[RERELEASE] How to find vulnerabilites

In this episode, Timothy De Block and Jonathan Singer dive into the challenges of modern enterprise security. The conversation covers how organizations—using McDonald's as an example—face threats from both digital and physical vectors. They explore how hackers might exploit everything from public Wi-Fi to social engineering tactics and touch on the evolving role of security leaders in dealing with both controllable and uncontrollable risks. Key Topics: Digital & Physical Attack Vectors: Discussion on hacking tactics such as public Wi-Fi, kiosk vulnerabilities, API exploitation, and social engineering. Security Beyond the Firewall: Why enterprise security involves more than just digital defense—physical security, insider threats, and brand manipulation also pose risks. The Growing Complexity of Security: How new technologies, like IoT devices and AI, are adding layers of complexity to enterprise security. Insider Threats & Social Engineering: The impact of internal threats, from disgruntled employees to social engineering attacks, on large organizations. Rapid-Fire Hacking Vectors: Public Wi-Fi Self-service kiosks Badge cloning Typo-squatting for domains Supply chain dependencies Insider threats

In this episode, Timothy De Block chats with Ben Burkert about the challenges of managing internal certificate authorities (CAs) and certificates. Ben shares his experiences working with internal CAs at major companies and how those challenges inspired the creation of Anchor.dev. Key Topics: The Importance of Certificates: Ben explains how certificate mismanagement can lead to outages and business interruptions, and why automation is crucial. TLS and ACME: Understanding how TLS secures communications and how ACME clients automate certificate management. Anchor.dev: A cloud service that simplifies internal CA management and helps companies secure their internal networks with automated renewals and distribution. LCL Host: A tool from Anchor.dev that enables HTTPS in local development environments, improving deployment workflows.

Tim (@LaNMaSteR53) is one of the leading names within the application security field. A former instructor for many organizations, he wanted to do more with training. He wanted to provide attendees to training with more hands on work. Get into an application, exploit it, and then provide remediation steps. He came up with the PWAPT training.

Samy (@samykamkar) shouldn't need too much of an introduction to most people. He's been in the news for hacking garage doors, credit cards, cars, and much much more. Samy likes to hack things and has a knack for finding vulnerabilities in everything from locked machines to wireless doorbells. His site has the full list of vulnerabilities as well as videos and press appearances. Which made him the perfect guess for talking about how to find vulnerabilities. In this episode we discuss: how Samy got started; what is a vulnerability; what skills are needed; how he decides his next project; steps to finding vulnerabilities; what he does when he discovers a vulnerability; how long the process takes.

Episode Summary: Patrick Gray, the host of the Risky Business podcast, shares how he transitioned from a tech journalist to a leading voice in cybersecurity podcasting. Patrick discusses the origins of his podcast, the evolution of his content, and how he maintains integrity with sponsors. He also offers advice for aspiring podcasters on focusing on the audience and using the right tools. Key Topics: The unexpected inspiration behind Risky Business. Moving from general tech journalism to focused security content. The importance of understanding technical details in reporting. The growth of the Risky Business team and their venture into video content. Navigating sponsorships while maintaining editorial independence. Advice for new podcasters: prioritize your audience and use the right tools.

Summary: In this episode, Timothy De Block sits down with Ralph Collum, a cybersecurity educator with over a decade of experience in the field. They delve into Ralph's career journey, discussing his transition from a chemist to a cybersecurity professional and the various roles he's taken on, including server administration, auditing, and penetration testing. Ralph shares insights on the importance of soft skills, continuous learning, and the evolving landscape of cybersecurity. Key Topics Discussed: Ralph’s Career Journey The Impact of the Pandemic on Cybersecurity Groups Getting Into Cybersecurity The Role of Soft Skills in Cybersecurity The Impact of AI on Cybersecurity Careers Resources and Recommendations Resources Mentioned: Books: The Code to the Dead Cow Joseph Menn Spam Nation by Brian Krebs The Art of Invisibility by Kevin Mitnick Social Engineering: The Science of Human Hacking by Christopher Hadnagy Websites: Help Net Security Bleeping Computer Hacker News Dark Reading Tools: Feedly for organizing cybersecurity news TryHackMe and Hack The Box for practical labs

Episode Summary: In this exchanged episode, Timothy De Block chats with Mubix about the intricacies of SIM swapping, an attack vector that has seen significant attention. They discuss the current state of SIM swapping, how attackers exploit this technique, and the measures carriers have implemented to mitigate these risks. Mubix highlights the importance of understanding your risk profile and the practical steps organizations and individuals can take to protect themselves.

In this engaging episode, Timothy De Block speaks with Steve Orrin about the intersection of artificial intelligence and cybersecurity. The conversation delves into the challenges and opportunities that AI presents in the cybersecurity landscape, exploring topics such as deep fakes, disinformation, and the implementation of AI in security practices.

In this automatic episode of Exploring Information Security, Timothy De Block talks with Mark Baggett about automating information security tasks using Python. They delve into the SANS SEC573 and SEC673 courses, which cover Python basics, advanced automation techniques, and real-world applications. Mark shares insights on using AI for coding, highlights his YouTube series "Infosec Tool Shed," and discusses upcoming workshops and conferences. The conversation also touches on the importance of Python in information security and practical experiences in automating security tasks.

In this off-the-cuff episode, Timothy De Block brings a mic to the floor of ShowMeCon for the first-ever HallwayCon podcast episode. He walks around with a mic and recorder, engaging in spontaneous conversations with random attendees. Timothy highlights the immense value of attending security conferences, emphasizing that these real, impromptu conversations with professionals are crucial for expanding knowledge and building relationships within the industry. This unique approach captures some just some of the many conversations going on at security conferences.