On The Wire

It’s been a few months since we talked with Bruce Schneier, the cryptographer, author, and speaker, and there was plenty to cover. In this episode, Dennis Fisher talks with Bruce about the Shadow Brokers NSA tool dump, the crypto debate, and the Sweet32 attack that was revealed last week.

Music by Chris Gonsalves and Ken Montigny. 

It’s not often that we get to talk to someone who has launched something into space, but this week we had the chance to speak to Mikhail Davidov and Jon Oberheide of Duo Security about the company’s Duo in Space project. Using a large latex balloon, the company launched a small-ish device into near space earlier this month in an effort to complete an authentication procedure from there to the ground. The process didn’t completely work, thanks to bandwidth issues, but the craft reached a maximum altitude of 96,000 feet and proved that Elon Musk doesn’t have the market cornered on cool space projects. Oh, and we also talked about NIST deprecating SMS for two-factor authentication.

The release by a group called Shadow Brokers of a massive amount of tools, vulnerabilities, and exploits apparently used by the Equation Group hacking team linked to the NSA has set the security industry buzzing and raised a number of questions about government surveillance, security, and foreign policy. Dennis Fisher talks with Rick Holland of Digital Shadows about what this all means for enterprises, the political implications, and the ethics of the government hoarding zero days.

In the midst of the Black Hat mayhem last week, Dennis Fisher took some time to sit down for a group podcast with some fellow journalists and other guests, including Patrick Gray of the Risky Business podcast, Jessy Irwin, Mike Mimoso of Threatpost, Fahmida Rashid of InfoWorld, Chris Brook of Threatpost, and Brian Donohue of Booz Allen Hamilton’s Cyber4Sight team. This episode covers a wide range of topics, including the most interesting sessions at the conference, 0-day sales, security research on security products, and how the media covers it all.

The Black Hat conference has become an overwhelming mass of talks, press conferences, and more talks. In this episode of the podcast, Dennis Fisher calls up Mike Mimoso of Threatpost to go over the talks they’re interested in seeing, the Apple iOS 10 security session, and how the conference has evolved over the years.

Security people spend a lot of time setting up defenses and thinking about how to secure their organization’s assets, so they don’t always have the time to think about how their adversaries might come at them and how those adversaries are thinking. Robert Hansen, a longtime security researcher, has spent a lot of time considering the attacker’s mindset: what motivates them, how they work, how they collaborate, and what they worry about. Dennis Fisher talked with Hansen about those topics, as well as ways to disrupt the attackers’ ecosystem, in this episode of the podcast.

Music by Chris Gonsalves and Ken Montigny.

Let’s be honest: The ransomware crews are kind of winning right now. They have a simple, clean business model, a huge victim base, and not much on the horizon to slow them down. In this episode, Dennis Fisher talks with Rick Holland of Digital Shadows about a new research paper the firm did on ransomware gangs, as well as other kinds of online extortion schemes, such as DDoS extortion. Rick talks about the extortion landscape, what’s enabling these operations, and what might be done to stop them.

Threat intelligence and ransomware have become inescapable topics in the security community of late, and there’s at least as much noise as signal in most of the discussions about them. To cut through some of this nonsense, Dennis Fisher called Wade Williamson of Vectra Networks to discuss the ways in which enterprises are detecting and dealing with ransomware on a network level and how they’re implementing and using threat intelligence feeds.

Music by Chris Gonsalves and Ken Montigny.

Apple this week announced a new system called differential privacy that it will be implementing in many of its products in the coming months. The system is designed to allow for the collection of user data without being able to tie any of it back to specific users. But it’s more complicated and nuanced than that, so Dennis Fisher got Rich Mogull of Securosis on the phone to talk through the details of the system and what it means for users.

Music by Chris Gonsalves and Ken Montigny. 

In this episode, Dennis Fisher talks with Jessy Irwin about the recent rash of data breaches and credential dumps and why humans are still so terrible at password security. The conversation touches on alternatives to traditional passwords, the limits of two-factor authentication, and he or if thing might actually improve.

Music by Chris Gonsalves and Ken Montigny.