Episodes

From EuroTrashSecurity

Jump to: navigation, search

Contents

Find The Podcast

->>> http://www.eurotrashsecurity.eu/episodes/eurotrash.xml <<<-

Episode 7

Getting our VoIP on with Sandro Gauci

Our Guest

Sandro Gauci is an authority on VoIP (in)security from Malta. Didn't we already tell you we have awesome security people in Europe? He recently attended Hackcon as a speaker in Norway and he will most likely follow up his awesome VoIP workshop from last year at Brucon with a 2-day VoIP security course.

You can follow Sandro on Twitter at http://www.twitter.com/sandrogauci

You can find out more about Sandro and VOIPPACK for Canvas at http://enablesecurity.com/


News Stories

  • Chip and PIN is broken, say researchers

http://news.zdnet.co.uk/security/0,1000000189,40022674,00.htm

  • Future police: Meet the UK's armed robot drones

http://www.wired.co.uk/news/archive/2010-02/10/future-police-meet-the-uk%27s-armed-robot-drones.aspx

  • MS update gives some XP boxes the Blue Screen

http://www.theregister.co.uk/2010/02/11/ms_bsod_update_glitch

  • NHS appraisal toolkit yanked offline - Frail and Weak

http://www.theregister.co.uk/2010/02/10/nhs_doctor_site_security_takedown

  • Month of PHP Security 2010 (May 2010)

http://www.suspekt.org/2010/02/19/sneak-preview-month-of-php-security-2010/

Courses going on in Europe

SANS Forensics 508: Computer Forensic Investigations and Incident Response Mentor: Florian Eichelberger Dates: Thursday, September 9, 2010 - Thursday, November 11, 2010 http://www.sans.org/mentor/details.php?nid=21388

SANS Security 560: Network Penetration Testing and Ethical Hacking Mentor: Erik Van Buggenhout Dates: Tuesday, April 20, 2010 - Tuesday, June 22, 2010 http://www.sans.org/mentor/details.php?nid=21434

Feedback

As always, you can follow us on twitter (http://www.twitter.com/eurotrashsec) and we welcome your feedback via e-mail on feedback@eurotrashsecurity.eu .

Episode 6

Burping into your webapps !

Our Guest

We are once again honoured to have one of the smart European infosec peeps as our guest. This time Portswigger, the brain behind the awesome Burp Suite joins us to discuss the state of web applications and new features in the tool that every (webapp) pentester should be familiar with. He recently released version 1.3 !

You can follow Portwigger at http://www.twitter.com/portswigger

More information on The Burp Suite can be found on http://www.portswigger.net

News Stories

  • IE6 exploit + a nasty privilege escalation bug !
  • full body scanners to be used


Feedback

As always, you can follow us on twitter (http://www.twitter.com/eurotrashsec) and we welcome your feedback via e-mail on feedback@eurotrashsecurity.eu .

Episode 5

Injecting nonsense in your GRC tables !

Our Guest

On this episode we are joined by Justin Clarke, information security rockstar and well-known for his entertaining talks on SQL injection and his 2009 book "SQL injection: Attack and Defense" (published by Syngress). We discuss the in and outs of SQL injection and search for the reason why it is still the number one threat to web applications.

You can follow Justin at http://www.twitter.com/connectjunkie

His book is available at http://bit.ly/86TvzX (Amazon) or http://bit.ly/92ZGab (Syngress)

Prize Question

Justin was so nice to offer us one copy of his book that we can give away to the first person who sends the correct answer to the following question to feedback@eurotrashsecurity.eu :

In blind SQL injection, if you replace a string blah with blah' || 'blah and it still works, which database (or databases) would that suggest are present?

Ok, so we failed to announce the winner in Episode 7 due some logistical issues but we're proud to announce the winner here. (drumroll ...) The winner is Jonathan James from Sweden !!! Enjoy the book Jonathan !

Now, since multiple answers could've been correct we selected the first person to submit at least 2 possible answers. The answer we started from, as provided by Justin was : "Oracle, Postgres or Ingres (and possibly others)"

There are no specific rules for this giveaway other than that only residents of the EU are eligible. The most complete answer will be selected. If we have multiple correct answers the e-mail that arrives in our mailbox first will be the winner. Please include your full name and, if you have one, your twitter name. The winner will be announced on Episode 7, to be released in the week of February 22nd.

News Stories

  • 26C3

Chris was there and had an awesome time. the Chaos Computer Club conference is one of (if not the) oldest hacker conferences in the world and is getting better every year. If you weren't able to attend or watch the live streams, you can still get your geek on by watching the recorded presentations : http://events.ccc.de/congress/2009/wiki/Welcome

  • 2010 bug

We discuss the impact of the 2010 bug on several technologies :

http://www.h-online.com/security/news/item/Problems-obtaining-cash-from-German-ATMs-Update-894801.html

http://www.h-online.com/security/news/item/EC-card-problem-persists-896549.html

http://www.theregister.co.uk/2010/01/06/year_2010_payment_card_bug/

http://www.theregister.co.uk/2010/01/05/windows_mobe_bug/

http://www.h-online.com/security/news/item/EC-card-disaster-French-manufacturer-Gemalto-takes-responsibility-897991.html

http://www.theregister.co.uk/2010/01/09/symantec_endpoint_manager_bug/

  • FIPS certified 'secure' USB sticks hacked

http://www.h-online.com/security/news/item/NIST-certified-USB-Flash-drives-with-hardware-encryption-cracked-895308.html

  • Mr Bean ousts PM from Spain's official website

http://www.theregister.co.uk/2010/01/05/spanish_coup/

  • Why Nominet disconnected more than 1,000 sites with no court oversight

http://www.out-law.com/page-10652

Feedback

As always, you can follow us on twitter (http://www.twitter.com/eurotrashsec) and we welcome your feedback via e-mail on feedback@eurotrashsecurity.eu .

Episode 4

The Crimbo edition !

A very special Xmas episode recorded together with the Exotic Liability crew. Chris, Craig, Dale and Wim are joined by Chris and Ryan to discuss what moved the infosec community on both sides of the big pond in 2009 and are looking forward to 2010. One certainty being you will receive more and better Exotic Trash / EuroLiability.

Have a very merry Christmas and may your information not be compromized in 2010.

Episode 3

File:Http://www.eurotrashsecurity.eu/images/cookies.jpg

Upcoming cons

Upcoming Events/Important Deadlines: Caro2010 in Helsinki, Finland Call for Papers deadline 31st January (Craig) (26th and 27th of May !) Note, speakers must pay their own way. Submit a half-page abstract of your talk via email to: cfp@caro2010.org http://caro2010.org/

BlackHat Europe (Barcelona, Spain) Call for Papers is out (Craig) http://www.blackhat.com/html/eu2010/registration/eu2010-cfp.html

26C3 end of December - Berlin http://events.ccc.de/congress/2009/wiki/index.php/Welcome

Source Barcelona = September 21st and 22nd 2010. (CFP not open yet) Brucon, mark down 24th and 25th of September 2010 in your calendar. (CFP not open yet)

Our guest

Ewout Meij (http://mokumvonamsterdam.blogspot.com). Ewout is an Amsterdam based security professional. Twitter handle: @mokum.

He recently wrote a post on fudsec and we thought we'd bring him in for a chat about all things infosec...

News Stories

  • EU approves data-sharing SWIFT agreement with US authorities

http://www.dw-world.de/dw/article/0,,4952263,00.html

  • Exploits are illegal in France since Nov. 24th (Wim) (and thanks for the link to Matthieu Suiche)

http://droit-finances.commentcamarche.net/legifrance/37-code-penal/89982/article-323-3-1 (In French) http://lists.immunitysec.com/pipermail/dailydave/2009-November/005964.html

  • Malmö hackerspace raided by Swedish Police (Wim)

http://forskningsavd.se/2009/11/29/i-can-haz-moar-bout-teh-reid/

  • Laurent Gaffie releases an ICMPv4/IP fuzzer (Craig) based on Philipe Biondi's scapy framework (if you haven't used scapy, you're really missing out). Time to test your embedded devices :). This release is hot on the heels of his SMB fuzzer 'SDL FAIL' (remote kernel vuln in 2 mins)

http://g-laurent.blogspot.com/2009/11/releasing-icmpv4ip-fuzzer-prototype.html

Feedback

As always, you can follow us on twitter (http://www.twitter.com/eurotrashsec) and we welcome your feedback via e-mail on feedback@eurotrashsecurity.eu .

Episode 2

News Stories

  • UK jails schizophrenic for refusal to decrypt files :

http://www.theregister.co.uk/2009/11/24/ripa_jfl/

  • Quick discussion on the Evil Maid :

http://theinvisiblethings.blogspot.com/2009/10/evil-maid-goes-after-truecrypt.html

  • ENISA launches Cloud Security Risk Assessment Report :

http://cloudsecurity.org/2009/11/20/enisa-cloud-security-risk-assessment/

  • T-Mobile staff sold personal data :

http://news.bbc.co.uk/1/hi/uk/8364421.stm

  • UK Information Commisioners office gets served a FOI (Freedom of Information) request by Software AG and reveals 356 data loss incidents voluntarily reported by UK organisations:

http://www.infosecurity-magazine.com/view/4800/uk-cios-reported-356-data-loss-incidents-last-year/

Special Guest

Wim ruined our first try to do an interview with Didier Stevens and luckily Didier agreed to free up some of his time to give it a second try. With redundant audio recordings, we managed to nail this one down.

Didier is a security researcher from Belgium with a special interest in Adobe's PDF file format. He has discovered several flaws in the format and has some interesting views on information security in general.

http://blog.didierstevens.com

http://www.twitter.com/didierstevens

Feedback

As always, you can follow us on twitter (http://www.twitter.com/eurotrashsec) and we welcome your feedback via e-mail on feedback@eurotrashsecurity.eu .

Thanks for listening and until the next time !

Episode 1

This is Episode 1.

Our tag line: [si-kyoor-i-tee] Security with funny accents

The team:

  • Wim (@wimremes): Information Security Consultant in Belgium, trying to hold his own. http://blog.remes-it.be
  • Chris (@ChrisJohnRiley): Senior Security Analyst for a major Austrian bank --> Ramblings of the Änal Security Guy Blog http://www.c22.cc
  • Dale (@daleapearson): Security Manager for a global outsourcing company, and do my technical stuff in my own time. --> Do my own thing over at http://www.securityactive.co.uk
  • Craig (@craigbalding): pen-tester, incident responder & internal security consulting at a F500. "Official" 3rd person voice pimpage here: http://www.craigbalding.com

Our thanks to


- Stories for discussion -

British Government to use talent competition to find the best young hackers (wim) apparently we are looking for the next Susan Boyle in information security ?

SANS London 09 (wim) Staying up-to-date comes with a hefty price tag :-( (chris) PaulDotCom's John Strand will be teaching and running a CTF event --> Friday Dec 4th

EU: Microsoft to test browser 'ballot screen'

Dale helped to organize. We recap with him and Craig who was also attending and talk about future editions.

Retrieved from "http://www.eurotrashsecurity.eu/index.php/Episodes"
This page was last modified on 23 February 2010, at 22:28. This page has been accessed 4,254 times.