Sign up to save your podcasts
Or
Share TechSNAP
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
TechSNAP episodes
- Episode 384: Interplanetary Peers
Jon the Nice Guy joins Wes to discuss all things IPFS. We'll explore what it does, how it works, and why it might be the best hope for a decentralized internet.
Plus, Magecart strikes again, Alpine has package problems, and why you shouldn't trust Western Digital's MyCloud.
Special Guest: Jon Spriggs.
Links:
- GovPayNow.com Leaks 14M+ Records
— Government Payment Service Inc. has leaked more than 14 million customer records dating back at least six years, including names, addresses, phone numbers and the last four digits of the payer’s credit card.- Magecart claims another victim in Newegg merchant data theft
— Researchers from RiskIQ, together with Volexity, revealed that California-based retailer Newegg is the latest well-known merchant to succumb to the threat actors.- RiskIQ: Another Victim of the Magecart Assault Emerges
- Password bypass flaw in Western Digital My Cloud drives puts data at risk
— A security researcher has published details of a vulnerability in Western Digital’s My Cloud devices, which could allow an attacker to bypass the admin password on the drive, gaining complete control over the user’s data.- WD MyCloud Metasploit Example
- Cloudflare goes InterPlanetary
— Today we’re excited to introduce Cloudflare’s IPFS Gateway, an easy way to access content from the InterPlanetary File System (IPFS) that doesn’t require installing and running any special software on your computer.- End-to-End Integrity with IPFS
— This post describes how to use Cloudflare's IPFS gateway to set up a website which is end-to-end secure, while maintaining the performance and reliability benefits of being served from Cloudflare’s edge network.- How permanent is data stored on IPFS?
- Lesson: Add Content to IPFS and Retrieve It · Decentralized Web Primer
- Leo Tindall: Putting This Blog on IPFS
- A Beginner’s Guide to IPFS
— IPFS consists of several innovations in communication protocols and distributed systems that have been combined to produce a file system like no other.- Useful resources for using IPFS and building things on top of it
- OrbitDB: Peer-to-Peer Databases for the Decentralized Web
- Rebuild Alpine Linux Docker Containers After Package Manager Patch
— An attacker could intercept a package request as a Alpine Linux Docker image is being built and add malicious code that target machines would then unpack and run within the Docker container38 min - Episode 383: The Power of Shame
TechSNAP progenitor and special guest Allan Jude joins us to talk mobile security, hand out some SSH tips and tricks, and discuss why security shaming works so well.
Plus, how Mozilla is protecting their GitHub repos, a check-in on Equifax, and some great picks.
Special Guest: Allan Jude.
Links:
- Protecting Mozilla’s GitHub Repositories from Malicious Modification
- British Airways: Suspect code that hacked fliers 'found'
- A year later, Equifax lost your data but faced little fallout
- Security Implications of SSH Forwarding
- sshd_config manual
- SSH Chaining (for jumphosts)
- Troy Hunt posts a blog where he argues in favour of publicly shaming companies for bad security
- Your phone is NOT your password
- Select Star SQL: an interactive book which aims to be the best place to learn SQL
- Source Of Evil – A Botnet Code Collection
- xsv: A fast CSV command line toolkit written in Rust
52 min - Episode 382: Domestic Disappointments
We’re joined by a special guest to discuss the failures of campaign security, the disastrous consequences of a mismanaged firewall, and the suspicious case of Speck.
Plus the latest vulnerabilities in Wireshark and OpenSSH, the new forensic hotness from Netflix, and some great introductions to cryptography.
Special Guest: Martin Wimpress.
Links:
- I’m teaching email security to Democratic campaigns. It’s as bad as 2016.
- Botched CIA Communications System Helped Blow Cover of Chinese Agents
- NSA-Designed Speck Algorithm to Be Removed From Linux 4.20
- Vulnerability Affects All OpenSSH Versions Released in the Past Two Decades
- Wireshark can be crashed via malicious packet trace files
- Service provider story about tracking down TCP RSTs
- The case of the 500-mile email
- Diffy: A cloud-centric triage tool for digital forensics and incident response
- An intensive introduction to Cryptography
- The Manga Guide to Cryptography | No Starch Press
45 min - Episode 381: Here Comes Cloud DNS
To make DNS more secure, we must move it to the cloud! At least that’s what Mozilla and Google suggest. We breakdown DNS-over-HTTPS, why it requires a “cloud” component, and the advantages it has over traditional DNS.
Plus new active attacks against Apache Struts, and a Windows 10 zero-day exposed on Twitter.
Sponsored By:
- Digital Ocean: Apply our promo snapocean after you create your account, and get a $10 credit.
Promo Code: snapocean- Ting: Save $25 off a device, or get $25 in service credits!
Promo Code: Visit techsnap.ting.com- iXSystems: Get a system purpose built for you.
Promo Code: Tell them we sent you!Links:
- Firefox Nightly Secure DNS Experimental Results
- DNS-over-HTTPS
- DNS over HTTPS
- A cartoon intro to DNS over HTTPS
- Discussion of draft-ietf-doh-dns-over-https in the IETF's DOH Working Group
- High performance DNS over HTTPS client & server
- Cloudflare Resolver for Firefox
- Active Attacks Detected Using Apache Struts Vulnerability CVE-2018-11776
- Windows 10 Zero-Day Vulnerability Exposed On Twitter
- Netdata: Get control of your servers.
— netdata is a system for distributed real-time performance and health monitoring. It provides unparalleled insights, in real-time, of everything happening on the system it runs (including applications such as web and database servers), using modern interactive web dashboards.- State of Software Distribution - 2018
— Few enterprises possess the ability to deploy the latest software and security patches at scale, putting their cybersecurity and business performance at risk. In the 2018 State of Software Distribution Report, we explore why IT decision makers say they struggle to keep up with the software distribution needs of the modern enterprise.24 min - Episode 380: Terminal Fault
Microsoft’s making radical changes to Windows 10, and a new type of speculative execution attack on Intel’s processors is targeting cloud providers.
Sponsored By:
- Digital Ocean: Apply our promo snapocean after you create your account, and get a $10 credit.
Promo Code: snapocean- iXSystems: Get a system purpose built for you.
Promo Code: Tell them we sent you!- Ting: Save $25 off a device, or get $25 in service credits!
Promo Code: Visit techsnap.ting.comLinks:
- Hanging Up on Mobile in the Name of Security
- Windows 10 Enterprise Getting "InPrivate Desktop" Sandboxed Execution Feature
- Introducing the Windows Pseudo Console (ConPTY)
- Understanding L1 Terminal Fault aka Foreshadow
- Merge L1 Terminal Fault fixes from Thomas Gleixner
- Cabot: Self-hosted, easily-deployable monitoring and alerts service
- cabotapp/cabot - Docker Hub
33 min - Episode 379: SegmentSmack is Whack
Take down a Linux or FreeBSD box with just 2kpps of traffic, own Homebrew in 30 minutes, and infiltrate an entire network via the Inkjet printers.
It’s a busy TechSNAP week.
Sponsored By:
- Digital Ocean: Apply our promo snapocean after you create your account, and get a $10 credit.
Promo Code: snapocean- iXSystems: Get a system purpose built for you.
Promo Code: Tell them we sent you!- Ting: Save $25 off a device, or get $25 in service credits!
Promo Code: Visit techsnap.ting.comLinks:
- HP Inkjet Printers Buffer Overflows in Processing Files Let Remote Users Execute Arbitrary Code
- Black Hat 2018: Update Mechanisms Allow Remote Attacks on UEFI Firmware | The first stop for security news
- How I gained commit access to Homebrew in 30 minutes
- Reconnaissance tool for GitHub organizations
- TruffleHog: Searches through git repositories for high entropy strings and secrets, digging deep into commit history
- BFG Repo-Cleaner by rtyley
- TCP implementations vulnerable to Denial of Service
- SegmentSmack: kernel: tcp segments with random offsets may cause a remote denial of service [CVE-2018-5390]
- Merge branch 'tcp-robust-ooo' · torvalds/linux
- New Sysadmin dealing with stress.
- Microsoft’s undersea data center now has a webcam with fish swimming past 27.6 petabytes of data
30 min - Episode 378: Two-Factor Fraud
Reddit’s Two Factor procedures fail, while Google’s prevents years of attacks. We’ll look at the different approaches, and discuss the fundamental weakness of Reddit’s approach.
Plus a Spectre attack over the network, BGP issues take out Telegram, and more!
Sponsored By:
- Digital Ocean: Apply our promo snapocean after you create your account, and get a $10 credit.
Promo Code: snapocean- iXSystems: Get a system purpose built for you.
Promo Code: Tell them we sent you!- Ting: Save $25 off a device, or get $25 in service credits!
Promo Code: Visit techsnap.ting.comLinks:
- Hey, don't route the messenger! Telegram redirected through Iran by baffling BGP leak
- Finding and Diagnosing BGP Route Leaks
- Cloud Leak: How A Verizon Partner Exposed Millions of Customer Accounts
- New Spectre attack enables secrets to be leaked over a network
- NetSpectre: Read Arbitrary Memory over Network
- Password breach teaches Reddit that, yes, phone-based 2FA is that bad
- We had a security incident.
- Google Employees Use a Physical Token as Their Second Authentication Factor
- Cisco is buying Duo Security for $2.35B in cash
32 min - Episode 377: Linux Under Pressure
Some new tools will give you better insights into your system under extreme load, and we flash back to the days of AOL and discuss the new way social hackers are spreading malware.
Plus the death of a TLD, the return of SamSam, and more!
Sponsored By:
- Digital Ocean: Apply our promo snapocean after you create your account, and get a $10 credit.
Promo Code: snapocean- iXSystems: Get a system purpose built for you.
Promo Code: Tell them we sent you!- Ting: Save $25 off a device, or get $25 in service credits!
Promo Code: Visit techsnap.ting.comLinks:
- psi: pressure stall information for CPU, memory, and IO v2
— PSI aggregates and reports the overall wallclock time in which thetasks in a system (or cgroup) wait for contended hardware resources.- Chinese “hackers” are sending malware via snail mail
— The trick is simple: a package arrives with a Chinese postmark containing a rambling message and a small CD. The CD, in turn, contains a set of Word files that include script-based malware. These scripts run when the victims access them on their computers, presumably resulting in compromised systems.- The death of a TLD
- SamSam: The (almost) $6 million ransomware
— Through original analysis, interviews and research, and by collaborating closely with industry partners and a specialist cryptocurrency monitoring organisation, Sophos has uncovered new details about how the secretive and sophisticated SamSam ransomware is used, who’s been targeted, how it works and how it’s evolving.- Open sourcing oomd, a new approach to handling OOMs
— As our infrastructure has scaled, we’ve found that an increasing fraction of our machines and networks span multiple generations. One side effect of this multigenerational production environment is that a new software release or configuration change might result in a system running healthily on one machine but experiencing an out-of-memory (OOM) issue on another.- Tyler's recent job story
30 min - Episode 376: Google Don’t Front
Google and Amazon recently shutdown Domain Fronting. Their abrupt change has created a building backlash.
We’ll explain what Domain Fronting is, how activists can use it to avoid censorship, and why large organizations are compelled to disable it.
Plus how road navigation systems can be spoofed with $223 in hardware, and another bad Bluetooth bug.
Sponsored By:
- Digital Ocean: Apply our promo snapocean after you create your account, and get a $10 credit.
Promo Code: snapocean- iXSystems: Get a system purpose built for you.
Promo Code: Tell them we sent you!- Ting: Save $25 off a device, or get $25 in service credits!
Promo Code: Visit techsnap.ting.comLinks:
- Road navigation systems can be spoofed using $223 equipment
- The World Economy Runs on GPS. It Needs a Backup Plan
- Big bad Bluetooth blunder bug battered – check for security fixes
- Vulnerability Note VU#304725 - Bluetooth Diffie-Hellman key exchange
- Domain Fronting
- Domain Fronting Is Critical to the Open Web
- Russia Blocks Millions of Amazon and Google IPs in Bungled Attempt to Ban Telegram
- Blocking-resistant communication through domain fronting
- Duplicati gets some love
- Duplicati
- Duplicati - Docker Hub
- Installing Duplicati on Ubunutu Linux
- Ben's Backup Basics
36 min - Episode 375: Surprise Root Access
Google's Cloud Platform suffers an outage, and iPhones in India get owned after a very specific attack.
Plus how a malware author built a massive 18,000 strong Botnet in one day, and Cisco finds more "undocumented" root passwords.
Sponsored By:
- Digital Ocean: Apply our promo snapocean after you create your account, and get a $10 credit.
Promo Code: snapocean- iXSystems: Get a system purpose built for you.
Promo Code: Tell them we sent you!- Ting: Save $25 off a device, or get $25 in service credits!
Promo Code: Visit techsnap.ting.comLinks:
- Cisco Removes Undocumented Root Password From Bandwidth Monitoring Software
- Google Cloud Platform reports issues; Snapchat and other popular apps affected
- Google Cloud Status Dashboard
- Bogus Mobile Device Management system used to hack iPhones in India • The Register
- A major election software maker allowed remote access on its systems for years - The Verge
- Router Crapfest: Malware Author Builds 18,000-Strong Botnet in a Day
- Anian wants to lean better backup
- How To Choose an Effective Backup Strategy for your VPS | DigitalOcean
- Tarsnap - Online backups for the truly paranoid
- Borg Documentation — Borg - Deduplicating Archiver 1.1.6 documentation
- borgmatic
- duplicity: Main
- restic · Backups done right!
36 min
About TechSNAP
From the publisher's feed
Systems, Network, and Administration Podcast. Every two weeks TechSNAP covers the stories that impact those of us in the tech industry, and all of us that follow it. Every episode we dedicate a…
portion of the show to answer audience questions, discuss best practices, and solving your problems.
More shows like TechSNAP
Packet Protector
7 Listeners