Security Serengeti

Russia Meddling was not quite as bad as originally thought, Federal agency passwords are weak, digital license plates are a terrible but cool idea, and INSURANCE!

We should be sponsored by a cyber insurance company, for as often as we discuss it...

Article 1 - Russian meddling in 2016 US presidential election was weak sauce

Article 2 - A fifth of passwords used by federal agency cracked in security auditSupporting Links:XKCD - Password StrengthGibson Research Corporation - How Big is Your Haystack?Perfect Passwords - GRC's Ultra High Security Password Generator

Article 3 - Researchers Could Track the GPS Location of All of California’s New Digital License PlatesSupporting Links:How to track equipped cars via exploitable e-ink platemaker

Article 4 - Insurance Company Launches First-Ever 'Cyber Catastrophe Bond,' Which Seems About RightSupporting Links:The Lawfare Podcast: Bryan Cunningham on a Federally Funded Backstop for the Cyber Insurance EcosystemCONNECTICUT INSURANCE LAW JOURNAL VOL. 28Economic effects of the September 11 attacks

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

A security analytics platform is usually central to many companies security monitoring strategy.  Forrester released a new Wave that discusses the current landscape and how each vendor stands up.  They then made it available on their website for free!

We discuss the top and bottom vendors, and sprinkle in some of our own experience and hopes and dreams for the SIEM.

Link to Report - The Forrester Wave™: Security Analytics Platforms, Q4 2022

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

David and I sit down to discuss a new article from an insurer stating that Cyber Insurance is going to get more expensive than natural disasters, the LastPass hack, and some quick hits on killer robots, the NDAA and the government's plan to get into AI for warfighters, and some utterly predictable 2023 predictions.

Article 1 - San Francisco terminates explosive killer cop botsSupporting Articles:San Francisco lawmakers approve lethal robots – but they can't carry guns

Article 2 - Dozens of cybersecurity efforts included in this year’s US NDAA

Article 3 - 'Sextortion,' Business Disruption, and a Massive Attack: What Could Be in Store for 2023

Article 4 - PAYWALL - Cyber attacks set to become ‘uninsurable’, says Zurich chiefSupporting Articles:NO PAYWALL - Cyber attacks set to become ‘uninsurable’, says Zurich chief

Article 5 - LastPass BreachSupporting Articles:LastPass Cops to Massive Breach Including Customer Vault DataLastPass admits attackers have a copy of customers’ password vaultsThe 2022 LastPass data breach is starting to look truly horrendousJeremi Gosney InfoSec.Exchange Thread

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

David and I put our prediction hats on.  With how ChatGPT is setting the security and news world on fire, we sit down and put together some of our own ideas with many great ideas others have shared, and we speculate on how ChatGPT and AI in general will change Cybersecurity for the better and for the worse!

Supporting Articles:Unleashing the Power of ChatGPT for Bug Bounty and Penetration TestingNapkin Ideas Around What Changes to Expect Post-ChatGPTHow ChatGPT can turn anyone into a ransomware and malware threat actor Andrew Ng Twitter Threat on "Authoritative Nonsense"Sam Altman's comment on ChatGPT's "greatness"

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

This was a pretty boring news week.  ChatGPT took up all the air, so we tried it out to see if it could podcast better than us!  Spoiler alert - Not yet.  The ChatGPT summaries (included below as an fyi) were ALL wrong in some way, and we discuss how in the podcast.

Article 1 - AWS strains to make Simple Storage Service not so simple to screw upChatGPT Summary - Amazon Web Services (AWS) has announced a new feature for its Simple Storage Service (S3) called S3 Replication Time Control (S3 RTC), which allows users to specify the exact time that objects should be replicated between S3 storage classes and AWS regions. S3 RTC is designed to help users reduce costs and improve the efficiency of their data replication processes by allowing them to specify when replication should occur and how often it should be repeated. The feature also includes options for scheduling replication during specific time windows and for specifying different replication times for different object groups. AWS believes that S3 RTC will be particularly useful for users who need to replicate data between regions for disaster recovery or compliance purposes, as it allows them to specify exact replication times to meet their specific business needs.

Article 2 - Royal Ransomware Puts Novel Spin on Encryption TacticsChatGPT Summary - The article discusses a new variant of ransomware called "Royal Ransomware," which uses novel encryption tactics to evade detection and make recovery more difficult. The ransomware is delivered through a phishing email that contains a malicious link or attachment, which, when clicked, installs the malware on the victim's system. Once installed, the ransomware encrypts the victim's files and demands a ransom in exchange for the decryption key. What sets Royal Ransomware apart from other ransomware is its use of advanced techniques to avoid detection by security software and to make it more difficult for victims to recover their data. These techniques include using multiple layers of encryption, deleting shadow copies of the victim's files, and installing a rootkit to maintain persistence on the victim's system. The article advises organizations to implement strong cybersecurity measures, such as email filtering and employee training, to protect against ransomware attacks.

Article 3 - InfraGard, FBI Program for Critical Infrastructure Cybersecurity, Breached by HackersChatGPT Summary - The Federal Bureau of Investigation (FBI) has issued a warning about a recent cyber attack on the InfraGard program, which is a partnership between the FBI and private sector organizations to share information about critical infrastructure and cybersecurity threats. The attack reportedly involved the use of a phishing email that was sent to InfraGard members, which contained a link that, when clicked, installed malware on the recipient's computer. The malware gave the attackers access to the victim's system and allowed them to steal login credentials and other sensitive information. The FBI is advising InfraGard members and other organizations to be cautious when opening emails and to use strong passwords and two-factor authentication to protect against these types of attacks.Supporting Article:FBI’s Vetted Info Sharing Network ‘InfraGard’ Hacked

Article 4 -

We have a smorgasbord of articles today!  Some consultants tell us that Deception is hard, and David has a spicy take, we discuss differential privacy briefly, aged domains used in malware, and KILLER ROBOTS!

Article 1 - Crafty threat actor uses 'aged' domains to evade security platforms

Article 2 - How to Use Cyber Deception to Counter an Evolving and Advanced Threat Landscape

Article 3 - Computer Repair Technicians Are Stealing Your DataSupporting Article:Samsung Releases Maintenance Mode, A New Feature To Hide Your Personal Information From Prying EyesThinking about taking your computer to the repair shop? Be very afraid

Article 4 - San Francisco lawmakers approve lethal robots, but they can't carry gunsSupporting Articles:Bomb-disposal robot violently disposes of Dallas cop-killer gunmanGoliath Demolition Tank

Article 5 -Census Bureau Chief Defends New Privacy Tool Against CriticsSupporting Article:What is Differential Privacy and How does it Work?

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

As you know, we're always looking for new and interesting reports to discuss, and this time we're discussing the Hype Cycle.  It's a report that's published by Gartner, and made available to normal folks like us via Vendors!  So what is the Hype Cycle (specifically for Security Operations here... I guess there are other Hype Cycles for other areas) and what can we learn from it?

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

The Interplanetary File System serving malware from the stars!  Also included are some bonus discussions around automatically exfiltrating information from your own organization using SOAR and a discussion about an article on API myths.  Matthew got heated on the API one.  It's mostly good information, but presented in a super sale-sy way.  And there's nothing Matthew hates more than sales.  Vendors make him froth at the mouth.

Article 1 - Top 5 API Security Myths That Are Crushing Your Business

Article 2 - InterPlanetary File System Increasingly Weaponized for Phishing, Malware DeliverySupporting Articles:Attackers Using IPFS for Distributed, Bulletproof Malware HostingSeveral Cyber Attacks Observed Leveraging IPFS Decentralized NetworkInterPlanetary File System

Article 3 - urlscan.io's SOAR spot: Chatty security tools leaking private dataSupporting Articles:Tell HN: GitHub leaked names of private repos with pagesUnderstanding Google Dorks and How Hackers Use Them

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

Matthew ran a little late this weekend, so apologies for being a day late deploying the latest security news into your earhole!

We talk Solarwinds and a lawsuit, then a little SEC action.  Then we discuss the ever decreasing time frame to patch new vulnerabilities, and we lead off with a little conspiracy theory action about a government contractor that just might be using their privileged position for some man in the middle for the gov.  I mean, what legitimate government contractor ISN'T run out of a UPS Store?

Article 1 - Mysterious company with government ties plays key internet roleSupporting Article:Where does Firefox store cerificates and how to delete one?

Article 2 - Zero-day are exploited on a massive scale in increasingly shorter timeframesSupporting Article:Microsoft Digital Defense Report 2022Intro to HDMoore’s Law

Article 3 - SolarWinds Faces Potential SEC Enforcement Act Over Orion BreachSupporting Article:CLASS ACTION COMPLAINT FOR VIOLATION OF THE FEDERAL SECURITIES LAWS SOLARWINDS CORPORATION Form 8-K

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

Several short stories for your consideration on this fine November day.

First, Sophos thinks we're on the hysteria part of the FUD Curve where Deepfakes are concerned, and we agree (as if our opinion mattered).  Then we discuss Bitcoin Mining Firms possibly going bankrupt.  Not really security related, but hey, it was interesting.  The Samsung is introducing Maintenance Mode for when you have to hand your phone over to be repaired!  Finally, the most interesting, the use of IIS Web Logs for command and control... this is amazing.  Unfortunately, the article didn't have a ton of information, but it's a really cool new method!

Article 1 - Phishing works so well crims won't bother with deepfakes, says Sophos chap

Article 2 - World’s largest Bitcoin mining firm Core Scientific on the verge of insolvency

Article 3 - Maintenance Mode aims to keep phone data private during repairs

Article 4 - Hackers use Microsoft IIS web server logs to control malwareSupporting Article(s):Cranefly Cyberspy Group Spawns Unique ISS Technique

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!