On The Wire

Criminals, like legitimate merchants, rely on their reputations in order to attract customers. When that reputation suffers, so does their business. And criminals don’t take lightly the subset of their community that preys on other criminals, stealing money or failing to deliver the goods they’ve promised. So criminals need to be very careful about who they deal with, which is where sites like Ripper come in. Ripper is a new service that serves as a database of known-bad cybercriminals, called rippers, who rip off their brethren. Dennis Fisher talked with Rick Holland of Digital Shadows about the site, the cybercrime underground, and how it mirrors the legitimate business world.

Music by Chris Gonsalves and Ken Montigny.

Cybercriminals depend upon the income they generate from their schemes to fund further operations, and one of the main ways that they extract money from victims is through ad fraud. This week, researchers at White Ops disclosed the existence of the Methbot ad fraud network, which is using a sophisticated worldwide infrastructure and custom browsers to fake views on video ads. The group is generating as many as 300 million fake impressions per day, which translates into as much as $5 million in daily revenue. Dennis Fisher talked with White Ops CEO Michael Tiffany about the details of the Methbot network and what can be done to unravel it.

Music by Chris Gonsalves and Ken Montigny

The last week or so has brought us a lot of emergency security and privacy advice, a lot of which hasn’t necessarily been great. So we decided to call Jessy Irwin and talk through what people can and should be doing to protect themselves, how threat models work, and how to talk to your family about security.

Music by Chris Gonsalves and Ken Montigny.

Samy Kamkar spends a lot of time coming up with clever hardware hacks, and his latest project, PoisonTap, may be at the top of the heap. Built on a $5 Raspberry Pi Zero board, the device can be plugged into the USB port on any locked or password protected machine and will perform a long list of attacks on the machine. It will hijack all of the Internet traffic from the PC, siphon cookies from HTTP requests, install a persistent backdoor, and even give access to a router on the local network. Dennis Fisher talked with Samy about where he got the idea for the PoisonTap and how far hardware hacking has come in recent years.

Music by Chris Gonsalves and Ken Montigny

The news has been full of headlines for weeks about election fraud, voting machine hacking, and all kinds of other scary sounding stuff. Much of the coverage has been hyperbolic to say the least, so we decided to get some clear-headed, rational thoughts on the topic from Avi Rubin. Avi is a professor at Johns Hopkins University and did some of the pioneering work on voting machine security in the early 2000s. We talked with Avi about the problems with electronic voting machines, the potential for tampering with them, whether the machines can be attacked remotely, and what other avenues attackers might have to disrupt the election.

Music by Chris Gonsalves and Ken Montigny.

Image: Joe Hall, CC By 2.0 license.

For a youngster, the Mirai botnet has gotten more than its share of attention in its short life. The botnet first came to prominence when researchers discovered it was used in an attack on Brian Krebs’s site several weeks ago, and later on a hosting provider. It gained more fame because it’s made up of compromised CCTV cameras, surveillance cameras, DVRs, and other non-computers. And then when someone used Mirai to attack DNS provider Dyn last week, the Internet lost its collective mind. To figure out what it all means and whether this is the future we have in store, Dennis Fisher talked with Ronnie Tokazowski of Flashpoint about the effects of the attacks and how to fix IoT security.

Music by Chris Gonsalves and Ken Montigny.

Photo: TVZ Design. CC By 2.0 license.

Few people have been more deeply involved in the fight to protect strong encryption than Cindy Cohn. Beginning in the early 1990s when she was brought in as an outside counsel to help the EFF in the Bernstein v. Department of Justice case, and extending through the current conflict between law enforcement and technology vendors over access to encrypted devices, Cohn has been on the front lines for more than two decades. Now the executive director of the EFF, Cohn joins Dennis Fisher to talk about the parallels between the original crypto wars and today’s conflicts, how technology can both protect and put users at risk, and how the issues will evolve in the future.

Music by Chris Gonsalves and Ken Montigny. 

It’s been a weird and wild week in the security world, with the Yahoo mail-scanning scandal, the arrest of another NSA contractor for allegedly stealing classified documents, and the FBI asking for cyber help. So we called up Mike Mimoso of Threatpost to unpack all of it and see where things stand.

Music by Chris Gonsalves and Ken Montigny. 

Image from Flickr stream of TVZ Design. 

Jessy Irwin makes her triumphant return to the podcast to help us work through our feelings about the Yahoo data breach, the NIST guidance on SMS two-factor authentication, and why we’re still giving terrible security advice to users. Dennis Fisher and Jessy also talk about what kind of breaches could be lurking on the horizon and whether the upcoming election will become a security story.

Music by Chris Gonsalves and Ken Montigny.

Image from Flickr stream of Pete O’Shea.

There is an effort underway by some of the larger Internet infrastructure companies to encrypt as much of the network as possible. Google has been working on this for several years, making HTTPS connections the default for many of its services, and CloudFlare has done a lot of work on this as well. This week CloudFlare role out three new major encryption services, TLS 1.3, opportunistic encryption, and automatic HTTPS rewrites. Dennis Fisher spoke with Nick Sullivan, CloudFlare’s head of crypto, about the changes and what they mean for the future of the web.

Music by Chris Gonsalves and Ken Montigny. 

Image from Flickr stream of Vladimer Shioshvili.