最高の Mind Hack ポッドキャスト (2024)

1
EP 85: The Rise Of Bots (and Bots As A Service) 40:49

5M ago40:49

40:49

Bots are actionable scripts that can slow your day to day business, be enlisted in denial of service attacks, or even keep you from getting those tickets Taylor Swift you desperately want. Antoine Vastel from DataDome explains how it's an arms race: the better we get at detecting them, the more the bots evolve to evade detection. Transcript here.…

1
EP 84: When Old Medical Devices Keep Pre-shared Keys 43:38

5M ago43:38

43:38

You would think there is a procedure to End-of-Life a medical device, right? Erase personal health info. Erase network configuration info. Speaking at SecTor 2023, Deral Heiland from Rapid 7 said he found that he was able to buy infusion pumps on the secondary market with the network credentials for the original Health Care Delivery Organization in…

1
EP 83: Tales From The Dark Web: Ransomware, Data Extortion, and Operational Technology 37:07

6M ago37:07

37:07

With the recent Clop attack on customers of MoveIt, ransomware is now old news. Attackers are skipping the encryption and simply extorting the exfiltrated data, according to Thomas “Mannie” Wilken, from the Accenture Cyber Threat Intelligence Dark Web Reconnaissance Team. He should know; he spends his days on the Dark Web seeing the rise of new inf…

1
EP 82: The Vulkan Files 35:09

6M ago35:09

35:09

Imagine a data dump of files similar to the Snowden Leaks in 2013, only this it’s not from the NSA but from NT Vulkan, a Russian contractor. And it’s a framework for targeting critical IT infrastructures. In a talk at DEF CON 31, Joe Slowick from Huntress, shares what a Russian whistleblower released in the form of emails and documents, and how we …

1
EP 81: Hacking Visual Studio Code Extensions 49:11

7M ago49:11

49:11

Rather than use backdoor exploits, attackers are stealing credentials going through the front door. How are they gaining credentials. Sometimes it’s from the tools we trust. Paul Geste and Thomas Chauchefoin discuss their DEF CON 31 presentation Visual Studio Code is why I have (Workspace) Trust issues as well as the larger question of how much we …

1
EP 80: Ghost Token 36:35

7M ago36:35

36:35

What if an GPC project OAUTH access token wasn’t deleted? This could expose databases to bad actors. Tal Skverer from Astrix discusses his DEF CON 31 presentation GhostToken: Exploiting Google Cloud Platform App Infrastructure to Create Unremovable Trojan Apps. Transcript here.Robert Vamosi による

1
EP 79: Conducting Incident Response in Costa Rica Post Conti Ransomware 56:50

8M ago56:50

56:50

How do you conduct an incident response for an entire country? When it’s 27 different life-critical government ministries each with up to 850 individual devices -- that’s uncharted territory. Esteban Jimenez of ATTI Cyber talks about his experience with the reconstruction of the cybersecurity system following Conti, how the country handled a second…

1
EP 78: Defending Costa Rica From Conti Ransomware 56:46

8M ago56:46

56:46

What is is like to hack an entire country, to take it’s government services offline, to deny a government an ability to function? Costa Rica knows. Esteban Jimenez of ATTI Cyber has been helping Costa Rica improve its cybersecurity posture for more than 16 years, and he has been helping them recently recover from a crippling ransomware attack in Ap…

1
EP 77: Security Chaos Engineering with Kelly Shortridge 40:32

8M ago40:32

40:32

Speaking at Black Hat 2023, Kelly Shortridge is bringing cybersecurity out of the dark ages by infusing security by design to create secure patterns and practices. It’s a subject of her new book on Security Chaos Computing, and it’s a topic that’s long overdue to be discussed in the field. Transcript.…

1
EP 76: Hacking Medical Systems 42:00

9M ago42:00

42:00

Are we doing enough to secure our health delivery organizations? Given the rise of ransomware attacks, one could day we are not. Karl Sigler from Trustwave SpiderLabs, talks about a new report that his team has written that is focused on the threat landscape for medical devices and the healthcare industry in general. Transcript here.…

1
EP 75: Hacking .Mil And Other TLD Domains (Ethically) 48:45

9M ago48:45

48:45

Internet domains are brittle. One could hack into a military, a foreign government, or even global commercial web services domain using flaws in the underlying architecture. Fredrik Nordberg Almroth, co-founder of Detectify, talks about how he did just that -- hack .mil, hack the top level domain of the Democratic Republic of Congo, and even Gmail …

1
EP 74: Disarming Document Threats 41:37

10M ago41:37

41:37

Phishing is everywhere. Who among us has not seen phish in their inbox? Aviv Grafi, from Votiro, gets into the weeds about how malicious documents are formed and how they might (despite good secure posture) still end up in your inbox or browser. He’s created a rather novel method to strip out the good content from the bad without affecting your ove…

1
EP 73: Hacking Human Behavior 36:48

10M ago36:48

36:48

Could the nudges and prompts like those from our Fitbits and Apple watches be effective in enforcing good security behavior as well? Oz Alashe, CEO and founder of CybSafe, brings his experience in the UK Intelligence Community to the commercial world along with some solid science around what motivates us to make changes in our lives. It’s not just …

1
EP 72: Tales From A Ransomware Negotiator 41:31

11M ago41:31

41:31

Say you’re an organization that’s been hit with ransomware. At what point do you need to bring in a ransomware negotiator? Should you pay, should you not? Mark Lance, the VP of DFIR and Threat Intelligence for GuidePoint Security, provides The Hacker Mind with stories of ransomware cases he’s handled and best practices for how to handle such an eve…

1
EP 71: The Internet As A Pen Test 44:49

11M ago44:49

44:49

Small to Medium Business are increasingly the target of APTs and ransomware. Often they lack the visibility of a SOC. Or even basic low level threat analysis. Chris Gray of Deepwatch talks about the view from the inside of a virtual SOC, the ability to see threats against a large number of SMB organizations, and the changes to cyber insurance we’re…

1
EP 70: Hacking Real World Criminals Online 58:00

12M ago58:00

58:00

More and more criminals are identified through open source intelligence (OSINT). Sometimes a negative Yelp review can reveal their true identity. Daniel Clemens, CEO of ShadowDragon, talks about his more than two decades of digital investigations, from the origins of the Code Red worm to the mass shooter in Las Vegas, with a fair number of pedophil…

1
EP 69: Self-Healing Operating Systems 49:19

1y ago49:19

49:19

It’s time to evolve beyond the UNIX operating system. OSes today are basically ineffective database managers, so why not build an OS that’s a database manager? Michael Coden, Associate Director, Cybersecurity, MIT Sloan, along with Michael Stonebreaker will present this novel concept at RSAC 2023. You can learn more at dbos-project.github.io…

1
EP 68: Incident Response in the Cloud 43:59

1y ago43:59

43:59

Incident response in the cloud. How is it different, and why do we need to pay more attention to it today, before something major happens tomorrow. James Campbell, CEO of Cado Security, shares his experience with traditional incident response, and how the cloud, with its elastic structure, able to spin up and spin down instances, is changing incide…

1
EP 67: When The Dark Web Discovered ChatGPT 40:54

1y ago40:54

40:54

We’ve seen drug marketplaces and extremists use the Dark Web. Will generative AI tools like ChatGPT make things crazier by lowering the barrier to entry? Delilah Schwartz, from Cybersixgill, brings her extensive background with online extremism to The Hacker Mind to talk about how she’s seeing a lot of chatter in the dark web.about AI online. She d…

1
EP 66: Shattering InfoSec’s Glass Ceiling 42:55

1y ago42:55

42:55

Booth babes and rampant sexism were more of a problem in infosec in the past. That is, until Chenxi Wang spoke up. And she’s not done changing the industry. She’s an amazing person who has done an incredible number of things in a short amount of time -- a PhD in Computer Engineering, inventor of a process still used by the DoD today, a successful t…

1
EP 65: The Hacker Revolution Will Be Televised 50:32

1y ago50:32

50:32

What if DEF CON CTFs were televised? What if you could see their screens and have interviews with the players in the moment? Turns out, you can. Jordan Wiens, from Vector 35, maker of Binary Ninja, is no stranger to CTFs. He’s played in ten final DEF CON CTFs, was a part of DARPA’s Cyber Grand Challenge, and recently he’s moderated the live broadca…

1
EP 64: Gaining Persistence On Windows Boxes 38:59

1y ago38:59

38:59

When we hear about bad actors on a compromised system for 200+ days, we wonder how they survived for so long. Often they hide in common misconfigurations. From her talk at SecTor 2022, Paula Januszkiewicz, CEO of Cqure, returns to The Hacker Mind and explains how a lot of little configuration errors in common Windows tools and services can open the…

1
EP 63: What Star Wars Can Teach Us About Threat Modeling 42:57

1y ago42:57

42:57

Having a common framework around vulnerabilities, around threats, helps us understand the infosec landscape better. STRIDE provides an easy mnemonic. Adam Shostack has a new book, Threats: What Every Engineer Should Learn From Star Wars. that uses both Star Wars and STRIDE to help engineers under vulnerabilities and threats in software development.…

1
EP 62: Tib3rius 43:22

1+ y ago43:22

43:22

Hacking websites is perhaps often underestimated yet is super interesting with all its potential for command injections and cross site scripting attacks. Tib3rius from White Oak Security discusses his experience as a web application security pen tester, his OSCP certification, and how he’s giving back to the community with his Twitch, Youtube, and …

1
EP 61: Never Mess With A Hacker 15:06

1+ y ago15:06

15:06

Holiday air travel tips from The Art of Invisibility: The World's Most Famous Hacker Teaches You How to Be Safe in the Age of Big Brother and Big Data by Kevin Mitnick and Robert Vamosi. This is a short episode until The Hacker Mind returns in the new year.Robert Vamosi による

1
EP 60: Hacking Latency In Live Music Online 53:44

1+ y ago53:44

53:44

If you call someone on the other side of the world, perhaps you notice the delay in their response. For voice that’s okay, but for live music that’s disastrous. Mark Goldstein thinks he’s solved the latency problem associated with the production of live musical performances online. Having one musician in Bangalore, another in California, and yet an…

1
EP 59: Hacking Hi-Tech Cars 41:36

1+ y ago41:36

41:36

Sometimes complex technology doesn't necessarily raise the barrier for entry for cyber criminals. Sometimes, as with our cars, it does the exact opposite.Robert Vamosi による

1
EP 58: Crimeware As A Service 39:37

1+ y ago39:37

39:37

The LockBit ransomware gang no longer offers just one service, like ransomware, but multiple services, like anti-analysis tools and bug bounty programs. Mick Baccio from Splunk’s SURGe explains how ransomware gangs are evolving into crimeware-as-a-service platforms, as a one stop shop for all your online criminal needs.…

1
EP 57: Hacking the Art of Invisibility II 24:35

1+ y ago24:35

24:35

In this follow up podcast, I talk about encrypting your hard drive with Tails OS, using Virtual Machines, and other ways to keep your laptop secure. In my book The Art of Invisibility, I challenged my co author, Kevin Mitnick, to document various ways to keep your data private. This is a companion episode with episode 41.…

1
EP 56: How To Get Paid To Hack 33:46

1+ y ago33:46

33:46

You could of course sell your skillz to the dark web. Or you could legitimately report what you find and get paid to do so. You might even travel the world. In this episode of The Hacker Mind, I return to Episode 7 with Tim Becker, Episode 9 with Stok, and Episode 22 with Jack Cable to get their perspective on leaving 1337 skillz while getting paid…

1
EP 55: How To Become A 1337 Hacker 36:54

1+ y ago36:54

36:54

Playing Capture the Flag challenges you to solve problems creatively, something that is missing in computer science programs. What else is needed? In this episode of The Hacker Mind, we return to where we started in Episode One: Why is West Point -- and for that matter, others -- Training Hackers? Think of this as the greatest hits from The Hacker …

1
EP 54: Cyber Ranges 25:51

1+ y ago25:51

25:51

Red teams and pen tests are point-in-time assessments. What if you could simulate an ongoing attack to test your teams’ readiness? You can with a cyber range. Lee Rossi, CTO and co founder.of SimSpace, a cyber range company, joins The Hacker Mind podcast to explain how using both live Red Teams and automated cyber ranges can keep your organization …

1
EP 53: Beyond MITRE ATT&CK 24:36

1+ y ago24:36

24:36

Just because you have a tool, like ATT&CK, you might not realize its full potential without someone being there to guide you … at least in the beginning. Frank Duff, now the chief innovation officer and co founder of Tidal Security, returns to The Hacker Mind to discuss the ATT&CK framework, only this time from the perspective of his new company. H…

1
EP 52: DEF CON Villages 39:30

1+ y ago39:30

39:30

DEF CON is 30 years old this year, and it’s bigger and better in part because of topic-specific villages. Here’s an inside look at four of the most popular villages. In this episode I’m talking to the organizers of the Lockpicking Village,the ICS village, the Car Hacking Village, and the Aerospace Village. And, there’s thirty more villages includin…

1
EP 51: G-Men In Cyberspace 35:07

2y ago35:07

35:07

Fighting organized crime online might seem like a logical extension for law enforcement, but, in fact, it is not all that straight forward. Michael McPherson is someone with 25 years in the FBI, who has transitioned out to the corporate world, and can best describe the experiences on both sides of fighting cybercrime.…

1
EP 50: The Fog of Cyber War 42:40

2y ago42:40

42:40

There’s an online war in Ukraine, one that you haven’t heard much about because that country is holding its own with an army of infosec volunteers worldwide. Mikko Hypponen joins The Hacker Mind to discuss cybercrime unicorns, the fog of cyber war that surrounds the Ukrainian war with its much larger neighbor, and of course Mikko’s new book, If It’…

1
EP 49: LoL 38:17

2y ago38:17

38:17

Living off the Land (LoL) is an attack where files already on your machine, ie your operating system, are used against you. They would be undetectable, right? Kyle Hanslovan, CEO of Huntress, joins The Hacker Mind to discuss recent LoL attacks, specifically the Microsoft Follina attack and the Kaseya ransomware attack, and how important it is for s…

1
EP 48: Hacking Teslas 1:00:03

2y ago1:00:03

1:00:03

With digital convenience there’s often a price. And if that means a bad actor can create a wireless key for your new Tesla, that price is pretty steep. At CanSecWest 2022, researcher Martin Herfurt announced a new tool, TeslaKee, which he hopes prevents wireless key attacks from happening. Martin joins The Hacker Mind to discuss this and his earlie…

1
EP 47: Ethical Hacking 50:57

2y ago50:57

50:57

Is hacking a crime? The US Justice Dept says it will no longer prosecute good-faith security researchers, but what constitutes good-faith security research? Bryan McAninch (Aph3x) talks about his organization, Hacking Is Not A Crime, and the ethical line it draws on various hacking activities. He also talks about the future generation of hacking, w…

1
EP 46: Reverse Engineering Smart Meters 1:04:19

2y ago1:04:19

1:04:19

After hearing a talk, a Dallas-based hacker set out to find out what was going on inside the smart meter attached to his home, and what he found was surprising. Since then Hash started a reverse engineering wiki site called Recessim and created dozens of YouTube videos in a channel of that same name to chronicle his adventures. He joins The Hacker …

1
EP 45: Hacking Industrial Control Systems 51:10

2y ago51:10

51:10

Can criminal hackers shut down a city’s electrical grid? Well, nothing’s impossible. But how might it actually happen? And how might we defend ourselves? Tom Van Norman, co-founder of the ICS Village, joins The Hacker Mind to share the group’s upcoming plans for RSAC and DEF CON, where they will again present present virtual scenarios and hands on …

1
EP 44: Hackers Wanted: Filling the Cybersecurity Skills Gap 55:42

2y ago55:42

55:42

Should infosec now be considered vocational training just like becoming an electrician or a plumber? How else should we address the skills gap in infosec? In this episode, Sonny Sandelius, Assistant Director of the SANS workforce programs, talks about programs that recruit people from outside computer sciences, encouraging those from diverse backgr…

1
EP 43: Follow The Rabbit 1:00:19

2y ago1:00:19

1:00:19

Hackers often make it look easy when in fact they started with no plan and were just following their curiosity, going down paths erratically just like a rabbit. Researchers Nir Ohfeld and Sagi Tzadik join The Hacker Mind to talk about their presentation at Black Hat Europe 2021 on the ChaosDB vulnerability. It’s about how they started with a delibe…

1
EP 42: Hacking Aerospace 1:07:04

2y ago1:07:04

1:07:04

Can you hack an airplane? A satellite in orbit? Turns out you can. And the fact that hackers are thinking about this now, that’s actually a good thing. Steve Luczynski and Matt Mayes join The Hacker Mind to talk about the importance of having hackers, vendors, and the government get together and work through problems. That’s why the Aerospace Villa…

1
EP 41: Hacking The Art of Invisibility 36:47

2y ago36:47

36:47

In the book The Art of Invisibility, I challenged my co author Kevin Mitnick to document the steps needed to become invisible online. There are a lot. In this episode, I'm going to discuss how hard it is to be absolutely invisible online. How there are always breadcrumbs and fingerprints left behind that could potentially identify you. That said, t…

1
EP 40: Hacking Ethereum Smart Contracts 1:03:38

2y ago1:03:38

1:03:38

How do you stop a half billion dollars in cryptocurrency from being stolen? You perform software testing and responsibly disclose it first, of course. Yannis Smaragdakis, a researcher with Dedaub, found a major vulnerability in Ethereum smart contracts, arguably within the billion-dollar range, that would have made it one of the largest hacks ever—…

1
EP 39: Fuzzing Crypto 38:35

2y ago38:35

38:35

For some people, crypto means cryptography. For others, it means cryptocurrency. Fortunately, in this episode, we’re discussing vulnerabilities in both. Guido Vranken returns to The Hacker Mind to discuss his CryptoFuzz tool on GitHub, as well as his experience fuzzing and finding vulnerabilities in cryptographic libraries and also within cryptocur…

1
EP 38: Going Passwordless 50:50

2y ago50:50

50:50

Passwords are everywhere, but they probably weren't intended to be used as much as they are today. Is there something more secure? Something better? Yes. Simon Moffatt from The Cyber Hut joins The Hacker Mind to discuss how identity and access management (IAM) is fundamental to everything we do online today, and why even multi factor access, while …

1
EP 37: A Hacker From Hollywood 27:44

2+ y ago27:44

27:44

This is the story of a film star who connected the simple concept behind a player piano to complex communication technology in use in our devices today. Hedy Lamarr is perhaps best known for the dozen or so motion pictures she made -- and as the most beautiful woman in the world -- but did you know that she also co-patented the frequency hopping sp…

1
EP 36: Fuzzing Message Brokers 39:11

2+ y ago39:11

39:11

Fuzzing makes it possible to locate vulnerabilities even in “safe” environments like Erlang, a language designed for high availability and robust services. Jonathan Knudsen from Synopsys joins The Hacker Mind to discuss his presentation at SecTor 2021 on fuzzing common message brokers such as RabbitMQ and VerneMQ, both written in Erlang, demonstrat…

聞く価値のあるポッドキャスト

ポッドキャスト Mind Hack

聞く価値のあるポッドキャスト

クイックリファレンスガイド