Security Serengeti

In this episode, we discuss a Kill Chain-like model for Social Engineering attacks.  We were going to do two articles, but we went deep.  Really deep.  So we split this one, and next week you'll get to hear about the Ransomware Timeline study.  That one was super interesting too!  Since the joke was ransomware related, I cut it out of this podcast, so no dad-level joke this week.

Article - Social Engineering Kill–Chain: Predicting, Minimizing & Disrupting Attack VerticalsSupporting Articles:Street Thief | Thriller Movie | Full Length | Free YouTube Movie

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this episode, we discuss how attackers can prehijack your account on popular social media and other apps, and how a surprising number of websites watch what you're doing before you hit submit.  

Article 1 - Hackers can hack your online accounts before you even register themSupporting Articles:Hackers Can 'Pre-Hijack' Online Accounts Before They Are Created by Users

Article 2 - Thousands of Popular Websites See What You Type—Before You Hit SubmitSupporting Articles:Awesome Gmail address tricks to get more out of your email ID

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this episode, we discuss Client Side Scanning, which is not what you think it is, the slippery slope it leads to, and the new US Law regarding reporting that just passed the US Senate.

Article 1 - Client side scanning may cost more than it deliversSupporting Articles:https://www.quora.com/Why-is-Facebook-censoring-private-messages

Article 2 - Breaking Down the Strengthening American Cybersecurity Act

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this episode we discuss Russia putting prisoner's to work on IT, and Cryptocurrency launderer put on US Sanctions list.  

Article 1 - Russia to Rent Tech-Savvy Prisoners to Corporate IT?Supporting Articles:Will It Blend Chuck Norris14th AmendmentWhat is Hard Labor?How Much do Prisoners Make in Each State?

Article 2 - Cryptocurrency laundromat Blender shredded by US Treasury in sanctions firstSupporting Articles:Who Is A United States Person?Sanctions List Search ToolA Fistful of Bitcoins: Characterizing Payments Among Men with No NamesCrypto Crime Trends for 2022: Illicit Transaction Activity Reaches All-Time High in Value, All-Time Low in Share of All Cryptocurrency Activity

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this episode we discuss the upcoming licensure requirements for SOC and Pentesting firms operating in Singapore, and then we briefly review a report from Microsoft on the how Russia is operating it's cyber arm of the war against Ukraine.

Article 1 - Singapore to license pentesters and managed infosec operatorsSupporting Articles:Original Law from 2018CSA Kicks Off Licensing Framework for Cybersecurity Service ProvidersLicensing Industry Consult Document (pdf)CLOSING NOTE TO INDUSTRY CONSULTATION ON THE LICENSING FRAMEWORK FOR CYBERSECURITY SERVICE PROVIDERS2022 Index of Economic Freedom

Article 2 - Microsoft: Russia Using Cyberattacks in Coordination With Military Invasion of UkraineSupporting Articles:The hybrid war in UkraineThe actual report the other two links are summaries of!Microsoft Documents Over 200 Cyberattacks by Russia Against Ukraine 0:03 / 2:35 The Way of the Gun (1/9) Movie CLIP - Raving Bitch Knock-Out (2000) HD

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this episode, we discuss the coming business of PERSONAL cyber insurance, and the late breaking news that India will be soon requiring some businesses to be notifying the government of a wide ranging set of "incidents" within 6 hours.  You have to read this one to believe it.

Article 1 - What’s happening in the world of personal cyber insurance?Supporting Articles:Do you need to get a personal cyber insurance policy?Do You Need Personal Cyber Insurance For Cyberattacks?

Article 2 - India to require cybersecurity incident reporting within six hoursSupporting Articles:Text of announcement - Notice the lack of details!Public-private cooperation for pandemic preparedness and responsePresident Biden Signs into Law the Cyber Incident Reporting for Critical Infrastructure Act, Expanding Cyber Reporting Obligations for a Wide Range of Public and Private Entities

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this episode, we finish taking a deep dive into an article by my Infosec spirit animal, Daniel Miessler on the future of Information Security work.  We agree, we disagree.  You should read the article and listen.

Article - Thinking About the Future of InfoSec (v2022)

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

I put on my robe and wizard hat... (NSFW)

In this episode, we take a deep dive into an article by my Infosec spirit animal, Daniel Miessler on the future of Information Security work.  We agree, we disagree.  You should read the article and listen.

Article - Thinking About the Future of InfoSec (v2022)

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

I put on my robe and wizard hat... (NSFW)

In this episode, we discuss a recent FBI report on cybercrime, and then we talk about the recent Ronin Bridge hack on Axie Infinity, and we get super deep into discussing the game, rather than the hack.  Oops?

Article 1 - Cybercriminals made $7bn in pure profit in 2021, says FBISupporting Articles:FBI Releases the Internet Crime Complaint Center 2021 Internet Crime ReportOrganizations paid at least $602 million to ransomware gangs in 2021

Article 2 - $625M stolen from Axie Infinity ‘s Ronin bridge, the largest ever crypto hackSupporting Articles:Who Hurts Most in $600 Million Axie Heist? ‘Not the Venture Capitalists’How much do you earn playing axie infinity?Community Alert: Ronin Validators Compromised

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this episode, we spend way too much time discussing a specious article about how state sanctioned criminals don't actually present any unique methods of disruption, and then hop skip and jump to Lapsus$ for a few minutes.

This one ran too long, both for the State Sanctioned, and the hack on Axie Infinity (coming next week!) so we broke it into two episodes.

Article 1 - https://www.csoonline.com/article/3655075/leaked-hacker-logs-show-weaknesses-of-russia-s-cyber-proxy-ecosystem.htmlSupporting Articles:LEAKED CHATS SHOW RUSSIAN RANSOMWARE GANG DISCUSSING PUTIN’S INVASION OF UKRAINE

Article 2 - A Closer Look at the LAPSUS$ Data Extortion GroupSupporting Articles:Trustwave’s Action Response: The Lapsus$ Hacker Group Shows Us the Importance of Securing the Digital Supply Chain

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!