another party (the verifier) that something is true, without revealing any information apart from the fact that this specific statement is true. CyberWire Glossary link: https://thecyberwire.com/glossary/zero-knowledge-proof Audio reference link: Staff, 2022. Zero Knowledge Proofs [Video]. YouTube. URL https://www.youtube.com/watch?v=5qzNe1hk0oY

  
• 11.30.2023

  Encore: The age old battle between social engineering and banking.

  Chip Gibbons, CISO at Thrive, sits down with Dave to talk about how to defend against social engineering attacks in banking. Dave starts us off this week with a story about Amazon opening up its selling market to Pakistani residents, and...

  
• 11.28.2023

  Encore: business email compromise or BEC (noun) [Word Notes]

  A social engineering scam where fraudsters spoof an email message from a trusted company officer that directs a staff member to transfer funds to an account controlled by the criminal.

  
• 11.23.2023

  Cops in the catfish game.

  Thanks for joining us again for another episode of fun project brought to you by the team of Hacking Humans, the CyberWire's social engineering podcast. Hacking Humans co-host Dave Bittner is joined by Rick Howard in this series where they...

  
• 11.21.2023

  HIPAA (noun) [Word Notes]

  A U.S. law designed to improve the portability and accountability of health insurance coverage. CyberWire Glossary link: https://thecyberwire.com/glossary/hipaa Audio reference link: Dr. Dana Brems, 2021. Doctor reacts to “HIPAA violations” [Video]. YouTube. URL https://www.youtube.com/shorts/Ksk00s8a_IU

  
• 11.16.2023

  Unmasking the deceptive.

  John Wilson, Senior Fellow, Threat Research at Fortra, joins to discuss email impersonation attacks which found that nearly 99% of these threats can be classified as business email compromise. Dave and Joe share some listener follow up from Terry, who writes...

  
• 11.14.2023

  Encore: man trap (noun) [Word Notes]

  A physical security access control device consisting of an enclosed hallway with interlocking doors on each end where both doors can’t be open at the same time. A person presents credentials to the entry doorway. If authorized, the entry door...

  
• 11.09.2023

  Leaving a trail of digital breadcrumbs.

  This week we are joined by Harry Maugans from Privacy Bee who sits down to discuss how our digital breadcrumbs, old and new, are coming back to haunt us. Joe and Dave discuss some follow up from listener Phil, who...

  
• 11.07.2023

  Common Vulnerability Scoring System (CVSS) (noun) [Word Notes]

  A qualitative public framework for rating the severity of security vulnerabilities in software. CyberWire Glossary link: https://thecyberwire.com/glossary/common-vulnerability-scoring-system Audio reference link: Peter Silva, 2020. What is Common Vulnerability Scoring System (CVSS) [Video]. YouTube. URL https://www.youtube.com/watch?v=rR63F_lfKf0

  
• 11.02.2023

  Weaponizing your out-of-office replies.

  James Dyer and Jack Chapman of Egress join to discuss "Cybercriminals don’t take holidays: How bad actors use this two-step phishing campaign to weaponize out-of-office replies." Dave and Joe share some listener follow up from Ron, who has a suggestion...

  
• 10.31.2023

  Encore: anagram (noun) [Word Notes]

  A word, phrase, or sentence formed from another by rearranging its letters. For example, cracking a columnar transposition cipher by hand involves looking for anagrams.

  
• 10.29.2023

  Spooky, scary, skeletons at the movies. [Hacking humans goes to the movies]

  Thanks for joining us again for a very special and scary episode brought to you by the team of Hacking Humans, the CyberWire's social engineering podcast. Hacking Humans co-host Dave Bittner is joined by Rick Howard in this series where...