Security Weekly Podcast Network (Audio)

AI hates us all, Binance, OpenSSH, Apple, WordPress, DNS, Scams, Josh Marpet, and More, on this episode of the Security Weekly News.
Visit https://www.securityweekly.com/swn for all the latest episodes!
Show Notes: https://securityweekly.com/swn-631

In the security news:
Supermarket refrigeration attacks, again!
Rapid7’s Ivanti findings and why we can’t have “nice” things
Google’s massive Android TV botnet takedown
Linux TCP kernel flaw that no one is patching
The Binance theft
APT flaw gives out root
PHP security debt
The porn and Digital billboard problem
Your own phone system to pwn
From PoC to weaponized exploit
Hacking to change time
Rooting an Echo Dot
Firmware should just work
AI chained bugs into working exploits
USB power states leak data across an air gap
AI-assisted vulnerability finding
GoAhead’s TLS handling
Hackers hijack emergency alert apps
Taiwan’s emergency services become an AI-agent target
CUI exposed through GSA’s Google Drive
GCHQ can’t account for thousands of storage devices
Railway employee blames an attempted intrusion on AI
VulnCheck opens its initial-access playground to the public
Visit https://www.securityweekly.com/psw for all the latest episodes!
Show Notes: https://securityweekly.com/psw-951

As the prevalence of AI continues to grow, more and more people are worried about their online safety. New scams seem to be popping up every day, packaged in creative and terrifying ways. How do you protect yourself?
Frank Riccardi, Author of CTRL+ALT+PWN: The Hacker’s Playbook (And How to Beat It), joins Business Security Weekly to discuss why it’s not the technology that PWNs you, it’s the trickery. Rather than resign yourself to an inevitable fate or remove yourself from the online world entirely, learn the tricks of the trade to avoid being just another pwned noob. Frank exposes the secret weapons, sneaky tactics, and psychological tricks used by hackers today—and discusses how to stop them.
Segment Resources:
https://www.amazon.com/CTRL-ALT-PWN-Hackers-Playbook/dp/B0F8GP89NL
In the leadership and communications segment, CISO Problems That Can't Be Solved With Technology, When Being Authentic Undermines Your Leadership, Empower Your Most Curious Employees to Drive Your Digital Transformation, and more!
Visit https://www.securityweekly.com/bsw for all the latest episodes!
Show Notes: https://securityweekly.com/bsw-472

Patrick Stewart, Videostrong, C3RB3R, GitLab, VMware, BTCPay, Binance, Aaran Leyland, and More, on the Security Weekly News.
Visit https://www.securityweekly.com/swn for all the latest episodes!
Show Notes: https://securityweekly.com/swn-630

Following the catalog of CVEs is great for enumeration, but chasing those CVEs for patching is terrible for strategy. Jeremiah Grossman shows what breach data tells us about the differences between having over 400,000 CVEs, a few thousand KEVs, and a few hundred ways that attackers compromise orgs. We go into the importance of distinguishing vulns from exploits and where we see agents making a meaningful impact. Then we touch on some history of appsec and why the trajectory of vulns like SQL injection and XSS, along with well-known security controls, point to a more secure future -- or even possibly a pretty secure present.
Resources
https://www.rootevidence.com/blog-posts/stop-chasing-cves/
https://www.rootevidence.com/blog-posts/the-defender-window-is-longer-than-you-think/
Visit https://www.securityweekly.com/asw for all the latest episodes!
Show Notes: https://securityweekly.com/asw-407