Network Security Podcast

Welcome to the last Network Security Podcast of 2008.  Rich and Martin are taking some well deserved time off and will be back on January 6th, 2009.  We kept it short and would like to wish everyone a very happy holiday season.  But don't think we'll be resting on our laurels while we're off, we've got some exciting plans for 2009!  Among other things we'll be working on the sound quality, updating the site and have some other interesting changes in store for you.  Unless one of us get's blindsided by reality that is.

Until next year, thanks for listening and we both wish you and your families the best for the holiday season!

Network Security Podcast, Episode 132, December 16, 2009

Show Notes:

• Microsoft zero-day attacks target all versions of IE
• Microsoft updates code analysis tool, SQL injection XSS Library
• Used BlackBerrys sold for $20 at McCain-Palin blowout, contacts and email included
• Sandboxie - If you try this out, let us know how you like it.
• Tonight's music:  I'd rather be naughty by A Don't Hug Me Christmas Carol

Alright folks- Martin is off this week as he bounces around for his paying job, so I brought in a special co-host this week. That's right, Big Bad Chris Hoff from Rational Survivability joins us to discuss the our national cybersecurity, DNS attacks, DHCP trojans, the future of information centric security, and, of course, the wonders of the cloud. (Oh, and some wacky fitness program we bought off an infomercial).

And yes, we talk sumo suits and Martin's fate during the last few minutes.

The Network Security Podcast, Episode 131, December 9, 2008.

Show Notes:

• The Commission on Cyber Security for the 44th Presidency releases their long-awaited report.


• CheckFree online bill payment redirected to a malicious site.


• The DNS Changer trojan starts it's own internal DHCP server.


• The future of DLP/information-centric security as Microsoft and EMC partner, then McAfee and Liquid Machines (and a few other vendors we talk about).
  

This week, Rich and Martin actually make the podcast live up to it's name.  You'll have to wait until the second half of the podcast, but we take a good part of today's show and discuss some of the technology that we've both put into our networks, the reasons behind the choices we've made, and some of the effects those choices have made on our computing experience.  Let us know about your home network and the hows/whys of the choices you've made in setting it up.

Network Security Podcast, Episode 130, December 2, 2008

Show Notes:

• PCI Compliance Services FAQ


• The End of Online Anonymity - It's not the end, it's a change in how we look at it.


• EFF to fight against telecom immunity in Tuesday hearing - I hope everything went well for Jennifer Granick and friends


• Cybercrime servers selling billions of dollars worth of stolen information, illicit services


• Canadian IT exec accused of stealing customer database


• There is always a back story ... - Richard dig's into the Canadian IT story

Rich and I are preparing for Thanksgiving, just like everyone else in America right now.  I don't know about you, but that primarily means I have five days of work to accomplish in three days of the week.  So we didn't organize a guest this week, we sat down together (1000 miles apart) and talked about some of the stories that caught our attention over the last couple of weeks.  It's a good show, and we're out of here until after Turkey Day.

Have a great Thanksgiving!

Network Security Podcast, Episode 129, November 25 2008

Show notes:

• Security FAIL - But I changed my Twitter password...  
• Gmail Security Flaw PoC
• Kernel Vulnerability found in Vista
• Final judgment:  SCO owes Novell millions (plus interest)
• Decreasing security for perceived security - all in the name of compliance
• Managing Security in Economic Downturns
• The Julie Amero forensic analysis

We're joined today by Glenn Fleishman to talk about our own recent past and the recent cracks in the WPA armor.  Rich recently got to visit Russia to participate in a talk on Data Leak Prevention, while Martin got his own sit down with DHS Secretary Michael Chertoff.  Glenn had a little excitement of his own, with a detailed article on the recently revealed vulnerabilities in WPA using TKIP.  It's a small vulnerabilty, but both Rich and Glenn suspect it's just a precursor to bigger, badder things to come. And somewhere in there, a three year anniversary for the podcast slipped by.

Network Security Podcast, Episode 128, November 18, 2008

Show Notes:

• Battered but not broken:  understanding the WPA crack 
• Practical attacks against WEP and WPA 

No time for any music or fancy stuff like that.

When I first got an invitation to attend a roundtable discussion with Department of Homeland Security Secretary Michael Chertoff, I thought thought it was a hoax, as did some of the people I asked about it.  A little fact checking revealed that it was the real deal, but the meeting was in Washington, DC.  Traveling cross country for an hour meeting isn’t in my budget, so I regretfully passed on the opportunity.  Fast forward a month and the invite comes again, but this time it’s happening at Stanford University.  There’s no way I could pass that by.  Andrew Storms and George Ou expressed interest in going and Secretary Chertoff’s Press Secretary, Caroline Dieker, made the arrangements and we were all invited to attend.

I was impressed by Secretary Chertoff; he speaks plainly, with only a little of the evasion I’d expected from someone in a position like his.  I don’t agree with all his arguments and ideas, but he was very open to discussing them publicly.  I almost feel bad that he’s going to be gone come January.  I tried to tweet the whole thing as much as possible, but it’s easy to get distracted in a situation like this.  I captured the entire conversation on my little iRiver 795 and here it is so you can listen for yourself. 

Network Security Podcast, Episode 127, November 11, 2008 - Blogger Roundtable with DHS Secretary Michael Chertoff

This is a special Get Out and Vote episode.  Rich is in Russia of all places and Martin is on the road most of today, so this episode was recorded on October 31, 2008, Halloween.  And there isn't much scarier today than Direct Recording Electronic (DRE) voting machines.  That might make a good costume next year.  In any case, exercise your right and responsibility to vote today!

Network Security Podcast, Episode 126, November 4, 2008

Show Notes:

• Voting machine lab de-certified
• Voting problems in Texas
• Warning sent out about Diebold (Premier) DRE's
• Going back to paper ... cause it works
• Video the vote - But check your local laws first!

PS.  We took great pains to make sure the audio quality was a lot better this week.  Thanks for listening

I had to run out the door immediately after recording, but despite technical difficulties, Rich and I recorded a short interview with David Mortman, 'blogger-in-residence' for Debix. 

Network Security Podcast, Episode 125, October 28, 2008

Show Notes

Want to talk about electronic voting?  We did.  So we invited Jacob West from Fortify to talk with us about a paper he just published with a couple of engineers at Fortify.  Guess what, they found electronic voting using DRE voting machines are the least secure way to vote.  Makes me feel good going into the election.  It's a good thing we're fairly self-policing when it comes to time, this is a conversation that could have gone on for a couple of hours.

We had a number of technical issues tonight, so be glad we've got a podcast up at all.

Network Security Podcast, Episode 124, October 21, 2008 

Show Notes:

• Dear Mr. President: Let's talk tech - We desparately need a geek in the Cabinet!
• Miley Cyrus Hacker Raided by FBI - Don't brag to the press when you're already in the cross-hairs!
• Flash Suckage:  Eat your cookies - Now you can be tracked through Flash too.  
• VeriSign and ICANN square off over the DNS root - Let's just give it to Dan K. and let him manage it.
• Judge Suppresses Report on Voting Machine Security - Which brings us to why we're really here
• Fortify's paper on e-voting