0x22 Monthly (2023-02)

Segfault.fm

Beschreibung:

Die Folge zu Januar und Februar! Diesmal mit ein paar Updates zu vorherigen Themen, Android, Autos und Telefonbanking. Schwachstellen, Schwachstellen und Schwachstellen. Viel Spaß beim Hören!

Shownotes:

• Three Lessons from Threema
• Paper: Three Lessons from Threema
• John Deere erlaubt Reparaturen nach Hacks
• FOSDEM 2023 - Matrix 2.0
• Tor is slow right now. Here is what is happening. - The Tor Project
• NSA: Software Memory Safety
• Bjarne Stroustrup reagiert auf NSA
• A call to action: Think seriously about safety
• Google Online Security Blog: Hardening Firmware Across the Android Ecosystem
• Spreading Malware via Google Ads
• grawity: ‘PuTTY on my Win98 VM crashes OpenSSH and I’m some’
• oss-sec: Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136)
• CVE-2022-24990: Getting Password via a specific User-Agent String
• Cisco Secure Endpoint update for ClamAV
• GoDaddy Hackers stole Source Code
• How I Broke Into a Bank Account With an AI-Generated Voice
• ROT256 : Cryptography & Other Random Bits.
• Beware rogue 2FA apps in App Store and Google Play – don’t get hacked!
• CVE-2022-3095: Backslash Confusion in Flutter
• Hyundai and Kia forced to update software on millions of vehicles because of viral TikTok challenge

Kapitel

1. Intro (00:00:00)

2. Begrüßung (00:00:55)

3. Threema (00:02:30)

4. Traktoren reparieren (00:13:00)

5. Tor (00:14:50)

6. NSA Empfehlung sicherer Programmiersprachen (00:21:55)

7. Android Firmware Security (00:32:20)

8. Malvertising (00:48:30)

9. OpenSSH CVE (01:00:28)

10. CVE severity ratings (01:05:10)

11. TerraMaster NAS root (01:16:15)

12. ClamAV (01:20:01)

13. GoDaddy multi-year breach (01:25:35)

14. Telefonbanking (01:36:55)

15. PW Manager pass (01:45:40)

16. 2FA done right, not (02:03:00)

17. URL backslash confusion attack (02:10:26)

18. TikTok Challenge: Kia Boyz (02:20:37)

19. Verabschiedung (02:33:50)

20. Outro (02:34:15)