What I like so much about the podcast world is how two shows can cover mostly the same material, but be wildly different. The world of security podcasts is like this, with my top three recommendations having completely different tastes and textures. I wasn’t going to recommend my own show, but then I realized that if I wasn’t…

Not sure how this isn’t bigger news, but Saudi Arabia shut down half its oil production after a number of drones attacked the largest oil processing plant in the world. Yemeni rebels claimed credit, but the US blames Iran. More

After too many decades on this planet, I now understand the benefit of studio headphones, and what makes them different than normal (consumer) options. My old set of Denons just died, so I decided to go with a pair of Audio-Technica ATH-M70’s. An early TL;DR! Just to save you some time, the answer is threefold, in order of…

AIG says BEC has overtaken ransomware as the primary claim type against their cyber insurance policies in EMEA, accounting for 23% of claims. More Paper

The NSA Cyber Chief wants to share digital threat information early and often. I like the fact that they’re opening up a bit, and I think it’s only good for everyone (except bad guys). More

Ring has already partnered with over 400 police departments. As you know, I’m torn on this kind of tech. Neighborhood watch can be a good thing, and it can also be a bad thing. Technology tends to magnify both weaknesses and strengths, so it can make neighborhood watch really great, or it can turn it into a nightmare. The problem is that you can easily start on the positive side, build it all the way up, and then in a few legal, policy, and tech changes have it turn into the oppressive form.

I’ve written before about the paradox of hiring managers not being able to find entry-level cybersecurity candidates, while many people with decent training or even degrees in the field cannot get hired. As it turns out, it’s not really that hard to explain. The Military takes you from zero to hero. In extremely large and long-term-focused organizations—like the…

As I talk about in my article on Red, Blue, and Purple Teams, there are many advocating for other team types beyond just those colors. See my article on the different Security Assessment Types. In April Wright’s work—who appears to have started the idea of these alternative team colors—the new ones look like this. Yellow: Builder Green: Builder…

Protestors in Hong Kong are physically attacking and destroying facial recognition cameras. Palo Alto says 7 out of 10 new domain registrations (NDRs) are either malicious or not safe for work, and they encourage companies to block them. …

There are some seriously nasty Windows RDP bugs out there. If you have RDP facing the internet, make sure you’re patched. And try to get to VPN as soon as possible.

A huge survey of firmware security has found virtually no improvement over the last 15 years. People seem surprised by this, but it is exactly what I would have predicted based on my analysis here. Basically, for most people not in the industry, our current state is actually fine.

Marcus Hutchins got off with time-served, and people have feelings. The range basically goes from ‘he did nothing wrong’, to, ‘he should rot in prison’. In my mind this outcome was close to perfect. Remember, he went through two years of hell since being brought up charges, he’s still a convicted felon, and he also is largely banned from the US. I think it’s good that he admitted guilt, faced consequences, and is being offered a chance to continue giving back to the community. More

Lots of people in the security community went silly over the FaceApp application last week, basically saying that you shouldn’t be using the application because they’ll steal your face and then be able to impersonate you.

Parts of Manhattan had a power outage Saturday night, which happened to be the anniversary of another power outage in 1977. The power company apologized but didn’t explain what happened. The hacker in me thinks this could easily be a probing shot by a sophisticated attacker, or a fun prank by amateurs.

The Telegraph has found strong links between Huawei employees and Chinese intelligence agencies. The Huawei counter was that this was extremely common among telecom companies, and that it wasn’t a big deal. The counter to that counter was, basically, “Well, then why did you try to hide it?” /gg

I created a new tutorial on OWASP Amass, and just joined the team as a contributor as well. Tutorial

Chinese hacking groups have been embedded deep inside multiple major US tech firms for many years, including Fujitsu, Tata, NTT, Dimension Data, and HPE. The first thing you should be thinking is where else they are today. More

There’s a Linux vulnerability called SACK Panic (among other names) that takes advantage of a kernel feature called Selective ACK. The feature lets systems tell the other side of the conversation how much data it’s received, and it turns out it can be overflowed or fuzzed.

The US is supposedly ramping up attacks against Russian power grid through the use of new cyberattack powers granted by Trump. I am happy to hear of this, but it’s an example of where we as outsiders can only know a tiny fragment of the story. But any signs that this administration sees Russia as a foe, and are treating it as such, are positive in my view.

Some absolutely fascinating research has just come out on what percentages and types of vulnerabilities are actually exploited in the wild. It found that only 5.5% of vulnerabilities discovered between 2009 and 2018 were actually exploited, with most of those being issues with a CVSS score of 9 or 10.

This is a Member-only episode. Members get the newsletter every week, and have access to the Member Portal with all existing Member content. Non-members get every other episode. Sign in or… Become a member and get immediate access

A sci-fi trilogy called The Three Body Problem included a powerful concept called Dark Forest Theory, which basically says it’s a bad idea for people who don’t know about their surroundings to make noise that might attract attention. Or, taken as a game theory strategy, it’s better to destroy other civilizations before they get the chance to destroy…

I’m a huge fan of Rob Graham and all he’s done for InfoSec. I also enjoy the fact that he seldom avoids a tussle. If he disagrees with you, you’re likely to hear about it. I probably agree with him on 85% of topics, so when he did a post recently, called Your Threat Model is Wrong, I…

Someone released a video recently that seemed to show Nancy Pelosi slurring and mangling her speech. The video spread virally in right-leaning circles, but it soon turned out to be fake. I commented on this in my most recent newsletter, saying: What this shows us is that it’s not the machine learning that makes Deepfakes dangerous; it’s the…

Unsupervised Learning is my weekly show that provides collection, summarization, and analysis in the realms of Security, Technology, and Humans. It’s Content Curation as a Service… I spend between five and twenty hours a week consuming articles, books, and podcasts—so you don’t have to—and each episode is either a curated summary of what I’ve found in the past…

This is a Member-only episode. Members get the newsletter every week, and have access to the Member Portal with all existing Member content. Non-members get every other episode. Sign in or… Become a member and get immediate access

Unsupervised Learning is my weekly show that provides collection, summarization, and analysis in the realms of Security, Technology, and Humans. It’s Content Curation as a Service… I spend between five and twenty hours a week consuming articles, books, and podcasts—so you don’t have to—and each episode is either a curated summary of what I’ve found in the past…