Unmasked

Get ready for a very special Unmasked. Joining us in this episode is Nick Serfass, CEO of RVATech. For those not in the Richmond area, RVATech is on a mission to ignite the growth of the technology sector, the success of technology companies, and the vibrancy of the technology community within the greater Richmond region. Listen in as we dive into Nick's intriguing journey, discuss initiatives RVATech is leading to foster Richmond's thriving tech community, and more.

Episode Notes: 

More about Nick:

Nick has been at the helm of the Richmond Technology Council
(rvatech/) since early 2019. Nick has worked to shepherd the growth
of programs across the board for the Council, including several new
cyber-related initiatives including CyberConVA and a formal partnership with the Virginia Cybersecurity Partnership (VCSP). Most
recently he worked to position Richmond as a potential Tech Hub in
artificial intelligence and machine learning through a US federal grant
program. Prior to rvatech/, Nick served as the Executive Director of
the American Institute of Architecture Students, where he put his
architecture background to use serving college students across
the country. He is a Virginia Wahoo, Miami Hurricane and Auburn
Tiger. His preferred programming language is Pascal.

Instagram: https://www.instagram.com/nickserfass/?hl=en

LinkedIn: https://www.linkedin.com/in/nickserfass/

CyberConVA 2024

https://rvatech.com/rvatech-events/cyberconva-2024/

• Theme: The Rise of Cyber AI and Transformation
• When: February 1, 2024 - 9am-5pm
• Where: Dominion Energy Center  600 E Grace St Suite 400, Richmond, VA 23219
• Details:
  • Join us in Richmond, Virginia, for a day of innovative sessions focused on connecting with the Richmond cyber community and growing your career. CyberConVA promises a full day of skill development, new ideas, and connections to supercharge your cyber career.
  • This 2nd Year
  • Student discount available 
  • Out of town guest packages available
• Virginia Cybersecurity Partnership (VCSP)
  • https://vacsp.com/

RVATech

• Website: https://rvatech.com/
• LinkedIn: https://www.linkedin.com/company/rvatech/
• Focus for 2024 - "Richmond VA Tech's Most Creative City"
  • In Richmond, creativity isn't just a buzzword; it's ingrained in our community of problem-solvers, thinkers, and doers. Here at rvatech/, we've cultivated a collaborative spirit that sets us apart from other tech cities. Our community is the heartbeat of Richmond's vibrant atmosphere of ideas, connections, and aspirations. “Tech’s Most Creative City” - A bold proclamation, isn't it? I believe it's not just a statement; it's our next chapter waiting to be written.
  • The concept of "Tech's Most Creative City" is set to make a significant impact on how we present ourselves to the world through:
    • A revitalized brand that reflects the vibrancy, innovation, and creativity that define Richmond's tech landscape
    • Creative elements in our conferences that make each experience memorable and inspiring
    • Outreach efforts to echo the creativity that defines us, drawing in technology's best, brightest, and most creative minds
    • Thank you for being a driving force in our creative community. Together, let's make 2024 a year of possibilities, where the world recognizes Richmond not only as a tech hub but as Tech's Most Creative City.

Join us for another riveting episode of Unmasked to close out November. Get ready to dive into recent cybersecurity events and hot topics. We dissect AI's use across multiple industries, examining how it's trained for specific tasks and discussing its limitations. And for those of you who are looking to break into or progress in the cybersecurity job market, we share insights on the critical role of certifications. But remember, it's not just about having a certification, it's about gaining practical skills and hands-on experience. So listen in, sit back and let's navigate the complex world of cybersecurity together. You won't want to miss this!

SHOW NOTES:

Whitehouse AI :President Biden Issues Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence

• The Executive Order establishes new standards for AI safety and security, protects Americans’ privacy, advances equity and civil rights, stands up for consumers and workers, promotes innovation and competition, advances American leadership around the world, and more.
• It builds on previous actions the President has taken, including work that led to voluntary commitments from 15 leading companies to drive safe, secure, and trustworthy development of AI.
• New Standards for AI Safety and Security
  • Require that developers of the most powerful AI systems share their safety test results and other critical information with the U.S. government.
  • Develop standards, tools, and tests to help ensure that AI systems are safe, secure, and trustworthy
  • Protect against the risks of using AI to engineer dangerous biological materials
  • Protect Americans from AI-enabled fraud and deception by establishing standards and best practices for detecting AI-generated content and authenticating official content
  • Establish an advanced cybersecurity program to develop AI tools to find and fix vulnerabilities in critical software
  • Order the development of a National Security Memorandum that directs further actions on AI and security
• Protecting Americans’ Privacy
• Advancing Equity and Civil Rights
• Standing Up for Consumers, Patients, and Students
• Supporting Workers
• Advancing American Leadership Abroad
• Ensuring Responsible and Effective Government Use of AI

Cybersecurity Education

Empowering Educators to Teach Cyber | Cyber.org

A Workforce development Organization

Funding from CISA

(Cybersecurity and Infrastructure Security Agency)

Director Jen Easterly

• US Army Intel

With Partnership with National Cyber Scholarship Foundation.

Has a cyber range for K-12 students to learn and practice safely

Path way to the basic certs: A+, Net+ Sec+, etc

ISC^2

(International Information System Security Certification Consortium)

Offering the CC free for a limited time.

(Certified in Cyber)

A entry level certification, perfect start for a lot of people high-school and above.

Options for hands on learning

• SANS holiday hack
• Try hack me- holiday hack

Join us for this very special episode as we sit down with the IT and Security experts from the University of Richmond. John Craft (Director of Information Security), Keith McIntosh (Chief Information Officer), and Svetla Walsh (Information Security Analyst) discuss their upcoming Capture the Flag (CTF) event. Get to know them beyond their professional titles as we break the ice with fun tidbits on their favorite cybersecurity-themed books and TV shows. 

We're not just about the banter, though. We also venture into the exhilarating world of CTF, an event that's not just about winning but also sharpening technical abilities and soft skills. Discover strategies to earn flags and points and how to work together in a team to maximize strengths. We wrap up by contemplating the future of CTFs in higher education, including the promising idea of inter-university collaborations. So, whether you're a cybersecurity veteran or a curious newbie, tune in for an informative and entertaining episode.

Welcome to another captivating episode of Unmasked! Join us as we embark on a thrilling journey into the dynamic realm of cybersecurity, led by the always entertaining and insightful Paul Blacker and Mark Harvey.

In this episode, we're excited to discuss Assura's involvement in Brightpoint Community College's IT Spirit Week. In this remarkable event, our expert team shared valuable insights into penetration testing and other aspects of offensive security. For Assura, giving back to the community isn't just a noble gesture; it's an essential commitment. Get a recap of how a tag on LinkedIn initiative this collaboration and details of Assura's participation. 

Our podcast then takes you from local to global, delving into the profound impact of large-scale conflicts on security. We explore the evolution of security, transcending mere physical fortifications to encompass the complex world of digital defenses. Join us for an array of tips on how to remain vigilant in an ever-evolving digital landscape.

Our hosts dissect pressing cyber headlines, shedding light on the paramount importance of cybersecurity in local utilities, including the safeguarding of our precious water resources. We unravel the intricate challenge of insider threats, which often subvert even the most well-intentioned policies and procedures. Plus, we delve into why merely checking security boxes is a recipe for organizational failure and what forward-thinking measures are essential to stay ahead in the game. You'll also learn why you shouldn't rely too heavily on AI technology. 

All this and more in this thrilling episode! So, don't miss out on this power half-hour of cyber insights. Tune in to gain perspective that helps you navigate the complex and ever-changing world of cybersecurity.

Ever wondered what it's like to infiltrate a ransomware gang? Well, you're about to find out. We're joined by Jon DiMaggio, Chief Security Strategist at Analyst1 and author of the Art of Cyberwarfare, who takes us on a thrilling journey into the perilous world of ransomware. This episode is a fusion of intriguing narratives from Jon's gripping investigative series, the Ransomware Diaries, and deep insights into the rising menace of ransomware attacks, brought to life by the recent MGM and Caesars attack.

Our conversation spirals into the darker corners of the cyber world, where young minds are being molded into cybercriminals. Jon walks us through the chilling reality of how online forums have become the breeding ground for these young cybercriminals, mentoring them into the world of ransomware. He shares firsthand accounts from his Ransom Mafia project, exposing the distinct playbooks of various ransomware groups, shedding light on their strategies, and offering a deep understanding of their operations.

As we dive deeper, we underline the importance of robust cybersecurity practices, from efficient password management to timely patching. We brainstorm on the critical role of artificial intelligence in enhancing security mechanisms and its potential contribution to fighting ransomware. As we wrap up this whirlwind tour of the cyber underworld, we touch upon tech support scams, the desperate need for better regulations, and how training and preparedness can help organizations armor up against potential threats.

This is an episode you don't want to miss!

More about our special guest:

Jon DiMaggio  (https://www.linkedin.com/in/jondimaggio/)
The Chief Security Strategist at Analyst1
The Author of The Art of Cyberwarfare, get it from No Starch Press (https://nostarch.com/art-cyberwarfare)
Ransomware Diaries -
https://analyst1.com/ransomware-diaries-volume-2/      https://analyst1.com/ransomware-diaries-volume-3-lockbits-secrets/

Jon has over 15 years of experience hunting, researching, and writing about advanced cyber threats.  

As a specialist in enterprise ransomware attacks and nation-state intrusions, including the world’s first ransomware cartel and the infamous Black Vine cyberespionage group,  he has exposed the criminal organizations behind major ransomware attacks,  aided law enforcement agencies in federal indictments of nation-state attacks, and discussed his work with The New York Times, Bloomberg, Fox, CNN, Royters, and Wired.  

ARTICLE LINKS: 

MGM, Caesars File SEC Disclosures on Cybersecurity Incidents (darkreading.com)

MGM Hack

• Looks Like MGM Resorts Just Get Hacked (msn.com)
• MGM Resorts: Slot machines go down in cyber-attack on firm - BBC News
• MGM Resorts shuts down IT systems after cyberattack (bleepingcomputer.com)
• Casino hackers demanded ransoms from MGM and Caesar's (qz.com)
  https://www.darkreading.com/application-security/okta-flaw-involved-mgm-resorts-breach-attackers-claim

Welcome back for episode six of Unmasked! This week, we take a deep dive into the headlines of September, providing you with valuable context and insights into the latest cybersecurity events. The reverberations of the MOVEit disaster are still keenly felt, and this time, they've led to a class-action lawsuit against Progress Software, with over 600 organizations seeking answers. The pivotal question we dissect is, who bears the ultimate responsibility when software vulnerabilities trigger catastrophic data breaches? This legal battle against Progress Software isn't merely another courtroom drama; it has the potential to reshape the entire landscape of software liability.

But that's not all! We swiftly shift gears to explore the world of secure practices for managing password changes and account requests. In a digital age where even well-intentioned service desk personnel can inadvertently pose security risks, we delve into a treasure trove of strategies organizations can adopt to fortify their defenses.

Our journey continues, though. We fearlessly navigate the uncharted waters of the digital realm, unveiling the myriad cyber threats that lurk in the internet's darkest corners. From exploiting software vulnerabilities to orchestrating extortion and romance scams, we shine a powerful spotlight on the cunning tactics employed by cybercriminals as they attempt to infiltrate personal data and seize valuable assets.

All this and more await for your cyber-listening pleasure!

You can subscribe to Unmasked on Spotify, Amazon, or wherever you get your podcasts. 

Show notes

Headlines for early September

Software Makers May Face Greater Liability in Wake of MOVEit Lawsuit (darkreading.com) 

• A nationwide class-action suit filed against Progress Software in the wake of the massive MOVEit breach could point to additional litigation against software companies whose vulnerable applications are exploited in large-scale supply chain attacks, a legal expert says. 
• filed by consumer-rights law firm Hagens Berman 
• compromised the sensitive personal information of more than 40 million people, and promises that more class actions are on the way as more of the 600 affected organizations come forward. 

Okta: Hackers target IT help desks to gain Super Admin, disable MFA 

• Okta released a warning about social engineering attacks targeting IT service desk agents at U.S.-based customers in an attempt to trick them into resetting multi-factor authentication (MFA) for high-privileged users. 
• attackers' goal was to hijack highly-privileged Okta Super Administrator accounts  
• The hackers used their admin access to elevate privileges for other accounts, reset enrolled authenticators, and they also removed the two-factor authentication (2FA) protection for some accounts. 

Children's snack recalled after its website caught serving porn 

• Supermarket chain Lidl has been recalling four types of PAW Patrol-themed snacks across the UK. 
• Last month, Lidl stores across the UK started recalling four types of PAW Patrol snacks because of an issue with its packaging. According to the retailer, a URL printed on the snack's packaging was compromised and, to everyone's

In this thrilling episode of Unmasked, our cybersecurity superheroes plunge headfirst into the late August headlines to uncover the most cutting-edge and formidable cyberattacks. Fasten your seatbelts and ensure your hands remain securely inside the vehicle as we embark on an exhilarating journey through the world of cybersecurity. 

Along our path, we'll make intriguing stops, including a detour through the realm of deceptive Amazon ads on Google, an exploration of Tesla's security breach stemming from an insider threat, and a stealthy incursion targeting the renowned international snack-maker, Mondelez, by way of a third-party partner. You might recognize Mondelez from their household snack brands like Ritz and Honey Maid. All this and much more await you in this week's gripping episode.

You can subscribe to Unmasked on Spotify,  Amazon, or wherever you get your podcasts.

Show notes:

August Headlines

Sneaky Amazon Google ad leads to Microsoft support scam (bleepingcomputer.com)   

• Classic Tech Support scam 
• But done in clever way 

Tesla data Breach Exposes Personal Info of over 75,000 Indiviuals: Inside Job By Former Employees Confirmed 

• Data leaked to German media 
• Former employees behind the breach 
• Employees misappropriated the information 

Hackers ask $120,000 for access to multi-billion auction house (bleepingcomputer.com) 

• IABs 
•  initial access through VPN or RDP 
• privileges associated with the access accounts ranged from cloud administrator (14 cases) to local admin (5 cases) and domain user (2 cases) 
• positive side effects, such as uncovering areas that need stronger security or identifying devices, services, and accounts that could pose a risk. 

Mondelez says crooks stole staff data in security breach • The Register 

• Mondelez International – Parent company for Oreo and Ritz Crackers and many others 
• 51,000 of its past and present employees that their personal information has been stolen from a law firm hired by the Oreo and Ritz cracker 
• Mondelez was among the global companies hit in the NotPetya outbreak — and it recently settled its lawsuit against Zurich American Insurance Company, which it brought because the insurer refused to cover Mondelez's $100-million-plus cleanup bill 
• data may have been compromised for 24 months. 

In the latest Unmasked episode, we're taking a deep dive into August headlines, unpacking all the threats and vulnerabilities that lurk in our digital realm. We're covering some major ground, from the Burger King data breach to unsettling cyber attacks on hospital EMR systems.

Join us as we also get into the nitty-gritty of credential-stuffing attacks, exploring the quirky world of threat group naming, and delving into the intriguing realm of side channel attacks – it's like something out of a spy movie!

Cybersecurity is like a never-ending puzzle, always evolving. So, keep your eyes peeled, stay informed, and remember that things are rarely straightforward in the world of cybersecurity!

You can subscribe to Unmasked wherever you get your podcasts. 

Show notes

Headlines for beginning of August 

• Emergency Rooms in 5 states shut down due to cyber attack
  • WhatA-  cyberattack has disrupted hospital computer systems in several states, forcing some emergency rooms to close and ambulances to be diverted 
  • The “data security incident” began Thursday at facilities operated by Prospect Medical Holdings, which is based in California 
    • Then spread to Texas, Connecticut, Rhode Island and Pennsylvania. 
  • Ransomware Attack Disrupts Health Care in at Least Three States - The New York Times (nytimes.com) 
• Burger King's Data Breach Exposes Sensitive Credentials
  • Experienced a serious data breach that made private login information public 
  • Security Affairs was first to note the vulnerability 
  • Exposed credentials could be exploited be malicious actors to access additional systems, perpetrate identity theft or launch targeted attacks on induvial and organizations to the breached data 
  • Burger King has reportedly taken immediate steps to rectify the situation
    Additional: Burger King Serves Up Sensitive Data, No Mayo (darkreading.com) 
• Retail chain Hot Topic discloses wave of credential-stuffing attacks (bleepingcomputer.com)
  •  Sub topic: What is "Credential Stuffing"? 
• Microsoft shifts to a new threat actor naming taxonomy | Microsoft Security Blog
  • New naming conventions 
  • Weather related names (Blizzard, Sleet, Typhoon)  
  • Does this help or hurt? 
  • Need we ask, does this "water down the threats?" "Downpour of confusion?" 
  • Table with APT names: How Microsoft names threat actors | Microsoft Learn 
• Acoustic attack 

New 'Deep Learning Attack' Deciphers Laptop Keystrokes with 95% Accuracy (thehackernews.com) 

• This is one of those things people love to make sound magic. 
• Sensitive compartmented information facility - Wikipedia 

Welcome to the latest episode of Unmasked. In this episode, we dive into the end of July headlines, covering a class action lawsuit against John Hopkins following a major data breach, emphasizing the need for better data handling and security practices. We also explore the complexities of IoT device regulation, questioning the absence of tech giants like Apple and Microsoft in this area. The episode educates listeners on online scams and provides essential tips to avoid falling victim to phishing tactics. Additionally, it stresses the importance of timely software updates and informed decision-making to enhance cybersecurity in the digital realm. All this and the building anticipation of the upcoming DEFCON.

Episode 3 show notes:

Headlines for the end of July 

• John Hopkins- Hit with Class Action Lawsuit connected to data breach 
  • Filed by the patient named Pamela Hunter, alleges that Hopkins "failed to properly secure and safeguard" patients' personal and medical information. 
  • If based on original MoveIT breach- not their fault/ hard to prove 
  • If plaintiff can prove negligence, then potential cancelation of cybersecurity insurance policy etc. 
• Biden Administration is tackling smart devices with a new label 
  • US Cyber Trust Mark- would require smart products to meet certain thresholds, including ongoing software security support, to qualify for the program 
  • FCC says the mark will signify that the devices meet/ and maintain certain standards 
  • Main devices would be smart home appliances, TV's, climate controllers, but also list smart fitness tracker 
  • Mark would be a shield – indicating that that device is meeting the standards 
  • Participating manufactures and retailers are:  Amazon, Google, Samsung, Logitech, Best Buy 
• Back to School Scams- Amazon Releases Scam warning email to all customers 
  • Unexpected calls, texts, emails that refer to costly membership fees going up if you do not act now... 
  • Issues with your membership- asking for bank account/ payment info 
  • Amazon issues warnings: 
    • Trust Amazon –owned channels 
    • Beware of false urgency 
    • Never pay over the phone 
    • Verify links first 
• Apple fixes new Zero Day threat 
  • Apple is aware of a report that this issue may have been actively exploited," the company said in an advisory describing a WebKit flaw tracked as CVE-2023-37450 that was addressed in a new round of Rapid Security Response (RSR) updates earlier this month. 
  • The other zero-day patched today is a new Kernel flaw tracked as CVE-2023-38606 that was exploited in attacks targeting devices running older iOS releases. 
  • exploited against versions of iOS released before iOS 15.7.1 
• DEFCON – Mark to interview industry folks while out in Las Vegas this week

Ever wondered how safe your digital life really is? Prepare to open your eyes to the unseen dangers lurking in your inbox and online transactions. Welcome to our latest episode of Unmasked, where the superheroes of cybersecurity provide a clearer understanding of the threats we face in our digital world. 

In this compelling episode, we dive deep into the ever-present threats of phishing attacks, remote work risks, and take a closer look at the MOVEit platform data breach and its implications for organizations beyond just MOVEit. In addition, we have a very special event on our show. Join us as we welcome our first guest, Assura's Offensive Security Operations Technical Director, Nick Berrie. We sit down with Nick and discuss the highly anticipated DEFCON 2023 hacker conference. We share our excitement about this unique networking opportunity and the wealth of insights from industry experts. Beyond the business side, we also dish on the fun aspects of DEFCON, from the diverse food scene to the overall Las Vegas experience. 

This is your chance to dive into the deep end of cybersecurity. Come hang out with us!