Securit13 Podcast

SecurityBsides Odessa CTF is open! https://odessa.securitybsides.org.ua/#ctf All who wants to support BSides Odessa you can do it here https://bsidesodessa.ticketforevent.com/

SecurityBSides Kharkiv https://kharkiv.securitybsides.org.ua

The mysterious hacker who claimed responsibility for the hack on the DNC is likely a disinformation campaign by Russian spies. https://motherboard.vice.com/en_us/article/wnxgwq/guccifer-20-is-likely-a-russian-government-attempt-to-cover-up-their-own-hack

The security firm halted the work after questions were asked in the European Parliament about its software. https://www.bbc.com/news/technology-44501506

She wrote an email posing as him, turning down a $50,000-a-year scholarship so that he wouldn't leave http://montrealgazette.com/news/local-news/mcgill-music-student-awarded-350000-after-girlfriend-stalls-career

Commentary: People can no longer tell when they're chatting with a robot. Google, what have you done? https://www.cnet.com/news/google-duplex-assistant-bot-deception-scary-ethics-question/ https://www.ieee-security.org/TC/SP2018/program.html https://www.cnet.com/news/google-duplex-assistant-bot-deception-scary-ethics-question/ https://www.engadget.com/2018/06/05/apple-safari-canvas-fingerprinting/ https://webkit.org/blog/8311/intelligent-tracking-prevention-2-0/ https://fpcentral.tbb.torproject.org

Apple is going after another way sites track you for ads. https://www.engadget.com/2018/06/05/apple-safari-canvas-fingerprinting/ https://webkit.org/blog/8311/intelligent-tracking-prevention-2-0/

Phone scammers are spoofing numbers to make them look familiar to you. You're more likely to pick up and trust the person on the other end https://www.cnbc.com/2018/06/12/you-think-its-your-friend-calling-but-its-actually-this-growing-phone-scam.html

Support us on Patreon https://patreon.com/securit13

Интервью с Александром Оленевым и Андреем Волошиным из Thea/Techmaker за жизнь, бизнес, обучение тренингам хардвер инженеров и немного про безопасность автомобилей. https://www.youtube.com/watch?v=5QBOmr_ZyLo DEFCON 25 Nissan Leaf security

https://www.troyhunt.com/controlling-vehicle-features-of-nissan/ Controlling vehicle features of Nissan LEAFs across the globe via vulnerable APIs

https://users.ece.cmu.edu/~koopman/pubs/koopman14_toyota_ua_slides.pdf Tpyota unintended acceleration bug

http://esd.cs.ucr.edu/webres/can20.pdf CAN bus specs (BOSCH)

https://www.bmw.co.uk/bmw-ownership/connecteddrive BMW ConnectedDrive

https://www.macworld.co.uk/news/apple/apple-car-release-date-3425394/ Apple iCar release date rumours, features & images

https://www.nvidia.com/en-us/self-driving-cars/ NVIDIA Self-driving cars

https://hackaday.com/2017/06/19/intel-discontinues-joule-galileo-and-edison-product-lines/ Intel Discontinues Joule, Galileo, And Edison Product Lines

https://techmaker.ua TWIC who wants to participate as an AppSec mentor on Techmaker email to [email protected]

https://mobiliuz.com/ Connected cars

Books Thinking, Fast and Slow, Daniel Kahneman ISBN 9785170800537 https://www.amazon.co.uk/Thinking-medlenno-reshay-bystro-Russian/dp/5170800533/ref=sr_1_1 Franchesca, Dorje Batuu ISBN 978-617-679-485-1 https://www.yakaboo.ua/ua/francheska-povelitel-ka-traektorij.html

Securit13 Patreon https://www.patreon.com/securit13

16.06.2018 BSidesKharkiv https://kharkiv.securitybsides.org.ua/ 07.06.2018 OWASP Odesa https://www.facebook.com/events/2104923576405410/ 07.07.2018 BSidesOdessa https://odessa.securitybsides.org.ua/ Kostiantyn Korsun про NoNameCon https://www.facebook.com/kostiantyn.korsun/posts/840821456102957 EFAIL https://efail.de/ Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels (draft 0.9.1) https://efail.de/efail-attack-paper.pdf ProtonMail is safe against the efail PGP vulnerability. https://twitter.com/ProtonMail/status/995996112526954496 Efail or OpenPGP is safer than S/MIME https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060315.html Digital Photocopiers Loaded With Secrets https://www.cbsnews.com/news/digital-photocopiers-loaded-with-secrets/ Throwhammer: Rowhammer Attacks over the Network and Defenses https://www.cs.vu.nl/~herbertb/download/papers/throwhammer_atc18.pdf Rowhammer strikes networks, Bolton strikes security jobs, and Nigel Thornberry strikes Chrome, and more http://www.theregister.co.uk/2018/05/12/security_roundup/ Memcached https://memcached.org/ 7-Zip: From Uninitialized Memory to Remote Code Execution https://landave.io/2018/05/7-zip-from-uninitialized-memory-to-remote-code-execution/ IBM bans all removable storage, for all staff, everywhere http://www.theregister.co.uk/2018/05/10/ibm_bans_all_removable_storage_for_all_staff_everywhere/ Second wave of Spectre-like CPU security flaws won't be fixed for a while http://www.theregister.co.uk/2018/05/09/spectr_ng_fix_delayed/ Every major OS maker misread Intel's docs. Now their kernels can be hijacked or crashed http://www.theregister.co.uk/2018/05/09/intel_amd_kernel_privilege_escalation_flaws/ Ex-CIA man fingered as prime suspect in Vault 7 spy tool manuals leak http://www.theregister.co.uk/2018/05/15/vault_7_leak/ DHCP Client Script Code Execution Vulnerability - CVE-2018-1111 https://access.redhat.com/security/vulnerabilities/3442151

Securit13 Patreon https://www.patreon.com/securit13

Keygen Music [2+ hour Mix] https://www.youtube.com/watch?v=cYkaG5CT53I

Мы немного поговорили про конференции, организованные, будущие и посещенные.

#BSidesKyiv 2018 https://www.facebook.com/pg/BSidesUkraine/ Video https://www.youtube.com/channel/UCOSf0249iC28paeqYY5nRSQ 22.05.2018 WWCode Security event https://www.facebook.com/events/243552549527834/ 16.06.2018 BSidesKharkiv https://kharkiv.securitybsides.org.ua/ 07.07.2018 BSidesOdessa https://odessa.securitybsides.org.ua/ Jack Daniel https://twitter.com/jack_daniel/status/992135632616124416 GiSec https://www.gisec.ae/

Music - KEYGEN MUSIC ~ One hour mix https://www.youtube.com/watch?v=c17k4LfLkaE

Наши ведущие обсуждали эту страшную абревиатуру GDPR еще до того как это стало мейнстримом, но до публикации дошло с опозданием... И все же несколько слов о регуляции и как ее понимают наши ведущие.

General Data Protection Regulation https://www.eugdpr.org/ How Europe's New Privacy Law Will Change the Web, and More https://www.wired.com/story/europes-new-privacy-law-will-change-the-web-and-more/amp Some more information: GDPR - A Practical Guide For Developers - Bozho's tech blog https://techblog.bozho.net/gdpr-practical-guide-developers/ America should borrow from Europe's data-privacy law https://www.economist.com/news/leaders/21739961-gdprs-premise-consumers-should-be-charge-their-own-personal-data-right Action Required to Secure the Cisco IOS and IOS XE Smart Install Feature https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180409-smi Iran hit by global cyber attack that left U.S. flag on screens https://flipboard.com/@flipboard/-iran-hit-by-global-cyber-attack-that-le/f-9fa77d2247%2Freuters.com FIDO Alliance and W3C have a plan to kill the password https://techcrunch.com/2018/04/10/fido-alliance-and-w3c-have-a-plan-to-kill-the-password/amp/ Okay, Let's Talk About John McAfee's Paid Cryptocurrency Promotions https://motherboard.vice.com/en_us/article/3kjpyn/john-mcafee-100k-twitter-promote-cryptocurrency-paid

Music - KEYGEN MUSIC ~ One hour mix https://www.youtube.com/watch?v=c17k4LfLkaE

Мы обсуждали новости, их все забыли и вот мы решили вам напомнить! Да, мы немножко слоупоки)))

Everything You Need to Know About Facebook and Cambridge Analytica https://www.wired.com/story/wired-facebook-cambridge-analytica-coverage/amp Cambridge Analytica whistleblower Christopher Wylie appears before MPs https://www.youtube.com/watch?v=X5g6IJm7YJQ Fact Check: Your Call and SMS History http://newsroom.fb.com/news/2018/03/fact-check-your-call-and-sms-history/ https://www.facebook.com/settings?tab=applications (FB removed "Apps others use") Total Meltdown? https://blog.frizk.net/2018/03/total-meltdown.html?m=1 It's baaack – WannaCry nasty soars through Boeing's computers http://www.theregister.co.uk/2018/03/28/wannacry_boeing/ Egg on Cisco's face: Three critical software bugs to fix over Easter http://www.theregister.co.uk/2018/03/29/cisco_critical_ios_bugs/ Guccifer 2.0 Was Always Sloppy https://motherboard.vice.com/amp/en_us/article/a3ygmp/guccifer-2-russian-military-intelligence-gru-vpn Rapid 2.0 Ransomware Released, Will Not Encrypt Data on PCs with Russian Locale https://www.bleepingcomputer.com/news/security/rapid-20-ransomware-released-will-not-encrypt-data-on-pcs-with-russian-locale/ Academics Discover New CPU Side-Channel Attack Named BranchScope https://www.bleepingcomputer.com/news/security/academics-discover-new-cpu-side-channel-attack-named-branchscope/ Practical Attacks Against Privacy and Availability in 4G/LTE Mobile Communication Systems https://arxiv.org/pdf/1510.07563.pdf Adrian Lamo, 'Homeless Hacker' Who Turned in Chelsea Manning, Dead at 37 https://krebsonsecurity.com/2018/03/adrian-lamo-homeless-hacker-who-turned-in-chelsea-manning-dead-at-37/ https://github.com/fulldecent/system-bus-radio Microsoft May Ban Users For Offensive Language Starting In May https://www.bleepingcomputer.com/news/microsoft/microsoft-may-ban-users-for-offensive-language-starting-in-may/ Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002 https://www.drupal.org/sa-core-2018-002 NOTICE OF DATA BREACH https://content.myfitnesspal.com/security-information/notice.html Durov refuses to hand over Telegram encryption keys to FSB http://searchsecurity.techtarget.com/news/252437323/Dorov-refuses-to-hand-over-Telegram-encryption-keys-to-FSB Signalling Security in Telecom SS7/Diameter/5G — ENISA https://www.enisa.europa.eu/publications/signalling-security-in-telecom-ss7-diameter-5g

Music - KEYGEN MUSIC ~ One hour mix https://www.youtube.com/watch?v=c17k4LfLkaE

Adam Doupé http://www.adamdoupe.com/ Adam on twitter https://twitter.com/adamdoupe Adam on youtube https://www.youtube.com/channel/UCWA6pfcx4Ok4xsIA7Mkr39w Series of live hacking of CTF challenges on YouTube https://www.youtube.com/playlist?list=PLK06XT3hFPziMAZj8QuoqC8iVaEbrlZWh Book The Cuckoo's Egg: Tracking a Spy Through the Maze of Computer Espionage https://www.amazon.co.uk/Cuckoos-Egg-Tracking-Computer-Espionage/dp/1416507787

Мы тут пытались обговорить ход подготовки к BSidesKyiv 2018. Как это получилось - судите сами.

Intro / Outro Extraction de la pierre de folie by Cuicuitte http://freemusicarchive.org/music/Cuicuitte/LAntville/Cuicuitte_-_LAntville_-_09_Extraction_de_la_pierre_de_folie

#BsidesKyiv 2018 https://securitybsides.org.ua/ Shedule https://securitybsides.org.ua/#schedule Tickets https://securitybsides.ticketforevent.com/ Radar2 http://www.radare.org/r/ Vero - True Social https://www.vero.co/ How To Get Started With Vero - True Social https://www.forbes.com/sites/anthonykarcz/2018/02/23/how-to-get-started-with-vero-true-social/#2b54ae3d2889 Here's how to delete your Vero account https://mashable.com/2018/02/27/how-to-delete-vero-account/#J8IkV29ZoOqy

Keygen Music [2+ hour Mix] https://www.youtube.com/watch?v=cYkaG5CT53I

White House blasts Russia for NotPetya cyberattack https://edition.cnn.com/2018/02/15/politics/white-house-russia-notpetya/index.html Memcached servers can be hijacked for massive DDoS attacks https://www.networkworld.com/article/3258772/security/memcached-servers-can-be-hijacked-for-massive-ddos-attacks.html Memcrashed - Major amplification attacks from UDP port 11211 https://blog.cloudflare.com/memcr ashed-major-amplification-attacks-from-port-11211/ GITHUB SURVIVED THE BIGGEST DDOS ATTACK EVER RECORDED https://www.wired.com/story/github-ddos-memcached/amp NETSCOUT Arbor Confirms 1.7 Tbps DDoS Attack; The Terabit Attack Era Is Upon Us https://www.arbornetworks.com/blog/asert/netscout-arbor-confirms-1-7-tbps-ddos-attack-terabit-attack-era-upon-us/ У Харкові засуджено підозрюваного за продаж клієнтської бази поштового перевізника https://cyberpolice.gov.ua/news/u-xarkovi-zasudzheno-pidozryuvanogo-za-prodazh-kliyentskoyi-bazy-poshtovogo-pereviznyka-6604/ Speculative Execution Bounty Launch https://blogs.technet.microsoft.com/msrc/2018/03/14/speculative-execution-bounty-launch/ Frequently Asked Questions about Microsoft Bug Bounty Programs https://technet.microsoft.com/en-us/security/dn425055.aspx AMD allegedly has its own Spectre-like security flaws https://www.cnet.com/google-amp/news/amd-has-a-spectre-meltdown-like-security-flaw-of-its-own/ ​Linus Torvalds slams CTS Labs over AMD vulnerability report http://www.zdnet.com/article/linus-torvalds-slams-cts-labs-over-amd-vulnerability-report/ Intel: Our next chips won't have data leak flaws we told you totally not to worry about https://www.theregister.co.uk/2018/03/15/intel_spectre_mitigation/ Intel ships (hopefully stable) microcode for Skylake, Kaby Lake, Coffee Lake https://arstechnica.com/gadgets/2018/02/intel-ships-hopefully-stable-microcode-for-skylake-kaby-lake-coffee-lake/ Samba settings SNAFU lets any user change admin passwords https://www.theregister.co.uk/2018/03/14/samba_password_bug/ Zero-day vulnerability in Telegram https://securelist.com/zero-day-vulnerability-in-telegram/83800/ Plugins for Popular Text Editors Could Help Hackers Gain Elevated Privileges https://thehackernews.com/2018/03/text-editors-extensibility.html В Исландии похитили 600 серверов для добычи Bitcoin https://www.ixbt.com/news/2018/03/06/v-islandii-pohitili-600-serverov-dlja-dobychi-bitcoin.html CBM - Car Backdoor Maker https://www.kitploit.com/2018/03/cbm-car-backdoor-maker.html Let's Encrypt updates certificate automation, adds splats https://www.theregister.co.uk/2018/03/14/lets_encrypt_updates_certificate_automation_adds_splats/ CEO of smartmobe outfit Phantom Secure cuffed after cocaine sting, boast of murder-by-GPS http://www.theregister.co.uk/2018/03/13/phantom_secure_ceo_arrested/

Keygen Music [2+ hour Mix] https://www.youtube.com/watch?v=cYkaG5CT53I

К нам пришел наш друг Сергей Смитиенко и мы поговорили про архитектуру х86. Получилось немного меланхолично и безысходно, но познаветельно.

Intro / Outro Ninja by Indikings http://freemusicarchive.org/music/Indikings/Back_In_Space/indikings_ninja

Breaking the x86 Instruction Set https://www.youtube.com/watch?v=KrksBdWcZgQ DEF CON 25 - Christopher Domas - Breaking the x86 Instruction Set https://www.youtube.com/watch?v=ajccZ7LdvoQ 17 BHB ASIA 013 Hello From the Other Side SSH Over Robust Cache Covert Channels in the Cloud https://www.youtube.com/watch?v=a9sGk7FtnYk Clémentine Maurice https://cmaurice.fr/ PinMe: Tracking a Smartphone User around the World https://arxiv.org/pdf/1802.01468.pdf Here's the Solution to the 3-Year-Old, $50,000 Bitcoin Puzzle https://motherboard.vice.com/en_us/article/kzpqzz/heres-the-solution-to-the-3-year-old-dollar50000-bitcoin-puzzle Books: Intel® 64 and IA-32 Architectures Software Developer's Manual https://software.intel.com/sites/default/files/managed/39/c5/325462-sdm-vol-1-2abcd-3abcd.pdf Intel® 64 and IA-32 Architectures Optimization Reference Manual https://www.intel.com/content/dam/www/public/us/en/documents/manuals/64-ia-32-architectures-optimization-manual.pdf

Keygen Music [2+ hour Mix] https://www.youtube.com/watch?v=cYkaG5CT53I