cover of episode 121: Ed
People
B
Beau Woods
E
Ed Skoudis
J
Jack Rhysider
Topics
Jack Rhysider: 我认为，即使受过良好教育的人也可能成为网络钓鱼攻击的受害者，因为人的弱点可能比电脑更大。Barbara Corcoran 的例子就说明了这一点，她损失了400,000美元，仅仅是因为一个伪造的电子邮件。 这突显了网络安全教育的重要性，但即使是专家也可能成为受害者。我们需要认识到，人的因素是网络安全中的一个关键弱点。 Ed Skoudis: 我从事渗透测试已有26年，期间处理过许多案例。在对一家医院进行渗透测试时，外部网络安全做的很好，没有发现重大漏洞。然而，在内部网络测试中，我们发现了一个关键漏洞，该漏洞控制着一个正在手术中使用的外科激光器。 这让我意识到，在渗透测试中，我们必须谨慎小心，因为我们的行为可能对现实世界产生重大影响。我们必须在规定的范围内操作，并遵循参与规则，以避免造成严重后果。 在对一款儿童玩具进行渗透测试时，我们发现了一个重放漏洞。起初，客户并不在意，但当我们解释说，这个漏洞可能导致儿童被烫伤时，他们立即采取了行动。这说明，作为安全专业人员，我们需要用客户能够理解的方式来沟通风险，并将其与他们的业务模式联系起来。 Beau Woods: 我是 I Am The Cavalry 的志愿者，我们致力于提高医疗设备的安全性。在 DEF CON 的 Biohacking Village Device Lab，我们与医疗器械制造商和黑客合作，以识别和修复漏洞。 我们发现，医疗器械制造商和黑客之间存在合作的意愿，这有助于提高医疗设备的安全性。然而，漏洞修复仍然是一个挑战，因为这需要医疗器械制造商、医院和生物医学承包商之间的多方协作。

Deep Dive

Chapters
Barbara Corcoran, a Shark Tank star, lost \$400,000 due to a phishing scam. The scam involved a spoofed email that tricked her bookkeeper into wiring the money. This highlights the vulnerability of even educated individuals to such attacks.
  • Phishing scam cost Barbara Corcoran $400,000
  • Spoofed email from trusted source
  • Human vulnerability to social engineering

Shownotes Transcript

In this episode we hear some penetration test stories from Ed Skoudis (twitter.com/edskoudis). We also catch up with Beau Woods (twitter.com/beauwoods) from I am The Cavalry (iamthecavalry.org).

Sponsors

Support for this show comes from Axonius. Securing assets — whether managed, unmanaged, ephemeral, or in the cloud — is a tricky task. The Axonius Cybersecurity Asset Management Platform correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action. Axonius gives IT and security teams the confidence to control complexity by mitigating threats, navigating risk, decreasing incidents, and informing business-level strategy — all while eliminating manual, repetitive tasks. Visit axonius.com/darknet to learn more and try it free.

Support for this show comes from Zscalar. Zscalar zero trust exchange will scrutinize the traffic and permit or deny traffic based on a set of rules. This is so much more secure than letting data flow freely internally. And it really does mitigate ransomware outbreaks. The Zscaler Zero Trust Exchange gives YOU confidence in your security to feel empowered to focus on other parts of your business, like digital transformation, growth, and innovation. Check out the product at zscaler.com/darknet.

Support for this podcast comes from Cybereason. Cybereason reverses the attacker’s advantage and puts the power back in the defender’s hands. End cyber attacks. From endpoints to everywhere. Learn more at Cybereason.com/darknet.

View all active sponsors.

Attribution

Darknet Diaries is created by Jack Rhysider.

Editing by Damienne. Assembled by Tristan Ledger. Sound designed by Andrew Meriwether.

Episode artwork by odibagas.

Audio cleanup by Proximity Sound.

Theme music created by Breakmaster Cylinder.