Mostly Security: Recent Episodes
Jon King and Eric Wuehler
Jon and Eric have worked in the security space as developers, architects and leaders for more years than they care to count. From commentary on current events to random musings, they chat (mostly) about security and technology topics. However, life is more than just the day job. From beekeeping adventures to hiking mountains to favorite shows, there's always something fun to wrap up the show.
Jon goes fishing and Eric potlucks. The Momas (meals) and the Papas (pals) both have security problems of different sorts. The government goes on a Duck Hunt to shut down QakBot. For fun we have the New York Times word game 'Connections' and a new method to create adult stem cells by resetting the epigenome.
- 0:00 - Intro
- 13:40 - Mom's Meals
- 17:29 - Papa's Pals
- 22:09 - Duck Hunt
- 29:12 - Eric Fun
- 33:16 - Jon Fun
School is back in session! FYI - kites won't fly without wind. Cryptocurrencies continue to make the news for all the wrong reasons and credit companies skirt the law with your personal data. Eric (might) like Open Range while Jon ponders whether insects feel joy and pain.
- 0:00 - Intro
- 13:13 - Crypto Startup loses 40 million
- 17:11 - SIM Swapping for Money
- 22:41 - Doxing for pennies...
- 30:11 - Open Range
- 34:11 - Do insects feel joy and pain?
Eric goes camping and Jon repairs his dishwasher. Apple is supporting California's right to repair law, the UK may outlaw end to end encryption and companies are threatening to remove features for residents (see Facebook vs. Canada), and Canary Tokens are awesome. India lands on the moon and you should see the movie Your Name!
- 0:00 - Intro
- 10:26 - Apple supports Right to Repair
- 17:12 - UK Tipping Point
- 21:15 - See: Canada+Facebook
- 23:21 - Canaries For All
- 30:02 - Chandrayaan-3 Lands
- 32:38 - Your Name
Eric spends 3 times as much to make better rotisserie chicken than Costco while Jon educates on bees and saves some hydrangeas with a couple trips to Lowes. The CSRB looks at Microsoft, Canon printers and Teslas have something in common, great profile of Window Snyder, and Colorado schools lose some data. Eric remind Jon about TV shows and Jon finds a fort off the coast of India.
- 0:00 - Introduction
- 8:51 - CSRB + Microsoft?
- 11:55 - Canon Printers...
- 14:30 - ...and Tesla
- 15:52 - Window Snyder
- 19:18 - Colorado...
- 22:25 - Foundation Season 2
- 25:52 - Murud Janjira
Eric and Jon return from (mostly driving) trips. Eric visits Crater Parks. A settlement for the family of Henrietta Lacks, and no immediate relief from app store fees. Second hand experience of a bank scam, and the most accurate acoustic side channel attack yet. For fun Eric visits Craters of the Moon (and Crater Lake), and an internet superconductor validation race.
- 0:00 - Intro
- 11:38 - Lacks Settlement
- 15:50 - No App Store Relief
- 19:19 - Sophisticated Scam
- 25:53 - Acoustic Attack!
- 32:20 - Craters of the Moon
- 36:35 - LK-99
Jon and Eric are both out this week - enjoy a look back at a few of their favorite Something Funs!
- 0:00 - Introduction
- 0:47 - Bees Survive Notre Dame Fire
- 2:05 - Fake Good News
- 4:09 - Where's Waldo
- 5:20 - Those Damming Beavers
- 8:47 - Hidden Heroines of Chaos
- 14:05 - Nikon Small World
Eric at the Night Market and his Schrödinger rotisserie; Jon at the coast. Microsoft makes useful logs more available, the SEC will require breach notifications within 4 days on an 8-K, and the JumpCloud breach is attributed to North Korea. For fun we have Red Rising book 6, and the space strategy game Stellaris. Enjoy!
- 0:00 - Intro
- 6:58 - MSFT Expanded Logging
- 9:17 - 8-K Breach Disclosures
- 13:21 - JumpCloud DPRK Link
- 18:45 - Jon's AI Experiment
- 23:43 - Red Rising book 6
- 26:27 - Stellaris
Eric is tricked into seeing part one of a movie and plans a baseball trip. Jon does pickles. Look for the US Cyber Trust Mark soon! Is your VM licensed for Java? AI summarizes an article with a few hallucinations. Eric enjoys romance novels and Jon hunts neutrinos.
- 0:00 - Introduction
- 12:18 - Brisket Saga Followup
- 13:30 - US Cyber Trust Mark
- 18:58 - Java Licensing Shakedown
- 22:54 - Government Backed Hacking
- 29:43 - Yumi and the Nightmare Painter
- 34:08 - Sparse Convolutional Neural Network Fun
Jon gardens and Eric has a potpourri of activities (hiking, museuming, movieing). Scams and phishing up huge year over year, and will Meta ever launch Threads in the EU (honoring privacy laws?). For fun we have SR-71 stories and a fishing charter out of SW Washington.
- 0:00 - Intro
- 11:35 - Scams Up
- 16:45 - No Threads for EU
- 23:23 - SR-71 Blackbird
- 32:50 - Salty Dog
Eric's attempt at making brisket was hampered by IOT failures, Jon's attempt at fishing was hampered by stomach failures. More surveillance camera oopsies and NSO acquisition notes. Will the UK force backdoors in encrypted messages and people really still send snail mail scams via the post office? Who knew. Threads is the latest Twitter replacement and we're looking forward to seeing pebbles from an asteroid.
- 0:00 - Introduction
- 19:37 - Surveillance Camera Fail
- 22:15 - NSO Acquisition Fail
- 23:40 - Backdoor Fail? 🤞
- 26:56 - Scammer OpSec Fail
- 33:36 - Threads isn't a Fail
- 37:09 - Pebbles from an Asteroid
Eric goes stargazing and Jon road-trips to southern oregon. Electromagnetic Fault Injection in drones and a severe zero click apple bug used to target Kaspersky employees. For fun we have a reimagined We Didn't Start the Fire by Fall Out Boy, and a new 'zoom out' feature by Midjourney.
- 0:00 - Intro
- 18:03 - EMFI
- 23:16 - TriangleDB
- 31:44 - We Didn't Start the Fire
- 33:38 - Midjourney Zoom Out
Father's Day stuffs, weddings, missed baseball games, beach pizza with carrot chasers. Google sells out to Squarespace. That 30TB external drive is not the deal you think it is. Oregon DMV data compromised. Eric ends up at America's Car Museum and Jon recommends He Who Fights With Monsters.
- 0:00 - Introduction
- 10:57 - Google Domains
- 15:00 - When is 30TB not 30TB?
- 23:03 - Oregon DMV Data Loss
- 29:45 - America's Car Museum
- 33:49 - He Who Fights With Monsters
- 36:30 - 仙俠
Jon stacks hay and has a graduate, while Amazon fails to deliver poptarts for Eric. Github repositories purporting to demonstrate zero days instead are malicious; Barracuda urges hardware replacement of compromised devices, unable to patch with software; and spy camera ecosystem completely compromised and practically unpatchable. For fun we have neal.fun's space elevator and a solar probe discovers more about the source of the solar wind.
- 0:00 - Intro
- 12:20 - Fake Exploits
- 16:03 - Hardware Replacement
- 22:47 - Spy Camera Vulnerabilities
- 30:30 - Space Elevator
- 34:57 - Coronal Holes
Eric's Rocket League team is in first place and Jon's bees are doing great! Kaspersky discovers a compromise on the inside (reboot your iPhone!), Chrome needs an update and BitDefender detects anomalies. Eric beams solar power down to earth and Jon muses what a lost couple decades might be.
- 0:00 - Introduction
- 8:53 - Reboot your iPhone
- 15:37 - Update your Chrome
- 18:16 - Check your Android Apps
- 24:25 - Solar Power from Outer Space
- 27:22 - Waking up after 2 decades
Eric runs around Oregon and Mostly Bee Talk with Jon. 60 Minutes demos DeepFake voice hacking -- social engineering remains the easiest and most prevalent way folks are compromised; and PyPi declares that all project and org maintainers must enroll in 2FA before the end of the year. For fun we have the Dragonfly Spectral Line Mapper that uses Raspberry Pi's and ZiGGY -- a mobile EV charging solution.
- 0:00 - Intro
- 13:52 - Eric Topic
- 19:52 - PyPi Goes 2FA
- 27:17 - Dragonfly Spectral Line Mapper
- 33:32 - Get ZiGGY With It
Jon goes fishing and figures he'll fix a car. Eric goes camping but doesn't really and learns about volunteering at the zoo. Please check out https://attachment.zip for fun, TikTok gets banned in Montana, Suzuki shuts down in India and TrendMicro informs us on the Lemon Group. Eric still enjoys playing Rocket League and Jon catches up on the Mistborn series.
- 0:00 - Introduction
- 11:56 - The .zip TLD is fun!
- 13:22 - TikTok banned in Montana
- 16:32 - Suzuki India
- 19:50 - Lemon Group
- 28:34 - Rocket League Old Farts
- 30:59 - Mistborn
Jon listens to concerts, the bees are doing well, and Eric avoids the heat and gets his sprinklers and AC working. The many scam apps claiming ChatGPT, new confusing top level domains, the FBI takes out a Snake with Perseus, and MSI has its firmware signing keys stolen by ransomware. Earth is probably safe from an asteroid for the next thousand years, and which came first, the (comb) jelly or the sponge?
- 0:00 - Intro
- 11:53 - ChatGPT Scams
- 15:39 - File Extension or TLD?
- 19:04 - Perseus vs. Snake
- 24:13 - Firmware Keys
- 30:19 - Probably Safe
- 33:39 - Jellies vs. Sponges
Eric survives a flash flood in his backyard and Jon's bees are alive. Wyoming will have a Nuclear Power Plant soon and ICS Patch Tuesday is a thing. The Spanish arrest a bunch of Phishing Pholks and there's 10 million bucks in easy money for somebody... Eric finishes The Three Body Problem series and Jon recommends the Paternus Trilogy.
- 0:00 - Introduction
- 11:04 - Nuclear Power is Back
- 13:55 - ICS Patch Tuesday
- 19:44 - Phishing Arrests
- 22:31 - Who wants $10,000,000?
- 28:53 - The Three Body Problem
- 32:36 - Paternus Trilogy
Spring Grilling begun for both Jon and Eric, and Jon got his bees, and it's a Google Night for topics. First, Google fails to encrypt Authenticator secrets when synchronizing across devices, invalidating the security premise; and then Google enables support for passkeys across all its accounts. For fun we have a recipe aggregator and interface: Super Cook, and an undisturbed, ancient tomb found in Ireland.
- 0:00 - Intro
- 12:32 - Authenticator Exposes Secrets
- 17:26 - Passkeys for Google
- 28:26 - SuperCook
- 33:06 - Ancient Tomb
Jon attempts to go fishing and repair a small engine. Eric attempts pest control. LockBit Ransomware code specific to Apple Silicon found and Kubernetes RBAC finds Monero "friends". Eric admires weed killing robots and Jon finds life deep in antarctic caverns.
- 0:00 - Introduction
- 16:40 - LockBit Ransomware for Mac
- 21:07 - Mac Ransomware
- 22:31 - Klever Kubernetes Exploits
- 29:12 - Weed Killing Robots
- 33:28 - Antarctic Caverns
Happy Tax Day (in the US). Read the latest Brandon Sanderson novel, Eric's going to coldplay, Jon tried a pottery class. Smooth Operator source is 'high confidence' North Korea, and it was still in the gathering stages (probably). Is Juice Jacking (again?) a thing, and principles of secure software development from CISA and supporting agencies. For fun, what your climate may be like in 60 years, and a talented potter on YouTube.
- 0:00 - Intro
- 14:13 - Smooth Operator Source
- 15:22 - Smooth Operator Followup
- 17:40 - Juice Jacking(?)
- 22:36 - Secure by-Design and -Default
- 40:19 - Climate in 60 years
- 44:50 - Matthew Kelly Pottery
Jon is unable to split bees and is still working out a cough. Eric drives half way to Seattle because Amtrak decided to stop functioning. Cars can now be stolen by popping out a headlight and no package manager is safe from supply chain attacks. Eric shares a Stitch and Jon gives credit to Einstein's first wife.
- 0:00 - Introduction
- 7:54 - Car Stealing
- 11:40 - NuGet Package Manager
- 20:35 - Stitch
- 23:22 - Forgotten Life of Einstein's First Wife
Eric and Jon are both back from their respective road trips. Samsung will patch for the Exynos flaws in April, the Biden administration issues and executive order limiting the government use of some forms of spyware, the RESTRICT act to ban tik tok is 'insanely broad' and could easily sweep other software into its net, and the 'Smooth Operator' supply chain vuln from last week hit the mac too. For fun we have two vacation happenings: freeze dried skittles and the shuttle Enterprise.
- 0:00 - Intro
- 11:08 - Exynos Followup
- 12:21 - Restrict Spyware
- 14:41 - Insanely Broad
- 20:21 - Smooth (Mac) Operator
- 29:54 - Freeze Dried Skittles
- 33:03 - The Shuttle Enterprise
Jon drives across the US, Eric takes his boy on college tours. ChatGPT has a bug, AirTags are used by the government, Bitcoin ATMs get hacked and Android Developers can better avoid fraud if they use the right APIs. Eric finally finishes book 2 of The Three Body Problem and Jon checks out a T-Rex.
- 0:00 - Introduction
- 9:27 - ChatGPT Outage
- 11:41 - AirTag Surveillance
- 14:42 - Bitcoin ATM Hack
- 18:47 - Android Fraud Abuse Help
- 23:46 - The Dark Forest
- 27:56 - Sue the T-Rex
Jon and Eric prepare for road trips; the trebuchet is (mostly) done, and spring may have started in Oregon. Project Zero finds a modem vuln in modern android phones and watches, Lionsgate streaming left an ElasticSearch instance wide open, and LinusTechTips YouTube channel was taken over. For fun we have Charlie Chaplin (and Einstein!) and a study on how bees learn the waggle dance.
- 0:00 - Intro
- 12:33 - Disable Voice over LTE
- 17:24 - Lionsgate Leak
- 21:35 - LinusTechTips Hacked
- 26:44 - Charlie Chaplin
- 31:22 - Waggle Dance Study
Eric does car things and watches a musical from 1875, Jon has trebuchet updates and enjoys the local High School production of The Addams Family. Telehealth company (legally) sells your medical data to advertisers. Cybercriminals are arrested in Europe and CISA will port scan your website. Eric is the only one who likes a 3 wheeled car and in the wake of SVB, Jon (after a sidebar on his Tablo woes) shares a great banking system explainer.
- 0:00 - Introduction
- 7:09 - Trial by jury
- 14:52 - Cerebral sells data
- 18:24 - Cybercriminals caught
- 21:24 - RVWP
- 26:41 - SOLO
- 30:27 - Bits About Money
Eric projects around the house and Jon gives a trebuchet update. LastPass hits keep coming, changing someone else's address, the (good!) network consequences of a DDoS takedown, and Wednesday was International Women's Day.
- 0:00 - Intro
- 11:05 - LastPass via Plex
- 13:56 - Address Change
- 21:42 - DDOS Seizure Fallout
- 26:53 - International Women's Day
Snow happens and disrupts everything except Eric's shiny new Rocket League Old Farts Season 8 Championship title. Scammy authenticator apps. AI generated voices breaking into banks. Typosquatting on PyPi. Electricity thieves for Crypto. Eric discovers Tatooine could exist and Jon speculates on how smart ChatGPT actually is...
Snow in Oregon! Eric refuses to buy a truck at 20%+ markup, Jon works on building a trebuchet. An old article about Advanced Persistent Manipulators, Twitter deploys an interesting 2FA "strategy," the largest breach of medical records so far in 2023, and the City of Oakland is still coping with their ransomware attack. For fun we have the "cheapest" way to space (so far) and the largest observed gathering of whales in potentially centuries.
- 0:00 - Intro
- 16:29 - Advanced Persistent Manipulators
- 20:13 - Twitter 2FA "Strategy"
- 25:02 - Regal Medical Group
- 27:57 - Oakland Ransomed
- 31:41 - A Perspective
- 35:41 - Krill Festival
Eric sits in the middle of a play and Jon laments over bees while the both of them watch sportsball for the commercials. Eric's sister chimes in with her review of the podcast and mocks his something fun from last week. For topics this week, walk through the process of decoding a UK Rail Ticket and opine on the FBI's use of Section 702. For fun, Eric talks about Open Source Seeds and Jon goes through the top 5 best Super Bowl commercials.
- 0:00 - Introduction
- 11:07 - Decoding UK Rail Tickets
- 16:00 - Section 702
- 23:58 - Open Source Seeds
- 29:35 - Top 5 Super Bowl Commercials
Eric visits the car show and Jon replaces a 17 year old entertainment setup. Ubiquiti Insider pleads guilty, the US secretly passed a medical cybersecurity law, 5 Guys is hit with BlackCat ransomware, and the ESXiArgs campaign enters a new phase. For fun we have a (shaken) new form of (space?) ice and a visual depiction of the dramatic reduction in working poor over the past 30 years.
- 0:00 - Intro
- 13:06 - Followup
- 15:59 - Inadvertent(?) Law
- 21:12 - 5 Guys Ransomed
- 23:54 - ESXiArgs
- 28:45 - Amorphous Ice
- 33:13 - Visual Capitalist
Eric roasts a chicken and watches a show...(booooring!) Jon reads some stuff without his brain, listens to a violinist, copies home movies, and forgets about this pesky thing called "time zones". Eric piles on LastPass' parent. Jon acknowledges AI assisted articles are an activity allowed and an adumbration of the demise of human authored advice. (Whew...) Also, update GitHub Desktop. Finally, Eric plays Snakes in HD and Jon and Eric argue (well, Eric mostly) over whether a Tractor Beam is just a different word for Gravity.
- 0:00 - Introduction
- 11:53 - GoTo lost the keys, too...
- 15:11 - AI Assisted Advice
- 21:04 - GitHub Desktop
- 24:15 - Snakes HD!
- 26:39 - Microscopic Tractor Beams
Eric's kitchen is (finally!) complete, and hell froze over as he bought a (Windows) PC. Jon gets to (finally!) hear Itzhak Perlman after the concert gets delayed since covid. Malware using Android devices to hack wifi hotspots, a VAST ad fraud takedown, and a financial transaction surveillance program that is (mysteriously!) still funded long after the settlement money has run out, providing multiple law enforcement agencies and departments unfettered access to transaction data without due process. For fun we have the Wonders of Street View and a non profit making high quality, public domain eBooks available to everyone.
- 0:00 - Intro
- 10:53 - Android DNS Hijacking
- 15:42 - VASTFLUX
- 23:09 - TRACing Everyone
- 31:13 - Street View Wonders
- 36:19 - Standard eBooks
Eric has a new car he admires from afar and revisits his Hash/Check app. Jon doesn't do much beyond reading and, something something, peaches. GTP3 takes away phishing indicators. AWS Cloudtrail IAM bypass exposed. Eric ponders poorly photoshopped cats and Jon appreciates shellsplaining...
- 0:00 - Introduction
- 10:56 - GPT3 Phishing Emails
- 17:51 - CloudTrail Bypass
- 24:38 - Poorly Phototshopped FTW
- 27:05 - Internet Cats
- 27:48 - explainshell.com
Eric has another fabulous week, and Jon ... also has a week. Eric's done with his Van Gogh Lego and both get to watch Harry Potter and the OR Symphony. Slack attempts to hide its breach disclosure from indexing, Apple isn't exactly transparent when it finds malware on a device, and an app to coordinate law enforcement agencies that exposed data about suspects, raids, and officers. For fun we have new learnings from JWST, the first ever bee vaccine, and a startup trying to use CRISPR to develop cell lines happy to live in bioreactors. Go Science.
- 0:00 - Intro
- 11:09 - Non-transparent Slack
- 14:54 - Silently Deleted
- 22:27 - SweepWizard Exposure
- 28:55 - Un-immature Galaxies
- 31:50 - Bee Vaccinated
- 35:28 - CRISPR "Meat"
The holidays are over and its back to work. Eric talks about using facial recognition to deny paying customers entry to entertainment and cheating your Tesla on the autobahn. Jon chats package oopsies with PyTorch updates and hacked Google Home devices. Eric finds science immitating art in the atmosphere while Jon makes ice cream and admires a really big bee.
- 0:00 - Intro
- 9:32 - No Rockettes For You!
- 14:13 - Autopilot on the Autobahn
- 19:01 - PyTorch Oopsie
- 23:16 - Hacking Google Home
- 28:42 - Real Termination Shock
- 32:58 - Ice Cream!
- 36:45 - Really Big Bee
Eric has a fabulous Christmas, and Jon's still without power. But both relish nerdly gifts. We learn more about the LastPass breach, men arrested for using hacked Ring doorbells to record (and taunt) police swat teams, a potentially huge data leak from Twitter, and TikTok verified to be tracking journalists. For fun we have printable binary posters and ultra thin solar cells. Happy new year everyone!
- 0:00 - Intro
- 13:03 - LastPass Data Breach
- 16:27 - Taunting while Swatting
- 22:14 - Twitter API Leak(?)
- 27:10 - TikTok Spying on Journalists
- 33:56 - Binary Posters
- 36:40 - Ultra Thin Solar
Gearing up for the break - Happy Holidays to All! Eric does some christmas light wardriving, Jon has a cookie party and has gifts delivered. Apple introduces new security features and Google encrypts some emails. NIST retires SHA1 and Apple fixes another zero-day. Eric rains on Jon's fusion parade and Jon relives 6 times his mind was blown.
- 0:00 - Intro
- 11:00 - Apple Security Features
- 16:29 - Gmail Encryption
- 18:26 - NIST Retires SHA1
- 21:02 - Apple Zero Day
- 23:44 - Why Fusion Will Never Happen
- 31:25 - Mind Blowing Quantum Physics
Eric and Jon prep for Christmas and Christmas Concerts; Apple may allow third party app stores, what happens when satellites are compromised, blind users of a medical implant left hanging when the company folds, and (hopefully) future end to end encrypted iCloud backups. For fun, a site about the satellites around earth and fusion ignition: more energy out than was put in. Happy holidays everyone.
- 0:00 - Intro
- 6:25 - YOU get an AppStore, and YOU ...
- 14:13 - Criminals in Space
- 19:16 - Second Sight Support Suffers
- 25:11 - E2E iCloud Backup
- 34:19 - Just a few Satellites
- 38:36 - Ignition, Fusion Ignition
Jon has a musical week, Eric decorates for the holidays. Android signing certs are compromised, LastPass breach continues and CrowdStrike blogs an attack on telecom companies. Launch Asteroids at Earth and check out the Pillars of Creation.
- 0:00 - Introduction
- 9:01 - Android Compromised
- 13:32 - LastPass Breach Continues
- 17:21 - Attack on Telecom Companies
- 25:18 - Astroid Launcher
- 30:45 - Pillars of Creation
Eric and Jon both have good Thanksgiving meals and breaks, Looney Tunes at the Oregon Symphony, and a recommendation for Glass Onion. iSpoof takedown in the UK, significant fines down under, and trusting your laptop to a repair shop may result in privacy violations. For fun we have a video teaching lockpicking to blind students, and Roal Road, an online portal for authors.
- 0:00 - Intro
- 13:00 - Glass Onion
- 14:39 - iSpoof No More
- 21:40 - That's not a Fine, this is a Fine
- 25:13 - Repair Shop Peeps
- 30:12 - Guelph in 72!
- 31:25 - Lockpicking Students
- 34:33 - Royal Road
- 36:40 - Path Of Ascension
It's Thanksgiving week in the US. More FTX nonsense. Apple's "privacy" is not what you think. Zeppelin ransomware keys. TwitterIsGoingGreat.com is exactly what you think it is. Chicken chicken chicken. Help for Honeybees. Mother Learning books.
- 0:00 - Intro
- 11:19 - FTX Nonsense
- 14:15 - Apple's "privacy"
- 21:24 - Zeppelin ransomware
- 26:35 - Twitter is going great
- 27:15 - Chicken chicken chicken
- 29:25 - Help for Honeybees
- 33:40 - Mother Learning
Eric and Jon both go on road trips, Eric goes stargazing, Jon fails to fix his mule. The FTX debacle continues apace, an "accidental" 70k lockscreen bypass bounty, a russian mobile software company masquerading as a US company, and 15k wordpress sites compromised to boost SEO for worthless Q&A sites. For fun we have minutia about the definition and measurement of time, and an AI model trained on scientific papers and textbooks.
Eric goes to a High School play while Jon plays with a laser engraver over a soggy weekend. Eric chats about MFA in Antarctica. Jon talks simple CVEs and order of operations. Web3 is still going great, FYI. Finally, check out a Submarine Cable Map online and decide for yourself if bees have feelings.
- 0:00 - Intro
- 0:53 - The Play That Goes Wrong
- 11:07 - Antarctic MFA
- 18:15 - Simple CVEs
- 23:47 - Cryptocurrency Fun!
- 30:56 - Submarine Cable Map
- 33:59 - Do Bees Have Feelings?
Halloween passes quickly this year; Eric finishes his kitchen magnetic board project, and Jon finally sets up the laser engraver. Three years later (was episode 70!) Amazon finally builds Eero into 5th gen Echo devices. An act may pass to help the government use open source software better, the FTC takes steps against Drizly CEO to enforce better security practices, and Android droppers found on Google Play. For fun, we have a nearly 2km long train in Switzerland and an obituary for Kathleen Booth, an early computer pioneer and inventor of Assembly Language.
- 0:00 - Intro
- 11:26 - Eero+Echo
- 12:25 - Securing Open Source Software Act
- 16:50 - Drizly CEO Ordered
- 22:27 - Android Droppers
- 27:22 - Not a Short Train
- 32:21 - Thanks for Assembly, Kathleen!
Jon's Fridge Saga Continues, Eric attends the Oregon AMS Winter Weather Conference. Passkeys are finally(?) here and GitHub Exploit PoCs should come with warning signs. Finally, check out Mark Rober's Squirrelimpics and Nikon's Small World.
- 0:00 - Intro
- 12:57 - Passkeys Are Here!
- 17:56 - GitHub PoC Exploit Fakes
- 25:43 - Squirrelimpics 3.0
- 27:51 - Nikon Small World
Jon enjoys Panic! and Eric goes to the pumpkin patch. Equifax uses their data to detect (and fire) the overemployed, a history of the Google Plasma Globe Affair, and how not to encrypt messages. Why some people are more attractive to mosquitos, and how to train a few hundred thousand brain cells to play pong.
- 0:00 - Intro
- 11:28 - Equifax Fires Overemployed
- 15:40 - Google Plasma Globe Affair
- 19:04 - Failed at Crypto
- 25:50 - Mosquito Attraction
- 29:48 - Dishbrain
Jon and Eric are in Texas, eating brisket. Eric's car insurance is about to spike and Jon's symphony visit takes a medical turn. Eric talks about Ikea Smart Lighting, Jon shares info on the US Airport Website hacks and Thermal Attacks for password discovery. Eric talks about Safer Nuclear Energy and Jon trolls Eric with "Fix Wasps". Finally, can CRISPR be used to cure HIV?
- 0:00 - Intro
- 10:54 - Ikea Smart Lighting
- 15:30 - Airport Websites Taken Down
- 17:30 - Thermal Attacks
- 22:55 - Safer Nuclear Energy
- 26:31 - Fig Wasps
- 31:14 - Cure HIV using CRISPR
Eric has a new driver and hutch-free-garage, and Jon has AAPL frustrations. Both Google and Facebook ahem Meta release AI driven text-to-video examples this week. The EU votes for USB-C, wifi cameras are easy to jam, Microsoft copes with two new Exchange zero days, and Mandiant finds novel malware VIB files loaded into ESX servers. For fun we have the longest running webcam on the internet (SFO Fog Cam) and the Steam game Slipways.
- 0:00 - Intro
- 19:25 - Imagen Video
- 22:25 - EU Votes for USB-C
- 25:37 - Jam the WiFi
- 28:39 - Exchange Zero Days
- 32:22 - Bad VIB(e)s
- 39:16 - Fog Cam
- 42:54 - Slipways
Eric rambles about photography, teaching his boy to drive, furniture items nobody wants, endangered flowers and sleeping with the watch. Jon has a boring, beeless, bachelor weekend. Deep Fakes with Real People, Python bugs from 2007 and License Plate tracking for Fun and Profit. Eric eyes a new island while Jon denotes the DART damage. Finally, read up on the Tripitaka Koreana. Magnificent.
- 0:00 - Intro
- 12:47 - Deep fakes with Real People
- 22:05 - Trellix (re)finds bugs from 2007
- 27:34 - Tracking License Plates
- 33:21 - New Island
- 35:45 - DART
- 37:28 - Tripitaka Koreana
Eric battles CO2 and gets his Speed Pillows installed, and Jon's fridge is still broke. Beware remote controlled insulin pumps, and congrats (?) to the Solarium Commission; a story of industrial sabotage, and a critical Oracle Cloud vulnerability. For fun we have the makeup and history of a QR code, and can we use AI to understand whales?
- 0:00 - Intro
- 17:04 - Insulin Pumps Vulnerable
- 18:32 - Solarium Commission
- 23:48 - Industrial Espionage
- 30:25 - Oracle Cloud #AttachMe
- 36:03 - Makeup of a QR Code
- 39:10 - How to Speak Whale
Eric is haunted by spiders and Jon is on a hunt for jeans. US Congress hears from Mudge, Apple introduces Lockdown Mode, the US Government sanctions people and entities for their roles in conducting cyber attacks, and Glassdoor has a Cache Poisoning. Eric follows up with how spiders fly, Jon finshes with a Cosmic Tarantula and the Phases of Water.
- 0:00 - Intro
- 11:58 - Twitter Whistleblower
- 15:45 - Lockdown Mode
- 22:40 - Sanctions
- 26:20 - Cache Poisoning
- 32:05 - Electric Flight of Spiders
- 35:35 - Cosmic Tarantula
- 37:26 - The Phases of Water
Eric's back in the kitchen and the kids are back in school. Apple holds an event to #takeJonsMoney, and USB4 naming can get more complicated -- who knew? The IRS lets taxpayer data sit in the open for a year, and Facebook tweaked its URLs so the tracking parameters can't be removed by browsers. A 14 year old boy cracked the Australian Signals Directorate challenge coin in an hour, and rest in peace Peter Eckersley. Far too young.
- 0:00 - Intro
- 15:10 - Apple Event
- 21:47 - USB4 Version 2.0 SuperSpeed Gen 42
- 27:28 - IRS Data Exposure
- 31:01 - Facebook URL Scheme
- 36:39 - ASD Challenge Coin
- 39:25 - Thank You For Let's Encrypt
Eric walks his week backward from hiking Mt. St. Helens to becoming a Twitch celebrity. Jon gets a Dream Machine. Krebs follows up on Ubiquiti, Eric tweets #TwitterWhistleblower and notes that Plex is Too Good. Jon eyes an 0ktapus and then the whole show goes hilariously awry. Eric goes nuclear. Jon finds soft body physics and admires CO².
- 0:00 - Intro
- 4:18 - Eric on Twitch
- 10:21 - Ubiquiti followup
- 12:01 - #TwitterWhistleblower
- 15:15 - Plex Password Reset
- 20:00 - Phishing, Continued
- 27:53 - When the Show Goes Awry
- 36:07 - Modular Nuclear Reactor
- 42:06 - Soft Body Physics
- 43:23 - J Webb finds CO²
Eric cooks and desperately waits for a kitchen, and Jon harvests his honey for the year and goes camping. Go look at the JWST images of Jupiter! Amazon releases cybersecurity education videos, Apple releases patches for serious vulnerabilities across all its platforms, a long standing heap reuse bug to get priv escalation in Linux, and Cellebrite has years of emails exposed in a legal filing. For fun join Rocket League Old Farts or play Call to Adventure.
- 0:00 - Intro
- 17:29 - JWST Jupiter Images
- 19:07 - Protect, Connect
- 21:38 - Apple Security Bug
- 24:22 - DirtyCred
- 27:44 - Cellebrite Legal Doxing
- 33:49 - Rocket League Old Farts
- 37:48 - Call to Adventure
Eric crosses a bridge and Jon's bees escape. Twilio and Cloudflare disclose on phishing attempts while Deere, well, its not a good look. Eric tempts Jon with Fake Bacon and Jon talks about GPS Jamming which is neither GPS nor Jamming.
- 0:00 - Intro
- 6:37 - St. John's Bridge
- 14:38 - Phishing Targets
- 19:22 - Deere in the Headlights
- 26:00 - Fake Bacon
- 32:08 - GPS Jam
Eric paints and Jon does #nothingMuch. Riot profits more from not mining BitCoin (thanks #texas!), Microsoft releases 121 fixes for patch Tuesday, and a way to read uninitialized memory from CPU cache. For fun we have the Ig Nobel Prizes, and (thanks #science) how to use dead spider bodies as claw machines.
- 0:00 - Intro
- 11:57 - Riot Power Credits
- 13:47 - Hacking Fuel Pumps
- 19:43 - Patch Tuesday
- 23:07 - Æpic Leak
- 29:55 - Ig Nobel Prize
- 35:06 - Dead Spiders
Eric and Jon are both back from vacation; Jon still recovering from Covid. Apple shows how Passkeys will be used outside the Apple ecosystem, a dating site for the unvaxxed has its data exposed, some practical suggestions to assist in the fight against ransomware, and some interesting malware stats and search tips from VirusTotal. For fun we have the series Red Rising by Pierce Brown, and Jon gets his DALL-E invite.
- 0:00 - Intro
- 12:30 - Practical Passkeys
- 15:48 - Unjected Exposed
- 20:15 - Ransomware Suggestions
- 25:28 - VirusTotal Dorking
- 33:31 - Red Rising
- 36:26 - Jon DALL-E
- 40:58 - Eric DALL-E
Jon and Eric were unable to connect this week - so Eric takes a look back at a few of the "Something Fun" topics over the last several years. Enjoy!
- 0:00 - Intro
- 0:32 - Episode 8
- 1:11 - First Amazon Purchases
- 4:51 - Jon's Beekeeping Journey Begins
- 6:30 - Episode 42
- 6:51 - 42
- 9:23 - Episode 96
- 9:53 - Hacking Passwords
- 13:48 - Crazy Sauce
- 18:42 - Episode 156
- 19:27 - Star Wars Scroll Creator
- 22:20 - Arecibo Collapse
- 25:18 - Chapel of the Ancients
- 28:15 - Human Nature
- 28:59 - Outro
Jon is in Germany touring cathedrals and Eric is unable to spend money. Cybersecurity apprenticeship programs, Rust-based ransomware and yet another breach. Eric finds hacking fly brains interesting and Jon admires Reims Cathedral.
- 0:00 - Intro
- 8:27 - No Sale for NSO Group
- 9:15 - Cybersecurity Apprenticeships
- 12:42 - Rust Ransomware
- 16:09 - Debt Collection Ransomware
- 20:25 - Hacking Fly Brains
- 23:28 - Reims Cathedral
Eric enjoying summer and Jon stressed out. Honda key fobs vulnerable to replay attacks, if you mine bitcoin in texas you're cut off, and how to sell a billion dollars in fake Cisco hardware. And (drumroll....) the first images from the James Webb Space Telescope are in, and they're stunning. Enjoy!
- 0:00 - Intro
- 21:37 - Rolling-PWN
- 27:51 - Bitcoin Shutdown in Texas
- 32:48 - Fake Cisco Hardware
- 38:49 - First Images from JWST!
Eric has a rollercoaster week, Jon counts his bees. Instagram is a ghost, North Korea adds targets to ransomware attacks, and Lawyers hire hackers to get information for litigation. Eric share Absurd Trolley Problems and Jon asserts Code is Just.
- 0:00 - Intro
- 14:54 - Boo, Instagram
- 24:38 - NK Ransomware Attacks
- 28:56 - Hacking for Lawyers
- 33:54 - Absurd Trolley Problems
- 36:21 - Code is Just
Eric feeling better and reading more, Jon fighting squirrels and bees. Are mass resignations incoming? How about some job applicants using Deepfakes then. The price of bitcoin may be hurting North Korea, and if you own the webview you can extract critical data. For fun we have a media hat trick: a podcast (The Joy of Why), a video (Japanese nail-less (de-)construction), and a book (Kaiju Preservation Society).
- 0:00 - Intro
- 14:58 - Resignations Incoming?
- 19:47 - Deepfake Job Applicants
- 23:17 - Bitcoin Crash Hurts North Korea
- 26:42 - WebView2 Apps
- 32:21 - The Joy of Wh(y)
- 34:44 - Look Ma, No Nails
- 36:01 - Kaiju Preservation Society
Jon got surprised by last minute concert tickets and has moar internet. Eric gets ill and reads a lot. A US defense contractor wants NSO group tool and some Modified Elephant followup. FBI chases a LinkedIn cryptocurrency scam, scammers chase unpatched Confluence servers, and the US DOJ catches a Russian botnet. Eric appreciates Lava Lamp Encryption and Jon follows up again on CRISPR.
- 0:00 - Intro
- 13:35 - NSO technology takeover
- 15:20 - Elephants planting evidence
- 18:44 - LinkedIn cryptocurrency scam
- 24:44 - Confluence bug exploit
- 27:32 - RSocks proxy seized
- 30:32 - Lava lamp encryption
- 34:50 - 100% effective so far!
Eric builds bee boxes and Jon's bees aren't doing so well. Oh, and bees "can be included under the law's definition of 'fish'." Three named vulnerabilities this week: PACMAN, SynLapse, and Hertzbleed. Although two of them shouldn't be much of a concern for most of the #realWorld. For fun we have a frustrating game, a beaver internet outage in Canada, and a faceID patent to detect the veins in your face.
- 0:00 - Intro
- 10:56 - Bees Are Fish?
- 13:52 - PACMAN
- 18:14 - SynLapse
- 27:00 - Hertzbleed
- 34:05 - QWOP
- 37:43 - Leave it to Beaver
- 40:29 - Face (veins) ID
Eric has no kitchen, Jon misses the symphony and almost catches a swarm. More "Death to Passwords" talk from Apple, an S3 Bucket exposed, and CISA warns about the top PRC exploits. Eric dives into a new book series and Jon watches more YouTube.
- 0:00 - Intro
- 16:00 - Apple Passkey
- 29:46 - Mobike Bucket
- 33:52 - CISA Alerts
- 38:49 - Cradle Series by Will Wight
- 43:39 - Out of the Woods YouTube
Jon fails at grafting and a Weekend at Eric's. Come for the Bad Guys, stay for the animation. Future cyber predictions, WSL malware, and the Polonium actor group. For fun we have lab grown wood products and the new AI artist in town.
- 0:00 - Intro
- 9:15 - The Bad Guys
- 15:54 - Cybersecurity in the Future
- 25:09 - WSL Malware Increasing
- 30:09 - Exposing Polonium Activity
- 35:54 - Lab Grown Wood
- 40:51 - AI Can't Spell
Jon talks bees, Eric has a boring weekend. Good news for "Good Faith" hackers. How to steal open source libraries "for science" and the Verizon Data Breach Investigations Report. Eric ponders stolen NFTs and Jon considers Viking Ships.
- 0:00 - Intro
- 13:08 - Good Faith Hackers
- 16:41 - Library Theft
- 19:13 - Sock Puppets
- 25:55 - Verizon Report
- 31:36 - Stolen NFTs
- 36:43 - Viking Ship
Eric returns from Disneyland and Jon goes back to Corvallis. iPhones could potentially be attacked even when turned off, executives also use bad passwords, and protocol downgrade attacks abound. For fun we have the world's most inconvenient convenience store, and a way to trick your brain into understanding more of what you read.
- 0:00 - Intro
- 15:28 - Eric Topic
- 21:00 - CEO Passwords
- 25:11 - Correct Horse Battery Staple
- 26:15 - Protocol Downgrade Attacks
- 36:18 - Inconvenient Convenience Store
- 39:15 - Bionic Reading
Eric visits a few states, Jon has a pleasant Mother's Day and they both watch Dr. Strange. A little Patch Tuesday followup, some notes on credit card stealing as a service (CCSaaS), a "Delete All The Things" malware making the rounds and another cryptocurrency hack. Eric chats about his favorite Google IO announcement and Jon shares thoughts on steganography.
- 0:00 - Intro
- 7:12 - Patch Tuesday
- 10:38 - CCSaaS
- 12:27 - F5 BIG-IP Vulnerability
- 14:37 - Cryptocurrency Hack
- 20:46 - Google IO
- 28:28 - Steganography
Jon and Eric are both on the road this week. Dead whale on a Washington beach reminds us of the famous Oregon video (see link!). Followup on the mite killing fungus, and Pegasus spyware on Spain's PM's phone. Security.txt is official, Microsoft security tips, Chrome 101's security bounties and auto password changes (old, oops!). For fun we have the oligopoly of pop culture, a floating anvil, more about breeding bees, and an asian giant hornet update.
- 0:00 - Intro
- 15:49 - Exploding Whale Video
- 16:41 - Biological Weapons
- 17:17 - Pegasus Followup
- 21:16 - Security.txt
- 25:35 - Microsoft 10 tips
- 29:00 - Chrome 101 Bounties
- 32:06 - Chrome Auto Password Changes
- 35:24 - Pop Culture Oligopoly
- 40:39 - Floating Anvil
- 42:12 - VSH Bees
- 50:16 - Asian Giant Hornet Update
Jon's doing more experiments with bees. Eric goes on another roadtrip. Psychic Signatures in the latest Java, a Super-sized HTTPS DDoS attack, and some chat entertainment. Eric's boy suggests the Astronomy Picture of the Day, Eric grudgingly admires Classic Mac running in a Browser and Jon looks forward to bee fungus.
- 0:00 - Intro
- 11:30 - Psychic Signatures
- 17:21 - 15.3 million requests per second
- 22:42 - Leaked Lapsus Chats
- 31:35 - APOD
- 32:19 - Classic Mac in a Browser
- 35:15 - Fungus for Bees
Jon gets his new bees and Eric preps for upcoming travel during the Easter weekend. Amazon's log4shell hotpatch made things worse (!!), what to do about mis- and dis-information, an IoT company attempts to perform a vanishing act, and data about exploited zero days in 2021. For fun we have a newly discovered stellar phenomenon: a 'micronova' and a show that started slow and ended (season 1 at least) well ... Severance.
- 0:00 - Introduction
- 15:06 - Fixing the Hotpatch
- 20:20 - Mis- and Dis-information
- 30:55 - Insteon Vanishes
- 36:11 - Exploited Zero Days in 2021
- 45:26 - Micronova
- 47:00 - Severance
Snow in April. Uh, what? Jon hires an electrician and Eric replaces smart plugs. Eric notes that Apple is finally catching up to Microsoft and Google, but not how they might want. Jon chats LOOPBins, Patch Tuesday goodness and ICS Toolkits. Eric feels bad about Ohm. Jon watches a show and admires a comet.
- 0:00 - Intro
- 15:33 - Patch your Apples
- 19:55 - LOOPBins
- 24:47 - Patch Tuesday
- 28:18 - ICS Toolkit
- 32:59 - Ohm
- 36:31 - Severance
- 38:09 - Really Big Comet
Jon is out of commission for a couple of days, but his bees are doing well! Eric is reading, playing with a new Pixel 6 and frustrated with Southwest Airlines (lack of) good password management. GitLab has a static password 'oops', Mailchimp is compromised and phishes crypto holders, and the FBI & DOJ take down a GRU Botnet. For fun we have potential future fluid telescope lenses, The Princess Bride in concert, and a new way of dating buried stone tools.
- 0:00 - Intro
- 16:38 - GitLab Static Password
- 19:44 - Mailchimp Compromised
- 24:56 - GRU Botnet Takedown
- 29:21 - Fluid Telescopes
- 32:36 - Princess Bride + Oregon Symphony
- 36:34 - Cosmogenic Nuclide Isochron Method
Eric rides a bike and eats a burger. Jon eagerly awaits bees. A few follow ups to Okta, Lapsus, Cryptocurrency losses and a Ukraine hacker. The FBI goes after BEC scams, Exxon mines bitcoin with excess gas, forged Legal requests and a new exploit, logo pending. Eric find CRISPR cows interesting and Jon is looking forward to buying books in the Kindle app.
- 0:00 - Introduction
- 10:03 - More Okta
- 11:09 - Lapsus Mastermind
- 13:01 - $625 million more...
- 14:22 - Ukraine Hacker
- 17:35 - FBI BEC News
- 19:05 - Excess Gas Bitcoin Mining
- 21:39 - Forged Legal Requests
- 29:12 - Spring4Shell
- 34:22 - CRISPR Cows
- 37:04 - Apple Reader App News
Jon's on vacation in New Mexico (?) and Eric does Many Mundane Things. Exotic Lily was an IAB for Conti, how to make phishing even harder to detect with browser-in-browser popups, Germany warns against Kaspersky use, and Okta is breached by Lapsus$. For fun we have 9 lines to represent all of physics, a da Vinci exhibit at OMSI, and Mesa Verde National Park.
p>Eric finishes a big book, went to a concert and resurfaced his garage floor. Jon went to the Symphony and ordered some Bees. Risky Biz is joined by a favorite cybersecurity writer, Nvidia "hacks back" and more cryptocurrency is lost to software bugs. Jon chats about a Russian CA and some Node sabatoge. For fun, Jon finds Ernest Shackleton's ship and Eric is excited about Daylight Savings news. Ed. Note: Eric is well aware the Earth revolves around the Sun and not the other way around. He was tired. * 0:00 - Intro * 12:53 - Risky Biz Bonus * 14:04 - Nvidia Hacks Back * 15:34 - Math is Hard * 17:56 - Russian TLS CA * 22:01 - Node Madness * 26:43 - Oregon Chorale * 27:34 - Daylight Savings??? * 30:36 - Endurance * 35:26 - 1917
Eric attempts a St. Helens visit and plays with IR filters, while Jon is going to a concert (!!). Google's TAG releases an update about Ukraine related activity, NVidia gets an "interesting" blackmail request from their breach, and NVidia code signing certs are seen signing malicious software on VT. For fun you may soon be able to buy a Purple Tomato, a non-Brandon Sanderson book kickstarter (by Will Wight), and the east coast may be taken over by palm sized flying spiders. Yay.
Eric goes to the Auto Show, Jon didn't build anything or break anything. Eric checks in with Printer Security and Jon chats about security topics related to Ukraine. Eric promotes a couple videos explaining Wordle Information Theory and then proceeds to ruin Jon's fun.
- 0:00 - Intro
- 10:23 - Last Day
- 11:03 - Printer Security
- 16:25 - FoxBlade Malware
- 19:00 - Conti Leak
- 27:53 - Wordle Information Theory
- 29:11 - The Correction
- 30:35 - Eric Ruins Jon's Fun
Jon resurrects his pellet grill (with help) and Eric prints components for his security system. Is Immersive Art new, and art? 1Password hooks up with Phantom wallet, NIST initiates cybersecurity labeling programs, and watch out for phishing in Teams. Wordle is (evidently) fun, and please don't use pixelation as a redaction technique.
- 0:00 - Intro
- 19:21 - Immersive ... Art (?)
- 21:20 - Phantom + 1Password
- 25:09 - Cybersecurity Labeling
- 29:07 - Phishing Teams
- 34:52 - Wordle Fun
- 38:47 - Pixelation Unredactor
The Super Bowl came and went, Eric watched a concert 800 miles away and Jon worked on the farm. Check in with the Red Cross hack, another company doing facial recognition for login, a football team gets ransomwared, an attack led by a Modified Elephant and using BGP to hack crypto wallets. Eric likes Suspicion and Jon drops a crypto presentation and wonders where Webb is. * 0:00 - Intro * 9:28 - Red Cross Hack * 13:45 - More Facial Logins * 16:02 - 49er Ransomware * 18:30 - Modified Elephant * 22:46 - Crypto BGP Hack * 27:21 - + Suspicion * 31:59 - Graybeard Talks Crypto * 35:06 - Where is Webb?
Jon is lazy-ish and Eric has a day at the coast. The IRS backs down from their facial recognition login, Subaru and Kia disable telematics in Massachusetts, the people allegedly behind the Bitfinex hack in 2016 are arrested, and Microsoft disables an install protocol handler being abused in the wild. For fun we have Valentine facts from around the world and a new polymer that's stronger and lighter than steel.
- 0:00 - Intro
- 11:06 - Just use login.gov
- 14:23 - Look MA, no Telematics
- 19:34 - Bitfinex Thieves
- 24:23 - MSIX Protocol Handler Disabled
- 30:42 - Fun Valentine Facts
- 36:09 - Novel Polymerization
Eric discovers much travel in his future, Jon shares Terrible News. The White House Website shares thoughts and provisions on government networks. Ransomware takes on the Oiltanking in Germany and Hospitals and Heath Care Facilities in the US. Eric looks between the couch cushions for money to send something into space and Jon attempts browser inception.
- 0:00 - Intro
- 13:21 - OMB Zero Trust
- 22:32 - Oiltanking Ransomwared
- 25:38 - Ransomware Internal Messages
- 31:57 - Send Stuff To Space
- 35:27 - webvm.io
Eric and Jon enjoy the (brief) respite from Oregon Winter Rain. Github enables second factor via push to mobile app, a 12 year old Linux privilege escalation, vulnerabilities in the Winter 2022 Olympics app, and remote controlling Tesla car functions via API keys. For fun a high schooler making circuits in his garage, and did you know McDonald's is a Real Estate company?
- 0:00 - Intro
- 14:02 - GitHub Push as 2nd Factor
- 19:47 - Linux Policy Kit Priv Esc
- 23:50 - Olympics App Vulnerabilities
- 29:36 - Teslamate
- 37:15 - Garage Chips
- 42:37 - McDonald's As Real Estate
Jon vaporizes some expensive bees, Eric creates an icon and is therefore serious. Cyber-Snow Days for Schools, Red Cross is hacked, Russia arrests some hackers and Ukraine has some PCs wiped. Eric's fun is Web3 and Jon's fun is new data on MS.
- 0:00 - Intro
- 9:56 - Out with snow days, in with cyber days
- 12:54 - Red Cross Hack
- 16:05 - REvil Arrests
- 20:27 - Ukraine PCs wiped
- 24:31 - web3isgoinggreat.com
- 28:42 - MS Discoveries
Eric returns from a wedding and Jon tidies up the apiary. A developer sabotages his own NPM packages, threat actors sending USB devices in disguise, and ransomware in the hardware. For fun, we have navigation by fish, public domain day 2022, and evidence of how lightning begins.
- 0:00 - Intro
- 16:23 - Dev Corruption
- 21:06 - USB in the mail
- 24:11 - iLOBleed
- 33:34 - Fish Drives Car
- 36:52 - Public Domain Day 2022
- 39:06 - How Lightning Begins
Happy New Year! Jon and Eric chat about cliché resolutions followed by log4j penalties. Eric softballs up a chrome note, a pixel 911 issue and an unlikely HomeKit crash. Jon talks about cryptocurrency contract bugs. Eric moves on to a serial brain and Jon drops a Cars reference while talking about tractors.
- 0:00 - Intro
- 9:52 - More Log4J Goodness
- 12:22 - Chrome Updates
- 14:00 - Pixel Updates
- 16:05 - HomeKit Crash
- 18:58 - Leon Spacewalker
- 27:24 - Your Brain
- 30:55 - Autonomous Tractors
Eric and Jon are enjoying a bit of downtime over the holiday; the JWST was launched successfully, and you might not realize "encouraged" meant "required" in China. More Log4J followup, Shutterfly hit with ransomware, phishing for stock info, and building automation systems attacked. For fun we have self replicating xenobots (what could go wrong?) and potential vaccines for addictive substances.
- 0:00 - Intro
- 1:10 - James Webb Launch
- 15:17 - "Encouraged"
- 17:22 - CISA Alert
- 21:28 - Shutterfly Ransomwared
- 26:37 - Phish to Market
- 30:39 - Building Automation System Hack
- 38:09 - Self Replicating Xenobots
- 41:32 - Opiod Vaccines
Holiday prep and Jon is easily distracted all episode without any help from Eric. Spiderman is seen in the theaters and Eric's height changes by a couple inches. Money is stolen for Bitcoins and IoT Honeypots distract Jon. IAM is still hard and Jon updates on the Log4j issue. Eric wonders how fast the universe is expanding and Jon talks about touching the sun.
- 0:00 - Intro
- 12:01 - Money for Bitcoins
- 14:55 - IoT Honeypots
- 23:04 - IAM is Hard
- 26:11 - Log4j Part 1
- 29:02 - Log4j Part 2 - Happy Holidays!
- 35:34 - Universe Expansion Rate?
- 40:39 - Touch the Sun?
Eric and Jon are ready for the Holidays. Apple releases an Android app (!!?), NPM expunges discord stealing packages, Log4Shell is the vulnerability of the week (year??), and reverse engineering NSO Groups zero click iMessage exploit. For fun we have the forgotten Heroines of Chaos, and linking increased rates of dementia to noise pollution.
- 0:00 - Intro
- 11:10 - Tracker Detect
- 13:51 - Discord Token Stealers
- 17:59 - Log4Shell Part 1
- 27:38 - Log4Shell Part 2
- 30:30 - NSO Zero Click Reversed
- 42:03 - Hidden Heroines of Chaos
- 47:04 - Dementia Linked to Noise
Eric sleeps, reads (and listens) to books and gets holiday'd up; Jon decorates with Star Trek ornaments. Eric talks about how Apple AirTags are marking cars to steal and Jon shares articles on government playing offense and defense in cybersecurity. Eric shares the story about a Graphing Calculator and Jon talks about seeing back in time to 50 million years after the Big Bang.
- 0:00 - Intro
- 10:24 - AirTags for Theft
- 15:43 - Offensive Cybersecurity
- 18:46 - Defensive Cybersecurity
- 23:42 - The Graphing Calculator
- 29:28 - James Webb Telescope
Eric has a traditional Thanksgiving, and Jon disappoints Eric with cold pizza. What exactly is Fake Honey? REvil associate found in Barnaul, should IT remain a separate business function, the Ubiquiti hack from an insider, HP releases a patch for wormable bug, and the internet truly is held together with (bee) spit and baling wire. For fun Eric visits Golden Spike National Park, and Jon shares what may be the cause of death by sleep deprivation.
- 0:00 - Intro
- 10:15 - Fake Honey?
- 11:32 - Netflix Show
- 15:32 - REvil Unmasked
- 17:50 - Get Rid Of IT?
- 19:28 - Ubiquiti Trusted Insider
- 26:05 - HP Wormable Printer Bug
- 29:53 - Spit and Baling Wire
- 39:09 - Golden Spike National Park
- 42:35 - Yelp Review Posters
- 45:52 - Sleep Deprivation Kills
Eric and Jon share thoughts on Wheel of Time, Dune and other media. Eric goes to grandma's house and Jon goes camping for Thanksgiving. A Zelle Scam, a GoDaddy WordPress breach and an NPM Flaw. Eric shares a little family history and Jon chats about Chainsaw (but not that kind of chainsaw). Then things get a little loopy while discussing Right Whales.
- 0:00 - Intro
- 13:14 - Zelle Scam
- 20:32 - GoDaddy Data Breach
- 24:41 - NPM Flaw
- 30:29 - The Peach City
- 34:15 - Chainsaw
- 37:33 - Right Whales
- 40:40 - Tahora Tracker
Concerts are back, and movies are good. Jon almost (?) breaks down and buys a car. An FBI site allows anyone to send an email from the FBI, the head of Instagram gets his account memorialized, and Emotet is back. Two things can be true: solar and vegetable farming. An amazing visual of the size of space, and editing audio and video by selecting and editing text.
- 0:00 - Intro
- 10:36 - Red Notice
- 19:32 - FBI Email Gateway
- 23:32 - In Memoriam
- 27:42 - Emotet is Back
- 32:38 - Solar Energy Vegetable Farming
- 36:13 - The Size of Space
- 39:42 - Edit audio and video by text
Jon drives a Ford and Eric is Jealous. Eric and Jon talk about ransomware reward money and a botnet. Eric goes and visits the only vertical street in North America and plugs his WiFi Check app. Jon wants to yeet stuff into space and butchers the french language discussing a really, really, really, really, really, really old company.
- 0:00 - Intro
- 10:16 - Ransomware Reward Money
- 13:49 - Meris Botnet
- 17:47 - Revil Ransomware
- 23:29 - Oregon City Municipal Elevator
- 27:37 - WiFi/Check
- 28:53 - Spinlaunch
- 35:07 - Bazacle
Eric fights water and Jon finishes his hay feeder. Eric watches Dune a second time while Jon holds to his principles. NSO added to export ban entity list, 2FA bots are on the rise, CISA releases a registry of known exploited vulnerabilities, and the Trojan Source vulnerability may or may not matter. For fun -- did you know DOS was still a thing? Listen to Disturbed's Sound of Silence, wireless electric car charging, and a detailed toxic map of the US.
- 0:00 - Intro
- 7:47 - Hay Feeder
- 12:22 - NSO on Entity List
- 17:04 - 2FA Bots
- 22:59 - CISA Registry
- 28:19 - Trojan Source
- 34:06 - Trojan Source Rebuttal
- 38:17 - LiveWired Followup
- 39:23 - Dune Screenplay Author
- 41:59 - The Sound Of Silence
- 43:56 - Wireless Car Charging
- 47:41 - ToxMap
Eric goes driving, Jon builds a feeder. 007 Spoilers. GPSd loses 1024 weeks. Docket enumerates Covid records. Email providers DDOS'd. Petrol Station Ransomware. Eric is happy to see Dune, Part Two greenlit and Jon shares a Chainsaw CNC video and fascinating details about Brains.
- 0:00 - Intro
- 15:43 - GPS -1024
- 19:51 - Docket COVID Security
- 25:26 - Email DDOS'd
- 28:37 - Petrol Ransomware
- 33:05 - Dune, Part Two
- 36:01 - Chainsaw CNC
- 39:12 - Amazing Brains
Eric and Jon go to the movies. Jon gets stung in the face. An open source tractor?!? Check your biometric logins, a phishing attack against Coinbase, more NPM package coinminers, and the largest Deepfake voice fraud yet. For "fun" we have micro plastics, Cloud Cuckoo Land, and dinosaur shrimp.
- 0:00 - Intro
- 10:11 - Jon's Eye
- 13:21 - Open Source Tractor
- 15:22 - Check Biometrics
- 17:35 - Coinbase Phishing
- 25:41 - Malicious NPM Packages
- 28:07 - Deepfake Voice Fraud
- 28:42 - Episode 91 Link
- 33:45 - Micro Plastics
- 38:04 - Cloud Cuckoo Land
- 41:45 - Triops Emerge
People actually still got their news despite the Facebook downtime and there's still something funny about a shaved alpaca. Eric talks about web site hacking and Jon shares his thoughts on SMS spam from hacked routers. Eric finds a couple planets and Jon find a math problem.
- 0:00 - Intro
- 11:00 - What to do with Facebook down
- 12:03 - NSA's ALPACA recommendations
- 15:12 - Missouri takes on "hacking"
- 20:08 - Routers that do SMS go boom
- 25:16 - Space!
- 27:40 - Math!
Eric's furnace is fixed, and Jon ekes forward the x-carve project. Quite the "quiet" week this week. The GriftHorse pun was right there, Twitch is doxed, Facebook blows their 9's, and Apple and Visa do not agree. For fun, images of a Mercury flyby, life advice from nerds, and defunct hyper compound eyes.
- 0:00 - Intro
- 14:48 - GriftHorse
- 20:02 - Twitch Dox
- 23:22 - Facebook Outage
- 34:30 - Apple Pay Visa Vuln
- 39:28 - Mercury Flyby
- 42:11 - Life Advice
- 47:20 - Hyper Compound Eyes
Eric is lazy and gets really cold, Jon fixes his CNC and gets his roof done. Tracking autodiscover websites, following bots that steal 2FA, scouting masked emails and chasing zero-day details. Eric ❤️ Van Gogh, Jon ❤️ justified text.
- 0:00 - Intro
- 15:36 - Autodiscover Followup
- 17:49 - Telegram Bots Stealing OTP
- 20:55 - 1Password+Fastmail=Private Emails
- 23:24 - Record Zero-day Hacks
- 28:31 - Van Gogh Art
- 31:46 - Super Metroid, Justified
(Anything but surprising ...). Eric and Jon are both excited about the rain, for different reasons. And a lot of "Security Bites (or Bytes)" tonight. A lock screen bypass, how to go passwordless, Facebook being evil in multiple ways, and an Autodiscover credential leak. For fun we have converting light to matter and a very hopeful look at the cost (or incredible, potential lack thereof) of a rapid transition to renewable energy. And a couple of book references along the way.
- 0:00 - Intro
- 11:59 - iPhone Lock Screen Bypass
- 14:03 - Passwordless Microsoft
- 17:07 - Facebook Blocking Watchdogs
- 20:33 - Project Amplify
- 21:36 - Autodiscover Leak
- 30:50 - Light to Matter
- 34:08 - Project Hail Mary
- 35:15 - The Man Who Solved The Market
- 38:19 - Oxford Study
Jon remembers he's no longer 25. Eric cleaned and went to a movie. Microsoft followup, a Walgreens Website Whoops and of course you would call a cyberweapon "Karma". Eric's fun is all space and Jon's fun is waiting for him to be able to come out and play.
- 0:00 - Intro
- 10:58 - CVE-2021-40444 Follow Up
- 16:37 - Covid Test Website Whoops
- 22:47 - Karma
- 28:04 - Inspiration 4
- 30:37 - LCRT
- 31:36 - DuAxel Robots
- 32:52 - X-Carve
Jon does plumbing and tail light repair, and Eric has a culinary weekend. Jailbreak detection evasion, spooky side channel of chrome, and two zero days, one in Microsoft and one in Zoho. For fun, the Perseverance rover has attained a core, an Asian Giant Hornet nest eradicated in Washington, and the "mythology of Bee Keeping" starring Jason Statham (??!?).
- 0:00 - Intro
- 14:37 - Jailbreak Detection Evasion
- 17:59 - Spoooook(y)
- 22:19 - MSHTML Zero Day
- 28:38 - Zoho Server Zero Day
- 33:06 - Perseverence Core (Dump)
- 35:59 - AGH Nest Discovered
- 40:50 - The Beekeeper
Eric does some electrical work, Jon chats with a police officer about his car. More Cryptocurrency is (are?) stolen. Apple has a double agent and can give you a digital driver's license. Azure has a bug and some more NSO iPhone hackery discussed. Eric finally knows what happened to the Red Delicious apples and Jon is looking forward to details from Venus.
- 0:00 - Intro
- 14:07 - More Cryptocurrency Theft
- 16:48 - Apple's Double Agent
- 20:23 - Apple Wallet Driver's License
- 26:45 - Azure Cloud Bug
- 36:35 - iPhone Exploits
- 45:25 - Red (not) Delicious Apples
- 49:39 - Going to Venus...
Eric returns home, and Jon goes Fishing. Why you should keep home and work on different computers, a man tracks down his digital (bitcoin) muggers, a local privilege escalation in a Razer installer, and a location vulnerability in the Bumble app. For fun we have nuclear batteries and how to roll your own handwriting recognition machine learning model.
- 0:00 - Intro
- 10:26 - Church and State
- 15:01 - Digitally Mugged
- 19:34 - Razer Local Privilege Escalatiom
- 26:01 - Bumble Vulnerability
- 32:37 - Nuclear Battery
- 38:35 - Handwriting Recognition Example
Eric drinks New Coke Zero. Jon gets less honey than he had hoped. Collisions in Apple's CSAM, a T-Mobile breach, a Covid testing site breach and Blackberry QNX bugs. Eric aspires to visit Machu Picchu now that he knows how old it really is and Jon talks about really hot tiny things and woolly mammoth travel tracking.
- 0:00 - Intro
- 14:36 - Apple CSAM collision
- 20:06 - T-Mobile breach
- 24:34 - Covid testing site breach
- 29:47 - Blackberry QNX Bugs
- 36:46 - Machu Picchu
- 40:02 - National Ignition Facility
- 43:42 - Mammoth Travels
Eric has mixed followup, and Jon finishes the Yurt; Scamming the wannabe scammers, AI authored phishing, and Poly Network Hacked and some crypto returned. A bit about the Apple CSAM detection features. A newly realized carnivorous plant, and a climate change serenity prayer.
- 0:00 - Intro
- 13:57 - Honor (?) Among Thieves
- 17:07 - Let the AI Phish
- 20:56 - Poly Network Hack
- 26:26 - Crypto Returns
- 29:26 - CSAM Take 1
- 35:50 - CSAM Take 2
- 43:20 - Carnivory
- 47:25 - Pinboard's Opinion
Hijinks all around in this episode. Eric fails to injure himself playing softball this week and Jon explains what 20/20 means? Jon expounds on the audio book value proposition while Eric fails to understand (again). A phone was lost, stay tuned next week for the result! A bit of Solarwinds followup, a capsule hotel IoT party, a sportsball video game gambit, and an accelerometer intrigue. Eric empathizes with the Silver Medalists and swoons over David Attenborough (again) while Jon talks up Time Crystals.
- 0:00 - Intro Hijinks
- 12:41 - Solarwinds Followup Hijinks
- 16:00 - Capsule Hotel Hijinks
- 21:02 - FIFA 21 Theft Hijinks
- 28:35 - Accelerometer Hijinks
- 34:30 - Olympic Medal Hijinks
- 37:41 - Pandemic Hijinks
- 41:13 - Time Crystal Hijinks
Eric wounds his face and Jon builds a Yurt Base. Keep your devices updated -- more active exploitation. FTC warns of potential crackdowns and fallout from data abuses, location data is not anonymous, and the White House releases a memo regarding cybersecurity for critical infrastructure control systems. For fun we have Project Hail Mary by Andy Weir, and a Google AI blog about movie-style image enhancement.
- 0:00 - Intro
- 12:38 - Update Your Apple (and other) Things
- 14:09 - FTC Crackdown Warning
- 18:56 - Location Fingerprint
- 27:46 - Cybersecurity for Critical Infrastructure
- 33:39 - Project Hail Mary
- 37:11 - Super-Resolution via Repeated Refinements
Eric's back from camping and Jon disassembles a yurt. Instagram introduces a Security Checkup and Wired outlines an ATM NFC Hack. Millions of printers have bugs and Jon waxes philosophical on security. Eric discovers a new poetry and Jon recommends a book by Trevor Noah.
- 0:00 - Intro
- 10:18 - Instagram Security
- 13:23 - ATM NFC Hack
- 17:24 - Printer Bugs
- 20:27 - Security Nihilism
- 28:32 - Source Code Poetry
- 31:43 - Born a Crime
Eric's still on vacation, and Jon goes Fishing. Coke Zero is getting a flavor [up|down]grade, and the Kaseya exploit details revealed. Google supports authenticated images in gmail, a glimmer of Net Neutrality, and inside the W3C's Privacy War. For fun we have River Runner and an awesome thread about the Appalachian mountains.
- 0:00 - Intro
- 9:14 - Coke Zero Flavor Change
- 10:52 - Kaseya Followup
- 17:15 - Google Supports BIMI
- 21:17 - Internet as Utility
- 25:06 - W3C Privacy War
- 34:58 - River Runner
- 37:14 - Geological Fun
Eric is on vacation and Jon goes to the beach. Some Android apps steal Facebook credentials and a law firm gets an injunction against ransomware criminals. Kaseya is busy and Kaspersky fixes a password manager. Goomics hits close to home and Jon chats about James Barry and Solar Panels over Canals.
- 0:00 - Intro
- 9:22 - Facebook stealing Android apps
- 12:24 - Legal Injunction
- 14:17 - Kaseya
- 20:45 - Password Manager Ooops
- 30:40 - goomics.net
- 33:22 - James Barry
- 37:49 - Solar Panel'd Canals
Eric and Jon both survived the PDX Heat Dome; followup for Microsoft signed malicious drivers, data about elder fraud, LinkedIn breach exposes 700M records, and the Western Digital drive compromise. For fun we have your Birth Day #1 song (or movie, etc), International Asteroid Day, and the first results from a medical trial using systemic application of CRISPR gene editing.
- 0:00 - Intro
- 11:04 - Malicious MSFT Signed Drivers
- 17:30 - Preventing Elder Fraud
- 23:13 - 700M LinkedIn Records
- 28:44 - MyBook Live Compromise
- 35:01 - Birth Day #1 Song
- 38:14 - International Asteroid Day
- 39:51 - Systemic CRISPR
It's gonna be hot next week. Eric grills on Father's Day and finishes a project. Jon watches a movie for Father's Day. Eric has his credit card number stolen (again!) and chats about Call Center Malware. Jon talks D3FEND and signed rootkits. Eric shares the origins of the Strawberry Moon and Jon speaks to really tall rhinos and disruptive dark fish.
- 0:00 - Intro
- 17:07 - Call Center Malware
- 23:48 - D3FEND
- 28:01 - Signed Rootkits
- 34:13 - Strawberry Moon
- 38:10 - Rhino Fossils
- 40:17 - Dark Fish
Eric has a wet graduation (and grills!) and Jon does more bee whatevers. Another dead Asian Giant Hornet found in Washington. Topics include McAfee demoing a vuln in Peloton, paying Ransomware more than once, and a significant Business Email Compromise found by Microsoft. For fun you can chat with an AI, or have a read about how to improve scientific research funding in the US. Also, go watch Loki.
- 0:00 - Intro
- 15:55 - Dead Asian Giant Hornet Found
- 19:54 - Mcafee + Peloton
- 23:54 - Ransomware Stats
- 26:56 - Business Email Compromise
- 36:26 - Thought Screen
- 39:52 - Fast Grants
It's been a long week and the hosts are tired. Some follow up happened. You can mine crypto with your antivirus software apparently. The FBI runs a legit illegit company. Fastly breaks the internet and you should watch out for an Alpaca on the Attack. Eric dives into Urban Spacial Order and Bird Anting while Jon considers a Stolen Ring from long ago and floats an article you should read above tax avoidance.
- 0:00 - Intro
- 12:07 - Followup
- 13:10 - Norton 360 Crypto Mining
- 15:56 - FBI, dba Anom
- 19:51 - Fastly Outage
- 26:46 - Alpaca Attack
- 28:36 - There's something funny about a shaved alpaca
- 37:25 - Urban Spatial Order
- 41:32 - Anting
- 43:51 - A Stolen Ring
- 48:07 - Avoiding Taxes
Jon returns from camping and Eric grills and is grilled. How to spot malicious extensions using reviews, Android's new privacy options, the Arizona suit against Google for potential privacy violations, and a "cloud first" botnet. For fun we have Ingenuity's latest (anomalous) flight, jumping from a plane without a parachute, and how to play Pinochle.
- 0:00 - Intro
- 14:16 - Dangerous Extensions
- 20:03 - Android 12 Privacy Options
- 24:18 - Google's Privacy Suit
- 31:46 - Kubernetes Botnet
- 36:30 - Ingenuity Anomaly
- 41:35 - No Parachute
- 44:28 - Pinochle
More water problems for Eric. Jon makes cheese. Apple admits it has a problem and Jon provides an example - then talks about the RSA Hack Ten Year Reunion show! Eric finds Crypto, COBOL and Taxes somewhat funny and Jon follows the trail that defined "Aerosol".
- 0:00 - Intro
- 7:08 - Apple has Malware!
- 11:41 - XCSSET Malware
- 17:32 - The RSA Hack, 10 years later
- 26:09 - Crypto, COBOL, and Taxes
- 30:08 - Define "Aerosol"
Eric tries his hand at brisket, and Jon has a cow (literally). A cool IMSI-catcher project, four android zero days, and a way to use Apple's Find My network to send arbitrary data. For fun we have "Dangit, Git!", China's mars rover landing, and the Soviet Venera program focused on Venus.
- 0:00 - Intro
- 14:47 - SeaGlass
- 22:44 - Android Zero Days
- 25:22 - Send My
- 32:46 - OpenHaystack
- 35:42 - Dangit, Git!?!
- 39:32 - China Lands On Mars
- 41:25 - Soviet Venera Program
Jon watches fencing this time, Eric tries out the new grill. Ransomware hits a pipeline and people bag gasoline. Eric figures SSH+YubiKeys is one more step toward a passwordless future. Jon chats up the Frag Attack and Eric likes the logo. A mobile chip bug has a massive footprint. Eric's curiosity is piqued on microreactors and Jon thinks about training some covid detecting bees.
- 0:00 - Intro
- 12:20 - Pipeline Ransomware
- 20:25 - GitHub, SSH and YubiKeys
- 24:28 - Frag Attack
- 31:57 - Mobile Chip Bug
- 36:47 - Nuclear Microreactor
- 41:35 - Covid Trained Bees
Eric is civic-y and ready to BBQ. Jon does more Bee stuff. Space news is good, Signal is rocking it, Anti-vaxxers + Q(R) codes, Google talks about bad apps and developers, and a(nother?) gatekeeper bypass. For fun we have namedrop.io, an immunity tracker dashboard, and did you know there was an annual Planetary Defense Conference?
- 0:00 - Intro
- 17:09 - Landing Nominal
- 19:28 - Ingenuity's 4th Flight
- 20:11 - C-17 Droppings
- 21:03 - Signal's Instagram Ads
- 25:30 - Anti-Vaxx QR
- 28:35 - Bad Apps and Developers
- 32:50 - Gatekeeper Bypass
- 41:24 - Name Drop
- 44:37 - Immunity Level
- 49:37 - Planetary Defense Conference
Eric and Jon "discuss" cooking with fire. Jon buys an oboe. Eric reminisces about a childhood home now in the news while Jon offers Captain Fantastic. Google Argentina sighs "Whoops!" and a Ransomware Gang yells "Stonks!" Jon drops RotaJakiro and CIA Malware. Eric shares thoughts about left-handed booksellers while Jon watches Ted Lasso and admires this year's crop of cicadas. Finally, if you have the means, please donate to help India out.
- 0:00 - Intro
- 9:51 - Hualapai Mountains
- 11:02 - Captain Fantastic
- 15:31 - google.com.ar goes where?
- 17:37 - Ransomware Gang Stonks
- 20:17 - RotaJakiro
- 23:30 - CIA Malware
- 27:33 - The Left-Handed Booksellers of London
- 32:08 - Ted Lasso
- 33:10 - Cicada 2021
- 36:07 - Covid & India
Eric uses Actual Fire while Jon uses Fake Fire, evidently. There will be posts. Vulnerable Energy Production seeks Cybersecurity Defense Solutions. Devices in the UK will need to display how long they'll get security updates (including phones). More supply chain attacks, and the hacked hacks back. Ingenuity has its test flight, Windows embraces Linux GUI apps, and a Cold War to monitor McDonald's ice cream machines.
- 0:00 - Intro
- 17:10 - Electricity Operations
- 21:14 - Security Updates Provided
- 25:09 - Mo' Supply Chain
- 30:06 - Signal's Signal
- 39:01 - Ingenuity Flies
- 40:49 - X + Windows
- 44:22 - Cold War
Eric paints a nebula, Jon weighs some bees. Notes about Contact Form Malware and more Exchange webshells. Eric likes Bloom Filters and Jon likes Nuclear Fusion with a side of Kiss the Ground.
- 0:00 - Intro
- 14:32 - Contact Form Malware
- 22:25 - FBI & Web Shells
- 27:14 - CISA Note
- 31:51 - Bloom Filters
- 33:49 - Nuclear Fusion
- 40:35 - Kiss the Ground
[Had to use backup audio for part of this, sorry!] It's spring -- that means sprinklers and dandelions. Jon talks way too much about bees. More about LoRa, how people are mining on GitHub's dime, the Oracle v. Google suit is ruled, Microsoft is building Java now, and ransomware at the vehicle inspection stations. For fun we have mutant rabbits and hints of a potential new particle. Or not, if you believe the computer folks.
- 0:00 - Introduction
- 15:19 - LoRa Part II
- 17:01 - Mining on GitHub
- 26:43 - It Is So Ordered
- 29:47 - Microsoft Builds Java
- 35:00 - Inspection Outage
- 39:16 - Mutant Rabbits
- 42:34 - Fainting Goats
- 44:25 - Fermilab Muons
"Bees use Tools?" Jon wonders. "I'm tired of driving." Eric muses. LoRa attacks outlined and the Mystery of the Eagles is solved. Apple patches, PHP Hacks and Ubiquity Oopsies, oh my! Classic video game inception and there's something alien at the core of the Earth.
- 0:00 - Intro
- 6:38 - Bees with Tools?
- 16:35 - LoRaWAN Attacks
- 22:27 - Eagle Mystery Solved!
- 24:42 - Another Apple Patch
- 28:08 - PHP Hack
- 33:17 - Ubiquity Oops
- 41:03 - Doom Snake
- 43:32 - Alien World at the Earth's Core
- 47:22 - Seveneves
Eric's on another road trip, and Jon's just back from camping (and plumbing). Exchange followup with 'indiscriminate' deployment of Black Kingdom ransomware, Hobby Lobby's exposed S3 bucket, Revenge Plot has real world consequences, more zero days used by an advanced group, and a walk through a TikTok RCE. For fun we have Space Probes, a Container Shortage, and no shortage of (bald) eagles.
- 0:00 - Intro
- 10:59 - Black Kingdom
- 12:45 - Hobby Lobby Exposed
- 14:04 - Revenge Plot
- 17:57 - "Expert" Hackers
- 23:04 - TikTok Android RCE
- 30:32 - Space Probes
- 34:02 - Container Shortage
- 39:51 - Eagles!
Jon is swimming in eggs and Eric is learning German. CryptoKitties are back in the form of NFTs and SMS hijacking just got easier. Using unregistered domain names in your code isn't awesome and more SolarWinds/Exchange disclosures. Eric watches a show in German while Jon discovers a Greek Computer.
- 0:00 - Intro
- 10:47 - Not Nifty NFTs
- 16:02 - Easy SIM Hijacking
- 20:59 - Default Values go Ooops
- 27:40 - Mimecast Incident Report
- 35:10 - Hackerville
- 39:10 - Pi Day (or Tau Day?)
- 41:53 - Antikythera
Jon fertilizes and Eric's got (more) water problems. The Exchange zero day has been seriously exploited. A vulnerability in a WiFi mouse app, a novel bitsquatting technique, and a new WebKit remote code execution. For fun you can get a job in Remote, Oregon, watch an amazing drone-in-a-bowling-alley video, and learn just what IS inside a proton?
- 0:00 - Intro
- 17:26 - Hafnium Timeline
- 24:26 - Krebs 30k Article
- 26:18 - WiFi Mouse
- 29:12 - Squatting Bits
- 33:55 - WebKit RCE
- 38:11 - Remote, Oregon
- 41:08 - Bowling for Drones
- 42:31 - What's In A Proton
Eric finds a drone and stinky garbage. Jon orders pizza and builds garden beds. Logos, Space and Spectre followup. People can't get into their cars without keys and Exchange can't deliver mail without a 0 day. SpaceX SN10 lands upright-ish until it doesn't and Eric suggests Talking to Strangers. Jon notes a cat identifier and SPACE HURRICANES.
- 0:00 - Intro
- 16:44 - Logos!
- 19:39 - Arecibo Cleanup
- 20:38 - Meet Nasa Flight Director: Diana Trujillo
- 22:23 - Weaponized Spectre
- 25:08 - Key Fob Failures
- 30:36 - Exchange 0-day
- 35:58 - Microsoft Note
- 38:06 - SN10 Goes Boom
- 41:02 - Talking to Strangers
- 44:34 - Cat Detector
- 47:40 - Space Hurricane
Jon talks too much bees (and hornets) and Eric plans deck changes and lockpicking. For followup the Nursery Cam "loophole" is disclosed and the Jamaica story gets worse. California DMV users exposed in data breach, a Washington State audit of unemployment fraud results in a huge breach, and Apple releases their platform security guide. For fun we have the Perseverance parachute message, hope for net neutrality, and accurate magnetic reversal calculations thanks to well preserved trees in New Zealand.
- 0:00 - Intro
- 1:34 - Bee Talk
- 10:22 - Lockpick Kickstarter
- 14:23 - Nursery Cam "Loophole"
- 16:24 - Jamaica One More Thing
- 18:50 - California DMV
- 23:33 - Audit Oops
- 28:03 - Apple Security Guide
- 32:28 - Perseverence Parachute
- 38:32 - Net New-trality
- 41:43 - Adams Event
Enjoying the cold... No snow day, but a "No Power Day". Space Helicopters, Nursery Cam Oopsies, Super Cookies, Jamaican Exposure and French Cyber Things. Eric shares a FIDO2 Kickstarter note and Jon reminisces about the origins of the Mozilla logo and Eric sneaks in a plug for folklore.org.
- 0:00 - Intro
- 11:27 - Space Helicopters
- 14:28 - Nursery Cam Oopsies
- 17:16 - Super Cookies
- 20:44 - Jamaican Exposure
- 23:53 - French Cyber Things
- 29:29 - Solo v2 FIDO2 Key
- 32:33 - Mozilla Logo
- 38:06 - Apple Folklore
Eric's latest app (Hash/Check) is officially released. Super Bowl was mostly watched and Jon can't gauge time. CISA releases malware analysis for Teardrop, a nifty bit of dependency research, cops playing music to take down live streams, Microsoft's TCP/IP patches, and a wordpress plugin vulnerability. For fun Eric brings a movie and short-shorts, and Jon brings the smallest known reptile and a prelude of next week's landing on Mars.
- 0:00 - Intro
- 4:07 - Hash/check
- 11:20 - CISA Teardrop MAR
- 12:32 - Dependency Confusion
- 18:35 - Dependency Confusion Pt. 2
- 20:52 - Beverly Hills Cops
- 25:11 - Microsoft TCP/IP Patches
- 28:26 - NextGen Gallery
- 32:02 - Along with the Gods: The Two Worlds
- 35:18 - Pixar Popcorn
- 37:05 - Nano Chameleon
- 39:32 - Perseverance Landing
Eric whines about 3D printing tools. John puts bees in his fridge and gets graded on his pruning skills. Eric then whines about Big Sur and TouchID issues. Jon mentions a few notes on SUPERNOVA, sudo on macOS and AIX (of all things) and iCloud Passwords beyond Safari. Eric fails to whine about how iOS 14 Messages work under the covers and Jon does math on Zero Day Patch Success. Eric shifts to fawning over Bletchley Park and Jon introduces you to Lynn Conway.
- 0:00 - Pre Intro
- 0:11 - Intro
- 15:02 - Big Sur and TouchID
- 18:41 - CISA SUPERNOVA Notes
- 19:52 - Sudo Bug on macOS & AIX
- 23:14 - iCloud Passwords for Chrome
- 24:30 - iOS 14 Messages
- 28:32 - 25% of Zero Day Patches Failed
- 34:01 - Bletchley Park Online
- 37:23 - Lynn Conway
Eric fixes his leaky faucet and gains an electrical problem, Jon "repairs" his Jetta. New Crypto-miner for QNAP, more iOS zero days, a decade old Sudo vulnerability, and an international Emotet takedown. For fun we have a password shanty, a cookie monster rock, seesaws at the border, and the whole GameStop situation. Oh, and bonus: Eric's written an app!
- 0:00 - Intro
- 8:37 - Jetta P2015 Fix
- 14:22 - QNAP Crypto-miner
- 16:17 - More iOS Zero Days
- 20:12 - Stackoverflow Redux
- 24:47 - Sudo Elevation
- 31:39 - Emotet Takedown
- 36:05 - Password Shanty
- 37:00 - Cookie Monster Rock
- 38:00 - Border Seesaws
- 39:33 - Outsider Trading
- 49:16 - Hash/Check
Eric's got another side project and Jon has a cow. A little Sunburst followup, a few Chrome 88 notes and DNSpooq has a logo. Oregon State discovers the first new Blue in 200 years and Dire Wolf DNA derived from planes, trains and automobiles. Finally, go watch Amanda Gorman. Really.
- 0:00 - Intro
- 15:31 - Sunburst Followup
- 19:55 - Chrome 88
- 25:20 - DNSpooq
- 37:00 - New Blue
- 40:57 - Dire Wolf DNA
- 44:14 - Amanda Gorman
Jon and Eric are both frustrated by water issues; Jon loses two bee colonies. Hope on the right-to-repair front from Europe, a side channel attack on hardware security keys, and evaluation of the Sunspot implant. For fun we have a Neal Stephenson novel 'Zodiac' and info about the James Webb Space Telescope that should launch in 2021.
- 0:00 - Intro
- 3:41 - Dead Bees
- 10:56 - Right To Repair
- 17:54 - Side channel on Security Keys
- 22:40 - Sunspot
- 30:41 - Zodiac
- 36:43 - James Webb Space Telescope
Eric gets new windows and watches a movie. Jon watches a show, fences some things and continues his flood watch. A look back 3 years at Spectre/Meltdown, Nissan leaks some code, Zyxel has backdoors and finally, SMB for your Browser! Jon pitches project pyodide and Eric mentions five axis printing and floating point video gaming.
- 0:00 - Ortni
- 11:01 - Spectre/Meltdown 3 years later
- 15:57 - Nissan Source Code Leak
- 21:05 - Zyxel Backdoor
- 25:01 - Web Assembly SMB
- 27:38 - Project Pyodide
- 30:35 - The Browser Will Be the OS
- 30:49 - Pitch and Yaw Printing?
- 34:10 - Floating Point Leviathan
Final episode of 2020. Eric and Jon talk holidays. Solarwind actors potentially using resellers as intrusion vector into cloud accounts. Physical security keys, ransomware against plastic surgeons, and taking down three bulletproof VPN providers. For fun we have dancing robots and an Alaskan Native rights activist.
- 0:00 - Intro
- 16:13 - Credential Abuse
- 22:21 - Physical Security Keys
- 27:02 - Plastic Surgery Dox
- 30:46 - VPN Takedown
- 34:19 - Do you Love me?
- 36:41 - Elizabeth Peratrovich
Eric complains about Apple and Jon chimes in. More SolarWinds and Sunburst notes. Farmers get their own Cybersecurity talking to and Journalist Phone Security is discussed. Happy Virtual Holidays, all! If you like choral music, check out the Oregon Chorale. Jon mentions the Great Conjunction and Science Events to watch for in 2021.
- 0:00 - Intro
- 15:03 - More SolarWinds
- 17:38 - More Sunburst
- 20:43 - Cybersecurity for Farmers
- 25:33 - Journalist Phone Security
- 38:01 - Happy Virtual Holidays
- 40:53 - Oregon Chorale
- 42:00 - The Great Conjunction
- 44:29 - Science Events to Watch in 2021
Eric drives slow and safe, Jon is late for Christmas. CRISPR for sickle cell looks amazingly promising. A Trillion Dollar problem, exfil data by turning your memory into a wifi card, and the Big Hack. Solarwinds supply chain attack disclosed and fallout continues. For fun we have a grazing goat math problem, listening to a whale heart, and macroeconomics for sovereign nations.
- 0:00 - Intro
- 4:17 - In Colbert We Trust
- 11:01 - CRISPR Follow Up
- 14:05 - Hidden Costs of Cybercrime
- 15:16 - AIR-FI
- 20:03 - Solarwinds Supply Chain
- 25:12 - Fireeye Sunburst
- 26:45 - Sneaky Injection
- 32:28 - Grazing Goats
- 36:13 - Whale Heart
- 39:05 - Spend then Tax
Tangents galore in the intro. Drone footage of Arecibo collapse. The Death of Flash (for realsies this time). The Next Apple Chips (already?) and some Public Transportation Ransomware, eh. Can you say "Socially Steganographic" with a straight face? Finish up with a glass of Quine Tweet and a stien of Kaggle Survey.
- 0:00 - Intro
- 17:04 - Arecibo collapse
- 17:56 - Flash EOL
- 19:10 - Next Apple Chips
- 21:40 - Public Transportation Ransomware
- 23:10 - The Ransom Note
- 25:07 - FireEye
- 29:49 - Socially Steganographic
- 36:02 - Quine Tweet
- 38:54 - Kaggle Survey
Post Thanksgiving Link Extravaganza. Donate to Wikipedia! Monolith, LoRa (sidewalk??), and iOS followup; Ransomware Days instead of snow days, M1 shines with Windows and Tensorflow, and AWS announces a Mac service. And an enormous iOS radio proximity zero click attack. For fun the Star Wars scroll creator, the Arecibo collapse (not fun), ice age paintings in Columbia, and Human Nature on Netflix.
- 0:00 - Intro
- 11:27 - Monolith Follow Up
- 12:44 - Donate To Wikipedia
- 14:06 - Sidewalk and LoRa
- 16:59 - iOS Zero Day
- 20:01 - Ransomware Days
- 23:52 - Windows on M1
- 24:48 - Tensorflow on M1
- 26:31 - Amazon EC2 Macs
- 28:06 - iOS Proximity Zero Click
- 45:08 - Star Wars Scroll Creator
- 47:58 - Arecibo Collapse
- 50:56 - Chapel of the Ancients
- 53:53 - Human Nature
Jon and Eric talk about a book and forget to mention the name (Rhythm of War, btw). Running Office on Apple Silicon times 3. More Ragnar Locker followup just so we can say Ragnarlok again. cPanel 2FA oops and a MobileIron RCE (along with a Password Manager Detour). Finally, booting from vinyl, a mysterious obelisk in the middle of Southern Utah, and a look at Bees and LoRa.
- 0:00 - Intro
- 7:02 - The book!
- 16:13 - Office on the Apple M1 x3
- 19:37 - Ragnarlok followup
- 21:41 - cPanel 2FA oops
- 25:53 - Password Manager Detour
- 28:50 - MobileIron RCE
- 35:26 - Booting From A Vinyl Record
- 38:53 - Utah Monolith
- 41:25 - LoRa and Bees
Covid continues, "winter" has arrived; MA passes right to repair law, how to turn off web site notifications, Microsoft announces their security co-processor, and Cisco fixes the ghost(s) in the machines. For fun we have the M1, how to install any iPhone/iPad app, Bill Gates and Rashida Jones' new podcast, and Mars' water loss.
- 0:00 - Intro
- 6:58 - Loss Of Bee Tree
- 15:44 - Right To Repair Initiative
- 20:32 - Web Site Notifications (Just ... don't)
- 24:28 - Pluton Processor
- 30:17 - Webex Ghosts
- 40:35 - M1
- 46:04 - Install any iPhone App
- 51:55 - Bill Gates and Rashida Jones Ask Big Questions
- 53:45 - Water On Mars
Eric doesn't hike Mt St Helens, instead finds mold growing in the bathroom. Jon goes to the coast and puts a wifi switch in his shop. Honest Criminals, Play Store "Malware", Liquor Ransomware, and 3 little iOS 0days. Eric throws a Jeopardy tribute and Jon does XSS and bioconductive ink.
- 0:00 - Intro
- 12:25 - Mt St Helens Hike 2020
- 13:28 - Honest Criminals
- 15:39 - Play Store "Malware"
- 27:05 - Liquor Ransomware
- 31:42 - iOS 0days
- 35:48 - Jeopardy!
- 38:51 - COVID Vaccine?
- 40:46 - XSS Company Name
- 43:17 - Bioconductive Ink
Eric has a covid scare (and cake!). Jon preps garden for next year. Zerologon and (not much) hospital followup, DoJ seizes domains, and Mattel discloses ransomware attack in SEC filing. REvil interview allegedly describes internals of ransomware as a service. For fun, we have What the Golf?, reconnecting with distant friends, and training a magpie to exchange bottle caps for peanuts.
- 0:00 - Intro
- 7:27 - Garden Beds
- 14:10 - Zerologon Followup
- 14:51 - No News is Good News
- 16:55 - Domain Seizure
- 20:02 - Mattel Ransomware Attack
- 22:59 - REvil Interview
- 30:11 - What the Golf?
- 35:31 - Voyager 2 Re-contact
- 39:07 - Peanuts for Bottle Caps
- 41:14 - Mark Rober Squirrel Course
Jon does yard work, Eric muses about holiday light displays. Mutant Bacterial Enzyme followup and Election Phishing (is the election over yet)? Details on potential ransomware attacks on US Health Care infrastructure. Eric chats about a very expensive rock and faster than light travel, Jon mentions murder hornets and fills us in on Lise Meitner.
- 0:00 - Intro
- 11:27 - Mutant Bacterial Enzyme
- 15:36 - Election Phishing
- 20:12 - Health Care Ransomware
- 21:41 - Krebs On Ransomware
- 24:44 - CISA Ransomare Publication
- 28:55 - Psyche the Asteroid
- 31:20 - Faster than Light Travel
- 36:09 - Murder Hornets
- 40:08 - Who is Lise Meitner?
Everyone go Vote! Winter (rain) is coming to Oregon, gotta get those chores done. Venice dodges the flood again, and Dickeys is breached. Chrome has a zero day, Google kills Nest Secure (and many other products), and phishing and exfiltration using legit services. For fun, did we mention you should vote? Also an uncrushable beetle and an Asteroid Smack Down.
- 0:00 - Intro
- 4:59 - Chainsawing
- 8:15 - Oregon Vote By Mail
- 14:18 - Venice, Again
- 15:19 - Dickeys
- 16:42 - Chrome Zero Day
- 20:06 - Nest Secure No More
- 23:17 - Products Killed By Google
- 26:27 - Phishing With Native Services
- 31:38 - Vote, please!
- 35:16 - Uncrushable
- 39:29 - Asteroid Pickup
Some Covid Phishing and Microsoft takes TrickBot to court. McAfee releases details on an Azure bug bounty and donates the proceeds to charity. Eric votes for David Attenborough and Jon votes for Generative Adversarial Network Art. #VOTE
- 0:00 - Intro
- 12:19 - Venice - 24 hours later
- 13:43 - FinFisher Raid
- 15:42 - Phishing the President's Covid
- 18:47 - Microsoft v TrickBot
- 22:40 - Prisoner of Azure-kaban
- 33:06 - Donating to Charity
- 33:32 - David Attenborough
- 37:39 - GANksy
Jon Paints and Eric Hikes. Calories anyone? Typosquatting followup, zerologon is multiplatform, and who doesn't like SPACE! Four! Point! Oh! Please Vote, and were you aware IAM is difficult? For fun we have Venice barriers, punk Astley, Twinkie Fungi, Nobel Prizes, and gene splicing. Please leave us a review!
- 0:00 - Intro
- 1:39 - Painting
- 6:15 - Elk Mountain
- 13:37 - Olive Garden
- 16:14 - Typosquatting Packages
- 19:37 - Something Phishy
- 19:52 - Samba Zerologon
- 23:31 - Space 4.0 (part 1)
- 27:25 - Space 4.0 (part 2)
- 30:54 - VOTE!
- 32:43 - Enter the Vault
- 45:48 - Venice Barriers
- 49:39 - Punk Astley
- 50:31 - Twinkies Are(n't) Forever
- 52:40 - Nobel Prizes
- 55:43 - Bring Me A Gene
- 57:51 - Link To Review
Jon patches his QNAP, Eric follows coffee maker firmware shenanigans. There's a 9-1-1 outage and a deconstructed Mac Spyware app. Ring makes a camera drone to fly around the inside of your house and Civilization is on the Subscription Bandwagon.
- 0:00 - Intro
- 7:26 - Meatless Mark Rober
- 13:43 - QNAP Ransomware
- 17:32 - Coffee Maker Ransomware
- 25:09 - 911 Outage
- 33:23 - Deconstructing a Mac App
- 41:07 - Ring Camera Drone
- 46:38 - Civilization Frontier Pass
Nice to breathe again, 3d printing fun, and concrete adventures. Directive to patch Zerologon, Russia bans ESNI, and did you know octal is a valid IP representation? Strava shows personal info to strangers, and Germany sees the first potential death due to a ransomware attack. For fun, you can fly Serenity, calculate the speed of light with a chocolate bar, code in Swift on Windows, and listen to Timber Wars. (will anyone notice if I don't put images into the metadata??)
- 0:00 - Intro
- 20:51 - Zerologon Patch Directive
- 22:20 - Russia Bans ESNI
- 25:54 - Other IP Encodings
- 34:54 - Strava Exposure
- 41:20 - Ransomware Death
- 45:51 - Fly Serenity
- 48:56 - Microwave and Chocolate
- 51:25 - Swift on Windows
- 53:14 - Timber Wars Podcast
No Mt. St. Helens for Eric, but bonus honey for Jon. GitHub drops passwords for cloning, Jon remembers a two year old underwater datacenter. More reminders about Disinformation and "Game Over" if you don't patch your servers. Eric's something fun isn't all that fun, then he stomps on Jon's fun. Jon gets excited about Library of Congress tech.
- 0:00 - Intro
- 12:40 - GitHub Passwords?
- 15:10 - Project Natick
- 20:29 - Disinformation Information
- 26:26 - ZeroLogon Attack
- 33:34 - Going to the Movies? No.
- 39:17 - Biomarking Bees
- 42:16 - Library of Congress Tech
Wildfires are consuming the west coast -- including Oregon; Eric repurposes railing for a fence, Hartford schools and Pakistan's largest power company hit by ransomware. For fun Eric has a FrozenBird and Mario Cart Live, and Jon brings the board game Karmaka.
- 0:00 - Intro
- 11:23 - Building A Fence
- 14:57 - School Ransomware
- 18:01 - Pakistan Ransomware
- 20:46 - Mcafee Netwalker
- 27:33 - Birdsicle
- 30:28 - Mario Cart Live
- 32:54 - Karmaka
Warning: This episode is rife with cliches. Eric's getting a new deck. Jon weeds and fences. Googling GitHub is now a thing. Apple notarizes a bad app. "Good" email names are more trouble than they're worth, and MoFi gets a 6 out of 10. Eric steals his something fun and Jon 1-ups that with a new 3d printer and an Umbrella Academy.
- 0:00 - Intro
- 12:06 - Medical data leaked on GitHub
- 15:33 - Apple notarization is not App Review
- 20:42 - Email Hijinks
- 27:29 - myrealbox.com
- 30:16 - MoFi gets 6/10
- 38:26 - AR Copy Paste
- 41:41 - New Photon Mono X 4k
- 47:16 - The Umbrella Academy
Jon harvests honey and Eric's on another road trip. "A Nevada Company" is Tesla, US Gov warns of the "BeagleBoyz", Bridgefy isn't secure, and an Ad Click Stealer. For fun Eric likes the Microsoft Flight Simulator (and the glitches), and Jon recommends an old fashioned (and fantastic) blog: honeybeesuite.com.
- 0:00 - Intro
- 3:43 - Honey Harvest
- 8:41 - "A Nevada Company"
- 12:14 - Hint: It's Tesla
- 13:38 - BeagleBoyz and FASTCash
- 21:07 - Bridgefy App
- 28:08 - Ad Library Click Stealer
- 35:16 - Microsoft Flight Simulator
- 40:22 - Honeybeesuite.com
Time behaves differently for Jon and Eric. More data leaked as ATMs give out "free" cash. A cruise line gets hit with ransomware and Jon explains Hooking (not that kind!) while Eric reviews shooting lasers at the moon and Jon clones keys from sound.
- 0:00 - Intro
- 16:02 - Insta, TikTok & YouTube
- 18:33 - ATM Banking Ooops
- 22:06 - Cruise Line Ransomware
- 26:10 - EDR Hooking
- 36:13 - Shooting Lasers at the Moon
- 40:32 - Rocket men
- 42:49 - Cloning keys from sound
Paper Wasps vs. Yellowjackets, and a bit of a Cow Adventure. Tons of subreddits defaced, China begins blocking TLS 1.3, an LTE vulnerability in ReVoLTE, and statistics about Incident Responses. Eric likes automatic decryption in Ciphey, and Jon has trouble picking something fun: a sudoku ML tutorial, an immunology article, and a retro gaming cassette.
- 0:00 - Intro
- 2:22 - Paper Wasps Vs Yellowjackets
- 13:38 - Reddit Defacement
- 15:37 - China Blocking TLS 1.3
- 18:55 - ReVoLTE
- 24:33 - Incident Response Report
- 34:59 - Ciphey
- 38:30 - Solving Sudoku Tutorial
- 40:05 - Immunology != Intuitive
- 42:36 - Tape Loader
Eric is half way to becoming Spiderman. Jon rebuilds a carburetor. Twitter and Zoom followup. Disinformation and Phishing. Insulin Pump Hacks and stuff neither Eric nor Jon understands. (Yet!) Eric makes YARPSF (yet aother raspberry pi something fun) and Jon gets into the physics of time machines, pickles and sadness.
- 0:00 - Intro
- 12:56 - Twitter
- 16:11 - Zoom
- 20:33 - Disinformation
- 24:32 - Phishing
- 28:26 - Insulin Pump
- 37:04 - OpenAPS
- 37:17 - Page Protection Layer
- 43:34 - Watched Pot
- 46:06 - Pickles and Sadness
Eric takes Stormlight on the road, Jon tries to change the oil, and the pickles are coming out just fine. Substack epitomizes irony by violating privacy in a privacy policy update, and a tiny bit more info in the Twitter breach. Nintendo game source leak exploration, GDPR complaints, and a PDF Shadow Attack. For fun, Eric brings another Pi project for monitoring power, and Jon likes the Way of Kings kickstarter.
- 0:00 - Intro
- 16:15 - Substack Irony
- 19:22 - Twitter Breach
- 22:16 - Sudo Make Me A Sandwich
- 23:50 - Nintendo Leak
- 31:12 - GDPR Complaint
- 35:20 - Out of Control
- 39:46 - PDF Shadow Attack
- 48:20 - Pi Power Monitoring
- 50:14 - Right Hand Rule
- 53:12 - Way Of Kings Kickstarter
Intro segue goodness, and, how to phrase it, largely home ec pickle talk - because Jon eats sandwiches (a lot). Some twitter followup, a well documented Twilio breach and Apple tries to roll out its Security Research Device program to much rejoicing (that's a reference). Fast Chargers can be bad and a genealogy hack for lulz. Eric appreciates that the Beavers Have Won and Jon digs Task Manager pixels, both fake and real.
- 0:00 - Intro
- 0:59 - Black Lives Matter
- 8:07 - Making Pickles
- 17:17 - Twitter Followup
- 20:18 - Twilio Breach
- 24:39 - Apple SRD Program
- 30:55 - BadPower Fast Chargers
- 35:45 - GEDmatch and MyHeritage
- 44:05 - Those Damming Beavers
- 47:21 - Task Manager DOOM (fake)
- 48:32 - Bad Apple Task Manager (real)
Go see NEOWISE while you can! Eric's almost got his microscope built, and Jon can't pass a hardware store. An open source password manager, more dark web prices, and an Unc0ver followup. A bad vuln (SIGRed) in Windows DNS, a massive Twitter compromise, and an Indian social app (Chingari) lack-of-authentication. For fun Eric's going to build a Pi Sniffer, and Jon brings back track separation with machine learning.
- 0:00 - Intro
- 6:44 - NEOWISE
- 12:04 - passbolt
- 16:29 - Dark Web Price Index
- 18:40 - Unc0ver Followup
- 24:28 - SIGRed
- 29:19 - Twitter Hacked
- 37:28 - Chingari Vulnerability
- 42:53 - Pi Sniffer
- 47:20 - Algoriddim
Jon and Eric talk about their July 4th Activities. There's a Tsunami coming and not the billions of passwords on the dark web. Watch your DNS and BIG-IP. New Far Side, a CyberForge and a codec that makes Jon happy.
- 0:00 - Intro - 4th of July Events
- 14:44 - Tsunami Coming
- 16:50 - Billions Of Passwords
- 23:23 - Azure Takeovers
- 31:03 - BIG-IP
- 35:32 - The New Far Side
- 38:33 - CyberForge
- 41:18 - H.266
Eric goes to the beach for a change of scenery, while Jon shovels manure on his PTO. Local governments are hit with a MageCart attack, and a whole lot of discussion about Safari -- what isn't coming, what's been taken away, and what's new in the next version. A few other WWDC announcements like Apple Silicon. Eric's building his new 3D printer, and Jon's making Jam and watching videos (not at the same time).
- 0:00 - Intro
- 10:44 - Magecart Follow Up
- 13:26 - Safari Declined APIs
- 21:38 - Safari 14 New Features
- 28:58 - SMS OTP Standard Discussion
- 32:00 - WWDC Other Announcements
- 33:59 - Jon Bitcode Conspiracy
- 42:06 - Prusa
- 45:34 - Raspberry Jam
- 46:57 - Developer App
Father's Day ramblings, more magecart madness, and setup your MFA before the bad guys do it for you. Safe Browsing bug and printers exposing themselves. A rickroll, a basketball, and Smallville.
- 0:00 - Intro
- 8:15 - More Magecart Madness
- 12:58 - MFA Or Crooks Will
- 20:28 - Face ID for Safari
- 21:22 - Face ID and Touch ID WWDC Video
- 23:47 - Safe Browsing Oops
- 29:47 - Printers on the Internet
- 34:14 - Jello + Shredder
- 35:10 - Jello + Shredder, actual
- 36:43 - Basketball with an Excavator
- 37:47 - Smallville
Games, networks, filtering, and bees to start. Jon did a quantum podcast, Excalidraw is cool, and Words Matter. Ripple20 has only 19 vulns (Intel's affected), phishing private notes for bitcoin, and theft of a master key. For fun try Inspriobot, read More Pages Than You Want about programming languages, and enjoy Space Parallax from the 21st century!
- 0:00 - Intro
- 4:12 - Cloudflare Filtering
- 5:51 - Mason Bees
- 15:13 - Quantum Podcast
- 16:35 - Excalidraw
- 17:55 - Return of Trunk
- 21:04 - Ripple20
- 25:25 - Intel Advisory
- 28:24 - Privnote, Phished
- 34:34 - South African Bank
- 38:33 - Inspirobot
- 40:59 - ACM on Programming Languages
- 45:04 - Space Parallax
Jon breaks Big News on the Podcast. Eric Plays Video Games. Patch Tuesday says Super Size Me. Apple says Let's Help a Password Manager out. Honda says Hold Up a Minute. SGAxe says Hello (No relation to the body spray). Eric Doodles while Jon Noodles on his Network. Finally, Ty says Thank You, Germany...
- 0:00 - Intro
- 1:23 - Rocket League
- 4:59 - Big News
- 10:13 - Super Size Patch Tuesday
- 11:45 - Apple Password Resources
- 14:15 - HTML Tag for Passwords
- 15:47 - Honda Cyberattack
- 17:38 - SGAXE
- 27:32 - DeepFace Doodles
- 30:01 - Jon's Network
- 41:27 - Weather By Ty
Rough week for so many people. #BlackLivesMatter. Talk to your kids. Protest. Donate [time|money|both]. In the security world, the iOS Jailbreak is patched, there's a big Thai cell provider leak, a vulnerability in Sign in with Apple is fixed, and one of the largest dark web hosting providers is taken offline. For fun this week, Eric brings an 8gb Pi, and Time.gov, which can measure your clock. Jon brings hot Qubits and good audiobooks.
- 0:00 - Introduction
- 4:56 - Scalzi Easy Mode Post
- 15:42 - iOS Jailbreak Patched
- 17:25 - Thai Cell Network Leak
- 21:39 - Sign In With Apple Hack
- 25:52 - No Backups
- 29:25 - 8 Gigs of Pi
- 32:38 - Measuring Clocks
- 35:39 - Hot Qubits
- 39:01 - Lady Astronaut Series
- 42:29 - Mary Robinette Kowal
Eric logs another 1500 miles. Jon does more bee stuff and then can't print a microscope. There's a blue mockingbird with a juicy potato. A jailbreak is unc0vered and Alex Stamos starts with 0 and lists some levels of privacy protection. Eric tries some zsh aliases and marvels at 23 movies in chronological order... BY SCENE... Jon likes Cicada Prime, a windows package manager, and the history of the entire world while Eric sneaks in another Mt. St. Helens plug...
- 0:00 - Intro
- 12:59 - Semi-Followup: Microscope Printing
- 17:37 - Blue Mockingbird
- 18:39 - Juicy Potato
- 20:31 - Unc0ver Jailbreak
- 24:21 - Levels of Privacy Protection
- 33:12 - zsh aliases
- 36:13 - Marvel Movies: Chronological Order By Scene
- 41:17 - Cicada Prime
- 46:18 - WinGet Package Manager
- 48:58 - history of the entire world, i guess
- 50:07 - Mt. St. Helens is about to Blow Up
Welcome to Blackberry talk. Hospitals need to fix things too, and how to decode a data breach. Signal proxies Giphy, unemployment fraud, chrome 83, and Tracked By Beer. St. Helens erupted 40 years ago this week, you can build your own microscope with a Pi and a 3d printer, plastic eating enzymes and massive migrating magma blobs!
- 0:00 - Intro - too much about Blackberries
- 13:12 - Right To Repair in Medicine
- 15:03 - iFixit Repair Manuals
- 16:31 - Decode a Data Breach
- 18:34 - Signal + Giphy
- 21:19 - Unemployment Fraud
- 25:21 - Chrome 83
- 31:34 - Tracked by Beer
- 38:24 - Mt. Saint Helens 40th Anniversary
- 41:08 - Open Flexure
- 46:05 - Plastic Eating Enzyme
- 49:33 - Magma Blobs
What day is it? Eric saves a bird, Jon sees free bees in a tree. Zoom scouts Keybase. Twitter makes work from home permanent. Ohio gets HSDOS'd, Hackers attempt a Wordpress Hijack, and you've been... uh... Thunder... um... Thunderspy'd. Finally, Eric does some shameless promotion of his boy's podcast and Jon watches a show.
- 0:00 - Intro
- 5:42 - Baby Bird
- 14:23 - Swarm Of Bees
- 14:47 - Zoom + Keybase
- 18:15 - Twitter Remote Work Policy
- 21:37 - Ohio’s COVID Fraud Website
- 24:23 - Wordpress Hijack Attempt
- 27:18 - Thunderspy
- 33:05 - weatherbyty.com
- 36:29 - AirPod Pros
- 39:05 - Devs
Social Isolation continues, and Jon has lost a bee colony (boo). Apple's T2 chip is a nightmare for refurbs, and two breaches this week. Social engineering doesn't qualify for bug bounties, facebook crashes lots of apps, and an icon-based-web-skimmer. For fun we have a time lapse and low light raspberry pi project and a 3d mini patreon to follow.
- 0:00 - Intro
- 10:44 - T2 Nightmare for Refurbs
- 17:01 - GoDaddy SSH Compromise
- 18:45 - Pakistani Mobile Users Breach
- 21:47 - Roblox "Hack"
- 26:12 - Facebook SDK Crash
- 28:47 - FBSDK GitHub Issue
- 32:11 - Favicon Based Skimmer
- 35:30 - PI-TIMOLO
- 41:57 - Artisan Guild
- 47:31 - MyMiniFactory
Eric reports on his Utah homework - receives an "F". Jon reports on his fence mending - receives an "Ouch". Hanging with Goats. Crashing Twitter. Exposure Notification (not camera related). Fuzzing and Image Processing. Falling for a phone scam. Eric might build a DIY Busy Light. Jon might buy a Mini CNC.
- 0:00 - Intro
- 4:57 - Byzantine Generals Problem
- 11:24 - Goat To Meeting
- 12:41 - Twitter App Crash
- 16:05 - Not Contact Tracing
- 17:26 - Breach Of The Week
- 19:58 - Apple 0clicks
- 22:54 - Episode 100 Fuzzing
- 24:39 - Industrial Control
- 27:07 - Falling For A Phone Scam
- 36:06 - DIY Busy Light
- 39:00 - Mini CNC
Walks in the rain for Eric and a Massive Bee Weekend for Jon. Facebook nudging people who like covid-19 misinformation, Avatarify deep fakes you, and Stripe has good API docs. An exposed payment processor for the breach this week, typosquatting Ruby Gems, Cloudflare tries to shame ISPs into security, and there's a bad iOS mail bug found. For fun, we have a game about nothing, earth day, and AI for audio.
- 0:00 - Intro
- 4:01 - Bee Weekend
- 10:32 - Facebook
- 11:31 - Avatarify
- 13:05 - Mostly Security Backgrounds
- 13:33 - Stripe API
- 15:23 - Paay Breach
- 18:37 - Ruby Typosquatting
- 19:19 - Npm Image Airplane Slide
- 24:03 - Cloudflare + BGP
- 29:11 - Previous Cloudflare+BGP Episode
- 30:02 - iOS Mail Vuln
- 39:01 - Seinfeld Game
- 41:35 - Earth Day
- 46:05 - Nvidia RTX Voice
Eric is confused by who wears a mask and who doesn't in public. Jon does a lot of gardening and bee stuff while listening to Air Supply. Just to be clear, there are no new scams, just repackaged scams. Microsoft, Zoom, Apple and Google Followup notes. Utah is tracking visitors to the state. Eric chats Snyk, Jon defines Doxing. Finally, a Raspberry Shake Vault and Old Man's Shark.
- 0:00 - Intro
- 12:20 - Send us bitcoin or we release photos
- 13:15 - Have I Been Pwned
- 13:40 - Episode 57
- 14:08 - Microsoft Vulns
- 15:55 - Zoom 0day
- 18:14 - Privacy Tracing COVID-19
- 22:25 - Utah Border Control
- 27:02 - Snyk VSCode Scanner
- 30:32 - Doxing
- 34:30 - Raspberry Shake Vault
- 37:21 - Old Man's Shark
Fourth week of Social Distancing continues, and followup is now 'zooming-up.' Breach of Italian email provider. There's a new SMS OTP Standard proposal, and a potential way to do contact tracking in a private manner. If you know Cobol you may be needed in New Jersey. Eric has fun with maps and food, and Jon brings a new green screen technology and hacking with Swift.
- 0:00 - Intro
- 1:54 - Online Schools in Oregon
- 5:12 - John Krasinski
- 12:33 - Zoombombing Illegal
- 17:15 - Zoom "Encryption"
- 19:46 - Zoom Security Council
- 21:37 - Email.it Breach
- 23:37 - SMS One Time Password Standard
- 28:05 - Private Contact Tracking
- 33:28 - COBOLers Wanted
- 43:03 - Fun With Maps
- 45:49 - Our Best Bites
- 47:25 - Background Matting
- 52:52 - Hacking With Swift
Zoom Zoom Zoom Zoom Zoom Zoom Zoom Zoom. COVID-19 COVID-19. Breach Breach. (s + "Attack" for s in ["Mask","Ultrasonic","Router"]). Canadian Comedy. Squid Insanity. Mistborn.
- 0:00 - Intro
- 11:37 - Zoom Followup
- 12:08 - Zoom 4 Mac
- 12:11 - Zoom 4 Windows
- 14:12 - Coronavirus Website Templates!
- 14:53 - Coronavirus Cell Phone Data Tracking
- 16:27 - BOTW: Not Sponsored By Under The Breach
- 16:54 - Georgia Citizen Details Breach
- 18:44 - Marriott Loyalty Program Breach
- 21:31 - Facial Recognition With A Mask
- 27:54 - Ultrasonic Attack
- 28:12 - Episode 24
- 31:42 - Home Router DNS Redirection
- 34:25 - Meandering: RPi Speed Test
- 35:55 - Four On The Floor
- 36:03 - SCTV
- 36:16 - Kids In The Hall
- 36:39 - Mr. Canoehead
- 38:20 - Squid Fun
- 41:38 - Mistborn
Eric has numerous Covid adventures, while Jon is "on PTO." Followup on Chrome, Covid domains, and tracking social distancing. Zoombombing (ick) and Zoomtracking (ugh). Covid spammers use an open HHS redirect, and Microsoft has another zero day. For fun we have Covid stories true and false, Where's Waldo, and 3D printing.
- 0:00 - Introduction
- 0:10 - Purple Hair
- 2:04 - Planes, Trains And Automobiles
- 18:00 - Chrome Pauses Updates
- 18:47 - Namecheap Avoids Covid Domains
- 19:44 - Distancing Compliance
- 25:11 - Zoombombing
- 28:36 - Zoomtracking
- 33:13 - HHS Open Redirect
- 38:14 - Microsoft Font Zero Day
- 40:33 - Mostly Security #102
- 44:42 - A Silver Lining
- 46:15 - Fake Good News
- 48:19 - Where's Waldo
- 49:20 - 3d Printer
Mason Bees and Breaches. Lots of Coronavirus. HomePwn and Dark Matter. Short and Sweet.
- 0:00 - Intro
- 3:31 - Mason Bees
- 7:25 - Breach Of The Week
- 10:11 - Coronavirus Scams - FTC
- 15:26 - Coronavirus Domains
- 20:09 - Hospital Attack
- 23:27 - WordPress and Struts
- 26:24 - HomePwn
- 29:38 - Dark Matter
Stay safe and wash your hands folks. Hard to avoid the Corona talk this week. Lots of followup: Folding@Home, Robocall legislation, and more Right to Repair. There's a sensitive breach at Whisper, Facebook is suing domain registrars (maybe a good thing), and an easy way to clone car keys. LVI is the latest hardware bug, and SMBGhost the big Microsoft news this week. Eric's fun is Egging for Vaccines, and Jon admires a moon-howling, scorpion-hunting mouse.
- 0:00 - Introduction
- 3:44 - Corona Medium Post
- 5:30 - Get Shorty
- 5:59 - Powell's Books
- 6:27 - Folding@Home for Corona
- 8:01 - Robocalls
- 9:26 - Right To Repair
- 14:59 - Whisper Breach
- 18:24 - Facebook Sues Domain Registrars
- 22:08 - Car Key Cloning
- 25:08 - Load Value Injection
- 30:41 - SMBGhost
- 36:24 - Eggs For Vaccines
- 41:46 - Mouse Vs Scorpion
Cast/Snip is back, Jon and Eric don't see Harry Potter and the Oregon Symphony together, and some restored film followup (with sound!). Jon does vicarious bee shopping and Eric drops some Coronavirus scams. Then we talk about Android stuff for some reason. Weird. Finally, SETI@Home is ending while WebAssembly is ramping up.
- 0:00 - Intro
- 0:13 - Squares On The Wall
- 1:43 - Cast/Snip Is Back
- 6:29 - Cast/Snip Source
- 7:05 - Harry Potter And The Oregon Symphony
- 9:29 - Shopping For Bees
- 10:30 - Restored Film Followup
- 12:29 - Coronavirus Scams
- 16:27 - One Beeeellion Downloads
- 19:59 - Stealing 2FA
- 22:06 - Mediatek Rootkit Exploit
- 31:50 - Satellite Disk Exploit
- 32:22 - SETI@Home Ending
- 34:43 - Clang In WebAssembly
- 35:58 - WAPM
A busy weekend at the auto show (Eric) and without power (Jon). Listen to Short Wave. MGM Breach wasn't exactly last week. Eero adds support for homekit, a billion vulnerable wifi devices, a chrome zero day, and sharing WhatsApp group links. For fun, we have The Indicator => Netflix => Documentaries => Frozen Amphibians, and blood test results.
- 0:00 - Introduction
- 5:36 - Auto Show
- 7:53 - Ford Mach-E
- 8:57 - Short Wave
- 9:57 - MGM Breach
- 11:47 - Homekit Eero
- 18:29 - Billion Wifi Devices
- 23:51 - Chrome Zero Day
- 26:55 - WhatsApp Group Links
- 30:59 - The Indicator
- 35:22 - Frogsicle
- 38:23 - Everlywell
Eric cleans, Jon drops bark dust. If your email address hasn't been compromised, is it a real email address? Some SameSite Cookies and OpenSSH ❤️ FIDO U2F. More Data Brokers with odd names and a PAN Enumeration Attack. Cheating McDonald's in Germany, a Paper Airplane Folding Machine and where the Stonehenge Bluestone Quarry lies.
- 0:00 - Intro
- 2:55 - Dejunkify
- 6:49 - Pwned Indicators
- 8:03 - SameSite Cookies
- 8:18 - 110
- 11:13 - OpenSSH ❤️ FIDO U2F
- 14:29 - Yodlee?
- 22:22 - PAN Enumeration Attack
- 32:39 - Cheating McD
- 35:50 - Pseudo Articley
- 37:39 - Paper Airplane Folding Machine
- 39:11 - Stonehenge Quarries
Three breaches this week. Chrome will begin blocking HTTP downloads, Intel releases a CSME patch, and Emotet begins spreading via insecure WiFi. Eric joins a majority of Americans being Wrong About Pizza, Amazon reviews can be hilarious, and how to create a (virtual) traffic jam.
- 0:00 - Introduction
- 1:03 - Acrylic Pens
- 2:04 - Holly In Grass
- 2:32 - Augustin Hadelich
- 6:00 - Israel Voter Breach
- 8:27 - Denmark Citizen Breach
- 9:33 - Prisoner Data Breach
- 10:59 - Chrome will block HTTP downloads
- 15:59 - Intel CSME Vulnerability
- 19:28 - Emotet Spreading via WiFi
- 26:07 - Pizza Fun
- 29:22 - Tungsten Cube Review
- 31:22 - Virtual Traffic Jam
A breach, a license plate and a WebEx flaw walk into a bar in Dongletown to caucus while listening to the symphony and find a bunch of fun.
- 0:00 - Intro (SPACE!)
- 5:08 - I Have Joined Dongletown
- 7:13 - SpiceJet Breach
- 9:14 - OpenALPR
- 10:13 - Episode 93: License Plate
- 16:37 - WebEx Flaw
- 21:00 - Caucus App
- 31:33 - Fun Fact
- 33:27 - Fun Video
- 35:38 - SPACE!
- 37:28 - Picard!
- 40:38 - Little Corny Parts
Another week, another episode. NFL Twitters are hacked, Microsoft support has a huge breach, Botnets are battling, and Macs are Shlayered. If you aggregate public info and multiple breaches, the consequences are "interesting" ... and evidently Americans DO still go to libraries. And museums. Go Smithsonian!
- 0:00 - Introduction
- 0:27 - 1917
- 3:54 - How To Offend Four Groups Of Nerds
- 8:39 - Football Twitter
- 11:32 - Microsoft Breach
- 15:17 - Botnet Battle
- 18:11 - Sextortion Post
- 18:56 - Shlayered Macs
- 22:47 - Breach Aggregation
- 26:00 - Library Often?
- 30:06 - Natural History Museum
There's a fire at the High School and Eric drives to Eugene. Jon doesn't remember his weekend but extolls the virtues of ditching the Costanza Wallet. More notes on the Windows Vulnerability with a great McAfee article on the math behind it. (Obligatory Note: More lost credentials!) Finally, an SML Illusion, US Flag Commentary and "I Have A Dream".
- 0:00 - Intro
- 7:03 - More Magecart
- 7:34 - Episode 96: An Especially Hardy Perennial
- 8:33 - I Ditched My Constanza Wallet
- 10:16 - Cops Use Pictures Used To Find You
- 11:22 - Windows Vulnerability
- 13:24 - Curveball Math
- 17:14 - Rick Astley And A Curveball
- 17:45 - Is There A Logo For It?
- 18:19 - Lots Of Telnet Creds
- 22:41 - A Sinusoidal Müller-Lyer Illusion
- 25:00 - 50 Flag Commentary
- 27:11 - MLK I Have A Dream
Back from Texas, and presumably done with brisket for a while. What to look for in a tractor (repairability). A billion medical images can't be wrong, lax cookies, and Super Patch Tuesday. Eric's fun is an AI Dungeon, and Jon points to a LoTR blog by Ian McKellen.
- 0:00 - Introduction
- 5:48 - Right To Repair
- 10:29 - A Billion Medical Images
- 15:46 - Lax Cookies
- 23:05 - Patch Tuesday
- 29:26 - AI Dungeon
- 34:40 - Ian McKellen's Blog
Live, frome Plano, Texas! It's Mostly Security! Much brisket is consumed and Raj Samani joins the show. What happens to your digital life once you or a loved one has passed on? Is the public ready to embrace security as a marketing feature? Raj tells a joke, Eric shares admin thoughts, and Jon reminisces about old tech.
- 0:00 - Intro
- 7:14 - Hey Siri What's My Password
- 22:49 - Apple and Security Research
- 28:44 - What's in the Box?
- 28:52 - Bypassing Garage Doors
- 29:05 - The Cloning of the Ring
- 41:29 - Why can't you trust atoms?
- 42:03 - Quantum Computing Joke
- 42:31 - Undocumented Admin
- 44:45 - Attaching 1980's HD to an iPhone
Eric and Jon discuss the holiday; an exposed elastic search instance, and a Wawa-winner of the gas station Visa article. What is a Quine, anyway? Restaurant chain Landry's breached from loyalty systems, data cars collect, and how to perform a reverse image search. For fun we have creative ways to exit VI, the oldest known cave paintings, and Public Domain day.
- 0:00 - Introduction
- 12:44 - Exposed Wyze ElasticSearch
- 15:31 - Wawa POS Malware
- 17:06 - Javascript Quine
- 19:44 - Landry's Restaurant Breach
- 24:12 - Data Cars Collect
- 35:21 - Reverse Image Search
- 44:26 - How To Exit Vi
- 46:17 - Oldest Cave Paintings
- 47:43 - Public Domain Day
Happy Holidays! Ring still has issues, and now they've really irritated Eric. Jon digs into ToTok (not to be confused with TikTok). Facebook can't catch a break and millions are tracked everywhere you might not want tracking. Jon has some scientific fun and Eric notes a playdate (but not with cats).
- 0:00 - Intro
- 9:54 - Ring Followup
- 11:58 - Eric's Tweet Rant
- 15:00 - ToTok is not TikTok
- 31:22 - Facebook Uses Location...
- 35:21 - Billions Tracked...
- 38:37 - Science Fun
- 42:20 - Playdate Update
- 44:17 - The "Cat"astrophe
Both Eric and Jon have seen Jumanji; Nebraska farmers like Right to Repair. Visa says gas stations are vulnerable, Unicode is (both?) evil and awesome, and we discuss the state of Ransomware in 2019. For fun, we have a nuclear impact map application (??) and Kotlin vs. Java. Also some ancient blog references.
- 0:00 - Introduction
- 2:23 - Jumanji: The Next Level
- 5:20 - Mead Update
- 8:14 - Right To Repair in Nebraska
- 11:22 - Vulnerable Gas Stations
- 19:10 - Hacking Github with dotless 'i'
- 21:51 - Evil Twins
- 24:54 - Awesome Unicode
- 26:44 - State of Ransomware
- 38:02 - Nukemap
- 41:15 - Kotlin vs Java
- 42:30 - Android+kotlin
- 45:27 - Kingdom Of Nouns
Eric thinks cooking with warm water is cool. Jon makes cool cutting boards. iPhone 11 Location follow up along with a new segment, "Open Bucket of the Week". A macOS fileless attack and TikTok in Trouble. Finally, we talk about pirates and a whole lot of fun.
- 0:00 - Intro
- 2:06 - Sous Vide
- 5:52 - Cutting Boards
- 9:41 - iPhone 11 Location Follow up
- 13:05 - Open Bucket Of The Week Follow Up
- 16:00 - macOS Fileless Attack
- 19:54 - TikTok In Trouble
- 22:37 - PlunderVolt
- 31:17 - Holiday Music - Pentatonix
- 32:40 - Holiday Music - The Piano Guys
- 33:54 - Deep Sea Scrolling
- 35:53 - PracticalAI.me
- 38:05 - Ace Of Clay
Eric sees multiple movies over Thanksgiving, while Jon ... does not. Two years to upgrade OS of emergency system in S.F., and Sprint's marketing firm has an open bucket. Eric has a mobile theme with both Android and iOS issues, and Jon details VPN issues and upcoming ARM instances in AWS. Eric enjoys his Pixel4 and @engineeringvids while Jon takes a break from ScienceFun for a post of basic command line tools.
- 0:00 - Intro
- 1:04 - Knives Out
- 5:44 - Two Year OS Upgrade
- 7:09 - Dispel Dice
- 9:22 - Open Sprint Bucket
- 12:48 - StrandHogg
- 17:10 - iPhone Location Services
- 20:55 - NordVPN and Disney+
- 27:20 - Graviton2 Instances
- 36:02 - Pixel4
- 38:33 - @engineeringvids
- 40:55 - Basic Tools
Pre-Thanksgiving Show, Post-Thanksgiving Edit. Some Followup on the NSA Advisory. Eric chats about Google wiping a personal phone and airplane warning lights being hacked. Jon gives 32,768 reasons to update your HP SSD and another big data "exposure". The Google Product Cemetery and Extrasolar Objects round out the fun.
- 0:00 - Intro
- 6:38 - NSA Advisory Followup
- 10:41 - MDM and Wiping Phones
- 13:20 - Airplane warning lights hacked
- 16:08 - HP SSD Update
- 20:08 - Data "Exposure"
- 23:23 - Personal Data is like Nuclear Waste
- 26:13 - The Google Cemetery
- 29:13 - Extrasolar Objects
Been a busy week, and Eric's still fighting with his network. Not that Jon has one. Egregious terms of service at Ring and the cops confirm bluetooth scanners are in use. Also, it's Data Leak Day! (Every day is data leak day). There's some weird stuff going down in Shanghai, and you, you, everyone gets a preview! Cloudflare can't rhyme, let's talk CRISPR/Cas9.
- 0:00 - Intro
- 6:41 - All Your Face are Belong to Us
- 10:12 - Scanner Use Confirmed
- 13:14 - WeWork Contracts Exposed
- 15:46 - Rev Transcriptions Security
- 19:11 - GPS Crop Circles
- 26:18 - Schneier on Shanghai
- 27:27 - Previews for All!
- 33:35 - Flan Scan Doesn't Rhyme
- 36:19 - CRISPR Sickle Cell Patient
- 41:55 - CRISPR/Cas9
Eric hangs out in San Francisco while Jon makes a pen. There's a Facebook Bug, a Confluence Bug and an NSA Advisory, along with some more ransomware notes and something about zombies? Eric reminisces about museums and Jon nostalgizes about Mosaic. WASM!
- 0:00 - Intro
- 4:09 - Jon Makes A Pen
- 8:11 - Facebook Bug
- 11:53 - Confluence Bug
- 15:18 - NSA Advisory
- 17:29 - Pemex Ransomware
- 21:04 - Zombieload 2
- 26:24 - The Exploratorium
- 29:30 - Mosaic Turns 26
- 33:18 - WebAssembly
Episode 100! This episode is Mostly Intro and Followup. Synology and QNAP; Pizza, Root beer, and Mead. Control your Echo with a laser, OpenSSH to support U2F, and beware insider threats. The Untitled Goose Game allows code injection; Fuzzing open source for fun and (no) profit. Could we decay nuclear waste with Ultra Fast lasers? And separation of music into tracks using machine learning.
- 0:00 - Welcome to episode 100!
- 3:19 - New Synology
- 4:29 - Cheese Pizza and Rootbeer Test
- 5:31 - Digiorno Delivers
- 8:08 - Making Mead
- 15:00 - QSnatch
- 16:02 - OpenSSH to support U2F
- 17:04 - Laser Controlled Voice Tube
- 21:19 - Trend Insider
- 22:18 - Episode 29
- 23:48 - Untitled Goose Game
- 27:18 - Fuzzing Libarchive
- 28:48 - OSS-Fuzz
- 37:04 - Chirped Pulse Amplification
- 40:53 - Spleeter
Eric has more fun than expected at a Weather Conference and gets to use a censor beep while editing. Jon waxes eloquent about 99 episodes, which coincidentally is the number of years between events in the Zero Hour Podcast. Other stuff was discussed as well - probably even a little about security. Enjoy.
- 0:00 - Intro - Oregon AMS
- 7:10 - Quantum Followup
- 10:53 - Chandra 2 Followup
- 13:54 - Hurricanes & Cybersecurity
- 17:13 - Smart Cylinders
- 22:27 - Winnti Group
- 26:33 - Discord Client
- 32:09 - Saildrone
- 36:50 - 50 Year Anniversary
- 40:31 - Zero Hour Podcast
Eric has more fun than expected at a Weather Conference and gets to use a censor beep while editing. Jon waxes eloquent about 99 episodes, which coincidentally is the number of years between events in the Zero Hour Podcast. Other stuff was discussed as well - probably even a little about security. Enjoy.
- 0:00 - Intro - Oregon AMS
- 7:10 - Quantum Followup
- 10:53 - Chandra 2 Followup
- 13:54 - Hurricanes & Cybersecurity
- 17:13 - Smart Cylinders
- 22:27 - Winnti Group
- 26:33 - Discord Client
- 32:09 - Saildrone
- 36:50 - 50 Year Anniversary
- 40:31 - Zero Hour Podcast
Eric goes pot shopping and Jon loves carrot cake. Has google achieved quantum supremacy? Biometric missteps, cache failures, Mercedes app glitches, and more cryptojacking containers. Eric joins the Rebble Alliance, the Air Force retires their 8" floppies, and bees can do math now.
- 0:00 - Intro
- 4:26 - Carrot Cake
- 6:56 - Google's Quantum Claim
- 8:32 - Not So Fast...
- 10:06 - Samsung Fingerprint Fail
- 14:23 - Pixel 4 Face Unlock
- 17:39 - Cache Poisoning
- 27:04 - Mercedes Glitch
- 30:14 - Docker Cryptojacking
- 32:58 - Rebble With a Cause
- 36:43 - No More 8" Floppies
- 39:01 - Bee Math
Apple Farms and Drones. Spy Chip Followup. Much Sudo About Nothing. Bluetooth Beaconing Enable Theft also Enables Mansplaining (what?!?) and some Reductor Malware details. Yellow lights are scientifically proven to be too short and Paul Graham proposes a language.
- 0:00 - Intro - Apple Farms and Drones
- 10:06 - Spy Chip Followup
- 11:25 - Much Sudo About Nothing
- 15:07 - Sudo Make me a Sandwich
- 16:11 - Bluetooth Beaconing Enabled Theft
- 19:08 - Reductor Malware
- 27:42 - Yellow Lights are Too Short
- 32:49 - Paul Graham's Bel
Eric paints and buys Jon a Yubikey. Jon ditches the Costanza wallet. Hacking back against ransomware, nomoreransom.org, and patch your routers folks. Stalking eyeballs, Twitter sells your 2FA phone number, and more cart skimmers. Eric's audiobook journey, publishers strongarm libraries, Ken Thompson had a good password, and the craziest article you'll read all week.
- 0:00 - Intro
- 4:40 - Eric buys Jon a present
- 8:18 - No more Costanza wallet
- 12:56 - Ransomware Victim Hacks Back
- 15:36 - No More Ransom Plug
- 17:18 - Patch Your Router (if you can)
- 21:04 - Eyeball Reflections
- 23:30 - SMH Twitter. SMH.
- 26:25 - Store Host Cloud Breach
- 32:00 - The Eye of the World
- 35:26 - Bad Macmillan
- 37:39 - eBook Petition
- 40:12 - Ken's Password
- 44:07 - Crazy Article
This Week: Gambling, Research, Takedowns, Phishing, Jailbreaks. Fun with Madeleine Albright & Colin Powell and the periodic table.
- 0:00 - Intro
- 3:21 - 21
- 5:35 - Is China the new Russia?
- 9:31 - McAfee Sodinokibi Research
- 11:37 - Dutch Police Takedown
- 15:43 - Specialized Phishing with iOS
- 20:40 - Checkm8 Jailbreak
- 28:40 - Madeleine Albright & Colin Powell
- 33:19 - The Periodic Table
Eric's on the road and under the weather; Jon has had better weekends. Apple's opening up the repair envelope, and the Internet is a Low Trust Society. Paper's not private, and IBM talks about malware targeting routers. For fun, Eric likes Echo .* and Jon evidently likes Goddard [Institute|Futuristics].
- 0:00 - Intro: Travel and Sick
- 2:57 - Honey Tasting
- 8:08 - Right-ish to Repair
- 9:59 - Dupes and Cynics
- 15:37 - Zen and the Art of Motorcycle Maintenance
- 17:17 - "As Designed" Paper
- 22:48 - Swiper, No Swiping
- 31:58 - Echo _____
- 37:36 - Water on Venus
- 40:15 - Wolf 359
This Week: Space Stuff, Data leaks in Ecuador, More Space Stuff, Something about where your car is, and Password Managers are Software, too. Wait, we're not done. Do you know what you're phone is doing? Soviet Soldiers Dancing and 3D Dominos, and finally, you will find out where Greater Adria went.
- 0:00 - Intro
- 5:07 - Hundred Year Starship
- 6:18 - One Strange Rock
- 7:18 - Ecuador Data Leak
- 10:47 - MoviePass Shutting Down
- 11:24 - Looking for Vikram
- 13:11 - License Plate Readers
- 18:29 - Password Manager Bug
- 20:01 - Chromium as U2F Bug
- 24:32 - Simjacker
- 30:57 - Soviet Soldiers Dancing
- 32:14 - 3D Dominos
- 34:07 - Greater Adria
Chapters:
- 0:00 - Intro + Car Troubles
- 4:48 - St. Helens Hike
- 10:16 - BMC Exposed on Supermicro Servers
- 11:36 - MLIR Donated to LLVM Foundation
- 12:42 - Chandrayaan-2 Crashes
- 13:30 - "Amature" 25m Telescope
- 16:06 - Vulnerable Internet Radios
- 19:05 - Apple's Vulnerabilities
- 22:39 - Schneier's Doghouse
- 27:07 - MEASURE of DevSecOps
- 37:02 - How Big is a Proton?
- 39:56 - Windows 10 PowerToys
- 42:13 - how to
Kids are back in school! Chainsaw carving. iOS exploit explanations. Realtime audio deepfakes. Ransomware isn't going anywhere. Google Play apps on HackerOne. Developing Modern Applications. A crossword game with regex. Tensorflow compilers.
- 0:00 - Back to School
- 1:30 - The Dining Philosophers Problem
- 4:00 - State Fair + Carver Kings
- 6:20 - Project Zero + iOS Exploits
- 7:30 - Realtime Audio Deepfakes
- 11:00 - Ransomware and Cities
- 15:19 - Google Play on HackerOne
- 21:44 - Developing Modern Applications
- 31:54 - Regex Crossword Game
- 34:52 - Tensorflow Compilers
Chapters:
- 0:00 - Intro - Sourdough Starter
- 3:26 - Kite Festival
- 8:56 - (Last Year Kite Festival)
- 10:33 - exFAT Open Sourced
- 11:36 - IBM: Hold my Chip
- 15:37 - Microsoft + MFA
- 21:40 - Fortigate VPN RCE
- 32:28 - Fortigate Blackhat Slides
- 37:18 - Atomic PI Case
- 40:46 - Won't Be Big and Professional
Eric does some camping, Jon does some hiking, and then there is another breach and Jon gets into some psychological motivational theory. Finally Eric is still stuck in space and Jon shares a biological discovery.
- 0:00 - Intro
- 1:35 - Cape Lookout Trail
- 3:00 - Tillamook
- 4:04 - YubiKey 5Ci
- 6:38 - EV Cert Lifespan
- 10:12 - MoviePass Breach
- 17:49 - Alex Stamos @ USENIX 2019
- 26:30 - Cool Milky Way Timelapse
- 28:57 - HIV discovered in 1966
Chapters:
- 0:00 - Intro - Texas is Hot
- 3:19 - Death to EV Certs
- 6:09 - AWS IAM Complexity
- 8:44 - Wormable RCEs
- 12:28 - Screwed Drivers
- 24:54 - Atlas 5 Sunrise
- 26:48 - Perseid Meteors
- 29:43 - Star Walk 2
Extra bits of fun wrap a bunch of ZDNET articles.
- 0:00 - Intro
- 7:19 - IP over Avian Carriers
- 9:30 - Disappearing Sunday Comic
- 10:50 - Chrome Extension Notes
- 12:32 - Cast/Snip is Shelved
- 13:30 - SHIELD Act
- 15:37 - AT&T Employee Bribes
- 18:48 - Chilean Voter Data Leak
- 22:44 - WiFi Dragonblood
- 27:08 - Raspberry Pi High Speed Camera
- 29:15 - Kingdom Hearts
- 31:48 - MacBook Touchscreen
- 34:10 - 4500 Year Old Yeast
Chapters:
- 0:00 - Intro
- 2:20 - Galaxy's Edge
- 8:46 - NPM "Issues"
- 15:31 - ERROR 418: I'm a teapot.
- 16:52 - Hardened Runtime Entitlements
- 22:14 - Don't Jump, Scott
- 25:59 - EV Certs are Dead
- 29:20 - EC2 Danger
- 32:15 - Six iOS Bugs
- 38:02 - Redfish Lake
- 42:47 - Potential Alzheimer's Vaccine
Ramen and Baked Baking Soda. Fencing Lowlights. Pi-hole experiments. HIBP Authentication, Plaintext Passwords and Encryption Backdoors. Nacho Analytics and Docker Escapes. More Space Goodness and Civ VI.
- 0:00 - Intro
- 0:42 - Ramen
- 3:38 - Fencing Lowlights
- 7:28 - Pi-Hole
- 11:54 - HIBP Authentication
- 16:15 - Plaintext Passwords
- 19:45 - Everybody wants backdoors
- 21:13 - Backdoors won't work
- 22:39 - Nacho Analytics
- 30:32 - Docker Escapes
- 41:08 - Chandrayaan 2
- 43:30 - Civ VI Expansion
Chapters:
- 0:00 - Intro
- 9:00 - OMR Tokens
- 13:05 - iOS URL Scheme Hijacking
- 23:09 - FIDO2 Support in Active Directory
- 28:36 - Building WSL
- 31:42 - Prime Day Whoops
- 37:47 - National Hot Dog Day
- 40:40 - Pickle Day
- 42:41 - Apollo 11 Anniversary
A super long Pixar Short, Trailer Towing, Tablesaws and Chainsaws, Earthquakes seen from a Raspberry Pi, Conferencing Software Gone Wild, Famous APTs, Medical Ooofs, The Patented Unhackable, and the Unraveling of the JPEG. Yep. That's the show. Guess which section the title comes from...
- 0:00 - Intro
- 11:55 - LA Earthquakes
- 14:04 - Zoom Ooops
- 19:30 - Silent Apple Fix
- 20:55 - Most Famous APTs
- 25:22 - Anesthesia Ooops
- 33:04 - Patented, Unhackable Computer
- 39:11 - JPEG Unraveled
Chapters:
- 0:00 - Intro - Password Woes
- 5:00 - Bellroy Wallet
- 5:33 - Costanzaist
- 10:42 - The Stand
- 12:32 - Yubico FIPS Vulnerability
- 14:16 - D-Link Security Settlement
- 17:20 - Forced App Install
- 20:33 - OSX/CrescentCore
- 27:10 - FaceTime Attention Correction
- 33:23 - Bad News Trainer
- 36:51 - Fluorescing Plants
- 39:40 - Spiderman Far From Home
I'm not sure why we put stuff in the summary that is just a repeat of the chapters... So let's try something new this week! Read the chapters! It will be fun!
- 0:00 - Tired Intro
- 4:16 - Godzilla: King of the Monsters
- 5:44 - MIB: International
- 6:54 - Android Supply Chain Followup
- 8:08 - Cloudflare throws shade
- 13:46 - Route Wazing
- 17:48 - Vogons
- 19:09 - Docker <3 Vulnerabilities
- 25:20 - Firefox 0day just for Coinbase
- 29:42 - Jon's Workish Fun
- 34:42 - Eric's Real Fun
A tale of two father's days. Google's cool with Sign in with Apple, and 1Password now supports Yubikey. A clever sports app violates privacy for license enforcement, and cameras are the most compromised IoT devices. Four, count them four fun things: Sagrada Familia's building permit, the national park type face, a passive listening device from the 40's, and apostrophe morse code.
- 0:00 - Intro + Key Lime Pie
- 4:15 - Google's comment on Apple's SSO
- 8:21 - 1Password + YubiKey
- 18:58 - La Liga Audio Snafu
- 23:56 - Most Compromised IoT Devices
- 30:02 - Sagrada Familia Building Permit
- 31:45 - National Park Type Face
- 33:11 - Surveillance Kit
- 37:00 - Red Handed Lyrics
School is out. Apple updates the Enterprise App Agreement and will send unknowns calls to voicemail. Package dependencies continue to be a problem. HIBP is looking for a home. Vim has a bug. Android supply chain issues. Rambleed. Eric relates a story about his ISP and Jon relates a remote VS Code story. (All in way less than an hour.)
- 0:00 - Intro
- 7:24 - Apple Enterprise Changes
- 10:18 - Spam -> Voicemail
- 13:48 - Package Dependencies
- 17:15 - Project Svalbard
- 19:45 - Vim Bug
- 21:48 - Android Supply Chain
- 25:12 - Rambleed
- 31:20 - Eric's ISP Adventures
- 37:23 - Remote VS Code on RPi
Eric's back from Chicago and Jon's destroying things with mowers. WWDC is going on, with some interesting security announcements already. Elastic buys Endgame, Quest Diagnostics is breached, and real life bank heists aren't like Hollywood movies. Eric had a good trip to NIST and Jon agrees with his buddies Gates and Buffet that Dairy Queen is Tasty.
- 0:00 - Intro -- Will it Flail?
- 8:56 - Sign In with Apple
- 12:35 - App Store Guidelines
- 17:01 - WWDC Keynote
- 22:50 - Elastic Buys Endgame
- 26:20 - Quest Diagnostics Breach
- 30:23 - Months not Seconds
- 32:32 - Bitdefender Report
- 39:15 - NIST is Nice
- 43:01 - Buffet and Gates
No honey yet, but we now have a "Days Since Last Facebook Scandal" counter. If you only had an hour to talk security, what would you say? SnapChat joins Facebook, and not in a good way, so just plan for some users being evil. If your name is Jared and you played high school lacrosse, the world is your oyster (apparently). MS-SQL and PHP together enjoy some rootkit malware and another Docker bug. Finally: Earthquakes, Murals and Table Saws.
- 0:00 - Intro
- 4:23 - dayssincelastfacebookscandal.com
- 5:11 - Campaign Security
- 10:52 - SnapLion
- 12:48 - Some Users will be Evil
- 13:17 - Explainable AI
- 15:24 - MS-SQL + PHP = Rootkit Malware
- 21:33 - Docker Race Condition
- 27:55 - Peru Earthquake seen in Oregon
- 29:32 - Chronicles of San Francisco
- 31:39 - SawStop
Eric and Jon are in Arizona; people seem to like the bees, and Jon gets to revel in his Bitcode conspiracy a little more. Instagram data found in an 'influencer' breach, and Google releases two factor auth effectiveness data. Jon's curious about Minecraft Earth, and everyone needs to sleep more.
- 0:00 - Intro
- 5:46 - More Bitcode Conspiracy
- 14:18 - Instagram Influencers Scraped
- 19:48 - 2FA Effectiveness Data
- 33:08 - Minecraft Earth
- 36:57 - Go to Sleep
I've always wondered if anyone actually bothers to read the summary. You know, if I don't "summarize" the episode, would anyone notice? If they did, would they care - and now that I've started the summary this way, do I go ahead and actually summarize anyway? Like, should I mention Jon talking about bees again? Or the quick little follow ups on MDS Attacks, GitHub's Package Registry or Social Proofs? Hacking the "unhackable" might be a good thing to mention, along with a software update "crashing" ankle monitors in the Netherlands. Oh, yeah - and then there's the SHA-1 Collision Attacks that are moving from theoretical to practical. But surely nobody wants to know about learning languages at an older age or photobioreactors in space or the fact that scientists have created a living organism from human-made DNA...
- 0:00 - Bees. What else?
- 5:22 - MDS Attacks
- 7:46 - GitHub Package Registry
- 9:18 - Social Proofs
- 11:30 - Hacking the "unhackable"
- 15:01 - Software is Everywhere
- 17:28 - SHA-1 Collision Attacks
- 23:38 - Learning Languages
- 28:55 - Photobioreactor in Space
- 33:04 - Synthetic Life
Go see Avengers. And don't be jealous, Star Wars, just Use the Force, Harry. Data on Let's Encrypt, HoloLens' live demo doesn't, and we reference two past episodes (37 and 39). Ransomware is targeting source on GitHub, Jon talks containers for Too Long, and a clever CSS hack. For fun, Eric likes the Texas Sand Fest winner and an AirPod that's 'been there, done that.' (no thank you). Jon is excited for Windows Terminal (go browse the source!).
- 0:00 - Intro
- 3:00 - Avengers: Endgame
- 4:36 - What does Star Wars have to do with it?
- 6:52 - Use the Force, Harry
- 8:19 - Let's Encrypt
- 9:30 - HoloLens Demo @ Build
- 12:24 - Mostly Security Episode 37
- 14:26 - GitHub Ransomware
- 16:35 - Mostly Security Episode 39
- 20:11 - Container Misconceptions
- 31:42 - Tracking with :hover
- 35:23 - 2019 Texas Sand Fest
- 36:19 - Man Swallows AirPod
- 38:24 - Windows Terminal
Jon's in Ireland, Eric's in Oregon, both are half asleep. Cast/Snip, meet Sherlock. Hardware is hard. Kids are smarter than you think. Let's Encrypt is great. Cryptocurrencies gonna Cryptocurrency. Telnet Server on Wheels. Sneaky robots.txt. Renting a parking space is cheaper than Office Space. Finally, what every podcast needs is MORE COWBELL.
Jon does more bee stuff, and Eric releases a new version of Cast/Snip. Moare Farcebook password woes, McAfee partners with the University of Guelph, and unlocking laptops with faces is suspect. 1 in 4 people purposefully ignore security rules, identity theft sites can look good on the surface, and an iOS Chrome bug that lets malvertising run amok. For fun, Microsoft may remove password expiration as defaults, software hardware keys exist, bees survive Notre Dame fire, and Libby is still awesome.
- 0:00 - Intro
- 2:02 - New Version of Cast/Snip
- 3:40 - Instagram Passwords Logged
- 4:57 - McAfee partners with University of Guelph
- 6:25 - Fields of Blueberries (swarming bees)
- 7:57 - Kids + Pamphlets
- 10:27 - 1 in 4 Ignore Security Guidelines
- 18:29 - Phishing for Identity Theft
- 23:00 - Let's Encrypt Root Certificate
- 24:19 - Easter Chrome Attack
- 31:41 - Sane(r) Password Guidance
- 32:50 - Software Hardware Key
- 35:51 - Bees Survive Notre Dame Fire
- 36:54 - Libby is Still Awesome
Jon modifies a rootbeer request while Eric watches a movie by himself and Jon wires up a solar panel. Breaking: The internet needs to relax. Next: Ask yourself, who's tracking your child? Then: Apple makes nice with Qualcomm. Intermission: StackOverflow Developer Survey notes. Later: Father-Son Fire Fun. Coming soon: Space Billboards. Finally: Zork!
- 0:00 - Intro
- 4:34 - It's Alive!
- 6:40 - Let it go...
- 8:10 - The S in IoT is for Security
- 15:22 - Apple makes nice with Qualcomm
- 22:22 - StackOverflow Survey
- 36:15 - Fire Wall
- 40:08 - Space Billboard
- 42:00 - Zork!
Eric returns from California with head full of Google kool-aid and ears full of Gwen Stefani. Eero acquisition wasn't all roses, Facebook mobile SDK sends lots of data to Facebook, and a robo voice mailer data breach. Jon talks about training Alexa, and Eric wants the world to know and avoid stalkerware. For fun, we of course have pics of a BLACK HOLE. Also "Hacker" "News."
- 0:00 - Intro
- 0:49 - Google Cloud Next
- 7:11 - Eero Acquisition
- 10:50 - Privacy International on Facebook SDK
- 17:25 - Stratics Data Leak
- 23:52 - Alexa is Listening
- 28:58 - Against Stalkerware
- 31:57 - Motherboard on Stalkerware
- 33:05 - Pics or it's not a Black Hole
- 34:25 - Katie Bouman, Superstar
- 36:27 - The Schwarzschild Radius
- 36:56 - Suspected Burglar
- 37:54 - "Hacker" "News"
Eric misses Chicago and ends up in Texas eating a tomahawk. Water is still wet (aka Facebook data leak in the news again). Jon follows up with some ASUS/Shadowhammer info (then his cat chimes). Robocalls are bad. Java is now bad - or at least the unlicensed version is. Eric and Jon reminisce about Java. NuGet package signing info and heat moving at the speed of sound. Finally, something different. Jon talks about bees.
- 0:00 - Intro
- 2:27 - Tomahawk Steak
- 3:43 - Water is Still Wet
- 6:38 - ASUS Hack
- 8:17 - Jon's cat chimes in...
- 10:25 - Shadowhammer Targets
- 13:16 - Robocalls Bad
- 15:25 - Caller ID Auth Good
- 17:03 - STIR/SHAKEN
- 21:38 - Java License Extortion
- 24:40 - The Java Reminisce
- 30:22 - NuGet Package Signing
- 38:49 - Heat moves at speed of sound
- 43:03 - Bee Video
Cedric Cochin joins the podcast while Eric is on Spring Break. Norsk is still recovering from ransomware and Apple's News+ service is strangely open. ASUS distributed hundreds of thousands of malicious, signed updates, and heart implants that are vulnerable to attack. Cedric's vacuum cleaner is too smart, and Jon appreciates a fossil find in China.
- 0:00 - Intro, Welcome Cedric
- 2:24 - Norsk Recovering
- 7:08 - Apple News+
- 11:21 - Herd Immunity
- 12:09 - ASUS Malicious Updates (Shadowhammer)
- 20:16 - Heart Implants Remotely Controllable
- 24:47 - Falsifying Patient Vitals
- 29:25 - Too Smart Vacuum
- 33:30 - Spectacular Fossils
Cast/Snip is live. Jon corrects the record on SHA. Phone numbers are horrible identity proofs. Most AntiVirus for Android is garbage. Aluminum Ransomware. Mirai is not dead yet. Eric rides into Quantum Country. Jon sneaks a peek at an original iPhone prototype.
- 0:00 - Intro
- 0:10 - Cast/Snip is Live
- 1:33 - SHA is a hashing algorithm
- 4:40 - Phone Numbers Stink
- 12:47 - AV for Android Mostly Stinks
- 16:16 - Commodity Ransomware
- 24:18 - Mirai is not Dead Yet
- 29:24 - Quantum Country
- 33:19 - Apple M68
Eric's app (Cast/Snip) is launching soon, and Libby is awesome. Marriott discloses much more information about the previous Starwood breach, and Amazon has their own Project Zero. Microsoft releases a Windows 7 patch to add SHA-256 support, and Jon spends 15 minutes talking about serverless and serverless vulnerabilities. For fun we have potential dinosaurs, quantum mechanics turning back time, and new synthetic DNA pairs. Scientific fun FTW.
- 0:00 - Intro
- 0:33 - Cast/Snip
- 4:27 - Libby is Awesome
- 5:20 - Starwood Details
- 9:51 - Amazon Project Zero
- 14:05 - Windows 7 Signature Update
- 17:52 - Windows 7 Market Share
- 21:56 - Serverless Architecture
- 28:16 - 12 Serverless Risks
- 31:00 - Little Bobby Tables
- 36:48 - Making Dinosaurs
- 37:23 - Jeff Goldblum's Response
- 38:09 - Quantum Time Reversal
- 41:26 - 4 New DNA Letters
Jon's gonna catch himself some bees. Eric's trying to avoid getting sick. Facebook - uh, is still Facebook and there's still no cryptocurrency to be found. The NSA open sources a reverse engineering tool and, not to be outdone, Microsoft open sources a calculator. Your Chrome browser should have updated by now. McAfee gets a live look at servers used by North Korean Hackers. Jon pokes at a Drupal hack and a MongoDB leak - and then geeks about mice with infrared vision. Eric admires the Dangerously Funny.
- 0:00 - Intro
- 5:49 - Facebook 2FA Phone Shenanigans
- 7:28 - Facebook on Privacy?
- 8:50 - More Cryptocurrency Woes
- 9:51 - NSA - GHIDRA
- 11:11 - Windows Calculator
- 11:42 - Update Chrome!
- 13:19 - North Korean Hackers
- 14:55 - Video: North Korean Hackers
- 16:51 - Drupal Hack
- 24:15 - Caller ID App Ooops
- 28:40 - Mice with Infrared Vision
- 32:20 - Once Upon a Mattress
- 34:50 - Dangerously Funny
Jon is back from Arizona and Eric's playing seamster. Another cryptocurrency heist, another Ring vulnerability, how to abuse (web) Service Workers, and a hardware attack at bare metal clouds. For fun, both the NSA and Eric are on GitHub, and Jon had a good time at Biosphere2 and Taliesin West.
- 0:00 - Intro
- 0:53 - Suspicious White Powder
- 4:38 - More Cryptocurrency Fun
- 9:22 - Ring Doorbell Interception
- 19:17 - Abusing Service Workers
- 25:51 - Baremetal Cloud Firmware Attack
- 33:41 - NSA on GitHub
- 35:03 - MacWiFiChecker
- 37:13 - Biosphere #2
- 43:22 - Taliesin West
Jon is out, Peter is in. A listener has a question about using consumer devices at work - we kinda-sorta answered it. Followup on Facebook, Apple, Amazon Eero and Nike AirBricks. Eric likes PASTA (but can't figure out where the last A came from). Peter details Google's Ad Blocking changes. Eric finds out where he lived 750 million years ago and Peter loves a digital library.
- Intro (Reminder, Javascript != Python)
- Send us Questions!
- Enterprise Certs, Part X+1
- Enterprise Certs, Part XXX
- The $1 Bet
- The Nike Air Bricks
- Toyota PASTA
- Google Chrome and Ad Blockers
- 750 Million Years Ago
- Libby the Library App
Follow-up galore: Ubiquiti, Android transcription, the FaceTime bug, and USB-C encryption. MacOS needs a bounty program, Eero gets bought by Amazon, patch Tuesday fun, and using Mono to bypass Mac security. We remember Opportunity and recommend watching the Cassini episode of 7 Days Out.
- Intro
- Ubiquiti Homework
- Android Live Transcribe
- FaceTime Bounty
- Default Root Keys
- Mac Bounty Program
- Amazon Acquires Eero
- Eero + Alexa
- Patch Tuesday
- Mono on Mac
- Farewell Opportunity
- 7 Days Out
Eric has an app for taking snips of podcasts, Facebook gets their certs back and still TBD on the curious case of the Cryptocurrency Exchange CEO. Jon gets personal with a Ubiquiti bug while GoDaddy either has or doesn't have a bug - it isn't clear - but No More Ransom gets a call out, so whatevs. Eric has only one something fun while Jon has two. Again.
- Hotel Room Intro
- Eric's Cast/Snip App
- Facebook's Certs are Back
- Schrödinger's CEO
- Jon's Ubiquiti Bug
- GoDaddy's Spammy Bear
- Raspberry's Pi Issues
- AI's 3D Printing
- Google's Live Transcribe
Eric has a new mic, and Jon's bees are still alive. The Chromecast hackers were kids, shutdown fallout, and Japan takes a bold step in "hacking" its citizens. A huge FaceTime bug followed by YAFS (Yet Another Facebook Scandal) -- this time involving side loading an app to snoop on teenagers. What secrets does an old Smart Lightbulb hold, and another WiFi Chipset vulnerability. For fun: the Portland Auto Show, how old joysticks used to work, and a possible cause for Alzheimers.
- Intro
- More about Bees
- Chromecast Hackers Quit Internet
- Did Hackers Exploit Shutdown
- Japanese Government Hacking IoT Devices
- Facetime Group Chat Bug
- Facebook "Research"
- Smart Lightbulb Disposal
- WiFi Chipset Vulnerability
- Portland Auto Show
- DOS Joystick Hell
- A Cause for Alzheimers
Raj Samani, one of the founders of nomoreransom.org and the head of McAfee's Advanced Threat Research team joins the show. Eric confuses JavaScript and Python. Jon and Raj discuss statistical probabilities. Why do you ransom Cryptocurrency Miners? Because that's where the Bitcoin is. Raj reports on a new ransomware family. Eric likes fonts. Jon likes old sound cards. Raj is going to get his sneakers hacked.
- Intro
- Eric makes a mistake
- DNS Infrastructure Tampering
- Airport Security Sidebar...
- DNS Hijacking Campaign
- Miner Ransomware
- New Ransomware: Anatova
- Programming Fonts
- Sound Blaster 1.0
- Nike Self Lacing Shoes
- Raj Samani on Twitter
- Podcast: Komrade Cyber
Jon scares security guards, Eric teaches Python, and we have an open slack invite on mostlysecurity.com. The Ring article from last week never got much traction, beware the Facebook challenge, ancient vulnerabilities unearthed, and Troy Hunt loads another massive breach into HIBP. Eric's going to build a Pi calendar, measuring programming language efficiencies, and what are Fourier transforms anyway?
- Intro
- Join Our Slack If you Want...
- Ring Videos
- 10 Year Challenge
- SCP Client Vulnerabilities
- 773 Million Breached Records
- Pi Family Calendar
- Language Energy Efficiency
- Fourier Transforms
Hi, Canada! Where is the Krusty Krab anyway? Carriers are still kinda awful. More Android phones fail the Face Test. Crashcast Part 2. The Promiscuity of Ring Security Cameras. Eric reads from his Spam Folder. Jon questions data anonymization and learns something about IRSF. Eric can't wait for the iPhone YubiKey. Jon gets punk'd from '96.
- Intro (Hi, Canada!)
- Eric's Krusty Krab Konundrum
- Carriers are still kinda awful
- Followup: More Android #FaceFail
- Followup: Crashcast is Easy
- Amazon Ring Security? Cameras
- Don't fall for the scam
- There is no Anonymous Data
- International Revenue Share Fraud
- YubiKey for iPhones!
- Circuit Evolution
- Is this the Krusty Krab?
Eric and Jon celebrate the new year in style (not). Weeding out Craigslist ads and Jon wants a Prusa 3d printer. USB-C gets authentication (and a rant from us) and remotely playing videos on Chromecast devices. For fun: millitext, the origins of BASIC, and China lands a rover on the Dark Side of the Moon.
- Intro
- Prusa i3 MK3
- USB-C Authentication
- ChromeOS blocks USB when Locked
- Chromecast Hack
- Millitext
- Origins of BASIC
- China Lands Moon Rover
Christmas Skiing, Drone Crashing, and Fake Glitter Bombs. Eric rants (politely) about passwords (again) and Jon talks Hot Tubs and Cryptocurrencies... (What?) Play a game and learn VIM at the same time - and, just FYI, IPv6 is a lot of address space.
- Intro
-
DroneCrashmas
- Partially Faked Glitter Bomb
- Never reveal your password
- Hot Tub Hacking
- More Bitcoin Thievery
- VIM Adventures
- Merry IPv6 Christmas!
Jon (maybe?) saves his bees, Beaverton schools on lockdown, glitter bombs, and cryptojacking on the rise. SMS is weak 2FA, FaceId on Android easily fooled, steganography is real, CenturyLink behaves unethically, and Microsoft adds a Windows sandbox. Eric likes terrible maps and Jon watches more YouTube.
- Intro
- Winterizing Bee Hives
- Beaverton School Lockdown
- Glitter Bomb
- Cryptojacking on the Rise
- Bypassing SMS 2FA At Scale
- Fooling FaceID
- Malware Commands in Images
- Free McAfee Steganography Tool
- CenturyLink Forces Ad
- Windows Adds Sandboxing
- Terrible Maps
- Frank Makes
Eric's office nears completion, and Jon experiments with yogurt. Followup about the crypto crash and the Marriott breach. An Android trojan that skirts 2FA, malware on the high seas, and the biggest data breaches of 2018. Eric likes Amazon's honey packages (no bees included), and Jon likes a "unique" assembler project.
- Intro
- Yogurt Making
- Nvidia Stock Crash
- Ex-Starwood Executive Speaks
- Tricky Android Trojan
- Malware on Ships
- Top 21 Data Breaches of 2018
- Grand Challenge Accepted
- Honey Packages
- Batch Assembly
Where, O Where, have my Cryptocurrencies gone? Are they hidden in what IBM is dumping? Are they sneaking into Microsoft's new OS? Maybe they are lost in the Marriott/Starwood Data Breach? Where ever they've gone, we don't know. But Microsoft is publishing more of their Minstrel Song as Open Source and the Apple Bards are sharing their Oral Histories with the world.
- Blockchain Study: 0 for 43
- Global Costs to Mine Bitcoin
- Mining Calculator
- Will Bitcoin become worthless?
- IBM dumping Notes
- Microsoft Windows Lite?
- Marriott Data Breach
- Microsoft Open Sources more stuff
- Infinite Loop. An Oral History.
- folklore.org
- He Invented It...
- -2000 Lines of Code
Eric fixes a leaky faucet, Jon manages to avoid salad. After some 2 for 1 followup, Stallman wants in on the digital currency scene, Jon <3 AWS re:Invent and Eric gets to make fun of JavaScript (again). To finish up, We are all about that Space (about that Space...)
- Intro
- Swedes get Chipped
- FBI AdFraud Sting
- Stallman and Digital Cash
- Exposed ElasticSearch
- AWS re:Invent
- Event Stream Maintainer?
- VS Code
- Rocket Launch viewed from ISS
- Mars Insight
Eric and Jon prep for Thanksgiving, while companies don't invest in Cybersecurity. Duo talks Secure Boot on the T2 chip, Jon lets his inner conspiracy theorist out, and Windows Store now accepts ARM64 builds. If getting a digital implant, best to do it sober! Three fun things this week: lyrics analysis, Frankenstein, and judgement of Thanksgiving side dishes.
- Intro
- Cybersecurity Priorities
- Secure Boot on the T2
- A12X is FAST
- Windows on ARM64
- It's Bitcode not Bincode
- Don't Forget Your Implant PIN
- Repetitive Song Lyrics
- The First Frankenstein
- Side Dishes of Thanksgiving
Cloudflare launches DNS Privacy apps for iOS and Android, a security "researcher" gets his hand caught in Krebs' cookie jar, and more speculative execution in x86-land. Jon describes his favorite whistle and Eric discovers you can build a cashless payment system without a blockchain.
- Intro
- Cloudflare's DNS Privacy Apps
- "Researcher" playing both sides...
- More Speculative Execution @ Intel
- WHLSL
- Sweden goes cashless (sans blockchain)
Eric continues basement construction, and Jon gets stung (but not by a bee). A tale of two cryptocurrency topics: the good and the sad. HSBC is breached, but we doubt the statistics about successful credential stuffing. And Krebs has a great article about skimmers in your online shopping cart. DeOldify is machine learning for colorizing old photos, and Eric's got three fun things this week.
- Intro
- Yellow Jacket != Honey Bee
- More Upload Plugin Fail
- Statcounter Trojan Horse
- Cryptocurrency Tumblers
- Ethereum City
- Celebration, Florida
- HSBC Breach
- Cart Skimmers
- Bend Trails
- Paypal Data Sharing
- Dorking for Printers
- DeOldify
Happy Halloween! We reflect on some ad fraud and right to repair followup, contemplate CAPTCHAs, cerebrate insecure devices, ponder Big Blue and their Red 34-billion-gallon Hat, and, uh, think, or errm, well, you know, chat about, um, filler words and top it all off with some good ol' reinforcement learning.
- Happy Halloween! Now go Vote.
- Ad Fraud Followup
- Right to Repair Followup
- Google reCAPTCHA v3
- Google Home Insecurity
- GitHub Incident Writeup
- IBM Buys RedHat
- How to Stop Saying "Um", "Ah" and "Ya Know"
- Reinforcement Learning
Implausible Bloomberg followup, JQuery plugin vulnerability (not JavaScript!), and no more GrayKey. An interesting theoretical Cromium vulnerability and an absolutely epic ad fraud article. Eric's screentime has stopped working, and Jon enjoyed the Apologetic Miner.
- Intro
- Kumoricon
- LibSSH Docker Container
- Implausible Supermicro
- JQuery Plugin "Zero Day"
- GrayKey Stops Working
- Cromium Vulnerability
- Massive Ad Fraud
- Screen Time in iOS 12
- The Apologetic Miner
Jon and Eric, live(ish) from Las Vegas! Facebook (again) and the coming PHPocalypse, along with a vulnerability in libssh. Jon learns about The Big Mac Index on a trip to Argentina and Eric geeks about The Illustrated TLS Connection.
- Intro
- McAfee MPOWER
- Jon's Root Beer
- Facebook Update
- Facebook Portal
- The PHPocalypse
- Vulnerability in libssh
- The Economist publishes...
- ...The Big Mac Index on GitHub
- The Illustrated TLS Connection
Eric and Jon both use chat support for network gear, the Bloomberg story gets stranger, and a double pile on Facebook and Google Plus. Microsoft joins OIN, opening up its patent portfolio. For fun Eric likes The Good Place, and Jon likes both The Broken Earth trilogy as well as binary layout optimization(??).
- Intro
- Frontier Woes
- Amplifi Teleport Setup
- Bloomberg Followup
- More Bloomberg Followup
- Facebook's Access Token Bug
- Verge on FB Breach
- Whatsapp Video Vulnerability
- Google Plus No More
- Microsoft Joins OIN
- The Good Place
- Codestitcher
- The Broken Earth
Burgerville isn't safe from data breaches, despite their fabulous fresh fruit milkshakes. The GRU minions make some rookie mistakes. Aaaand, boom. Bloomberg drops the "All your hardware are belong to us" bomb. Eric likes Volkswagen, Jon likes doodles, and they both like Weird Al...
- Burgerville breach
- FBI Report: FIN7
- Wired: FIN7
- Followup - Episode 41: Freeze your Credit
- Reckless campaign by Russian military
- Car registration leak...
- Bloomberg: The Big Hack
- Eclypsium: Hardware Supply Chain Threats
- @thegrugq: Supply Chain Security
- Risky Business Podcast
- Patrick Gray: Doubling Down
- Volkswagen for CI
- Tess Ferrandez: Deep Learning
- Weird Al: Mission Statement
A class action lawsuit is filed for NCIX data sale, 854 million worth of cryptocurrency has been stolen in 2018, and Monero fixed a catastrophic bug which would allow someone to 'print' money. Google backs off forced logins to chrome after pressure from the community. Why we have insecure software, and Facebook demonstrates the opposite of Google's old mantra. More software musings and Azure Functions 2.0 debuts.
- NCIX Class Action Lawsuit
- $854 Million Worth of Cryptocurrencies Stolen in 2018
- Monero "Catastrophic" Bug
- Vess' Monero Comment
- Chrome Auto-login
- Matthew Green Chrome Rant
- Why Software Remains Insecure
- Facebook Allows Targetting by "Shadow Contact Information"
- Notes About Software
- Azure Functions 2.0 Launches
- 42
Right to Repair is back with Tractor Talk. Eric chats cryptocurrency losses and potential losses. Jon agrees with Jeff, there is only security - and what happens to computer data when a company goes under? Eric hikes a volcano and Jon freezes his credit.
- Farm Lobby & Right to Repair
- Episode 009
- Cryptocurrency Exchange loses 60 million
- The Bitcoin Bug was Really Bad™
- There is only Security
- Digital data from a defunct business
- Eric hikes Mt. St. Helens
- Free Azure CI/CD Pipelines
- Free Credit Freezes
Eric talks Blockchain security at LA conference, another MongoDB is exposed on the internet, and California poised to pass an IoT security law. Aadhaar grand challenge (episode 32) accepted -- evidently Aadhaar enrollment software is routinely modified. For fun, Eric suggests the Netflix Origins series, and Jon collects and stores seeds for next spring.
- Eric at MWC Americas
- Marketing Database Exposed
- Mongo Security Guidance
- CA IoT Regulations
- Aadhaar Software Vulnerabilities
- UIDAI Denial
- Netflix Origins
- Collecting Flower Seeds
Jon makes root beer. Eric paints. Google Chrome turns 10. Exposing your .git on the web. First email addresses and the Web Design Museum.
- Google Chrome Turns 10
- Browser Wars
- Exposed .git on the Web
- What's a Tarpit?
- Join in part Canadian?
- Smashing Security Podcast
- Web Design Museum
Back from two more road trips. What life is like when your last name violates profanity filters, and horror stories from (maybe?) an ex-Tesla IT person. Fun with spammers and a book-length article about What-Is-Code.
- WA International Kite Festival
- "Offensive" names
- Former Tesla IT Engineer Stories
- GitHub DDoS Recovery
- Spamming Spammers
- What is Code?
Scam phone calls are still a thing and apparently you can hack multifunction printers by sending a malicious fax. Eric can't describe a video and Jon bends spaghetti.
- Followup: Hacking voting machines
- Quick Take: Teen Hacks Apple
- Phone Scams - "Windows Security"
- Phone Scams - "IRS Sends Local Cops"
- IRS Back to School Scam Alert
- Hacking by fax
- Sidenote: It is Gif as in Gift, Jon
- Fabricated
- Spaghetti Bending
- Backstory: The Adam Savage Quote
Blackhat and Defcon roundup, including the keynote, voting machine hacking, breaking voice authentication, and hacking various devices, like heartbeat monitors, tornado alarms, and bodycams. Eric asks about early books, and it's Palindrome Week in the land of goofy date formats.
- Blackhat Week
- Parisa Tabriz Keynote
- 11 Year Old Hacking
- Cracking Voice Authentication
- Spoofing a Heartmonitor
- San Francisco Alarms
- Bodycam Vulnerabilities
- Eric -- Danny the Champion of the World
- Jon -- Hardy Boys
- Palindrome Week
Mobile phone voting? Ummm... Its a little more complicated than people believe. Comcast fixes some bugs. Jon wants a BioReactor. Eric brags about his "Porsche".
- Underwater Fish Cam
- Episode 027!
- Mobile Phone Voting
- GossiTheDog on Voting
- Voatz Response
- XKCD on Voting
- Comcast Bugs!
- Reset Apple Watch without Passcode
- We grew a lung!
- Eric's First Car: '67 VW Bug
- Jon's First Car: '73 Oldsmobile Cutlass Supreme
Eric is STILL fishing, but in Idaho. Recording on battery in his truck (dedication!). Edge gets Web Auth support, inmates in Idaho get free emails, and Reddit is breached via SMS. Software continues to eat the world and Verizon has released a great visualization tool against years of DBIR reports. Hiking and a bit of Apple introspection for fun.
- Edge Gets U2F
- Reddit Breach
- Inmate Exploitation
- 2011: Software Is Eating the World
- DBIR Data Visualizations
- Take a Hike...
- Apple @1T Cash View
- Four Million Beta Users
Eric successfully fishes, and Jon fixes his QNAP issue. Google says they haven't been phished since deploying U2F keys in 2017. Chrome flags HTTP sites as 'Not Secure' and Troy posts a video for why HTTPS matters even for static 'marketing' sites. Old movie GIFs and water on Mars.
- QNAP Issue was Plex
- Can't Phish This (Google)
- Just Having 2FA isn't Perfect
- Chrome 68 Arrives
- Integrity Matters
- https://www.reddit.com/r/silentmoviegifs/
- Water On Mars
Jon returns from camping so Eric can go fishing again. Costco still sells hot dogs, the Polish dogs have just migrated to Sam's Club. A trip through anti-cheat development at Riot Games, and a raft of QNAP vulnerabilities. Chickens are fun! As are javascript games...
- Sam's Club Pounces
- DeepFake Deep Dive
- Aadhaar Grand Challenge
- AntiCheat==Malware Evasion?
- QNAP Command Injections
- Silicon (Chicken) Valley
- Jelly Mario!
Marcelo DaCruz joins to meander through various topics that include a little cryptocurrencies, promoting other podcasts, malicious World Cup apps, 4th of July data breaches, password managers, and wrapping car keys in foil. Oh, and Costco. And what Marcelo's first Amazon purchase was. Whew!
- IOTA is worth 3 billion?
- Ethereum's Blockchain is 1TB
- Hamas Lures Israeli Soldiers
- Risky Business Podcast
- Golden Cup Cyber Threat
- Timehop Data Breach
- Apple to deploy 1Password
- Wrap your key fob in foil
- Charlie Miller's thoughts
- Costco kills the hot dog
- Marcelo's first Amazon purchase
Eric rants about cryptocurrencies, Jon speculates about a billion ten year olds. Eric likes watching zoo animals and Jon appreciates fireworks in another state. Happy Independence Day, America!
- Oregon State wins the College World Series
- Gentoo Linux Incident
-
Cryptocurrencies, again...
- IOTA wut?
- EOS huh?
- Ways to think about machine learning
- Oregon Zoo
- Fireworks
Jon's bees don't cooperate and Eric watches baseball. Docker hub containers that mine Monero for their own benefit and a Kubernetes honeypot; Tesla's malicious insider and insider threats in general. AI assisted slow motion, NES on the playgrounds, and what it costs to run a worldwide data service.
- Intro - Bees Do Their Own Thing
- Intro - OSU Survives in College World Series
- Followup - Yubikey supports more than just Chrome
- Malicious Docker Images
- Kubernetes Honeypot
- Tesla's Malicious Insider
- Significance of Insider Threats
- AI Assisted Slow Motion
- NES in Swift Playgrounds
- Troy Hunt Takes One for the Team
Eric rewatches The Matrix. Jon rewatches an assortment from Studio Ghibli. But enough about movies. Some followup with a bit more followup. Did you know your browser can talk directly to USB devices and that your router knows where you live? Eric finds a "smart lock" that suggests you not look behind the curtain. Jon expresses more love for serverless utilities.
- Followup from E025 - Selling your location
- Followup from E026 - Apple's Notarized Apps
- Followup from E009 - Right to Repair
- Followup from E026 - 3D Printed Homes in The Netherlands
- WebUSB and Yubico 2FA
- Google knows where you live
- Google home location leak
- "Unbreakable Smart Lock" #fail
- pulumi.io
Eric goes fishing (with an 'f'), Jon has baby goats, and hacking Windows 10 via Cortana. Treat robots as you would like them to treat you, and an underwater datacenter.
- Win10/Cortana Vulnerabilities
- Google Assistant Android Advantage
- Don't Kick That Robot
- Microsoft's Underwater Data Center
Microsoft buys GitHub and now we'll see what that actually means. Apple WWDC surprises developers with cool stuff. Antoni Gaudí wishes he had a concrete printer. Jon continues to explore his love for open source.
- GDPR Followup
- Amazon Alexa ODM Solutions
- Sonos Beam
- Microsoft Buys GitHub
- Microsoft + GitHub + Concerns?
- Apple WWDC - Notarized Apps
- Apple WWDC - Parental Control
- Printing a House
- Barcelona and the Sagrada Família
- Open Source Mac Apps
Eric has to deal with a stolen credit card. Jon checks in again on the telcos who resell your location data. Your Amazon cylinder might email an audio recording to someone. GDPR makes the web much faster. Eric likes time, Jon almost likes Apple.
Notes:
- Krebs follow up on location data tracking
- Alexa eavesdropping scandal
- GDPR Fallout
- All about time by Zach Holman
- Steam Link! Oh, wait...
Comcast gets two bits of followup; look up the real-time location of nearly any cell phone user in the states; more Google duplex and cylinder security; a Sunday sermon with some Oatmeal.
Links:
- Followup: eFail (nice lego dumpster fire) - https://boingboing.net/2018/05/21/mime-considered-harmful.html
- Followup: Comcast Mesh - https://www.engadget.com/2018/05/21/comcast-is-now-selling-mesh-wifi-pods-to-its-internet-customer/
- Followup: Comcast Leaks - https://www.engadget.com/2018/05/22/xfinity-bug-revealed-personal-data-router/
- Don't Share the Where - https://krebsonsecurity.com/2018/05/mobile-giants-please-dont-share-the-where/
- More Google Duplex - https://9to5google.com/2018/05/21/google-duplex-explained-turing-test/
- Cylinder Security - https://www.techrepublic.com/article/smart-office-secrets-alexa-siri-and-google-assistant-could-hear-commands-the-human-ear-cant/
- Do You Hear Laurel? - https://www.nytimes.com/interactive/2018/05/16/upshot/audio-clip-yanny-laurel-debate.html
- Adam Savage's Sunday Sermon - https://youtu.be/krTMy64VusE
- The Oatmeal: Making Things - http://theoatmeal.com/comics/making_things
Eric's password buttons were pushed this week, not-so-secure eMail clients, and a touch of Google I/O. Fake coin offerings and ... a knife?
Links:
- Password Rant - https://twitter.com/ericwuehler/status/996509740673908736
- Followup: Eero + Echo - https://daringfireball.net/thetalkshow/2018/05/08/ep-221
- Weird Al Hamilton Polka - https://www.youtube.com/watch?v=3v0c6smpHSk
- eMail Client Vulnerabilities - https://efail.de/
- Google I/O - https://www.theverge.com/2018/5/8/17328828/google-io-keynote-summary-highlights-news-recap-2018
- Ordering with a Voice Assistant - https://twitter.com/jonathan_b_king/status/996517910158819335
- Buy Howeycoins! - https://www.howeycoins.com/index.html
- Cutco Cheese Knife - https://www.cutco.com/products/product.jsp?item=traditional-cheese-knife
Logging in with only a physical key, Twitter's oopsie, Facebook fires a stalker and Signal's messages do not "self-destruct". Jon chats about stuff from the Microsoft Build conference. Eric still likes Netflix. Jon likes books.
Links:
- Gigabit Router Followup - Botnet - https://www.zdnet.com/article/botnets-competing-to-attack-vulnerable-gpon-fiber-routers/
- Gigabit Router Followup - Fix - https://thehackernews.com/2018/05/protect-router-hacking.html
- Death to Passwords! - https://www.yubico.com/2018/04/yubico-and-microsoft-introduce-passwordless-login/
- Twitter logs passwords - https://blog.twitter.com/official/en_us/topics/company/2018/keeping-your-account-secure.html
- Facebook fires analyst for stalking - https://arstechnica.com/information-technology/2018/05/facebook-fires-security-analyst-accused-of-using-access-to-stalk-women/
- Signal notifications do not self-destruct - https://motherboard.vice.com/en_us/article/kzke7z/signal-disappearing-messages-are-stored-indefinitely-on-mac-hard-drives
- Microsoft Build 2018 - https://www.theverge.com/2018/5/8/17319908/microsoft-build-conference-2018-news-recap-highlights-windows-10
- Netflix: Lost in Space - https://www.netflix.com/title/80104198
- Book: Old Man's War - https://www.amazon.com/Old-Mans-War-John-Scalzi-ebook/dp/B000SEIK2S/
Jon describes farm equipment, while Eric teaches driving lessons. Routers around the world are vulnerable, and a critical battle is won for the open web. A fun book tracking hackers and a crazy project for a VGA adapter.
Links:
- What is a flail? - https://en.wikipedia.org/wiki/Flail_mower
- Oregon Instructional Permit - http://www.oregon.gov/ODOT/DMV/TEEN/pages/permit.aspx
- Vulnerable GPON Routers - https://threatpost.com/millions-of-home-fiber-routers-vulnerable-to-complete-takeover/131593/
- Not a Computer Crime - https://www.eff.org/deeplinks/2018/04/dc-court-accessing-public-information-not-computer-crime
- Python Environment - https://www.xkcd.com/1987/
- The Cuckoo's Egg - https://www.amazon.com/Cuckoos-Egg-Tracking-Computer-Espionage/dp/1416507787/
- Software Defined Radio - https://osmocom.org/projects/osmo-fl2k/wiki/Osmo-fl2k
Eric is back from the road trip. IoT, the gift that keeps on giving. Eric chats about hotel security cards. Jon channels Harry Potter with Obiliviate DNS. The Grand Canyon is really cool and Jon tries installing a garage door opener.
Links:
- Grand Canyon - https://www.nps.gov/grca/index.htm
- Ski lift exposed to the internet - https://www.golem.de/news/patscherkofel-gondelbahn-mit-sicherheitsluecken-1804-133930.html
- Hotel key card security - https://wired.trib.al/RkHWQ0U
- The Hotel Hacker - https://www.wired.com/2017/08/the-hotel-hacker/
- Oblivious DNS - https://www.techrepublic.com/article/oblivious-dns-could-protect-your-internet-traffic-against-snooping/
- BGP Hijack - https://www.welivesecurity.com/2018/04/25/ethereum-cryptocurrency-wallets-raided/
Peter Wooley joins Jon to talk javascript while Eric cannot prevent it. NPM gains package signing capabilities; a casino is hacked courtesy of their fish tank; and once DeepFake matures, how do we tell what's real? Peter recommends playing Celeste on the Switch, Jon should have read a couple more books about bees, and clicky keyboards are awesome.
Links:
- Peter Wooley on Twitter - https://twitter.com/peterwooley
- Javascript won! - https://hackernoon.com/javascript-has-already-won-235b29ed126b
- NPM signed packages - http://blog.npmjs.org/post/172999548390/new-pgp-machinery
- Typosquatting packages - http://incolumitas.com/2016/06/08/typosquatting-package-managers/
- Fish Tank Thermometer - https://thehackernews.com/2018/04/iot-hacking-thermometer.html
- Pi-hole - https://pi-hole.net/
- WiFi Grill - https://greenmountaingrills.com/
- DeepFake Videos - https://www.buzzfeed.com/craigsilverman/obama-jordan-peele-deepfake-video-debunk-buzzfeed
- Celeste - https://en.wikipedia.org/wiki/Celeste_(video_game)
- More Bees! - https://en.wikipedia.org/wiki/Nuc
- Clicky keyboard - https://www.engadget.com/products/razer/blackwidow/chroma/
Gmail doesn't follow email address standards; having your accountant hacked is Not Good; and confidential data is found in VirusTotal. Eric shares a fun what-if, and Jon is mesmerized watching sorting algorithms.
Links:
- Followup - PF Chang's vs. Panera - https://medium.com/@AkshaySharmaUS/p-f-changs-security-flaw-revealed-following-panera-bread-s-leak-b47fa6a1bba6
- Google says: Ignore Those Dots! - https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-to-scam-a-gmail-user.html
- When Accountants Don't Patch - https://krebsonsecurity.com/2018/04/when-identity-thieves-hack-your-accountant/
- Confidential Data in VirusTotal - https://threatpost.com/malware-scanning-services-containers-for-sensitive-business-information/124802/
- Space Jetta - https://what-if.xkcd.com/142/
- 15 Sorting Algorithms in 6 Minutes - https://www.youtube.com/watch?v=kPRA0W1kECg
Jon chats about his car and beekeeping. Cloudflare's Privacy Focused DNS and an ARM v Intel post. Will Apple use its own chips in it Macs? And poor, poor Panera... Eric tries hiking Multnomah Falls and ends up hiking somewhere else. Jon gets a kick out of colors.
Links:
- If you have an iPhone, use Overcast - https://overcast.fm
- Cloudflare's Privacy Focused DNS - https://1.1.1.1/
- Dot-cm Typosquatting sites visited 12M times - https://krebsonsecurity.com/2018/04/dot-cm-typosquatting-sites-visited-12m-times-so-far-in-2018/
- Beyond XSS: Edge Side Include Injection - http://gosecure.net/2018/04/03/beyond-xss-edge-side-include-injection/
- Apple Plans to Use Its Own Chips in Macs From 2020, Replacing Intel - https://www.bloomberg.com/news/articles/2018-04-02/apple-is-said-to-plan-move-from-intel-to-own-mac-chips-from-2020
- Intel v ARM power reqs - Killowatt - https://twitter.com/eastdakota/status/976560820611031040
- ARM Takes Wing: Qualcomm vs Intel CPU comparison - https://blog.cloudflare.com/arm-takes-wing/
- Panera doesn't take Security Seriously - https://medium.com/@djhoulihan/no-panera-bread-doesnt-take-security-seriously-bf078027f815
- Eric (tries) hiking in the Gorge - https://www.fs.usda.gov/recarea/crgnsa/recarea/?recid=30026
- Jon likes Color (courtesy of xkcd) - https://blog.xkcd.com/2010/05/03/color-survey-results/
Eric sees Ready Player One opening day. Boeing is hit by WannaCry and researchers demonstrate spoofing facial recognition using IR emitters in a ball cap. Someone built a game using HIBP passwords ("My Little Pwnage"). A personal VPN hotspot and a glowing meteorite ring.
Links:
- Ready Player One - http://readyplayeronemovie.com/
- Boeing + WannaCry - https://www.seattletimes.com/business/boeing-aerospace/boeing-hit-by-wannacry-virus-fears-it-could-cripple-some-jet-production/
- Invisible Mask Attack - https://arxiv.org/pdf/1803.04683.pdf
- My LIttle Pwnage - https://mylittlepwnage.eu/
- Amplifi Teleport - https://amplifi.com/teleport/
- Carbon Fiber and Meteorite Glowstone Ring - https://youtu.be/K2VWLT63_cI
What does Zuckerberg mean by dust in the chickens, exactly? If you look at the bitcoin blockchain, more than just bitcoin transactions can be found. AI learns to WIN by cheating. How safe is your bitcoin hardware wallet? Checking out the StackOverflow Developer Survey. Muppets and IKEA.
Links:
- Chicken Dusting? - https://www.theverge.com/2018/3/21/17150270/mark-zuckerberg-facebook-regulated
- AMD Follow up - https://community.amd.com/community/amd-corporate/blog/2018/03/21/initial-amd-technical-assessment-of-cts-labs-research
- What's in the Bitcoin Blockchain? - https://www.theguardian.com/technology/2018/mar/20/child-abuse-imagery-bitcoin-blockchain-illegal-content
- Serverless and Container Adoption - http://www.zdnet.com/article/serverless-computing-containers-see-triple-digit-quarterly-growth-among-cloud-users/
- AI Learns to play Tic Tac Toe - http://www.zdnet.com/article/serverless-computing-containers-see-triple-digit-quarterly-growth-among-cloud-users/
- Hardware wallet Security - https://krebsonsecurity.com/2018/03/15-year-old-finds-flaw-in-ledger-crypto-wallet/
- StackOverflow Developer Survey - https://insights.stackoverflow.com/survey/2018/
- Muppet Guys Talking - http://muppetguystalking.com
- IDEA Instructions - https://idea-instructions.com
MemFixed sends flush packets to memcached servers. Security tools start showing up for Ethereum. ISPs insert spyware into downloads from legitimate sites. Carl joins to discuss the recently disclosed AMD vulnerabilities.
Links:
- Followup - MemFixed - https://www.bleepingcomputer.com/news/security/memfixed-tool-helps-mitigate-memcached-based-ddos-attacks/
- Ethereum Security Tool - https://blog.trailofbits.com/2018/03/09/echidna-a-smart-fuzzer-for-ethereum/
- Government injected spyware - https://citizenlab.ca/2018/03/bad-traffic-sandvines-packetlogic-devices-deploy-government-spyware-turkey-syria/
- AMD Vulnerabilities - https://www.wired.com/story/amd-backdoor-cts-labs-backlash/
- Two Photos, one millisecond - https://petapixel.com/2018/03/07/two-photographers-unknowingly-shot-millisecond-time/
- Numberphile - http://numberphile.com/videos/analytical_continuation1.html
Security implications of Google's Android 'P' first developer preview. Newly unclassified documents from 2016 (likely Shadow Broker fallout). Girl Scout cybersecurity badges and drones in Puerto Rico.
Links:
- GitHub DDoS - https://github.com/649/Memcrashed-DDoS-Exploit
- Android P security features - https://www.theverge.com/2018/3/7/17088394/android-p-developer-preview-notifications-kotlin-microphone
- Android ecosystem statistics - https://developer.android.com/about/dashboards/index.html
- Unclassified 2016 'BOD-16-02' - https://twitter.com/RidT/status/970880435411709952
- Girl Scouts cybersecurity badges - https://www.nbcnews.com/tech/tech-news/girl-scouts-fight-cybercrime-new-cybersecurity-badge-n852971
- Drones in Puerto Rico - https://www.wired.com/story/drones-electricity-puerto-rico/
Jon is back from Florida. Is it Trust-ICO or Trustico? Anatomy of an Amplification Attack. Visualizing data and watching documentaries.
Links:
- Trustico emails private keys - https://arstechnica.com/information-technology/2018/03/23000-https-certificates-axed-after-ceo-e-mails-private-keys/
- GitHub does not <3 open memcached - https://www.wired.com/story/github-ddos-memcached/
- LA Times Open S3 == Cryptojacked - https://threatpost.com/cryptojacking-attack-found-on-los-angeles-times-website/130041/
- Jon's pwned password - https://haveibeenpwned.com/Passwords
- Jon's Something Fun: Visual Capitalist - http://www.visualcapitalist.com/
- Eric's Something Fun: Round Planet - https://www.netflix.com/title/80212704
We chat CSS Keyloggers and are not worried. Careful what you put into securityheaders.io. Is your Password in the list of 500 million known passwords? And you can't chat with Peter without a Disney sidetrack.
Links:
- CSS Keyloggers - https://www.bram.us/2018/02/21/css-keylogger-and-why-you-shouldnt-worry-about-it/
- securityheaders.io - https://securityheaders.io
- Pwned Passwords - https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/
- Avatar Flight of Passage - https://disneyworld.disney.go.com/attractions/animal-kingdom/avatar-flight-of-passage/
- Check your Password - https://haveibeenpwned.com/Passwords
- Peter's Something Fun: D&D Starter Set - https://www.amazon.com/dp/B00SI774U6
iFixit and the iPhone X Teardown, Consumer Reports is now adding Security and Privacy into their electronic device ratings, Telegram has a Zero-day vulnerability due to a Right-to-Left Unicode character and Salon.com wants to mine cryptocurrencies in exchange for viewing their website. Jon talks about building a Raspberry Pi time-lapse video and Eric talks about StackOverflow stats.
Links:
- iFixit and iPhone X Teardown - https://video.vice.com/en_us/video/motherboard-ifixit-worlds-best-iphone-teardown-repair/5a01b91b177dd416f530a081
- Consumer Reports adds Security and Privacy - https://www.consumerreports.org/televisions/samsung-roku-smart-tvs-vulnerable-to-hacking-consumer-reports-finds/
- Zero-day Vulnerability in Telegram - https://securelist.com/zero-day-vulnerability-in-telegram/83800/
- Unicode character crashes iPhones - https://techcrunch.com/2018/02/16/iphone-bug-telugu-unicode-ios-mac-text-bomb/
- Salon.com wants to mine cryptocurrencies - https://www.salon.com/about/faq-what-happens-when-i-choose-to-suppress-ads-on-salon/
- Python library for checking astral data - https://pypi.python.org/pypi/astral
- Eric checks StackOverflow stats - https://stackoverflow.com/users/251299/eric
- Jon's stats on StackOverflow - https://stackoverflow.com/users/4155/niniki
Carl talks meltdown/spectre from the trenches. Jon fawns over the Falcon Heavy launch. Eric yaps about Right to Repair and Hacking John Deere tractors. Carl wants an alarm clock, buys an Alexa - its all downhill from there, and it is Cedric's fault.
Links:
- Netflix Repokid - https://medium.com/netflix-techblog/introducing-aardvark-and-repokid-53b081bf3a7e
- Transaction Synchronization Extension - https://software.intel.com/en-us/node/524022
- Falcon Heavy Launch - https://www.space.com/39632-spacex-falcon-heavy-launch-whats-next.html
- Tesla added to US satellite catalog - https://twitter.com/AFSpace/status/961371676582797313
- Right to Repair - https://repair.org/
- Hacking Tractors - https://motherboard.vice.com/en_us/article/xykkkd/why-american-farmers-are-hacking-their-tractors-with-ukrainian-firmware
- Carl buys an Echo Spot - https://www.amazon.com/Amazon-VN94DQ-Echo-Spot-Black/dp/B073SQYXTW/
Jon's roof doesn't collapse. Eric talks about a moon and snow caving. Then they actually talk about security stuff. Sorta. Thoughts on Chronicle, Alphabet's now named security company. Then, is there a solution for the AWS IAM permissions? And "Jackpotting" ATMs is the new thing in the US (Yay! WinXP!). Finally, Eric wants to know the first thing you bought on Amazon and Jon is looking to get stung.
Links:
- Alphabet announces Chronicle: https://chronicle.security
- PolySwarm.io: https://polyswarm.io/
- Using AWS X-Ray to achieve Least Privilege: https://medium.com/@glicht/using-aws-x-ray-to-achieve-least-privilege-permissions-93dfd6701318
- Snyk.io: https://snyk.io/
- Functional One - AWS Least Privilege: https://github.com/functionalone/aws-least-privilege
- Jackpotting: https://krebsonsecurity.com/2018/01/first-jackpotting-attacks-hit-u-s-atms/
Jon and Eric ramble through a few completely random topics. Pointless flaws in Apple Preference Panes, Stripe says goodbye to Bitcoin, Burger King takes on Net Neutrality and Jon almost earns himself a Darwin Award.
Links:
- Flaw in AppStore System Preferences: https://www.macrumors.com/2018/01/10/macos-high-sierra-app-store-password-bug/
- Stripe drops support for Bitcoin: https://stripe.com/blog/ending-bitcoin-support
- 50 Cent is a Bitcoin Millionaire: https://www.theverge.com/2018/1/24/16930010/50-cent-rich-bitcoin-twitter-instagram-humblebrag
- Linus rants... https://lkml.org/lkml/2018/1/21/192
- Whopper Neutrality: http://www.latimes.com/business/la-fi-net-neutrality-burger-king-20180125-story.html
- Montana signs on net neutrality rules: https://www.engadget.com/2018/01/22/montana-governor-executive-order-requires-net-neutrality/
- SymPy: http://www.sympy.org/en/index.html
- @AwardsDarwin: https://twitter.com/AwardsDarwin/status/956362264453533696
Jon and Eric chat about stuff completely unrelated to security, with bonus tangents!
Links:
- Shadows Over Camelot: http://www.theboardgamefamily.com/2010/06/shadows-over-camelot-noble-quest-for/
- The Laundroid: https://www.theverge.com/2018/1/10/16865506/laundroid-laundry-folding-machine-foldimate-ces-2018
- Crash of the Cryptocurrencies: https://arstechnica.com/information-technology/2018/01/in-the-wild-malware-preys-on-computers-dedicated-to-mining-cryptocurrency/
- Tangent! Electricity in Rural Alaska: https://green.blogs.nytimes.com/2009/06/30/big-alaska-looks-to-small-nuclear/
- Hawaii UX #Fail: https://www.washingtonpost.com/news/post-nation/wp/2018/01/14/hawaii-missile-alert-how-one-employee-pushed-the-wrong-button-and-caused-a-wave-of-panic/