Eurotrash Security Podcast

The guys over at the Eurotrash Information Security Podcast had me on last week. We discussed HBGary, Thinkst, ZaCon and a bunch of other stuff..

It was pretty enjoyable (although i tried listening to myself and think its a lucky thing i dont do this too often). You can grab it [here]

Comments

Post a Comment

Check out some of our other popular posts:

A Steve Jobs masterclass (from a decade ago)

Image
A decade ago, Steve Jobs sat down at the D8 conference for an interview with Kara Swisher and Walt Mossberg . What followed was a masterclass in both company and product management. The whole interview is worth watching, but I thought there were a few segments that stood out. Caveat: Any time someone talks about a tech-titan, there’s reflexive blowback from parts of the tech community: “ He wasn’t really an engineer ”, “ He wasn’t really... ” - This post will ignore all of that. Even if you strongly dislike him, there are lessons to be learnt here. Let’s begin... What matters most: The interview starts with Kara and Walt congratulating Jobs, because Apple had just bypassed Microsoft in Market Capitalization . Right out of the gate, Jobs makes it clear: It’s surreal to anyone who knows the history, but: Jobs: It doesn’t matter very much... it’s not what’s important.. it’s not why any of our customers buy our products.. It’s good for us to keep that in mind, remember what we’re doing an
Read more

New features aren't Solved Problems

Image
One of the big disconnects in infosec lies between people who build infosec products and people who end up using them on the ground. On the one hand, this manifests as misplaced effort: features that are used once in a product-lifetime get tons of developer-effort, while tiny pieces of friction that will chaff the user daily are ignored as insignificant. On the other, this leaves a swath of problems that are considered “solved” that really aren’t. The first problem is why using many security products feels like pulling teeth. This is partially explained by who does what on the development team. The natural division of labor amongst developers means that the super talented developers are working on the hairy-edge-case problems (which by definition are edge-cases) while less experienced developers are thrown at “mundane” / CRUD parts of the system.  But most of your users will spend most of their time on those "mundane" parts of the system. It’s those common paths that are most
Read more

Canarytokens: Token Anything, Anywhere

Image
InfoSec superstar (and long-time Canary fan ) theGrugq recently mused on twitter about generating alerts when certain binaries are run on your hosts. We definitely think it has its uses, and we figured it would be worth discussing a quick way to make this happen (using the existing http://canarytokens.org ) TL;DR : You can pass arbitrary data to a web-token allowing you to use it as a reliable, generic alerter of sorts. We often refer to our Web and DNS Canarytokens as our token ‘primitives’. With these two tokens, you can create traps for attackers nearly anywhere, on any system for any kind of scenario. In fact, nearly all of our other token types are built on top of the Web and DNS tokens. A brief overview of how they work: Web token Visit http://canarytokens.org and create a web token with the label “Fake email in the finance folder of Adrian’s inbox”. The server gives me a unique Canarytoken/link. I place it in the finance folder of Adrian’s inbox. If an at
Read more