People actually still got their news despite the Facebook downtime and there's still something funny about a shaved alpaca. Eric talks about web site hacking and Jon shares his thoughts on SMS spam from hacked routers. Eric finds a couple planets and Jon find a math problem. 0:00 - Intro 11:00 - What to do with Facebook down 12:03 - NSA's ALPACA recommendations 15:12 - Missouri takes on "hacking" 20:08 - Routers that do SMS go boom 25:16 - Space! 27:40 - Math! 

Mostly Security

201: Hang With Some Aliens

Eric's furnace is fixed, and Jon ekes forward the x-carve project. Quite the "quiet" week this week. The GriftHorse pun was right there, Twitch is doxed, Facebook blows their 9's, and Apple and Visa do not agree. For fun, images of a Mercury flyby, life advice from nerds, and defunct hyper compound eyes. 0:00 - Intro 14:48 - GriftHorse 20:02 - Twitch Dox 23:22 - Facebook Outage 34:30 - Apple Pay Visa Vuln 39:28 - Mercury Flyby 42:11 - Life Advice 47:20 - Hyper Compound Eyes 

200: Don't Look A GriftHorse In The Mouth

Eric is lazy and gets really cold, Jon fixes his CNC and gets his roof done. Tracking autodiscover websites, following bots that steal 2FA, scouting masked emails and chasing zero-day details. Eric ❤️ Van Gogh, Jon ❤️ justified text. 0:00 - Intro 15:36 - Autodiscover Followup 17:49 - Telegram Bots Stealing OTP 20:55 - 1Password+Fastmail=Private Emails 23:24 - Record Zero-day Hacks 28:31 - Van Gogh Art 31:46 - Super Metroid, Justified 

199: The Safety Was Engaged

(Anything *but* surprising ...). Eric and Jon are both excited about the rain, for different reasons. And a lot of "Security Bites (or Bytes)" tonight. A lock screen bypass, how to go passwordless, Facebook being evil in multiple ways, and an Autodiscover credential leak. For fun we have converting light to matter and a very hopeful look at the cost (or incredible, potential lack thereof) of a rapid transition to renewable energy. And a couple of book references along the way. 0:00 - Intro 11:59 - iPhone Lock Screen Bypass 14:03 - Passwordless Microsoft 17:07 - Facebook Blocking Watchdogs 20:33 - Project Amplify 21:36 - Autodiscover Leak 30:50 - Light to Matter 34:08 - Project Hail Mary 35:15 - The Man Who Solved The Market 38:19 - Oxford Study 

198: To Our Surprise

Jon remembers he's no longer 25. Eric cleaned and went to a movie. Microsoft followup, a Walgreens Website Whoops and of course you would call a cyberweapon "Karma". Eric's fun is all space and Jon's fun is waiting for him to be able to come out and play. 0:00 - Intro 10:58 - CVE-2021-40444 Follow Up 16:37 - Covid Test Website Whoops 22:47 - Karma 28:04 - Inspiration 4 30:37 - LCRT 31:36 - DuAxel Robots 32:52 - X-Carve 

197: That Was The Boom

Jon does plumbing and tail light repair, and Eric has a culinary weekend. Jailbreak detection evasion, spooky side channel of chrome, and two zero days, one in Microsoft and one in Zoho. For fun, the Perseverance rover has attained a core, an Asian Giant Hornet nest eradicated in Washington, and the "mythology of Bee Keeping" starring Jason Statham (??!?). 0:00 - Intro 14:37 - Jailbreak Detection Evasion 17:59 - Spoooook(y) 22:19 - MSHTML Zero Day 28:38 - Zoho Server Zero Day 33:06 - Perseverence Core (Dump) 35:59 - AGH Nest Discovered 40:50 - The Beekeeper 

196: Track, Don't Whack!

Eric does some electrical work, Jon chats with a police officer about his car. More Cryptocurrency is (are?) stolen. Apple has a double agent and can give you a digital driver's license. Azure has a bug and some more NSO iPhone hackery discussed. Eric finally knows what happened to the Red Delicious apples and Jon is looking forward to details from Venus. 0:00 - Intro 14:07 - More Cryptocurrency Theft 16:48 - Apple's Double Agent 20:23 - Apple Wallet Driver's License 26:45 - Azure Cloud Bug 36:35 - iPhone Exploits 45:25 - Red (not) Delicious Apples 49:39 - Going to Venus... 

195: Give the Tree a Break

Eric returns home, and Jon goes Fishing. Why you should keep home and work on different computers, a man tracks down his digital (bitcoin) muggers, a local privilege escalation in a Razer installer, and a location vulnerability in the Bumble app. For fun we have nuclear batteries and how to roll your own handwriting recognition machine learning model. 0:00 - Intro 10:26 - Church and State 15:01 - Digitally Mugged 19:34 - Razer Local Privilege Escalatiom 26:01 - Bumble Vulnerability 32:37 - Nuclear Battery 38:35 - Handwriting Recognition Example 

194: Punk Seals

Eric drinks New Coke Zero. Jon gets less honey than he had hoped. Collisions in Apple's CSAM, a T-Mobile breach, a Covid testing site breach and Blackberry QNX bugs. Eric aspires to visit Machu Picchu now that he knows how old it really is and Jon talks about really hot tiny things and woolly mammoth travel tracking. 0:00 - Intro 14:36 - Apple CSAM collision 20:06 - T-Mobile breach 24:34 - Covid testing site breach 29:47 - Blackberry QNX Bugs 36:46 - Machu Picchu 40:02 - National Ignition Facility 43:42 - Mammoth Travels 

193: Now More Delicious

Eric has mixed followup, and Jon finishes the Yurt; Scamming the wannabe scammers, AI authored phishing, and Poly Network Hacked and some crypto returned. A bit about the Apple CSAM detection features. A newly realized carnivorous plant, and a climate change serenity prayer. 0:00 - Intro 13:57 - Honor (?) Among Thieves 17:07 - Let the AI Phish 20:56 - Poly Network Hack 26:26 - Crypto Returns 29:26 - CSAM Take 1 35:50 - CSAM Take 2 43:20 - Carnivory 47:25 - Pinboard's Opinion 

192: True Portland Fashion

Hijinks all around in this episode. Eric fails to injure himself playing softball this week and Jon explains what 20/20 means? Jon expounds on the audio book value proposition while Eric fails to understand (again). A phone was lost, stay tuned next week for the result! A bit of Solarwinds followup, a capsule hotel IoT party, a sportsball video game gambit, and an accelerometer intrigue. Eric empathizes with the Silver Medalists and swoons over David Attenborough (again) while Jon talks up Time Crystals. 0:00 - Intro Hijinks 12:41 - Solarwinds Followup Hijinks 16:00 - Capsule Hotel Hijinks 21:02 - FIFA 21 Theft Hijinks 28:35 - Accelerometer Hijinks 34:30 - Olympic Medal Hijinks 37:41 - Pandemic Hijinks 41:13 - Time Crystal Hijinks 

191: Psychologically Vampiric

Eric wounds his face and Jon builds a Yurt Base. Keep your devices updated -- more active exploitation. FTC warns of potential crackdowns and fallout from data abuses, location data is not anonymous, and the White House releases a memo regarding cybersecurity for critical infrastructure control systems. For fun we have Project Hail Mary by Andy Weir, and a Google AI blog about movie-style image enhancement. 0:00 - Intro 12:38 - Update Your Apple (and other) Things 14:09 - FTC Crackdown Warning 18:56 - Location Fingerprint 27:46 - Cybersecurity for Critical Infrastructure 33:39 - Project Hail Mary 37:11 - Super-Resolution via Repeated Refinements 

190: Angry Anime Dad

Eric's back from camping and Jon disassembles a yurt. Instagram introduces a Security Checkup and Wired outlines an ATM NFC Hack. Millions of printers have bugs and Jon waxes philosophical on security. Eric discovers a new poetry and Jon recommends a book by Trevor Noah. 0:00 - Intro 10:18 - Instagram Security 13:23 - ATM NFC Hack 17:24 - Printer Bugs 20:27 - Security Nihilism 28:32 - Source Code Poetry 31:43 - Born a Crime 

189: Walk the Asymptote

Eric's still on vacation, and Jon goes Fishing. Coke Zero is getting a flavor [up|down]grade, and the Kaseya exploit details revealed. Google supports authenticated images in gmail, a glimmer of Net Neutrality, and inside the W3C's Privacy War. For fun we have River Runner and an awesome thread about the Appalachian mountains. 0:00 - Intro 9:14 - Coke Zero Flavor Change 10:52 - Kaseya Followup 17:15 - Google Supports BIMI 21:17 - Internet as Utility 25:06 - W3C Privacy War 34:58 - River Runner 37:14 - Geological Fun 

188: In It For The Bubbles

Eric is on vacation and Jon goes to the beach. Some Android apps steal Facebook credentials and a law firm gets an injunction against ransomware criminals. Kaseya is busy and Kaspersky fixes a password manager. Goomics hits close to home and Jon chats about James Barry and Solar Panels over Canals. 0:00 - Intro 9:22 - Facebook stealing Android apps 12:24 - Legal Injunction 14:17 - Kaseya 20:45 - Password Manager Ooops 30:40 - goomics.net 33:22 - James Barry 37:49 - Solar Panel'd Canals 

187: No one is in a hurry

Jon and Eric have worked in the security space as developers, architects and leaders for more years than they care to count. From commentary on current events to random musings, they chat (mostly) about security and technology topics. However, life is more than just the day job. From beekeeping adventures to hiking mountains to favorite shows, there's always something fun to wrap up the show.

hubhopper

Mostly Security

hubhopper