400: Supply Chain Attacks

FromTechSNAP

Start listening View podcast show

400: Supply Chain Attacks

FromTechSNAP

ratings:

Length:

33 minutes

Released:

Mar 28, 2019

Format:

Podcast episode

Description

We break down the ASUS Live Update backdoor and explore why these kinds of supply chain attacks are on the rise.
Plus an update from the linux vendor firmware service, your feedback, and more!

Released:

Mar 28, 2019

Format:

Podcast episode

Titles in the series (100)

Systems, Network, and Administration Podcast. Every two weeks TechSNAP covers the stories that impact those of us in the tech industry, and all of us that follow it. Every episode we dedicate a portion of the show to answer audience questions, discuss best practices, and solving your problems.

Skip carousel

Episode 204: Ghost of Crypto Past | TechSNAP 204: We’ll break down the technical baggage that led to the new FREAK SSL flaw & the security ramifications of top executives using personal email accounts… Plus why just need to stop hiding file extensions. Plus some great feedback & much, much more! by TechSNAP
98 min listen
Episode 215: EXTenuating Circumstances | TechSNAP 215: Researches have uncovered a weakness in almost all Internet encryption. We’ll explain what LogJam is, how to protect yourself & what the cause is. Plus Linux gets bit by a filesystem corruption bug, passport id thieves, a great batch of questions & more! by TechSNAP
87 min listen
Episode 198: Dude Where's My Card? | TechSNAP 198: Adobe has a bad week, with exploits in the wild & no patch. We’ll share the details. Had your credit card stolen? We’ll tell you how. Plus the harsh reality for IT departments, a great batch of questions, our answers & much much more! by TechSNAP
105 min listen
Episode 193: Don’t Fire IT | TechSNAP 193: More and more data breaches are leading to blackmail but the stats don’t tell the whole story. We’ll explain. Plus the latest in the Sony hack, and the wider reaction. Plus a great batch of emails & much, much more! by TechSNAP
93 min listen
Episode 196: Sony’s Hard Lessons | TechSNAP 196: We reflect on the lessons learned from the Sony Hack & discuss some of the tools used to own their network. Plus a overview of what makes up a filesystem, a run down of the Bacula backup system & much more! by TechSNAP
106 min listen
Episode 192: Signed by Sony | TechSNAP 192: If we could rebuild the Internet from scratch, what would we change? It’s more than just a thought experiment. We’ll share the details about real world research being done today! Plus we dig through the Sony hack, answer a ton of great question & a rocki by TechSNAP
102 min listen
Episode 201: Group Problemcy | TechSNAP 201: A 20 year old design flaw in Windows has just been patched & it requires some major re-working of the software. Attackers compromise Forbes.com & why Facebook’s new ThreatExchange platform could be a great idea. by TechSNAP
94 min listen
Episode 200: Your TechSNAP Story | TechSNAP 200: A new major security breach at a large health insurance firm could expose 10s of millions, a phone phishing scam anyone could fall for & we celebrate our 200th episode with your TechSNAP stories. Then its a storage spectacular Q&A & much, much more! by TechSNAP
99 min listen
Episode 202: SuperFishy Mistake | TechSNAP 202: Lenovo PCs ship with man-in-the-middle adware that breaks HTTPS connections, we’ll break down how this is possible, the danger that still exists & more. Plus the story of a billion dollar cyber heist anyone could pull off, the Equation group & much more! by TechSNAP
72 min listen
Episode 195: Cloudy With a Chance of SSL | TechSNAP 195: We go inside the epic takedown of SpamHaus, then we break down why CloudFlare’s Flexible SSL is the opposite of security. Followed by a great batch of questions, our answers & much much more! by TechSNAP
69 min listen
Episode 206: Two Factor Falsification | TechSNAP 206: Microsoft takes 4 years to fix a nasty bug, how to bypass 2 factor authentication in the popular ‘Authy’ app. Hijacking a domain with photoshop, hardware vs software RAID revisited, tons of great questions, our answers & much much more! by TechSNAP
100 min listen
Episode 228: Export Grade Vulnerabilities | TechSNAP 228: Lenovo & HP are caught injecting malware even after you format the drive, Ubiquiti Networks is socially engineered out of 46 million & are we entering the era of Security Research Prohibition? We debate. Plus your questions, the roundup & much, much more! by TechSNAP
72 min listen
Episode 207: Lunch Lady Lockdown | TechSNAP 207: Reverse Engineering Incentives to Improve Security. New Jersey school district computers held for ransom & the flash bug that lives on from 2011 with a twist! Plus some great networking questions, drone powered Internet & more! by TechSNAP
87 min listen
Episode 211: The French Disconnection | TechSNAP 211: What’s really the key to detecting a breach before its become much too late? We’ll share some key insights, plus a technical breakdown of China’s great cannon & the new New French Surveillance Law that should be a warning to us all & much, much more! by TechSNAP
107 min listen
Episode 214: Venomous Floppy Legacy | TechSNAP 214: We explain the Venom vulnerability, what the impact is & the steps major providers are taking to protect themselves. Plus strategies to mitigate Cyber Intrusions, a truly genius spammer, great questions, a huge round up & more! by TechSNAP
110 min listen
Episode 199: Internet of Problems | TechSNAP 199: The internet of dangerous things is arriving but what about taking care of the devices we already have? Plus details on critical updates from Adobe, the surprising number of Gas Stations vulnerable to exploitation via the internet & much, much more! by TechSNAP
85 min listen
Episode 194: Best Of TechSNAP 2014 | TechSNAP 194: We look back at this year in TechSNAP. Allan shares his war stories, TrueCrypt shuts down, Heartbleed happens & more! by TechSNAP
101 min listen
Episode 205: An Uber Mess | TechSNAP 205: Using encryption is a good thing, but its just the start, we’ll explain. Plus how one developer totally owned the Uber app. Then it’s a great batch of your questions & our answers! by TechSNAP
64 min listen
Episode 191: Celebrity Bugs | TechSNAP 191: 2014 has been the year of the celebrity bugs, we take a look at the new trend of giving security vulnerabilities names & logos & ask who it truly benefits. Plus practical way to protect yourself from ATM Skimmers, how they work & much more! by TechSNAP
114 min listen
Episode 216: Spy vs MSpy | TechSNAP 216: Spyware creator mSpy hacked, find out why this breach is particularly egregious, what’s wrong with pcap & why RSA’s death has been greatly exaggerated. Plus a great batch of questions, a rocking round up & much, much more! by TechSNAP
85 min listen
Episode 209: Day-0 of an InfoSec Career | TechSNAP 209: Is it possible to make a truly private phone call anymore? The answer might surprise you. Cisco and Level 3 battle a huge SSH botnet & how to Build a successful Information Security career & much, much more! by TechSNAP
129 min listen
Episode 208: Any Cert Will Do | TechSNAP 208: Why boring technology might be the better choice, Google revokes & China chokes, why you want to create an account at irs.gov before crooks do it for you. Plus your great IT questions, a rocking round up & much, much more! by TechSNAP
83 min listen
Episode 203: TurboHax | TechSNAP 203: Lenovo & Google are victims of DNS hijacking, we’ll share the details, Everyone wants you to secure your data, just not from them & how Turbotax profits from Cyber tax fraud! Plus a great batch of your questions, a fantastic round up & much, much more! by TechSNAP
107 min listen
Episode 197: Patch and Notify | TechSNAP 197: Been putting off that patch? This week we’ll cover how an out of date Joomla install led to a massive breach, Microsoft and Google spar over patch disclosures, picking the right security question & more! by TechSNAP
121 min listen
Episode 218: Hacking Henchmen for Hire | TechSNAP 218: This week, how hard lessons learned in 1982 could be apply to 2015’s security breaches, hacking for hire goes big & a savage sentient car that needs better programming. Plus some fantastic questions, a rocking round-up & much more! by TechSNAP
83 min listen
Episode 212: Dormant Docker Disasters | TechSNAP 212: The man who broke the music business, the major downsides to the container culture & yes, they really are trying to sell you Security Snake Oil. Plus your great questions, our answers & much, much more! by TechSNAP
94 min listen
Episode 259: Can You Hack Me Now? | TechSNAP 259: Verizon Enterprise gets breached & the irony is strong with this one, details on the NPM fiasco & why the SAMSAM is holding up the doctor. Plus some great questions, a packed round up & much, much more! by TechSNAP
91 min listen
Episode 222: ZFS does not prevent Stupidity | TechSNAP 222: From hacking to hacked, hacking team gets owned & what gets leaked is the best part, we’ll share the details. Plus, a new OpenSSL vulnerability revealed, Apple tweaks their two factor authentication.. Your questions, our answers & much much more! by TechSNAP
83 min listen
Episode 242: A Keyboard Walks into a Barcode | TechSNAP 242: A research team finds various ways to attack LastPass, how to use a cocktail of current Android exploits to own a device & hacking a point of sale system using poisoned barcodes! Plus some great questions, our answers, a rockin roundup & much, much more! by TechSNAP
80 min listen
Episode 213: Blame as a Service | TechSNAP 213: Why a stolen healthcare record is harder to track than you might think, Security pros name their must have tools & blame as a service, the new Cybersecurity hot product. Plus great questions, a huge Round Up & much, much more! by TechSNAP
98 min listen

More Episodes from TechSNAP

Skip carousel

430: All Good Things: It's a storage showdown as Jim and Wes bust some performance myths about RAID and ZFS. by TechSNAP
52 min listen
429: Curious About Caddy: Jim and Wes take the latest release of the Caddy web server for a spin, investigate Intel's Comet Lake desktop CPUs, and explore the fight over 5G between the US Military and the FCC. by TechSNAP
31 min listen
428: RAID Reality Check: We dive deep into the world of RAID, and discuss how to choose the right topology to optimize performance and resilience. by TechSNAP
36 min listen
427: Gigahertz Games: Jim finally gets his hands on an AMD Ryzen 9 laptop, some great news about Wi-Fi 6e, and our take on FreeBSD on the desktop. by TechSNAP
51 min listen
426: Storage Stories: We take a look at Cloudflare's impressive Linux disk encryption speed-ups, and explore how zoned storage tools like dm-zoned and zonefs might help mitigate the downsides of Shingled Magnetic Recording. by TechSNAP
31 min listen
425: Ryzen Gets Real: We take a look at AMD's upcoming line of Ryzen 4000 mobile CPUs, and share our first impressions of Ubuntu 20.04's approach to ZFS on root. by TechSNAP
33 min listen
424: AMD Inside: Cloudflare recently embarked on an epic quest to choose a CPU for its next-generation server build, so we explore the importance of requests per watt, the benefits of full memory encryption, and why AMD won. by TechSNAP
28 min listen
423: Hopeful for HAMR: We explore the potential of heat-assisted magnetic recording and get excited about a possibly persistent L2ARC. by TechSNAP
30 min listen
422: Multipath Musings: We take a look at a few exciting features coming to Linux kernel 5.6, including the first steps to multipath TCP. by TechSNAP
24 min listen
421: Firewall Fun: We explore the latest round of Windows vulnerabilities and Jim shares his journey adding OPNsense to his firewall family. by TechSNAP
25 min listen
420: Choose Your Own Compiler: Compiling the Linux kernel with Clang has never been easier, so we explore this alternative compiler and what it brings to the ecosystem. by TechSNAP
24 min listen
419: Nebulous Networking: From classifying cats to colorizing old photos we share our top tips and tools for starting your machine learning journey. Plus, learn why Nebula is our favorite new VPN technology, and how it can help simplify and secure your network. by TechSNAP
34 min listen
418: 5G Fundamentals: As the rollout of 5G finally arrives, we take some time to explain the fundamentals of the next generation of wireless technology. by TechSNAP
34 min listen
417: Machine Learning Magic: We explore the rapid adoption of machine learning, its impact on computer architecture, and how to avoid AI snake oil. by TechSNAP
26 min listen
416: I.T. Phone Home: Ubiquiti's troublesome new telemetry, Jim's take on the modern Microsoft, and why Project Silica just might be the future of long term storage. by TechSNAP
28 min listen
415: It's All About IOPS: We share our simple approach to disk benchmarking and explain why you should always test your pain points. by TechSNAP
34 min listen
414: Rooting for ZFS: We dive into Ubuntu 19.10's experimental ZFS installer and share our tips for making the most of ZFS on root. by TechSNAP
42 min listen
413: The Coffee Shop Problem: We peer into the future with a quick look at quantum supremacy, debate the latest DNS over HTTPS drama, and jump through the hoops of HTTP/3. by TechSNAP
32 min listen
412: Too Good To Be True: It's TechSNAP story time as we head out into the field with Jim and put Sure-Fi technology to the test. by TechSNAP
35 min listen
411: Mobile Security Mistakes: We take a look at a few recent zero-day vulnerabilities for iOS and Android and find targeted attacks, bad assumptions, and changing markets. by TechSNAP
30 min listen
410: Epyc Encryption: It's CPU release season and we get excited about AMD's new line of server chips. Plus our take on AMD's approach to memory encryption, and our struggle to make sense of Intel's Comet Lake line. by TechSNAP
50 min listen
409: Privacy Perspectives: We examine why it's so difficult to protect your privacy online and discuss browser fingerprinting, when to use a VPN, and the limits of private browsing. by TechSNAP
39 min listen
408: Apollo's ARC: We take a look at the amazing abilities of the Apollo Guidance Computer and Jim breaks down everything you need to know about the ZFS ARC. by TechSNAP
35 min listen
407: Old School Outages: Jim shares his Nagios tips and Wes chimes in with some modern monitoring tools as we chat monitoring in the wake of some high-profile outages. by TechSNAP
43 min listen
406: SACK Attack: A new vulnerability may be the next 'Ping of Death'; we explore the details of SACK Panic and break down what you need to know. by TechSNAP
44 min listen
405: Update Uncertainty: We explore the risky world of exposed RDP, from the brute force GoldBrute botnet to the dangerously worm-able BlueKeep vulnerability. by TechSNAP
31 min listen
404: Prefork Pitfalls: We turn our eye to web server best practices, from the basics of CDNs to the importance of choosing the right multi-processing module. by TechSNAP
34 min listen
403: Keeping Systems Simple: We’re back from LinuxFest Northwest with an update on all things WireGuard, some VLAN myth busting, and the trade-offs of highly available systems. by TechSNAP
47 min listen
402: Snapshot Sanity: We continue our take on ZFS as Jim and Wes dive in to snapshots, replication, and the magic on copy on write. by TechSNAP
32 min listen
401: Everyday ZFS: Jim and Wes sit down to bust some ZFS myths and share their tips and tricks for getting the most out of the ultimate filesystem. by TechSNAP
48 min listen

Related podcast episodes

Skip carousel

Exploiting Client-Side Node.js with Moses Hernandez - Paul's Security Weekly #516: I know what you're thinking, Node.js is server-side right? Not exactly. It turns out many client-side applications have embedded Node.js. And its not always updated to the latest version. And, its vulnerable to attacks! Moses Hernandez is a Consulting... by Security Weekly Podcast Network (Video)
22 min listen
77: Testing Complex Systems with Maintainable Test Suites: Creating maintainable test suites for complex systems. The episode describes some complexities involved with hardware testing, then shares techniques for shifting complexity out of the test cases. The techniques are applicable to the testing of any complex system. by Test and Code
23 min listen
Is Performance Part of the DevOps Toolchain?: Dive into the world of DevOps with our special episode of the DevOps Toolchain Show, where we unveil the reasons behind our rebranding and deep-dive into the significance of performance testing within the DevOps ecosystem. Discover how continuous... by TestGuild Devops Toolchain Podcast
12 min listen
Ep. 25: Microsoft's Monday Outage Is a Lesson in App Complexity; Plus, Telstra’s BGP Hijack: In this week’s episode, we dive into a recent out… by Cisco Podcast Network
16 min listen
Ep. 26 The case of an overloaded database and what happens when a bug bites: In this week’s episode, we dive into a recent out… by Cisco Podcast Network
19 min listen
2.5 Admins 172: HOLEy ZFS: Jim and Allan break down the details of the recent ZFS data corruption bug, and give their tips for managing a fleet of 40+ servers. Plug Support us on patreon and get an ad-free RSS feed with early episodes sometimes News Two new versions of OpenZ... by 2.5 Admins
32 min listen
#501: Using AWS AppConfig: Does your team use feature flags or other dynamic configuration to update your software's behavior d by AWS Podcast
24 min listen
2.5 Admins 172: HOLEy ZFS: Jim and Allan break down the details of the recent ZFS data corruption bug, and give their tips for managing a fleet of 40+ servers. Plug Support us on patreon and get an ad-free RSS feed with early episodes sometimes News Two new versions of OpenZ... by Late Night Linux Family All Episodes
32 min listen
2.5 Admins 96: Skunky Routers: Internet Explorer is dead, Cisco small business routers that need to be junked, antivirus on Linux servers, and you’ll never guess what Jim and Allan recommend for easily rolling back updates. Plugs ZFS Developer job description Webinar: Open-source ... by 2.5 Admins
31 min listen
Episode 86: Evolve Your OS | LUP 86: The proprietor of Evolve OS stops by to discuss what makes Evolve OS a unique Linux desktop & the challenges smaller projects face. Plus a look at tiny powerful Linux gadget that we think might be worth backing, a debate about “the look” of apps & more! by LINUX Unplugged
77 min listen
373: Your New Tools: We embrace new tools to upgrade your backup game, securely move files around the network, and debunk the idea that Windows will ever be based on Linux. by LINUX Unplugged
65 min listen
All the News - Just Six Months Later - Application Security Weekly #265: We cover appsec news on a weekly basis, but sometimes that news is merely about the start of a new project, sometimes it's yet another example of a vuln class, and sometimes it's a topic we hope doesn't become a trend. So, what themes have we seen and... by Security Weekly Podcast Network (Audio)
70 min listen
Lenovo's Mike Leach on the Role of the Workstation in Modern AI - Ep. 118: Whether you're using the latest generation of AI … by The AI Podcast
29 min listen
Sequoia: A Local Privilege Escalation Vulnerability in Linux’s Filesystem Layer - Wheel - PSW #707: The Qualys Research Team discovered a size_t-to-int type conversion vulnerability in the Linux Kernel’s filesystem layer affecting most Linux operating systems. Any unprivileged user can gain root privileges on a vulnerable host by exploiting this... by Security Weekly Podcast Network (Video)
45 min listen
CISA malware analysis, "hunt forward" missions, Spectre v2: CISA expands automated malware analysis US Cyber Command launched “hunt forward” missions Spectre v2: Linux Boogaloo CHECK OUT Capture the CISO season 2 . Thanks to today's episode sponsor, Vanta The average security pro spends nearly a... by Cyber Security Headlines
7 min listen
Palo Alto patches, CISA’s Sisense warning, GitHub repos gamed: Palo Alto Networks fixes several DoS vulnerabilities in PAN-OS operating system Sisense breach exposes customers to potential supply chain attack Threat actors gaming GitHub Search Thanks to today's episode sponsor, Vanta The average security pro... by Cyber Security Headlines
9 min listen
321: Fresh Install Feels: What makes a fresh install of Linux perfect? We ask our panel and share a few tools, tips, and habits that make our Linux installs perfect. by LINUX Unplugged
68 min listen
OWASP Breach, Types of Prompt Injection, Device-Bound Sessions, ASVS & APIs - ASW #280: OWASP leaks resumes, defining different types of prompt injection, a secure design example in device-bound sessions, turning an ASVS requirement into practice, Ivanti has its 2000s-era Microsoft moment, HTTP/2 CONTINUATION flood, and more! Show Notes: by Application Security Weekly (Video)
29 min listen
OWASP Breach, Types of Prompt Injection, Device-Bound Sessions, ASVS & APIs - ASW #280: OWASP leaks resumes, defining different types of prompt injection, a secure design example in device-bound sessions, turning an ASVS requirement into practice, Ivanti has its 2000s-era Microsoft moment, HTTP/2 CONTINUATION flood, and more! Show Notes: by Security Weekly Podcast Network (Video)
29 min listen
UEFI & SMM Vulnerabilities - Jesse Michael - PSW #764: Navigating the UEFI waters is treacherous. While UEFI has become the standard on most PCs, servers, and laptops, replacing legacy BIOS, it is a complex set of standards and protocols. Jesse joins us to help explain how some of this works and describe... by Security Weekly Podcast Network (Video)
77 min listen
Black Hat Interviews - WhiteSource and Venafi - ASW #74: We interview Azi Cohen the Co-founder of WhiteSource. He will be talking about Application security has undergone a transition in recent years, as information security teams testing products before release became irrelevant, developers started playing... by Security Weekly Podcast Network (Video)
30 min listen
Black Hat Interviews - WhiteSource and Venafi - ASW #74: We interview Azi Cohen the Co-founder of WhiteSource. He will be talking about Application security has undergone a transition in recent years, as information security teams testing products before release became irrelevant, developers started playing... by Application Security Weekly (Video)
30 min listen
How to Build an API: In this episode, Scott and Wes talk about creating APIs — what’s happening behind the scenes and why it’s important. Sanity - Sponsor is a real-time headless CMS with a fully customizable Content Studio built in React. Get a Sanity... by Syntax - Tasty Web Development Treats
46 min listen
Security from a Developer's Perspective - Josh Goldberg - ASW #262: A lot of appsec conferences have presentations for appsec audiences -- but that's not often the group that's building apps. What if more developer conferences had appsec content? We talk with Josh about security from the developer's point of view,... by Security Weekly Podcast Network (Audio)
71 min listen
073 Understanding Azure Service Fabric with Sravan Rengarajan: Did you know that Azure Service Fabric is used by most of Microsoft’s global high scale services such as Bing, Dynamics or Xbox)? It’s a battle tested distributed systems platform that enables developers to deploy, manage and scale their... by PurePerformance
48 min listen
182: Exciting FlatHub, Wine 7.0, SUSE Liberty Linux, Linux Mint, AppIndicators: On this episode of This Week in Linux, Exciting FlatHub Updates In Store, New AppIndicator Protocol?, SUSE Announces SUSE Liberty Linux, Framework to Open Source Firmware, Linux Mint 20.3 Edge ISO, in App News: Wine 7.0, FFMPEG 5.0, Qprompt 1.0, by This Week in Linux
36 min listen
49: tox - Oliver Bestwalter: tox is not just a tool to help you test a Python project against multiple versions of Python. In this interview, Oliver and Brian just scratch the surface of this simple yet powerful automation tool. by Test and Code
56 min listen
ASW #231 - Neatsun Ziv: In this episode, Neatsun Ziv, co-founder and CEO of Ox security takes a deep dive into supply chain security. He focuses on the new Open Software Supply Chain Attack Reference (OSC&R), a consortium of leading cybersecurity leaders. OSC&R the... by Security Weekly Podcast Network (Audio)
80 min listen
Email and SMS Workflow Testing with Jack Lawrence and Brooks Nelson: Do you have an automation test that requires you to test the sending emails and create user accounts workflows? How about testing SMS? In this episode, Jack Lawrence, a cofounder of Mailinator, and Brooks Nelson, the head of Mailinator's Business... by TestGuild Automation Podcast
29 min listen
How Rollups Will Decentralize Their Sequencer | Josh Bowen, Ben Fisch by Empire
73 min listen

Discover this podcast and so much more

400: Supply Chain Attacks

400: Supply Chain Attacks

Description

Titles in the series (100)

More Episodes from TechSNAP

Related podcast episodes