Security Serengeti

It's all Uber all day today.  First we discuss the implications of Uber CSO being charged for not reporting the 2016 incident to the FTC and misprision!  Then we review a blog article on how Uber managed to reduce their log size by 169x!  

Article 1 - The Fallout From the First Trial of a Corporate Executive for ‘Covering Up’ a Data BreachSupporting Article(s):Former Uber general counsel testifies ex-security chief downplayed 2016 data breach

Article 2 - Reducing Logging Cost by Two Orders of Magnitude using CLPSupporting Article(s):CLP: Efficient and Scalable Search on Compressed Text Logsy-scope / clp - Github

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

A report!  A new report, in the torrents of blog posts and reports released by security companies!

A boring report :(

We discuss the Google September 2022 Threat Horizons report.  It's extremely Google Cloud centric, which I suppose it expected, but a little sad.  I think we were both disappointed in this report, as it's a very dry read, doesn't really present much new information, and has mitigations specific to Google Cloud.

Report Link - September 2022 Threat Horizons Report

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

Alright, so it's a little click baity, but I'm seeing that this is going to be a new role in criminal gangs.  Drone Pilot.  

We also discuss putting backdoors in ML Models at Compile Time, Microsoft's new RSS feed for vulns, and local thieves using jammers and de-authers to help them steal cars!

Article 1 - Inserting a Backdoor into a Machine-Learning System

Article 2 - How criminals are using jammers, deauthers to disrupt WiFi security camerasSupporting Articles:AURSINC WiFi Deauther Watch V1 ESP8266 Development Board | Wearable Watch | OLED | Attack/Control/Test Tool | LOT for DSTIKE NodeMCU(2.4GHz ONLY)Handheld MEGA 16 5GDRONESHOOT 800 – PHANTOM TECHNOLOGIES’ ANTI DRONE GUNHow Much Does Security Camera Installation Cost?Why Deauthing is not Jamming

Article 3 - Microsoft adds new RSS feed for security update notificationsSupporting Link:https://api.msrc.microsoft.com/update-guide/rss

Article 4 - How Wi-Fi spy drones snooped on financial firmSupporting Articles:Drone Hacking a FAKE Makerspace

BONUS ARTICLE - Microsoft Defender for Endpoint announcements at Microsoft Ignite 2022

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

Malicious OAuth apps are coming for your Exchange admins!  Oh noes!  Also, Powerpoint gets in the malware delivery game and it turns out that hackers are not considering the efficiency of spinning up AWS boxes to run cryptominers.  Not very considerate of them.  David has a particularly nasty twist on the Powerpoint one.  

Article 1 - Exchange servers abused for spam through malicious OAuth applicationsSupporting Article:OAuth app policies

Article 2 - Hackers Using PowerPoint Mouseover Trick to Infect Systems with Malware

Article 3 - Cryptominers hijack $53 worth of system resources to earn $1Supporting Article:Configure Amazon EC2 Dedicated Hosts

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

We discuss a new malware-as-a-service offering, bankers dodging regulations by using third party chat, and what would a Bloomberg Terminal for security look like?

Article 1 - Want to sneak a RAT into Windows? Buy Quantum Builder on the dark webSupporting Article:Agent Tesla RAT Delivered by Quantum Builder With New TTPs

Article 2 - Ever suspected bankers could just use WhatsApp comms? $1.8b says you're rightSupporting Articles:15 U.S. Code § 78q–1 - National system for clearance and settlement of securities transactionsSEC Charges 16 Wall Street Firms with Widespread Recordkeeping Failures

Article 3 - When Will Cybersecurity Get Its Bloomberg Terminal?Supporting Article:Beginner’s Guide to the Bloomberg Terminal

Article 4 - High-Profile Hacks Show Effectiveness of MFA Fatigue Attacks

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

We discuss the advances in AI Voice Technology, a new executive order requiring software vendors to establish secure coding practices, and a blog post on Anton Chuvakin's blog about transparency and trust in your detections from him and Oliver Rochford. 

Article 1 - We’re Entering the Age of Unethical Voice TechSupporting Articles:Fraudsters Cloned Company Director’s Voice In $35 Million Bank Heist, Police FindBanned Commercials - John Wayne Beer Commercial.mpg

Article 2 -  White House to tech world: Promise you'll write secure code – or Feds won't use it

Article 3 - On Trust and Transparency in Detection

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

Today we discuss China calling out the US for hacking universities, the new Twitter lawsuit on behalf of stock owners, and Uber being hacked.

Article 1 - Twitter, Inc. (Whistleblower)

Article 2 - China Accuses the NSA of Hacking a Top University to Steal DataSupporting Articles:Northwestern Polytechnical UniversityChinese Experts Uncover Details of Equation Group's Bvp47 Covert Hacking ToolDOD Grows University Affiliated Research Center Partnerships With HBCUsFY23 Department of Defense AppropriationsDoD Basic Research Letter - Final

Article 3 - Uber reels from 'security incident' in which cloud systems seemingly hijackedSupporting Articles:Bill Demirkapi Summary Thread on TwitterTeamPass

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this episode we look at a marketing article that discusses some survey result that are a little interesting, specifically regarding how people at companies feel about cyberwar.  Then we read over and discuss some highlights from an interview with an Inital Access Broker that's super interesting.

Article 1 - The (Nation) State of Cyber: 64% of Businesses Suspect They’ve Been Targeted or Impacted by Nation-State Attacks

Article 2 - An interview with initial access broker Wazawaka: ‘There is no such money anywhere as there is in ransomware’Supporting Link:Who is the Network Access Broker ‘Wazawaka?’

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this episode, we discuss Cloudflare IP's being banned in Austria due to overzealous Copyright enforcement, how attackers are moving off of Cobalt Strike as it's getting too well known, and finally Stego!  Yes, that's right, all of that CTF experience in stegonagraphy will finally come in handy!  Attackers were spotted downloading malware hidden in the cert of a JPG.

Article 1 - Pirate sites ban in Austria took down Cloudflare CDNs by mistakeSupporting Links:How content delivery networks (CDNs) workWahrnehmung von Leistungsschutzrechten GmbH - Informationen

Article 2 - Cybercrime Groups Increasingly Adopting Sliver Command-and-Control FrameworkSupporting Links:A How-To Guide for Using Sliver

Article 3 - James Webb telescope images used to hide malwareSupporting Links:How to monitor/detect Microsoft Office macro execution?Command line process auditing

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this episode, we discuss street criminals turning from drug related crime to fraud and potentially cybercrime, and PyPI's issues with malicious packages.

Article 1 - Small-time cybercrime is about to explode — We aren't readySupporting Articles:Crime clearance rate in the United States in 2020, by typeThe NYPD Tapes: Inside Bed-Stuy’s 81st PrecinctMiami Street Gangs See No Hope In Dope. They’ve Switched To Identity Fraud Fueled By Russian HackersBrett Johnson: US Most Wanted Cybercriminal | Lex Fridman Podcast #272

Article 2 - Malicious PyPi packages turn Discord into password-stealing malwareSupporting Articles:Two more malicious Python packages in the PyPI241 npm and PyPI packages caught dropping Linux cryptominersSnyk finds PyPi malware that steals Discord and Roblox credential and payment info

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!