Security Weekly Podcast Network (Video)

Django Source Code Security Scanner - Joff Thyer

Paul Paget

Links for this episode: http://tinyurl.com/HNTV-TARGET-HVAC http://tinyurl.com/HNTV-PCI http://tinyurl.com/HNTV-Fed-Sec-Fail SANS DIFRCON! http://bit.ly/1b5WxTJ

HVAC vulnerabilities, DDoS for your POTS lines, and jamming wi-fi and other 802 networks.

Brian Richardson is a Senior Technical Marketing Engineer with Intel Software and Services Group. Brian goes over UEFI and what is done to keep your computer secure.

Point-of-sale vulnerabilities, drive-by downloads, self-driving cars and more. Next week we will be at our new location for filming the podcast.

Windows Meterpreter recently got some new capabilities thru the Extended API module by OJ Reeves also known as TheColonial. This is covered in this weeks technical segment.

Jared DeMott is a principal security researcher at Bromium and has spoken at security conferences such as Black Hat, Defcon, ToorCon, Shakacon, DakotaCon, GRRCon, and DerbyCon. He is active in the security community by teaching his Application Security course.

Dave Kennedy testifies before Congress and gets called a liar by someone that didn't hear his testimony or read his findings. Akamai tells about the most common problems with Wordpress plugins, Starbucks mobile app is insecure and there's a backdoor in Cisco. Plus a whole lot more!

Crafting 802.11 Packets with Scapy

Joel is a seasoned security executive with a passion for information security research. He has over 20 years of diverse Information Technology experience with an emphasis in Information Security. Joel is currently the Chief Information Security Officer for Advanced Auto Parts and maintains a blog at http://www.malicious-streams.com/ .

Links for this episode: Neiman Marcus: http://zd.net/1ixB1ix DHS Breach: http://ubm.io/1mwBCyo John Teaching at Monterey: http://bit.ly/1b5WxTJ

Here is Paul's explanation on why the podcast is now "Paul's Security Weekly" and you'll see a lot more of "Hack Naked" and less of another name that will no longer be mentioned.

Paul, Jack, Larry, John, Carlos, Allison and now Joff are all here hosting the first ever episode of Paul's Security Weekly! Listen in for all the discussion of this week's security stories!

Rob Lee is an entrepreneur and consultant in the Washington, DC area, specializing in information security, incident response, and digital forensics. Rob is currently the curriculum lead and author for digital forensic and incident response training at the SANS Institute in addition to owning his own firm.

Ian is currently serving as a Director of Services at the leading boutique security consulting company IOActive, where he leads the services practice in the EMEA region. He is one of the founders of the Penetration Testing Execution Standard (PTES), its counterpart – the SexyDefense initiative, and a core member of the DirtySecurity crew.

In this episode we recap 2013 and talk about Router and iPhone backdoors. Links for this episode: http://tinyurl.com/HNTV-NSA-IPHONE http://tinyurl.com/HNTV-Router-Backdoor

Puffy-cheeked Paul, Larry and Jack are back with stories of the week from securing your Apache server to talking about Dave Kennedy and the healthcare.gov site, hacking bug bounties and security con videos are available online. Plus a ton more!

Thomas works for NCC Group as a Security Consultant, conducting all different types of security assessments. Ryan is a British Computer Security graduate, security enthusiast and Security Engineer for RandomStorm living in France. He is interested in Web Application Security and Information Security in general. http://www.scriptalert1.com is a very simple and concise platform to explain Cross-Site Scripting, it's dangers and mitigation. Our aim is for penetration testers to include a link in their pen test reports to the resource and to get it to be the de facto description for semi-technical / tech savvy managers.

Before he wrote hashcat he was a bug hunter for fun, focusing on open source software. After 2005 he only did bug hunting on commercial software and therefore not allowed to disclose product names. In 2010 he started hashcat and since that time it's the only project he's been working on.

Greg Hetrick joins Paul this week to talk about all the interesting and fun stories of the week in the world of IT security!

As always the guys have some great discussions and stories of the week!

Kyle is an information security engineer who devotes his spare time to exploiting the ‘internet of things’. He enjoys lockpicking, CTFs, tinkering with electronics, exploit development and blogging about his findings. He is the founding member of Louisville Organization of Locksport.

Deciphering the Episode 350 crypto challenge with Mike Connor.

Winn Schwartau is one of the world's top experts on security, privacy, infowar, cyber-terrorism and related topics. He is well known for his appearances at DEFCON as the host for the game Hacker Jeopardy.

The Cavalry Isn't Coming - Preserving Security Research Through the Demonstration of Public Good.

Stephen Sims is an industry expert with over 15 years of experience in information technology and security. Stephen currently works out of San Francisco as a consultant performing reverse engineering, exploit development, threat modeling, and penetration testing. The technique of stealing the token of a process with higher privileges in order to achieve privilege escalation is often used during Kernel exploitation.

Dan Philpott is a Solutions Architect with Natoma Technologies working with Federal customers on cloud computing and federal information security projects. His work focuses on federal information security initiatives including FISMA, cybersecurity, FDCC, USGCB, HSPD-12, risk management and other federal information assurance initiatives

Mona can be used by pentesters and exploit developers to take a proof of concept crash and turn it into a working exploit in a quick and organized fashion, eliminating downtime.

We've all heard the term "Hacking Back". We all have mixed feelings about this term. Lets be clear, its not about feelings! The revenge-based "hacking back" was doomed for failure from the beginning. On the flip side, we're losing the battle against attackers on many fronts. What can we do? Setting traps, tracking attackers, luring them into areas of the network and systems deemed "honeypots" is on the table, or is it? What are the legal ramifications to this activity?

SCADA systems are being attacked and making headlines. However, this is not news, or is it? There is a lot of new found "buzz" around attacking SCADA and defending SCADA. Technology has evolved and many systems are Internet connected and more advanced than ever. Water, power, electric, manufacturing all have SCADA.

It's Episode 70 of the Stogie Geeks Podcast!

Episode 350 is dedicated to Veterans, so we found it only fitting to have a panel with InfoSec individuals who are also Veterans. We want to discuss how serving in the military has helped these people in their careers.

Kevin Finisterre is a Senior Research Consultant with Accuvant, has hacked everything from utilities providers to police cars and is keen on disseminating information relating to the identification and exploitation of software vulnerabilities on many platforms.

Jayson E. Street is an author of “Dissecting the hack: The F0rb1dd3n Network” from Syngress. Also creator of dissectingthehack.com He has also spoken at DEFCON, DerbyCon, UCON and at several other ‘CONs and colleges on a variety of Information Security subjects. His life story can be found on Google under “Jayson E. Street” *He is a highly carbonated speaker who has partaken of Pizza from Beijing to Brazil. He does not expect anybody to still be reading this far but if they are please note he was chosen as one of Time’s persons of the year for 2006. ;)

Contacts: [email protected] [email protected] They can also be reached on twitter: @ProjectHoneynet @angelodellaera @lvdeijk

Discussion of expectations of privacy today and what does privacy mean.

Greg Hetrick shows us how to better lock down our Java apps since we can't "just uninstall Java!"

Description: Extracts and outputs HTML/JS comments from HTTP responses. Why would someone use the tool or technique ? : "The attached script makes use of patterns to extract HTML comments from HTTP responses. There are times sensitive information may be present within HTML comments. While this does not necessarily represent a breach in security, it can give an attacker leverage useful for exploitation."

Jack's rantapocalypse, popping penguins, the Yahoo bounty, Paul wants a new phone and the Blackhole kit guy goes down. We think.

Heather Mahalik is a senior digital forensics analyst at Basis Technology. As the on-site project manager, she uses her experience to manage the cell phone exploitation team and supports media and cell phone forensics efforts in the U.S. government. Heather is a certified SANS instructor and teaching the upcoming course Advanced Smartphone and Mobile Device Forensics.

Thierry has 14 years experience in information security, designing resistant architectures and systems, managing development and information security teams, ISM policies and high profile penetration tests. Thierry has a security blog over at blog.zoller.lu . Thierry is currently now working as a Practice Lead for Threat and Vulnerability Management at Verizon Business.

The team goes off on some pretty big tangents this week and does a lot more rambling than actual discussion of stories. However, they did get in talk about DerbyCon, the Yahoo bug bounty and a couple of hacks this week. If you're not hardcore about having the whole segment about published security articles, you might enjoy this on as well.

Jared DeMott has spoken at security conferences such as Black Hat, Defcon, ToorCon, Shakacon, DakotaCon, GRRCon, and DerbyCon. He is active in the security community by teaching his Application Security course, and has co-authored a book on Fuzzing.

Jaime enjoys long walks on the beach while his computer equipment is busy fuzzing software, cracking passwords, or spidering the internet. He's also the creator of the gitDigger project as well as staff of DEFCON's wireless village.

Vivek Ramachandran is a world renowned security researcher and evangelist. His expertise includes computer and network security, exploit research, wireless security, computer forensics, embedded systems security, compliance and e-Governance. He is the founder of Security Tube and Pentester Academy .

Before the gang heads off for Derby Con, we still have the stories of the week. Paul, Greg and Patrick are here to talk about Shodan searches, Dropbox opening your docs, 10 things to never say during a presentation and a whole lot more!

The last segment from episode 345 features Dave, Martin, Adrian and Nick, the DerbyCon organizers to talk about the upcoming third edition of their conference in Louisville. Find out how they planned it to be bigger and better this year! Plus, a couple stories of the week!

Pete Finnigan works as an independent Oracle security consultant for his own company PeteFinnigan.com Limited . Pete specializes in performing detailed Oracle security IT Health checks against Oracle databases using a detailed methodology developed by Pete from many years of experience in securing databases.

Rich has twenty years experience in information security, physical security, and risk management. He is the founder of Securosis and specializes in data security, application security, emerging security technologies, and security management.