Talkin' Bout [Infosec] News

Originally Aired on July 12, 2021 Articles discussed in this episode: 00:00 – BHIS | Talkin’ Bout News 2021-07-12 01:56 – Story # 1: https://www.bleepingcomputer.com/news/security/biden-asks-putin-to-crack-down-on-russian-based-ransomware-gangs/ 03:09 – Russia’s R.A.R.E. Program 03:54 – Story # 2: https://www.securityweek.com/solarwinds-confirms-new-zero-day-flaw-under-attack 05:33 – Story # 3: https://thehackernews.com/2021/07/hackers-spread-biopass-malware-via.html 08:44 – Story # 4: https://thehackernews.com/2021/07/magecart-hackers-hide-stolen-credit.html 11:53 – Story # 5: https://www.bleepingcomputer.com/news/security/mint-mobile-hit-by-a-data-breach-after-numbers-ported-data-accessed/ 15:31 – Story # 6: https://www.microsoft.com/security/blog/2021/07/12/microsoft-to-acquire-riskiq-to-strengthen-cybersecurity-of-digital-transformation-and-hybrid-work/ 18:42 – Story # 7: https://threatpost.com/lazarus-engineers-malicious-docs/167647/ 29:02 – Story # 8: https://www.bleepingcomputer.com/news/security/insurance-giant-cna-reports-data-breach-after-ransomware-attack/ 35:21 – Story # 9: https://thehackernews.com/2021/07/critical-flaws-reported-in-philips-vue.html 46:19 – Story # 10: https://www.bleepingcomputer.com/news/security/fashion-retailer-guess-discloses-data-breach-after-ransomware-attack/ 48:16 – Story # 11: https://www.securityweek.com/morgan-stanley-hit-accellion-hack-through-third-party-vendor 49:37 – PDF Doc Details: https://www.doj.nh. (00:00) - BHIS | Talkin' Bout News 2021-07-12 (01:56) - Story # 1: https://www.bleepingcomputer.com/news/security/biden-asks-putin-to-crack-down-on-russian-based-ransomware-gangs/ (03:09) - Russia's R.A.R.E. Program (Fan Graphic) (03:54) - Story # 2: https://www.securityweek.com/solarwinds-confirms-new-zero-day-flaw-under-attack (05:33) - Story # 3: https://thehackernews.com/2021/07/hackers-spread-biopass-malware-via.html (08:44) - Story # 4: https://thehackernews.com/2021/07/magecart-hackers-hide-stolen-credit.html (11:53) - Story # 5: https://www.bleepingcomputer.com/news/security/mint-mobile-hit-by-a-data-breach-after-numbers-ported-data-accessed/ (15:31) - Story # 6: https://www.microsoft.com/security/blog/2021/07/12/microsoft-to-acquire-riskiq-to-strengthen-cybersecurity-of-digital-transformation-and-hybrid-work/ (18:42) - Story # 7: https://threatpost.com/lazarus-engineers-malicious-docs/167647/ (29:02) - Story # 8: https://www.bleepingcomputer.com/news/security/insurance-giant-cna-reports-data-breach-after-ransomware-attack/ (35:21) - Story # 9: https://thehackernews.com/2021/07/critical-flaws-reported-in-philips-vue.html (46:19) - Story # 10: https://www.bleepingcomputer.com/news/security/fashion-retailer-guess-discloses-data-breach-after-ransomware-attack/ (48:16) - Story # 11: https://www.securityweek.com/morgan-stanley-hit-accellion-hack-through-third-party-vendor (49:37) - PDF Doc Details: https://www.doj.nh.gov/consumer/security-breaches/documents/morgan-stanley-20210702.pdf

Building a phishing engagement is hard. While the concept is straightforward, real-world execution is tricky. Being successful takes enormous amounts of up-front setup and knowledge in quickly evolving phishing tactics. While there is always a need to craft a custom email, the most considerable amount of work is setting up an infrastructure to make it all work. Wouldn’t it be nice if you had a playbook of how to set everything up to save time and prevent mistakes? What if we coded this playbook so we could share this with others and modify our tactics when things change? In this Black Hills Information Security (BHIS) webcast, we’re going to do just that. We will take a top-down look at how a phishing engagement is designed. Then we will work through coding this design, so we don’t have to keep building a phish. Lastly, we will touch on how to fly under the radar and how coding TTP’s help save time and guarantee accuracy. Join the BHIS Community Discord: https://discord.gg/bhis Music By Beau: https://www.nobandwidth.io 00:00 – FEATURE PRESENTATION: How to Build a Phishing Engagement – Coding TTP’s 01:06 – About Ralph May 01:58 – Disclaimers 03:19 – Overview 03:56 – Phishing is Hard 06:33 – Infrastructure 07:12 – Operational Security 08:39 – Designing a Phish 13:18 – Phishing Emails 15:48 – 1st Tool: EVILGINX2 17:30 – EVILGINX IOC’s 18:20 – 2nd Tool: GoPhish 19:08 – GoPhish IOC’s 20:52 – 3rd Tool: NGINX (00:00) - FEATURE PRESENTATION: How to Build a Phishing Engagement - Coding TTP's (01:02) - About Ralph May (01:51) - Disclaimers (03:06) - Overview (03:43) - Phishing is Hard (06:20) - Infrastructure (06:59) - Operational Security (08:26) - Designing a Phish (13:01) - Phishing Emails (15:29) - 1st Tool: EVILGINX2 (17:10) - EVILGINX IOC's (18:00) - 2nd Tool: GoPhish (18:48) - GoPhish IOC's (20:31) - 3rd Tool: NGINX (21:45) - 4th Tool: Digital Ocean Cloud Provider (22:10) - 5th Tool: Mailgun Email Service (22:52) - 6th Tool: CDN-Azure (23:33) - Coding a Phish – 1st Tool: Ansible (26:09) - 2nd Tool: Terraform (28:36) - 3rd Tool: Docker (30:22) - Combining Ansible and Terraform (32:14) - Ansible Secrets (34:04) - DEMO: Executing a Phishing Engagement (41:57) - What's Next (43:19) - QnA (56:03) - PostShow Banter™ — Ohs and Ahs

Join the BHIS Community Discord: https://discord.gg/bhis Music By Beau: https://www.nobandwidth.io 00:00 – 2021-04-01 – PreShow Banter™ — Intro Sec Con & The Birth of PreShowBanterCon-A-Thon 2021!™ 05:29 – You’re So Vanity 08:39 – Let’s Talk About Florida Man 11:27 – Kellon is here – Intro Sec Con Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,588 other subscribers Email Address Subscribe (00:00) - 2021-04-01 - PreShow Banter™ — Intro Sec Con & The Birth of PreShowBanterCon-A-Thon 2021!™ (08:28) - Let's Talk About Florida Man (11:12) - Kellon is here - Intro Sec Con

Originally Aired on July 6, 2021 Articles discussed in this episode: 00:00 – BHIS | Talkin’ Bout News 2021-07-06 02:32 – Story # 1 – CISA self-assessment audit tool – https://www.bleepingcomputer.com/news/security/cisa-releases-new-ransomware-self-assessment-security-audit-tool/amp/ 08:24 – Story # 2 – Insurance rates up 32% – https://www.theregister.com/2021/07/05/cyber_insurance_report/ 20:48 – Story # 3 – 0 Day for Windows OS PrintNightmare – https://doublepulsar.com/zero-day-for-every-supported-windows-os-version-in-the-wild-printnightmare-b3fdb82f840c 31:32 – Story # 4 – Kaseya Indicators of Compromises – https://cyberworkx.in/2021/07/06/kaseya-says-its-not-a-supply-chain-attack-and-releases-indicators-of-compromises/ 41:16 – Story # 5 – Dotnet Core for PowerShell – https://cyberworkx.in/2021/07/04/critical-remote-code-execution-vulnerability-in-dotnet-core-for-powershell/ 42:54 – Story # 6 – Intuit shares data with Equifax – https://krebsonsecurity.com/2021/07/intuit-to-share-payroll-data-from-1-4m-small-businesses-with-equifax/ 48:33 – Alissa Torres’ Shout Outs (see description for links) 52:00 – Story # 7 – The Audacity of Spyware – https://mashable.com/article/audacity-spyware-privacy-policy Alissa Torres’ Shout Outs: * https://www.dianainitiative.org/event-schedule/* https://dfrws.org/conferences/dfrws-usa-2021/* https://www.activecountermeasures.com/event/hacking-packet-captures-the-foundations-of-network-security/* https://wildwesthackinfest.com/antisyphon//advanced-endpoint-investigations/ Check out our Cyber Range, not just a place to work through challenges and play,

Articles discussed in this episode: 00:00 - BHIS | Talkin’ Bout News 2021-07-06 02:32 - Story # 1 - CISA self-assessment audit tool - https://www.bleepingcomputer.com/news/security/cisa-releases-new-ransomware-self-assessment-security-audit-tool/amp/ 08:24 - Story # 2 - Insurance rates up 32% - https://www.theregister.com/2021/07/05/cyber_insurance_report/ 20:48 - Story # 3 - 0 Day for Windows OS PrintNightmare - https://doublepulsar.com/zero-day-for-every-supported-windows-os-version-in-the-wild-printnightmare-b3fdb82f840c 31:32 - Story # 4 - Kaseya Indicators of Compromises - https://cyberworkx.in/2021/07/06/kaseya-says-its-not-a-supply-chain-attack-and-releases-indicators-of-compromises/ 41:16 - Story # 5 - Dotnet Core for PowerShell - https://cyberworkx.in/2021/07/04/critical-remote-code-execution-vulnerability-in-dotnet-core-for-powershell/ 42:54 - Story # 6 - Intuit shares data with Equifax - https://krebsonsecurity.com/2021/07/intuit-to-share-payroll-data-from-1-4m-small-businesses-with-equifax/ 48:33 - Alissa Torres’ Shout Outs ( see description for links ) 52:00 - Story # 7 - The Audacity of Spyware - https://mashable.com/article/audacity-spyware-privacy-policy Alissa Torres’ Shout Outs: https://www.dianainitiative.org/event-schedule/ https://dfrws.org/conferences/dfrws-usa-2021/ https://www.activecountermeasures.com/event/hacking-packet-captures-the-foundations-of-network-security/ https://wildwesthackinfest.com/antisyphon//advanced-endpoint-investigations/

Originally Aired on June 28, 2021 Articles discussed in this episode: 00:00 – PreShow Banter™ — Way West Recap06:38 – Story 1 : https://www.bleepingcomputer.com/news/security/wd-my-book-nas-devices-are-being-remotely-wiped-clean-worldwide/12:58 – Story 2 : https://www.vice.com/en/article/bvzd8v/hackers-use-fake-call-center-to-trick-victims-into-installing-ransomware19:41 – Story 3 : https://thehackernews.com/2021/06/bios-disconnect-new-high-severity-flaws.html29:27 – Story 4 : https://venturebeat.com/2021/06/16/cybereason-80-of-orgs-that-paid-the-ransom-were-hit-again/44:27 – Story 5 : https://nypost.com/2021/06/23/john-mcafee-dies-by-suicide-inside-prison-in-barcelona/45:43 – Story 6 : https://www.marketplace.org/2021/06/23/texas-homeowners-startled-by-hijacked-thermostats/52:56 – Story 7 : https://www.bleepingcomputer.com/news/security/mercedes-benz-data-breach-exposes-ssns-credit-card-numbers/55:38 – Story 8 : https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/ Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,555 other subscribers Email Address Subscribe

00:00 - PreShow Banter™ — Way West Recap 06:38 - Story 1 : https://www.bleepingcomputer.com/news/security/wd-my-book-nas-devices-are-being-remotely-wiped-clean-worldwide/ 12:58 - Story 2 : https://www.vice.com/en/article/bvzd8v/hackers-use-fake-call-center-to-trick-victims-into-installing-ransomware 19:41 - Story 3 : https://thehackernews.com/2021/06/bios-disconnect-new-high-severity-flaws.html 29:27 - Story 4 : https://venturebeat.com/2021/06/16/cybereason-80-of-orgs-that-paid-the-ransom-were-hit-again/ 44:27 - Story 5 : https://nypost.com/2021/06/23/john-mcafee-dies-by-suicide-inside-prison-in-barcelona/ 45:43 - Story 6 : https://www.marketplace.org/2021/06/23/texas-homeowners-startled-by-hijacked-thermostats/ 52:56 - Story 7 : https://www.bleepingcomputer.com/news/security/mercedes-benz-data-breach-exposes-ssns-credit-card-numbers/ 55:38 - Story 8 : https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/

https://youtu.be/ZXNzG8ilfiw 00:00 - Talkin’ Bout Ransomware 01:26 - Story 1: https://nypost.com/2021/06/06/texas-mom-arrested-after-posing-as-her-13-year-old-daughter-at-middle-school/ 06:26 - Story 2: https://cyberworkx.in/2021/06/07/worlds-first-known-malware-targeting-windows-containers-to-compromise-cloud-environments/ 10:42 - Story 3: https://threatpost.com/revil-spill-details-us-attacks/166669/ 22:27 - Story 4: https://www.eff.org/deeplinks/2021/06/van-buren-victory-against-overbroad-interpretations-cfaa-protects-security 24:43 - Story 5: https://cyberworkx.in/2021/06/05/microsoft-teams-is-getting-better-security-end-to-end-encryption-for-voice-calls-from-july/ 30:33 - Story 6: https://lock.cmpxchg8b.com/passmgrs.html Join the BHIS Community Discord: https://discord.gg/bhis

Originally Aired on June 1, 2021 Articles discussed in this episode: 00:00 – PreShow Banter™ — Fishing Attacks 02:40 – Story 1: https://m1racles.com/ 05:33 – Story 2: https://arstechnica.com/gadgets/2021/05/vulnerability-in-vmware-product-has-severity-rating-of-9-8-out-of-10/ 11:26 – Story 3: https://www.securityweek.com/nuclear-flash-cards-us-secrets-exposed-learning-apps 15:29 – Story 4: https://www.darkreading.com/risk/cyber-insurance-firms-start-tapping-out-as-ransomware-continues-to-rise/d/d-id/1341109 23:44 – Story 5: https://www.zdnet.com/article/various-japanese-government-entities-had-data-stolen-in-cyber-attack-report/ 26:26 – Story 6: https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,444 other subscribers Email Address Subscribe (00:00) - PreShow Banter™ — Fishing Attacks (02:40) - Story 1 : https://m1racles.com/ (05:33) - Story 2 : https://arstechnica.com/gadgets/2021/05/vulnerability-in-vmware-product-has-severity-rating-of-9-8-out-of-10/ (11:26) - Story 3 : https://www.securityweek.com/nuclear-flash-cards-us-secrets-exposed-learning-apps (15:29) - Story 4 : https://www.darkreading.com/risk/cyber-insurance-firms-start-tapping-out-as-ransomware-continues-to-rise/d/d-id/1341109 (23:44) - Story 5 : https://www.zdnet.com/article/various-japanese-government-entities-had-data-stolen-in-cyber-attack-report/ (26:26) - Story 7 : https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/

In this Black Hills Information Security (BHIS) webcast, you will learn tools and techniques for performing penetration tests against Microsoft Azure environments. Increasingly, more organizations are migrating resources to being hosted in the cloud. With this comes a greater potential for misconfiguration if there isn’t a solid understanding of the attack surface. While there are many similarities between traditional on-premises pentesting and cloud-based pentesting, the latter is an animal of its own. This webcast attempts to clear up some of the fogginess around cloud-based pentesting, specific to Microsoft Azure environments, including Microsoft 365. In order to adequately determine the attack surface, the appropriate coverage areas are highlighted. Differences between Azure resources and Microsoft 365 can oftentimes be confusing but knowing these differences is key to helping you pivot and escalate privileges. Conditional access policies are great for defining different scenarios for how users can authenticate securely but can also be misconfigured. There are security protections for stopping certain password attacks but some of these can be bypassed. Ultimately, a methodology for testing Azure environments along with tools and techniques are presented in this talk. 36:31 – Webcast officially starts Join us on the BLACK HILLS INFOSEC Discord server for interaction with Beau and your fellow attendees: https://discord.gg/bhis Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,437 other subscribers Email Address Subscribe (00:00) - FEATURE PRESENTATION: Getting Started in Pentesting the Cloud – Azure (02:32) - WHOAMI (03:20) - Talk Roadmap (05:33) - Why Azure? (08:06) - Identifying Attack Surface (12:50) - Recon & External Attacks (19:31) - Password Attacks (21:37) - Password Protection & Smart Lockout (23:05) - Authentication (26:52) - Conditional Access Policies & MFA (34:11) - Post Compromise (36:46) - Command Line Access (37:40) - LINK: CloundPentest Cheatsheets: https://github.com/dafthack/CloudPentestCheatsheets (37:53) - Azure Subscription Hierarchy (41:31) - Resource Specific Issues (41:55) - Serverless Environment Variables (48:59) - Leveraging Scanning Tools (51:11) - Key Takeaways (52:37) - PostShow Banter™ — They Got Questions, Beau

Join our Incident Master Ean Meyer as we play another round of Backdoors & Breaches (B&B) session using our new Tabletop Simulator (TTS) version! If you have STEAM / TABLETOP SIMULATOR / BACKDOORS & BREACHES WORKSHOP, you can play using the same version of the game. https:/steamcommunity.com/sharedfiles/filedetails/?id=2401033477 Incident Master: Ean | EanMeyer Defenders: Qasim | hashtaginfosec Kaitlyn | Kadawi Blake | zer0cool Vee | Po1Zon_P1x13 Ralph | ralphte1 Game Play Master: Jason | BanjoCrashland Our good friend Edward Miro wrote an extensive guide on how to install and use B&B on TTS. Check it out below! https://www.blackhillsinfosec.com/backdoors-breaches-tabletop-simulator-guide/ Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,408 other subscribers Email Address Subscribe

Join Incident Master Ean Meyer as we play another round of Backdoors & Breaches.

There has been a huge explosion of different free and open-source options for EDR in the security space. Which is nice because the commercial offerings are stupid expensive. In this Black Hills Information Security (BHIS) webcast, we look at OpenEDR, Elastic, and Velociraptor. With all these great options, there is no reason your organization should not have one of these offerings. Further, they are essential for any IR gig you may do. You may be a shop that is looking at commercial offerings, however, you should always look at the free offerings first. Remember, you are not paying for what the commercial product offers, you are paying for what it does versus what the free offerings do not. Join the BHIS Community Discord: https://discord.gg/bhis 0:00:00 – FEATURE PRESENTATION: Your Free & Open EDR Options! 0:02:03 – Why We here? 0:04:46 – EDR? Like that there electronic music? 0:11:48 – Vendors 0:14:21 – MITRE Evaluations 0:19:17 – So, Why EDR? 0:23:05 – Free and Open Source? 0:28:48 – OSSEC 0:31:12 – So, WAZUH 0:38:28 – Velociraptor 0:41:09 – DEMO: Velociraptor 0:48:35 – Vendors and Free/OS 0:49:57 – Elastic (Formerly Endgame) 0:55:09 – OPEN EDR – From Comodo 0:58:41 – Conclusions 1:01:53 – Backdoors & Breaches Virtual Slides for this webcast can be found here: (00:00) - FEATURE PRESENTATION: Your Free & Open EDR Options! (02:03) - Why We here? (04:46) - EDR? Like that there electronic music? (11:48) - Vendors (14:21) - MITRE Evaluations (19:17) - So, Why EDR? (23:05) - Free and Open Source? (28:48) - OSSEC (31:12) - So, WAZUH (38:28) - Velociraptor (41:09) - DEMO: Velociraptor (48:35) - Vendors and Free/OS (49:57) - Elastic (Formerly Endgame) (55:09) - OPEN EDR - From Comodo (58:41) - Conclusions (01:01:53) - Backdoors and Breaches Virtual (01:07:05) - John Pitches BHIS SOC

Originally Aired on May 10, 2021 Articles discussed in this episode: * https://whyy.org/segments/the-greatest-hoax-on-earth/ * https://www.fbi.gov/news/pressrel/press-releases/fbi-statement-on-network-disruption-at-colonial-pipeline * https://arstechnica.com/gadgets/2021/05/peloton-takes-3-months-to-fix-flaw-that-exposed-users-private-information/ * https://threatpost.com/critical-cisco-sd-wan-hyperflex-bugs/165923/ * https://www.macrumors.com/2021/05/10/hacked-airtag-links-to-custom-url-lost-mode/ * https://jalopnik.com/security-researchers-hack-a-tesla-from-a-drone-1846833249 Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,362 other subscribers Email Address Subscribe

This is a joint emergency webcast from the teams of Black Hills Information Security, Wild West Hackin’ Fest, and Active Countermeasures, presented by John Strand. There have been a couple of very scary ransomware stories in the news over the past few weeks. We figured it would be a good idea to throw a quick emergency webcast together to cover some of these new developments and hit on some very real and very easy things to mitigate against some of these attacks. We say “some” because these attacks are evolving. Traditionally, there are two classes of ransomware, but we are seeing a third start to develop which is harder to deal with. But not impossible. Yes, we will be talking about deception and attribution. Yes, we will be talking about beacon analysis. Because they are kind of our things. But, we will also discuss some new open-source technologies. And… something you can just turn on. The point is these attacks are rapidly evolving. The attack on Colonial shows just a glimpse of how bad these attacks are going to get. Also, we are seeing how we cannot view Operation Technology (OT) as a completely different security creature. Everything is interconnected. We need to start treating security more holistically and stop saying things like, “we just want to focus on the OT/SCADA/PCI/HIPAA enclave.” Slides for this webcast can be found here: https://www.blackhillsinfosec.com/wp-content/uploads/2021/05/SLIDES_LetsTalkAboutRansomware.pdf Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,344 other subscribers Email Address Subscribe (00:00) - PreShow Banter™ — John Strand Has Windows Updates (25:39) - FEATURE PRESENTATION: OK, Let’s Talk About Ransomware (01:25:34) - Wrap-up Questions

Originally Aired on May 5, 2021 Articles discussed in this episode: * https://thehackernews.com/images/-V6c2_ZHgMzI/YJFAaQl5RjI/AAAAAAAAA_8/wNs6d4zWc1MHLJ5VPaSpzHvXkFIIcwfZQCLcBGAsYHQ/s0/reset-passsword.jpg * https://threatpost.com/dell-kernel-privilege-bugs/165843/ * https://www.bleepingcomputer.com/news/security/new-windows-pingback-malware-uses-icmp-for-covert-communication/ * https://signal.org/blog/the-instagram-ads-you-will-never-see/ * https://nakedsecurity.sophos.com/2021/05/04/apple-products-hit-by-fourfecta-of-zero-day-exploits-patch-now/ Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,321 other subscribers Email Address Subscribe

Originally Aired on May 3, 2021 Articles discussed in this episode: * https://threatpost.com/deepfake-attacks-surge-experts-warn/165798/ * https://threatpost.com/linux-kernel-bug-wider-cyberattacks/165640/* https://www.reddit.com/r/netsec/comments/n36x7h/arbitrary_code_execution_in_exiftool/* https://krebsonsecurity.com/2021/04/experians-credit-freeze-security-is-still-a-joke/* https://github.com/alievk/avatarify-python * https://media.ccc.de/v/29c3-5327-en-writing_a_thumbdrive_from_scratch_h264 Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,306 other subscribers Email Address Subscribe

Join our Incident Master BanjoCrashland as we play another round of Backdoors & Breaches (B&B) session using our new Tabletop Simulator (TTS) version! If you have STEAM / TABLETOP SIMULATOR / BACKDOORS & BREACHES WORKSHOP, you can play using the same version of the game. https:/steamcommunity.com/sharedfiles/filedetails/?id=2401033477 Incident Master: Jason Blanchard | BanjoCrashland Defenders: Matt Thomas | slegna Richard Phung | p3hndrx Maril Vernon | SheWhoHacks Kaitlyn Wimberley | kadawi Blake Regan | zer0cool Ralph May | ralphte1 John Strand | strandjs Our good friend Edward Miro wrote an extensive guide on how to install and use B&B on TTS. Check it out below! https://www.blackhillsinfosec.com/backdoors-breaches-tabletop-simulator-guide/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,295 other subscribers Email Address Subscribe

Originally Aired on April 26, 2021 Articles discussed in this episode: * https://usdaynews.com/celebrities/celebrity-death/dan-kaminsky-death-cause/* https://signal.org/blog/cellebrite-vulnerabilities/* https://arstechnica.com/gadgets/2021/04/hackers-backdoor-corporate-password-manager-and-steal-customer-data/* https://youtu.be/G0gOAvpGoJg Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,281 other subscribers Email Address Subscribe

Originally Aired on April 19, 2021 Articles discussed in this episode: * https://www.theverge.com/2021/4/13/22382821/fbi-doj-hafnium-remote-access-removal-hack* https://apnews.com/article/russia-safe-harbor-ransomeware-hacking-c9dab7eb3841be45dff2d93ed3102999* https://threatpost.com/critical-cloud-bug-vmware-carbon-black/165278/* https://www.theverge.com/2021/4/18/22390379/federal-investigators-breach-software-codecov-solarwinds* https://threatpost.com/google-project-zero-cuts-bug-disclosure-timeline-to-a-30-day-grace-period/165432/ Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,264 other subscribers Email Address Subscribe

Originally Aired on April 12, 2021 Articles discussed in this episode: * https://threatpost.com/azure-functions-privilege-escalation/165307/* https://www.theverge.com/2021/4/8/22374464/linkedin-data-leak-500-million-accounts-scraped-microsoft* https://news.linkedin.com/2021/april/an-update-from-linkedin* https://www.bbc.com/news/world-middle-east-56708778* https://www.tenable.com/blog/cve-2018-13379-cve-2019-5591-cve-2020-12812-fortinet-vulnerabilities-targeted-by-apt-actors Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,241 other subscribers Email Address Subscribe

Originally Aired on April 7, 2021 Articles discussed in this episode: * https://www.scmagazine.com/home/security-news/phishing/array-of-recent-phishing-schemes-use-personalized-job-lures-voice-manipulation/* https://www.coindesk.com/hackers-mined-crypto-on-githubs-servers-report* https://www.securityweek.com/white-hats-earn-440000-hacking-microsoft-products-first-day-pwn2own-2021* https://www.infosecurity-magazine.com/news/consulting-firm-data-breach/* https://github.com/Neo23x0/Raccine* https://github.com/ralphte/build_a_phish* https://support.microsoft.com/en-us/windows/protect-your-pc-from-ransomware-08ed68a7-939f-726c-7e84-a72ba92c01c3* https://www.infosecurity-magazine.com/news/florida-school-district-40m-ransom/ Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,208 other subscribers Email Address Subscribe

Originally Aired on April 5, 2021 Articles discussed in this episode: * https://www.bleepingcomputer.com/news/security/533-million-facebook-users-phone-numbers-leaked-on-hacker-forum/* https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic/* https://threatpost.com/call-of-duty-cheats-gamers-malware/165209/* https://outflank.nl/services/outflank-security-tooling/* https://thehackernews.com/2021/04/22-year-old-charged-with-hacking-water.html* https://www.paulosyibelo.com/2021/04/this-man-thought-opening-txt-file-is.html Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,198 other subscribers Email Address Subscribe

Originally Aired on March 29, 2021 Articles discussed in this episode: * https://www.bleepingcomputer.com/news/security/engineer-reports-data-leak-to-nonprofit-hears-from-the-police/* https://thehackernews.com/2021/03/solarwinds-orion-vulnerability.html* https://thehackernews.com/2021/03/apple-issues-urgent-patch-update-for.html* https://unit42.paloaltonetworks.com/malicious-cryptojacking-images/ Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,178 other subscribers Email Address Subscribe

Originally Aired on March 24, 2021 Articles discussed in this episode: * https://www.theverge.com/2021/3/22/22345792/microsoft-discord-acquisition-report-10-billion* https://krebsonsecurity.com/2021/03/weleakinfo-leaked-customer-payment-info/* https://grahamcluley.com/police-raid-apartment-alleged-verkada-hacker/ Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,176 other subscribers Email Address Subscribe

During remote red team exercises, it can be difficult to keep from leaking information to the target organization’s security team. Every interaction with the target’s website, every email sent, and every network service probed leaves some trace that the red team was there. Mature blue teams can correlate those pieces of information to identify red team actions and infrastructure, and use that information to either block the red team outright or execute deception operations to frustrate further attacks. In this Black Hills Information Security (BHIS) webcast, Michael will discuss common sources of data leakage during remote red team exercises and steps red teamers can take to eliminate or disguise the leakage outright, or to compartmentalize their actions and keep the blue team from connecting the dots. He’ll also discuss how red teamers can see the attack from the defender’s point of view so that these concepts can be applied to new tools and technologies in the future. Join the BHIS Community Discord: https://discord.gg/bhis​ 0:00:00​ – PreShow Banter™ — It’s Not Delivery, Its Frozen 0:09:36​ – PreShow Banter™ — One Rural to Rule Them All 0:11:51​ – PreShow Banter™ — Proudly Sucking at Charity 0:13:08​ – PreShow Banter™ — SPECIAL GUEST: Rural Tech Fund 0:20:39​ – PreShow Banter™ — Meth Lab For Computers 0:25:41​ – FEATURE PRESENTATION: OPSEC Fundamentals for Remote Red Teams 0:27:00​ – WHOAMI 0:30:42​ – Why OPSEC is Important For Red Teams 0:34:01​ – Possible Countermeasures 0:36:37​ – Other Red Team Threats 0:38:06​ – Assessing Red Team Actions (00:00) - PreShow Banter™ — It's Not Delivery, Its Frozen (09:36) - PreShow Banter™ — One Rural to Rule Them All (11:51) - PreShow Banter™ — Proudly Sucking at Charity (13:08) - PreShow Banter™ — SPECIAL GUEST: Rural Tech Fund (20:39) - PreShow Banter™ — Meth Lab For Computies (25:41) - FEATURE PRESENTATION: OPSEC Fundamentals for Remote Red Teams (26:59) - WHOAMI (30:42) - Why OPSEC is Important For Red Teams (34:01) - Possible Countermeasures (36:37) - Other Red Team Threats (38:06) - Assessing Red Team Actions (39:26) - Building OPSEC Standard Procedures (40:42) - Local Workstation Setup (45:01) - OS Modifications (49:44) - TOOL Configurations (56:35) - Source IP Addresses (01:01:36) - Fail-Safe VPN (01:02:57) - Other Third-Party Services (01:10:05) - Network Services (01:15:19) - Testing New Tools (01:21:42) - Got Questions (01:27:03) - PostShow Banter™ — Access Granted

Originally Aired on March 22, 2021 Articles discussed in this episode: * https://threatpost.com/google-spectre-poc-exploit-chrome/164787/* https://threatpost.com/office-365-phishing-attack-financial-execs/164925/* https://krebsonsecurity.com/2021/03/weleakinfo-leaked-customer-payment-info/* https://arstechnica.com/gadgets/2021/03/critics-fume-after-github-removes-exploit-code-for-exchange-vulnerabilities/* https://arstechnica.com/information-technology/2021/03/expert-hackers-used-11-zerodays-to-infect-windows-ios-and-android-users/ Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,168 other subscribers Email Address Subscribe (00:00) - Intro (01:00) - Critics fume after Github removes exploit code for Exchange vulnerabilities (17:44) - Google Releases Spectre PoC Exploit For Chrome (28:40) - “Expert” hackers used 11 0-days to infect Windows, iOS, and Android users

Originally Aired on March 17, 2021 Articles discussed in this episode: * https://www.bloomberg.com/news/articles/2021-03-09/hackers-expose-tesla-jails-in-breach-of-150-000-security-cams* https://media.cert.europa.eu/static/SecurityAdvisories/2021/CERT-EU-SA2021-014.pdf* https://security.googleblog.com/2021/03/introducing-sigstore-easy-code-signing.html* https://krebsonsecurity.com/2021/03/weleakinfo-leaked-customer-payment-info/* https://twitter.com/PythonResponder/status/1372023079719817218?s=20 Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,163 other subscribers Email Address Subscribe

The Livestream of our first Backdoors & Breaches (B&B) session using our new Tabletop Simulator (TTS) version of the game was a success! If you have STEAM / TABLETOP SIMULATOR / BACKDOORS & BREACHES WORKSHOP, you can play using the same version of the game. 11:05​ – Backdoors & Breaches Session Begins! Our good friend Edward Miro wrote an extensive guide on how to install and use B&B on TTS. Check it out below! https://www.blackhillsinfosec.com/backdoors-breaches-tabletop-simulator-guide/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,144 other subscribers Email Address Subscribe

It is another year for the Sacred Cash Cow Tipping Webcast. For those of you who are new to our email list within the past year, this is a webcast where we cover the various tools and techniques that Black Hills Information Security (BHIS) uses to bypass endpoint security protections. The point of this webcast is not so much to teach people how to bypass these products, but rather to show that they can be bypassed. Hopefully, this leads to some conversations about defense-in-depth and how many vendors exaggerate their capabilities. We also discuss how simply writing signatures for specific strains of malware is a waste of time. Well, I mean, it has its place. But it is not something that should be the primary cornerstone of your security support structure. There is a lot to unpack in this webcast, one of the main things to unpack is why we are still doing it. We are still doing this because it is still necessary. We still have vendors and CISOs perpetuating the myth that a security product can protect you from all attacks. This is an oversimplification, and it needs to be exterminated like a termite or a cockroach. In past years we have had vendors threaten to sue… and some cooler vendors send us beer. Hopefully, this year ends in beer. Join the BHIS Community Discord: https://discord.gg/bhis​ 0:00:00​ – PreShow Banter™ — We Love You 3000 0:02:56​ – PreShow Banter™ — SolarWinds Forever 0:07:26​ – PreShow Banter™ — Watching Bitcoins Being Mined 0:08:53​ – PreShow Banter™ — TeacherCoin™ 0:11:12​ – PreShow Banter™ — Babies’ Toys For Your Hands 0:15:45​ – FEATURE PRESENTATION: Sacred Cash Cow Tipping 2021 0:21:28​ – Ralph May: Due Diligence 0:25:42​ – Ralph May: ScareCrow 0:32:56​ – Ralph May: RDP 0:35:51​ – Marcello: Sentinel One (00:00) - PreShow Banter™ — We Love You 3000 (02:56) - PreShow Banter™ — SolarWinds Forever (07:26) - PreShow Banter™ — Watching Bitcoins Being Mined (08:53) - PreShow Banter™ — TeacherCoin™ (11:12) - PreShow Banter™ — Babies' Toys For Your Hands (14:06) - PreShow Banter™ — This is Huge (15:45) - FEATURE PRESENTATION: Sacred Cash Cow Tipping 2021 (21:28) - Ralph May: Due Dilligence (25:42) - Ralph May: ScareCrow (32:55) - Ralph May: RDP (35:50) - Marcello: Sentinel One (44:52) - Jordan Drysdale: Windows Subsystem for Linux (53:31) - Rob (mubix) Fuller: Initial Access (01:05:15) - Rob (mubix) Fuller: Post Exploitation (01:10:58) - Joff Thyer: Strip PowerShell Script Comments (01:17:49) - Joff Thyer: Build a .NET Assembly to Execute Shellcode (01:20:57) - Joff Thyer: Load/Run DLL/Assembly in PowerShell (01:23:27) - PostShow Banter™

Originally Aired on March 8, 2021 Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,118 other subscribers Email Address Subscribe

Originally Aired on March 3, 2021 Articles discussed in this episode: * https://www.msn.com/en-us/money/other/microsoft-these-exchange-server-zero-day-flaws-are-being-used-by-hackers-so-update-now/ar-BB1ec0In Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,093 other subscribers Email Address Subscribe

Originally Aired on March 1, 2021 Articles discussed in this episode: * https://threatpost.com/yeezy-sneaker-bots-boost-sun/164312/* https://www.darknet.org.uk/2021/02/gitlab-watchman-audit-gitlab-for-sensitive-data-credentials/* https://www.wired.com/story/gab-hack-data-breach-ddosecrets/* https://www.cyberark.com/resources/threat-research-blog/hunting-azure-blobs-exposes-millions-of-sensitive-files* https://github.com/cyberark/blobhunter Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,084 other subscribers Email Address Subscribe

Originally Aired on February 24, 2021 Articles discussed in this episode: * https://www.scmagazine.com/home/security-news/government-and-defense/fireeye-and-microsoft-execs-senators-dissect-mandatory-breach-disclosure-in-wake-of-solarwinds/* https://www.wired.com/story/russia-gru-hackers-us-grid/ Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,080 other subscribers Email Address Subscribe

Originally Aired on February 22, 2021 Articles discussed in this episode: * https://www.reuters.com/article/us-northkorea-cybercrime-pfizer-idUKKBN2AG0NI* https://threatpost.com/silver-sparrow-malware-30k-macs/164121/* https://www.securityweek.com/chinese-hackers-cloned-equation-group-exploit-years-shadow-brokers-leak Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,071 other subscribers Email Address Subscribe

Originally Aired on February 17, 2021 Articles discussed in this episode: * https://www.scmagazine.com/home/security-news/everyones-half-asleep-and-bosses-dont-want-trouble-the-struggle-to-secure-utilities/* https://attack.mitre.org/matrices/enterprise/* https://www.scmagazine.com/home/security-news/network-security/siem-rules-ignore-bulk-of-mitre-attck-framework-placing-risk-burden-on-users/* https://www.securityweek.com/cybercriminals-leak-files-allegedly-stolen-law-firm-jones-day Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,063 other subscribers Email Address Subscribe

Originally Aired on February 8, 2021 Articles discussed in this episode: * https://threatpost.com/500-malicious-chrome-extensions-millions/152918/* https://threatpost.com/fake-forcepoint-google-chrome-extension-hacks/163728/* https://threatpost.com/industrial-networks-hackable-security-holes/163708/* https://www.reuters.com/article/us-usa-cyber-florida/hackers-broke-into-florida-towns-water-treatment-plant-attempted-poisoning-sheriff-says-idUSKBN2A82FV* https://twitter.com/SkelSec/status/1346553596855390212 Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,027 other subscribers Email Address Subscribe

Originally Aired on February 1, 2021 Articles discussed in this episode: * https://threatpost.com/microsoft-365-bec-innovation/163508/* https://threatpost.com/critical-libgcrypt-crypto-bug-arbitrary-code/163546/* https://www.newyorker.com/magazine/2021/02/08/the-next-cyberattack-is-already-under-way?&web_view=true Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 3,008 other subscribers Email Address Subscribe

ORIGINALLY AIRED ON JANUARY 25, 2021 Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 2,989 other subscribers Email Address Subscribe

ORIGINALLY AIRED ON JANUARY 20, 2021 Articles discussed in this episode: * https://www.theregister.com/2021/01/20/malwarebytes_solarwinds_hack_latest/* https://threatpost.com/solarwinds-malware-arsenal-raindrop/163153/* https://threatpost.com/dnspooq-flaws-allow-dns-hijacking-of-millions-of-devices/163163/ Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 2,982 other subscribers Email Address Subscribe

A few short years ago, penetration testers did not have to work too hard for their malware command channels to execute. Fast forward to today in the age of Endpoint Detection and Response, User Behavior Analytics, and advanced built-in O/S defenses, your standard toolkit for malware generation/execution does not work anymore. All is not lost! Using some relatively simple programming techniques, and tactical changes, we can still gain malware execution to establish our C2 channels. With some additional tactical changes post-exploitation, we can still move around below the radar but we need to move with greater care and stealth than ever before. Join the BHIS Discord Community– https://discord.gg/aHHh3u5 00:00 – The Soundboard Has Too Many Buttons 04:10 – FEATURE PRESENTATION: Malware Execution in the Age of Advanced Defenses 05:36 – Attacker / Threat Actor Emulation 09:41 – That Matrix 10:34 – Endpoint Defense Maturity 13:25 – C2 Implant Execution 19:41 – Metasploit: Why Is My Network Traffic Caught? 23:09 – C2 – Customize and LOL 41:13 – The More You Know… 44:11 – Recon/Discovery Artifacts 46:15 – Amusement with AMSI 47:33 – Simple! 48:10 – AMSI Bypass 50:27 – Event Tracing Bypass 51:34 – Attack Combo! 52:24 – Conclusion (00:00) - The Soundboard Has Too Many Buttons (04:10) - FEATURE PRESENTATION: Malware Execution in the Agge of Advanced Defenses (05:36) - Attacker / Threat Actor Emulation (09:41) - That Matrix (10:34) - Endpoint Defense Maturity (13:25) - C2 Implant Execution (19:41) - Metasploit: Why Is My Network Traffic Caught? (23:09) - C2 - Customize and LOL (41:13) - The More You Know... (44:11) - Recon/Discovery Artifacts (46:15) - Amusement with AMSI (47:33) - Simple! (48:10) - AMSI Bypass (50:27) - Event Tracing Bypass (51:34) - Attack Combo! (52:24) - Conclusion

Originally aired on January 13, 2021 Articles discussed in this episode: * https://www.theregister.com/2021/01/13/darkmarket_europol_shutdown/* https://www.theregister.com/2021/01/12/microsoft_linux_edr/* https://threatpost.com/mimecast-certificate-microsoft-supply-chain-attack/162965/* https://threatpost.com/hackers-leak-pfizer-covid-19-vaccine-data/163008/* https://krebsonsecurity.com/2021/01/ubiquiti-change-your-password-enable-2fa/ Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 2,975 other subscribers Email Address Subscribe

Does the news on SUNBURST and SUPERNOVA have you feeling like you’re flapping in the (Solar)Wind? Join John Strand, Jonathan Ham, and Jake Williams as they discuss the implications of the breaches in this no-FUD webcast. No, we won’t be discussing “cyber Pearl Harbor” – because lets be honest, that’s just hyperbole. Join us to learn why this is bad, but also why we assess that the sky isn’t falling. Join these three amigos to discuss breach details and actionable steps you can take in your own networks. Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 2,956 other subscribers Email Address Subscribe

Originally aired on December 21, 2020 Articles discussed in this episode: * https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hacked-with-suspected-nso-group-imessage-zero-click-exploit/ * https://theintercept.com/2020/12/17/russia-hack-austin-texas/ Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 2,925 other subscribers Email Address Subscribe

Originally aired on December 14, 2020 Articles discussed in this episode: * https://www.theverge.com/2020/12/14/22173803/gmail-youtube-google-assistant-docs-down-outage* https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html* https://krebsonsecurity.com/2020/12/u-s-treasury-commerce-depts-hacked-through-solarwinds-compromise/* https://www.darkreading.com/threat-intelligence/fireeye-breach-fallout-yet-to-be-felt/d/d-id/1339680* https://www.solarwinds.com/solutions/orion Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 2,921 other subscribers Email Address Subscribe

Originally aired on December 11, 2020 Articles discussed in this episode: * https://www.nobandwidth.io/* https://www.nytimes.com/2020/12/08/technology/fireeye-hacked-russians.html* https://www.picussecurity.com/resource/blog/techniques-tactics-procedures-utilized-by-fireeye-red-team-tools* https://blog.netspi.com/cve-2020-17049-kerberos-bronze-bit-attack/* https://www.bleepingcomputer.com/news/security/microsoft-fixes-new-windows-kerberos-security-bug-in-staged-rollout/* https://capricocave.wordpress.com/2020/12/10/docker-botnets/* https://www.trustedsec.com/blog/4-free-easy-wins-that-make-red-teams-harder/* https://arstechnica.com/tech-policy/2020/12/florida-posted-the-password-to-a-key-disaster-system-on-its-website/ Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 2,902 other subscribers Email Address Subscribe

Are you responsible for the security of webapps? Are you curious about how penetration testers are able to find vulnerabilities in them? Burp Suite is the preferred tool for many webapp pentesters and bug bounty hunters. It’s easy to get started in Burp, but not all of its features are easy to find or simple to configure. If you’ve ever watched someone else use Burp, you’ve no doubt picked up something useful from them: everyone seems to have their own tricks for getting more out of it. In this live one-hour Black Hills Information Security (BHIS) webcast, BB King will walk through how he sets up Burp for his own webapp and Web API pentests. Then he’ll show the settings, tools, and BApp Store Extensions that help him perform better tests. If you have any responsibility related to webapps – even if it’s not pentesting them – you may find that Burp Suite can help you. If you already use Burp Suite, come see how one of our testers does it and we bet you’ll find a thing or two you can take back and use on your next security assessment. Join the BHIS Discord Community– https://discord.gg/aHHh3u5 0:00:00 – PreShow Banter™ — Special Guests: The Innocent Lives Foundation 0:29:12 – FEATURE PRESENTATION: Getting Started With Burp Suite 0:32:33 – Initial Setup After install 0:45:25 – A Quick Run-Through Burp Suite 1:22:08 – We Has Questions? Outline for this webcast can be found here: https://www.blackhillsinfosec.com/wp-content/uploads/2020/12/SLIDES_GettingStartedWithBurpSuiteOutline.pdf Show Notes: * BHIS SWAG STORE! https://spearphish-general-store.myshopify.com/* https://wildwesthackinfest.com/training/ * https://github.com/snoopysecurity/awesome-burp-extensions* https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/* https://bitbucket.org/mrbbking/quieter-firefox/src* https://portswigger.net/ * (00:00) - PreShow Banter™ — Special Guests: The Innocent Lives Foundation (29:12) - FEATURE PRESENTATION: Getting Started With Burb Suite (32:33) - Initial Setup After install (45:25) - A Quick Run-Through Burp Suite (01:22:08) - We Has Questions?

Have you ever tried packaging a Python library/app in order to upload it to the Python Package repository (Pypi)? Not so straight forward is it? There’s a gazillion files you need (setup.py, Manifiest.ini, etc..) which all do different things. On top of that, there’s a decent amount of overhead to configure the necessary settings in order to expose any command line interface (CLI) tools your packaging. Additionally, you also need to manage dependencies, keep them in sync with your requirements.txt files and install third-party applications in order to upload them to Pypi. That’s after you even manage to setup a proper development environment and necessary virtual environments for your dependencies. Ever wonder if there’s a simpler solution that takes care of everything for you? In this Black Hills Information Security (BHIS) webcast, Marcello will show you how to make the entire Python development & packaging process as short and simple as a Haiku (https://python-poetry.org/). He’ll also show you the setup/workflow that he uses for all of his Python projects and throw in some pro tips along the way. Missed the first episode? Check out Pretty Little Python Secrets—EP 1—Installing Python Tools/ Libraries the Right Way- Marcello Salvati — https://youtu.be/ieyRV9zQd2U Join the Black Hills Information Security Discord Community — https://discord.gg/aHHh3u5 0:00:00 – PreShow Banter™ — Everybody Leaves West Virginia 0:12:15 – FEATURE PRESENTATION: Making Python Packaging Haiku Simple 0:16:56 – Why and How to Package Python? 0:23:26 – What Are All These Files? 0:31:28 – How to Upload the Dang Thing 0:37:01 – Setup a Development Environment? 0:42:44 – Pipenv! 0:46:52 – Pipenb Solves, but Also Creates Problems 0:49:21 – Poetry Corner 0:58:11 – Cookiecutter Automation (00:00) - PreShow Banter™ — Everybody Leaves West Virginia (12:15) - FEATURE PRESENTATION: Making Python Packaging Haiku Simple (16:56) - Why and How to Package Python? (23:26) - What Are All These Files? (31:28) - How to Upload the Dang Thing (37:01) - Setup a Development Environment? (42:44) - Pipenv! (46:52) - Pipenb Solves, but Also Creates Problems (49:21) - Poetry Corner (58:11) - Cookiecutter Automation (01:01:53) - Questions! (01:08:00) - Porchetta

Originally aired on November 30, 2020 Articles discussed in this episode: * https://www.computerweekly.com/news/252491324/Surge-in-Ryuk-ransomware-attacks-has-hospitals-on-alert* https://www.baltimoresun.com/maryland/baltimore-county/bs-md-co-what-to-know-schools-ransomware-attack-20201130-2j3ws6yffzcrrkfzzf3m43zxma-story.html* https://www.darknet.org.uk/2020/10/fuzzilli-javascript-engine-fuzzing-library Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 2,879 other subscribers Email Address Subscribe (00:00) - An Intro That Flaps (01:19) - Surge in Ryuk ransomware (03:57) - Baltimore County schools ransomware attack (11:36) - Fuzzy Wuzzy Javascript

Originally aired on November 19, 2020 Articles discussed in this episode: * https://duo.com/blog/the-great-dns-vulnerability-of-2008-by-dan-kaminsky* https://blog.cloudflare.com/sad-dns-explained Check out our Cyber Range, not just a place to work through challenges and play, but also an open direct/hands-on training environment. https://www.blackhillsinfosec.com/services/cyber-range/ Join the BHIS Blog Mailing List – get notified when we post new blogs, webcasts, and podcasts. Join 2,880 other subscribers Email Address Subscribe