On The Wire

Ransomware is one of the nastier and more insidious threats to emerge in the last decade, and the attackers using it have targeted consumers and businesses alike. Threats such as CryptoLocker, Locky, Cryptowall, and many others have been locking up users’ files and demanding hundreds or thousands of dollars in order to decrypt them. Security researchers and law enforcement have had some success in going after ransomware gangs, but they are highly distributed and amorphous and difficult to get a handle on. To find out where this mess came from, who’s behind it, and wha we can do about it, Dennis Fisher talked with Juan Andres Guerrero-Saade of Kaspersky Lab, Jessy Irwin, and Patrick Wardle of Synack for this special edition of the podcast.

Alex Howard has been writing and thinking about technology and open data issues for more than a decade, having worked at O’Reilly Radar, the Huffington Post, and now at the Sunlight Foundation. In this episode of the podcast, Dennis Fisher talks with Alex about the ways in which technology coverage has shifted, the advent of open data and how governments and enterprises are sharing more information, and what he’s working on at the Sunlight Foundation. You can find Alex on Twitter @digiphile.

Music by Chris Gonsalves and Ken Montigny.

Dennis Fisher talks with David Dewey, director of research at Pindrop, about the data in the 2016 Phone Fraud Report. Since 2013 there has been a 45 percent increase in phone fraud and now more than one in every 2,000 calls to corporate call centers is fraudulent. This kind of fraud is costing business as much as $27 million a year. Dewey talks about the factors driving this boom in phone fraud and how businesses are dealing with it.

In this episode of the On the Wire podcast, Dennis Fisher talks with Chris Hadnagy of Social-Engineer Inc., about the concept of social engineering, how he got into the field, and how social engineering techniques are used by attackers. Chris talks about the way phishing has evolved in recent years, the rise of phone fraud and vishing, and how pretexting and information gathering aid attackers.

Music by Chris Gonsalves and Ken Montigny.

Patrick Wardle is well-known in the security community for his research on Mac OS X security features and malware. He’s demonstrated practical methods for bypassing Gatekeeper and the other security mechanisms in OS X, and he recently released a free tool called RansomWhere? that’s designed to generically detect OS X ransomware, such as KeRanger. Dennis Fisher talked with Wardle about RansomWhere?, the ransomware problem, and how we can modify user behavior to protect themselves.

Music by Chris Gonsalves and Ken Montigny.

Katie Moussouris has been a part of the hacker community since, well, a long time. A former penetration tester at @stake and a longtime security employee at Microsoft, she has spent the last two years as the chief policy officer at HackerOne, the bug bounty coordination platform. Now, she’s starting her own consulting firm to help vendors and hackers learn to play nice together and coordinate vulnerability research, reward, and disclosure. Katie spoke with Dennis Fisher about the current state of bug bounties, the limits of those programs, offensive security markets, and a range of other topics.

Music by Chris Gonsalves and Ken Montigny.

Jessy Irwin of 1Password returns to the podcast to talk with Dennis Fisher about the conclusion, at east for now, of the Apple-FBI case, the consequences of the outcome, the continued push for encryption in many communications channels, and the need for better security communications from vendors. Then the conversation turns to password policies and usable security and why we’re not making as much progress as we’d like on that front.

Music by Chris Gonsalves and Ken Montigny. 

Dennis Fisher talks with Mike Mimoso of Threatpost about the details of Apple’s legal and PR battle with the FBI and federal government. The case involves a lot of oddities, including the FBI’s choice to play it out in public, why the FBI didn’t seek help from forensics experts, and why the government decided that this was the case it wanted to fight this battle over.

Music by Chris Gonsalves and Ken Montigny.

Apple has been touting its Apple Pay app as a secure, convenient alternative to other payment systems. It has been adopted by a number of major retailers and card issuers, but David Dewey, research director at Pindrop Labs, ran several experiments on the system’s card enrollment and authentication flow and found some serious problems. Using social engineering and other techniques, Dewey was able to enroll other people’s cards in his Apple Pay account and use them as if they were his own. In this episode of the podcast, Dennis Fisher talks with Dewey about the research, how the card issuers have addressed the problems he found, and what can be done to further secure mobile payment systems.

Music by Chris Gonsalves and Ken Montigny. 

In this episode, Dennis Fisher brings on Rich Mogull of Securosis to talk about the FTC demanding information from PCI assessors. The PCI standard has been in place for more than a decade now and while it has contributed to raising the level of security, the assessment industry has long been fraught with problems. Rich talks about the conflicts of interest in the assessment process, why nothing has been done about it before, and what the FTC might do with the data it gathers from the assessors. They also talk about the interest the FTC is taking in how many companies that suffered a data breach had gotten a compliant assessment the previous year.

Music by Chris Gonsalves and Ken Montigny.