Security Serengeti

In this episode, we discuss ClOP ransoming the wrong water company (oop?) and Tornado Cash sanctions.  We're not crypto experts, but dang if it isn't super interesting.  

Article 1 - Hackers attack UK water supplier but extort wrong companySupporting Article(s):Hackers Attack UK Water Supplier, Apparently Send Ransom Demand to the Wrong Company

Article 2 - Dutch authorities arrest 29-year-old dev with suspected ties to Tornado CashSupporting Articles:Erik Voorhees urges MakerDAO community to exit USDC positions after Tornado Cash sanctionsDutch Authority says arrested Tornado Cash developer suspected of involvement in financial crimesDevelopers could be punished for code created to commit crime, says Dutch regulatorArrest of suspected developer of Tornado CashThe Chopping Block: Did OFAC Overstep by Sanctioning Tornado Cash? – Ep. 386Cloning Tornado Cash Would Be Easy, but Risky'It Doesn’t Change Anything' Says Tornado Cash After Code Disappears From GitHubDeFi Exchange dYdX Blocking Addresses Associated With Tornado CashDeFi Web Apps Block Users Hit by Tornado Cash ‘Dust Attack’TRM Labs - Digital Asset Compliance and Risk Management

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this episode, we discuss the IBM Security Cost of a Data Breach Report 2022.  It's actually a really interesting report that goes into some detail on how much a Data Breach costs, and what things you can do as a defender to drive those costs down (and what things you're doing that increase those costs!)

We break down some of the high level statistics, and then we discuss what are the top things you can be doing to drive down the costs if your company gets breached.  Highly actionable information in here.

Report Link - Cost of a Data Breach Report

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this episode, we discuss the AIG Threat Group and their impact on Security, and then how another 'encrypted' message provider apparently doesn't know what that means.  We actually stuck to our self imposed 30 minute limit for once!  Shocking!  Really because we only picked two articles this week.  Ah well.

Article 1 - 'AIG' Threat Group Launches With Unique Business Model

Article 2 - For months, JusTalk messages were accessible to everyone on the InternetSupporting Articles:Messaging app JusTalk is spilling millions of unencrypted messagesLaw Enforcement Portals: Gateways to Compliance’s FutureUS government’s reported number of wiretaps don’t add upPwC audits ExpressVPN servers to confirm essential privacy protectionsAll Proton VPN apps are now open source and auditedFBI Snooped on Criminals Using Encrypted Messaging App

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this episode, we discuss INSURANCE! AGAIN!  It's seriously the most interesting part of Cyber right now.  Travelers Insurance is attempting to get a court to release it from paying a company because a company did not use MFA everywhere.  Super interesting.  Additionally we discuss Huawei and forced removal of equipment, and a prison break in Nigeria.  We are all over the place this week.

Article 1 - Travelers Wants Out of Contract With Insured That Allegedly Misrepresented MFA Use

Article 2 - Bill for US telcos to bin Chinese kit blows out by $3 billionSupporting Articles:Take it Huawei, Pai: Senate passes bill to rip 'dodgy' kit from rural telcosCNN Exclusive: FBI investigation determined Chinese-made Huawei equipment could disrupt US nuclear arsenal communicationsH.R.4998 - Secure and Trusted Communications Networks Act of 2019The Big Hack: How China Used a Tiny Chip to Infiltrate U.S. CompaniesYears later, Bloomberg doubles down on disputed Supermicro supply chain hack story

Article 3 - Nigerian Prison BreakSupporting Articles:UPDATED: Kuje Prison Attack: Heads will roll as Buhari receives report indicting officials – AregbesolaKuje Prison Attack: Our prisons not built to withstand terrorist attacks – Controller General

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this episode, we look at a $20 GPS tracker that you can add to your car to disable it if stolen, a (possibly) fake Android App to attack Russians for invading Ukraine, and a new product that promises to solve your ransomware problems.  Is this the end of the line for ransomware finally?  (spoiler alert - Probably not)

Article 1 - Unpatched GPS Tracker Security Bugs Threaten 1.5M Vehicles With DisruptionSupporting Articles:Seriously, David found like 20 of these, and they all have mostly the same info.  I'm not copying them all down here.  That being said, if you wanted to order one to play around with it - Mini GPS Tracker Car Micodus MV720N

Article 2 - Russian Hackers Tricked Ukrainians with Fake "DoS Android Apps to Target Russia"Supporting Articles:Anti-Russian denial-of-service app actually infects pro-Ukrainian activistsContinued cyber activity in Eastern Europe observed by TAG

Article 3 -  Can Encryption Key Intercepts Solve The Ransomware Epidemic?Supporting Articles:Nubeva Announces Third-Party Validation Of Its Upcoming Ransomware Reversal Solution

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this episode, we try something new...  A movie review!  WHOAMI is a German language movie, with English subtitles available on Netflix.  

Plot Summary from IMDB - "Benjamin, a young German computer whiz, is invited to join a subversive hacker group that wants to be noticed on the world's stage."

There will be spoilers without, so if you decide you want to watch it before listening to the podcast, here is your warning!  (There's an audio warning before we start on the spoilers)

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this episode, we look at the accusation that North Korea was behind the Harmony Bridge hack, Twitter users behind fished by a devious new method, and the 1 billion records lost in China because a dev hard coded some credentials into their code.  Yikes.  

Article 1 - Verified Twitter accounts phished via hate speech warnings

Article 2 - Crypto sleuths pin $100 million Harmony theft on Lazarus GroupSupporting Articles:More than $100m in cryptocurrency stolen from blockchain bizAxie Infinity’s blockchain was reportedly hacked via a fake LinkedIn job offerHow a fake job offer took down the world’s most popular crypto gameTrail Through Tornado Cash to North Korea

Article 3 - Human Error Blamed for Leak of 1 Billion Records of Chinese CitizensSupporting Articles:The Shanghainese of 6000 Years Ago - the Majiabang Culture

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this episode, we anxiously pore through the 2022 DBIR, looking for nuggets of wisdom we can apply to our defenses... only to find that not much changed this year.  Ransomware is up, social engineering is down, but it's still a lot of the same types of attacks being done the same way by the same bad guys.  

If next year's is similar, we will not bother having a specific episode for review.

Article - 2022 Data Breach Investigations Report

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this episode we discuss the top ten mistakes that CISO's make when it comes to vulnerability management.  I think that really could have been a top 5 list, but hey, maybe there was a word count.  Then we discuss RSA.  Which is funny, because neither of us went, so we read a bunch of articles about it and pretend we went!  Interestingly enough, we meant to discuss RSA as a covid super spreader event, and our different risk based takes on Covid, but we ran out of time!

Article 1 - Vulnerability management mistakes CISOs still make

Article 2 - RSA 2022 Musings: The Past and The Future of SecuritySupporting Articles:Inside the RSAC expo: Buzzword bingo and the bear in the roomRSAC branded a 'super spreader event' as attendees share COVID-19 test resultsMDR vs. MSSP: Why it's vital to know the difference

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

In this episode, we discuss a study done on the changes in timeline of ransomware actions from 2019 to 2021, including some enviable metrics reductions.  Seriously, if our companies were able to make efficiency increases like these, stockholders would be jumping for joy!

Article - Countdown to Ransomware: Analysis of Ransomware Attack TimelinesSupporting Articles:Quantum RansomwareManaging Administrative Shares (Admin$, IPC$, C$, D$) in Windows 10How to remove administrative shares in Windows Server 2008

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!