Episodes

From EuroTrashSecurity

Jump to: navigation, search

Contents

Find The Podcast

->>> http://www.eurotrashsecurity.eu/episodes/eurotrash.xml <<<-

->>> Also available through iTunes <<<-

Microtrash 15

Sharon Conheady will be giving a training on Social Engineering at Brucon and joins us to talk about that and Social Engineering in general.

Find more about the training here : http://2010.brucon.org/index.php/Training#Training_.233:_Social_engineering Find more about Sharon's services here : http://www.firstdefenceis.com/

Episode 13

Ivan Ristic recently talked at BlackHat in Las Vegas about the awesome research he did on SSL. On this episode he discusses that research, his work on modsecurity, why WAFs are far from dead and his view on information security in general. Saying we were honoured to have Ivan as our guest would be an understatement. Go listen for yourself.

Microcast 9

We don't tend to post shownotes for Microcasts but since Microcast 9, featuring Source Conference organizer Stacy Thayer as our guest, includes a prize question, we make a difference here.

the competition has ended and the winner has been contacted, thanks all for playing ! To win the free ticket to the Source Conference, provide us with the details about the first ever Keynote speaker at Source and send your answer to feedback@eurotrashsecurity.eu. We will draw a random name from the submissions on Friday August 30th and announce it our twitter account http://www.twitter.com/eurotrashsec .

Episode 11

We are joined by Pete Herzog from ISECOM to talk OSSTMM, The Bad People Project and Möbius Defense.

Our Guest

Interview with Pete Herzog (ISECOM)

As Managing Director, Pete is the co-founder of ISECOM and is directly involved in all ISECOM projects. His main objective is for ISECOM to assure truth in security application and deployment. Pete focuses on scientific, methodical testing for controlling the quality of security, countermeasures, access controls, and business integrity.

News Stories

  • Google to offer encrypted search :

http://news.cnet.com/8301-30684_3-20005055-265.html

  • Google admits wi-fi data collection blunder

http://news.bbc.co.uk/2/hi/technology/8684110.stm http://www.theregister.co.uk/2010/05/21/google_halts_wifi_payload_data_deletion/

  • EU says Google and Microhoo still violate data protection law

http://www.theregister.co.uk/2010/05/26/eu_says_google_microsoft_and_yahoo_still_do_not_comply_with_data_retention_laws

  • Gregory D. Evans / LIGATT Twitter Plagiarism

http://attrition.org/errata/charlatan/gregory_evans/ligatt03/

  • Germany enforces secure wireless internet :

BERLIN - Germany's top criminal court ruled Wednesday that Internet users need to secure their private wireless connections by password to prevent unauthorized people from using their Web access to illegally download data.

Internet users can be fined up to euro100 ($126) if a third party takes advantage of their unprotected WLAN connection to illegally download music or other files, the Karlsruhe-based court said in its verdict.

"Private users are obligated to check whether their wireless connection is adequately secured to the danger of unauthorized third parties abusing it to commit copyright violation," the court said.

See http://news.yahoo.com/s/ap/20100512/ap_on_hi_te/eu_germany_wireless_passwords

  • FSA to contact people on the sucker list and warn them.

http://www.theregister.co.uk/2010/05/19/share_scam_sucker_list_warning/

  • Fraud Bazaar Carders.cc Hacked

http://krebsonsecurity.com/2010/05/fraud-bazaar-carders-cc-hacked/

  • BBC Series: The Real Hustle

http://en.wikipedia.org/wiki/The_Real_Hustle http://www.bbc.co.uk/realhustle/

  • AUScert Conference: Understanding Scam Victims

http://conference.auscert.org.au/conf2010/presenter.php?presenter_id=F_S

  • Paul Wilson from The Real Hustle programmes Real Hustler site.

http://rpaulwilson.blogspot.com/

  • Great post from shrdlu on what a CISO expects from a visiting auditor.

http://layer8.itsecuritygeek.com/layer8/comments/audit-instructions/

Call for papers

  • Hack.lu

http://2010.hack.lu/cfp-hacklu2010.txt

  • BruCON - Lightening Talks

http://2010.brucon.org/index.php/Lightning_Talks

  • ApacheCon North America 2010

https://blogs.apache.org/foundation/entry/call_for_participation_technical_talks

Feedback

As always, you can follow us on twitter (http://www.twitter.com/eurotrashsec) and we welcome your feedback via e-mail on feedback@eurotrashsecurity.eu .

Episode 10

We are joined by Philip M. Gollucci from the Apache Infrastructure team to talk about the recent Apache hack and how the industry has responded to the information released on the Apache blog.

Our Guest

Interview with Philip M. Gollucci (VP Apache Infrastructure)

  • Apache Incident Reports

http://blogs.apache.org/infra/entry/apache_org_04_09_2010

http://blogs.apache.org/infra/entry/apache_org_downtime_report

News Stories

  • Blippy exposes users credit card information

http://mashable.com/2010/04/23/blippy-credit-card-numbers/ http://mashable.com/2010/04/23/blippy-statement/

  • Google Streetview logs WLAN SSIDs

http://www.theregister.co.uk/2010/04/22/google_streetview_logs_wlans/

  • UK-wide cyber security challenge

http://www.zdnet.co.uk/news/jobs/2010/04/28/uk-wide-cyber-security-challenge-kicks-off-40088794/

  • Infosecurity Europe 2010

http://www.infosec.co.uk/

  • Month of PHP Security

http://php-security.org/

  • Infosec Cynic Show

http://www.infoseccynic.com

  • Offensive Security Hacking Tournament

http://www.information-security-training.com/news/how-strong-is-your-fu-registration-and-rules/

Call for papers

  • Plumbercon

http://plumbercon.org/ (14th May)

  • Brucon

http://brucon.org (30th April)

Feedback

As always, you can follow us on twitter (http://www.twitter.com/eurotrashsec) and we welcome your feedback via e-mail on feedback@eurotrashsecurity.eu .

Episode 9

Andres Riancho from Bonsai Sec joins us to talk about the upcoming 1.0 release

Our Guest

Andres Riancho is the lead developer of W3AF the awesome Web Application Attack and Audit Framework. Andres is also the founder of Bonsai Sec, an information security company based in Argentina.

You can find out more about Andres through http://www.bonsai-sec.com or on Twitter at http://www.twitter.com/w3af

The W3AF project can be found on Sourceforge --> http://sourceforge.net/projects/w3af/

News Stories

  • UK firms face £500,000 fine for losing data

http://www.sophos.com/blogs/gc/g/2010/04/06/uk-firms-face-500000-fine-losing-data/

  • Aus dem Tagebuch eines Bughunters --> German

http://www.trapkit.de/index.html

  • German Government Pays Hacker For Stolen Bank Account Data

http://tacticalwebappsec.blogspot.com/2010/04/german-government-pays-hacker-for.html

  • Good analysis on the current state of Internet security

http://journal.paul.querna.org/articles/2010/04/11/internet-security-is-a-failure/

  • Digital Economy Bill

http://www.guardian.co.uk/technology/2010/apr/08/digital-economy-bill-passes-third-reading

  • Just4Meeting - Information Security Meeting - Portugal / June 25th - 27th

http://www.just4meeting.com/


Feedback

As always, you can follow us on twitter (http://www.twitter.com/eurotrashsec) and we welcome your feedback via e-mail on feedback@eurotrashsecurity.eu .

Episode 8.5 (Exclusocast)

In this exclusive interview we talk to Didier Stevens about his recent PDF discoveries and how his latest Proof of Concept really works.

Our Guest

Didier Stevens is a multiple time guest on the show and one of the coolest guys in Infosec.

Didier is a security researcher from Belgium with a special interest in Adobe's PDF file format. He has discovered several flaws in the format and has some interesting views on information security in general.

http://blog.didierstevens.com

http://www.twitter.com/didierstevens

Feedback

As always, you can follow us on twitter (http://www.twitter.com/eurotrashsec) and we welcome your feedback via e-mail on feedback@eurotrashsecurity.eu .

Episode 8

Taking it to the Street.... Jayson E Street that is!

Our Guest

Jayson E Street is the world renowned author of Dissecting the Hack, Conference organizer (exCon) and all round great guy.

You can find out more about Jayson through http://www.dissectingthehack.com or on Twitter at http://www.twitter.com/jaysonstreet

News Stories

  • Horizontal scrollbar prompts EU gripe from 6 browser makers

http://arstechnica.com/tech-policy/news/2010/03/horizontal-scrollbar-prompts-eu-gripe-from-6-browser-makers.ars

  • OpenSSH version 5.4(5.4p1) released (08 March 2010)

http://www.openssh.com/

  • Sumo wrestler lifts cash machine

http://www.theregister.co.uk/2010/03/08/cash_machine/

  • Internet Explorer 0-day

http://www.microsoft.com/technet/security/advisory/981374.mspx Exploit now in Metasploit (Video) http://blog.c22.cc/2010/03/11/internet-explorer-iepeers-dll-use-after-free/

  • Faster Cracking of Passwords with SSD Tools

http://www.theregister.co.uk/2010/03/12/password_cracking_on_crack/

  • UK Plastic Fraud losses fall for first time in 3 years

http://www.theregister.co.uk/2010/03/10/uk_plastic_fraud/

  • Ford preps anti-hacking tech for in-car WiFi

http://www.theregister.co.uk/2010/03/12/ford_in_car_secure_wifi/

  • SecurityFocus to partially shut down

http://www.h-online.com/security/news/item/SecurityFocus-to-partially-shut-down-952967.html

Feedback

As always, you can follow us on twitter (http://www.twitter.com/eurotrashsec) and we welcome your feedback via e-mail on feedback@eurotrashsecurity.eu .

Episode 7

Getting our VoIP on with Sandro Gauci

Our Guest

Sandro Gauci is an authority on VoIP (in)security from Malta. Didn't we already tell you we have awesome security people in Europe? He recently attended Hackcon as a speaker in Norway and he will most likely follow up his awesome VoIP workshop from last year at Brucon with a 2-day VoIP security course.

You can follow Sandro on Twitter at http://www.twitter.com/sandrogauci

You can find out more about Sandro and VOIPPACK for Canvas at http://enablesecurity.com/


News Stories

  • Chip and PIN is broken, say researchers

http://news.zdnet.co.uk/security/0,1000000189,40022674,00.htm

  • Future police: Meet the UK's armed robot drones

http://www.wired.co.uk/news/archive/2010-02/10/future-police-meet-the-uk%27s-armed-robot-drones.aspx

  • MS update gives some XP boxes the Blue Screen

http://www.theregister.co.uk/2010/02/11/ms_bsod_update_glitch

  • NHS appraisal toolkit yanked offline - Frail and Weak

http://www.theregister.co.uk/2010/02/10/nhs_doctor_site_security_takedown

  • Month of PHP Security 2010 (May 2010)

http://www.suspekt.org/2010/02/19/sneak-preview-month-of-php-security-2010/

Courses going on in Europe

SANS Forensics 508: Computer Forensic Investigations and Incident Response Mentor: Florian Eichelberger Dates: Thursday, September 9, 2010 - Thursday, November 11, 2010 http://www.sans.org/mentor/details.php?nid=21388

SANS Security 560: Network Penetration Testing and Ethical Hacking Mentor: Erik Van Buggenhout Dates: Tuesday, April 20, 2010 - Tuesday, June 22, 2010 http://www.sans.org/mentor/details.php?nid=21434

Feedback

As always, you can follow us on twitter (http://www.twitter.com/eurotrashsec) and we welcome your feedback via e-mail on feedback@eurotrashsecurity.eu .

Episode 6

Burping into your webapps !

Our Guest

We are once again honoured to have one of the smart European infosec peeps as our guest. This time Portswigger, the brain behind the awesome Burp Suite joins us to discuss the state of web applications and new features in the tool that every (webapp) pentester should be familiar with. He recently released version 1.3 !

You can follow Portwigger at http://www.twitter.com/portswigger

More information on The Burp Suite can be found on http://www.portswigger.net

News Stories

  • IE6 exploit + a nasty privilege escalation bug !
  • full body scanners to be used


Feedback

As always, you can follow us on twitter (http://www.twitter.com/eurotrashsec) and we welcome your feedback via e-mail on feedback@eurotrashsecurity.eu .

Episode 5

Injecting nonsense in your GRC tables !

Our Guest

On this episode we are joined by Justin Clarke, information security rockstar and well-known for his entertaining talks on SQL injection and his 2009 book "SQL injection: Attack and Defense" (published by Syngress). We discuss the in and outs of SQL injection and search for the reason why it is still the number one threat to web applications.

You can follow Justin at http://www.twitter.com/connectjunkie

His book is available at http://bit.ly/86TvzX (Amazon) or http://bit.ly/92ZGab (Syngress)

Prize Question

Justin was so nice to offer us one copy of his book that we can give away to the first person who sends the correct answer to the following question to feedback@eurotrashsecurity.eu :

In blind SQL injection, if you replace a string blah with blah' || 'blah and it still works, which database (or databases) would that suggest are present?

Ok, so we failed to announce the winner in Episode 7 due some logistical issues but we're proud to announce the winner here. (drumroll ...) The winner is Jonathan James from Sweden !!! Enjoy the book Jonathan !

Now, since multiple answers could've been correct we selected the first person to submit at least 2 possible answers. The answer we started from, as provided by Justin was : "Oracle, Postgres or Ingres (and possibly others)"

There are no specific rules for this giveaway other than that only residents of the EU are eligible. The most complete answer will be selected. If we have multiple correct answers the e-mail that arrives in our mailbox first will be the winner. Please include your full name and, if you have one, your twitter name. The winner will be announced on Episode 7, to be released in the week of February 22nd.

News Stories

  • 26C3

Chris was there and had an awesome time. the Chaos Computer Club conference is one of (if not the) oldest hacker conferences in the world and is getting better every year. If you weren't able to attend or watch the live streams, you can still get your geek on by watching the recorded presentations : http://events.ccc.de/congress/2009/wiki/Welcome

  • 2010 bug

We discuss the impact of the 2010 bug on several technologies :

http://www.h-online.com/security/news/item/Problems-obtaining-cash-from-German-ATMs-Update-894801.html

http://www.h-online.com/security/news/item/EC-card-problem-persists-896549.html

http://www.theregister.co.uk/2010/01/06/year_2010_payment_card_bug/

http://www.theregister.co.uk/2010/01/05/windows_mobe_bug/

http://www.h-online.com/security/news/item/EC-card-disaster-French-manufacturer-Gemalto-takes-responsibility-897991.html

http://www.theregister.co.uk/2010/01/09/symantec_endpoint_manager_bug/

  • FIPS certified 'secure' USB sticks hacked

http://www.h-online.com/security/news/item/NIST-certified-USB-Flash-drives-with-hardware-encryption-cracked-895308.html

  • Mr Bean ousts PM from Spain's official website

http://www.theregister.co.uk/2010/01/05/spanish_coup/

  • Why Nominet disconnected more than 1,000 sites with no court oversight

http://www.out-law.com/page-10652

Feedback

As always, you can follow us on twitter (http://www.twitter.com/eurotrashsec) and we welcome your feedback via e-mail on feedback@eurotrashsecurity.eu .

Episode 4

The Crimbo edition !

A very special Xmas episode recorded together with the Exotic Liability crew. Chris, Craig, Dale and Wim are joined by Chris and Ryan to discuss what moved the infosec community on both sides of the big pond in 2009 and are looking forward to 2010. One certainty being you will receive more and better Exotic Trash / EuroLiability.

Have a very merry Christmas and may your information not be compromized in 2010.

Episode 3

File:Http://www.eurotrashsecurity.eu/images/cookies.jpg

Upcoming cons

Upcoming Events/Important Deadlines: Caro2010 in Helsinki, Finland Call for Papers deadline 31st January (Craig) (26th and 27th of May !) Note, speakers must pay their own way. Submit a half-page abstract of your talk via email to: cfp@caro2010.org http://caro2010.org/

BlackHat Europe (Barcelona, Spain) Call for Papers is out (Craig) http://www.blackhat.com/html/eu2010/registration/eu2010-cfp.html

26C3 end of December - Berlin http://events.ccc.de/congress/2009/wiki/index.php/Welcome

Source Barcelona = September 21st and 22nd 2010. (CFP not open yet) Brucon, mark down 24th and 25th of September 2010 in your calendar. (CFP not open yet)

Our guest

Ewout Meij (http://mokumvonamsterdam.blogspot.com). Ewout is an Amsterdam based security professional. Twitter handle: @mokum.

He recently wrote a post on fudsec and we thought we'd bring him in for a chat about all things infosec...

News Stories

  • EU approves data-sharing SWIFT agreement with US authorities

http://www.dw-world.de/dw/article/0,,4952263,00.html

  • Exploits are illegal in France since Nov. 24th (Wim) (and thanks for the link to Matthieu Suiche)

http://droit-finances.commentcamarche.net/legifrance/37-code-penal/89982/article-323-3-1 (In French) http://lists.immunitysec.com/pipermail/dailydave/2009-November/005964.html

  • Malmö hackerspace raided by Swedish Police (Wim)

http://forskningsavd.se/2009/11/29/i-can-haz-moar-bout-teh-reid/

  • Laurent Gaffie releases an ICMPv4/IP fuzzer (Craig) based on Philipe Biondi's scapy framework (if you haven't used scapy, you're really missing out). Time to test your embedded devices :). This release is hot on the heels of his SMB fuzzer 'SDL FAIL' (remote kernel vuln in 2 mins)

http://g-laurent.blogspot.com/2009/11/releasing-icmpv4ip-fuzzer-prototype.html

Feedback

As always, you can follow us on twitter (http://www.twitter.com/eurotrashsec) and we welcome your feedback via e-mail on feedback@eurotrashsecurity.eu .

Episode 2

News Stories

  • UK jails schizophrenic for refusal to decrypt files :

http://www.theregister.co.uk/2009/11/24/ripa_jfl/

  • Quick discussion on the Evil Maid :

http://theinvisiblethings.blogspot.com/2009/10/evil-maid-goes-after-truecrypt.html

  • ENISA launches Cloud Security Risk Assessment Report :

http://cloudsecurity.org/2009/11/20/enisa-cloud-security-risk-assessment/

  • T-Mobile staff sold personal data :

http://news.bbc.co.uk/1/hi/uk/8364421.stm

  • UK Information Commisioners office gets served a FOI (Freedom of Information) request by Software AG and reveals 356 data loss incidents voluntarily reported by UK organisations:

http://www.infosecurity-magazine.com/view/4800/uk-cios-reported-356-data-loss-incidents-last-year/

Special Guest

Wim ruined our first try to do an interview with Didier Stevens and luckily Didier agreed to free up some of his time to give it a second try. With redundant audio recordings, we managed to nail this one down.

Didier is a security researcher from Belgium with a special interest in Adobe's PDF file format. He has discovered several flaws in the format and has some interesting views on information security in general.

http://blog.didierstevens.com

http://www.twitter.com/didierstevens

Feedback

As always, you can follow us on twitter (http://www.twitter.com/eurotrashsec) and we welcome your feedback via e-mail on feedback@eurotrashsecurity.eu .

Thanks for listening and until the next time !

Episode 1

This is Episode 1.

Our tag line: [si-kyoor-i-tee] Security with funny accents

The team:

  • Wim (@wimremes): Information Security Consultant in Belgium, trying to hold his own. http://blog.remes-it.be
  • Chris (@ChrisJohnRiley): Senior Security Analyst for a major Austrian bank --> Ramblings of the Änal Security Guy Blog http://www.c22.cc
  • Dale (@daleapearson): Security Manager for a global outsourcing company, and do my technical stuff in my own time. --> Do my own thing over at http://www.securityactive.co.uk
  • Craig (@craigbalding): pen-tester, incident responder & internal security consulting at a F500. "Official" 3rd person voice pimpage here: http://www.craigbalding.com

Our thanks to


- Stories for discussion -

British Government to use talent competition to find the best young hackers (wim) apparently we are looking for the next Susan Boyle in information security ?

SANS London 09 (wim) Staying up-to-date comes with a hefty price tag :-( (chris) PaulDotCom's John Strand will be teaching and running a CTF event --> Friday Dec 4th

EU: Microsoft to test browser 'ballot screen'

Dale helped to organize. We recap with him and Craig who was also attending and talk about future editions.

Retrieved from "http://www.eurotrashsecurity.eu/index.php/Episodes"
This page was last modified on 6 September 2010, at 21:11. This page has been accessed 12,004 times.