The 443 - Security Simplified

Recall Windows Recall

This week on the podcast, we discuss a new Microsoft Windows feature that is shaping up to be a security nightmare. Before that, we discuss a new research initiative from the Advanced Research Projects Agency for Health (ARPA-H) that could make big improvements in healthcare cybersecurity.

SSID Confusion Attacks

This week on the podcast, we cover a newly disclosed weakness in the 802.11 Wi-Fi standard that affects common enterprise Wi-Fi deployments. Before that, we discuss CISA's Secure by Design Pledge for technology vendors before ending with a Microsoft research post on Quick Assist social engineering.

The 443 Podcast - Episode 291 - Picking Secure Technologies

This week on the podcast, we cover guidance from CISA and its international partners that guides organizations on the right questions to ask during the technology procurement process to make sure the products they buy are secure. Before that, we cover Microsoft's research into a common vulnerability impacting over 4 billion Android application installations followed by a discussion on the Tunnel Vision VPN vulnerability.

The 443 - Kraken Edition

The 2024 Verizon DBIR

This week on the podcast, we cover the key takeaways from the 2024 Verizon Data Breach Investigations Report. Before that, we discuss what we learned from United Healthcare CEO Andrew Witty's congressional testimony on their ransomware attack in February. We also discuss a research article from JFrog on malicious Docker Hub repositories.

The 443 Podcast - Episode 288 - Cisco ArcaneDoor Attack

This week on the podcast, we cover a nation-state backed attack against Cisco ASA appliances which Cisco TALOS themselves have dubbed "ArcaneDoor." After that, we discuss a phishing tookit being used to target LastPass users before ending with a new way to deliver malware payloads using legitimate services.

The 443 Podcast - Episode 287 - Ending Session Hijacking

This week on the podcast, we cover a Google initiative to kill off session hijacking attacks once and for all. Before that, we give an analysis of CVE-2023-3400, the Palo Alto zero-day vulnerability currently under active exploit. Additionally, we discuss a recent white paper from CISA on securely deploying artificial intelligence systems.

The 443 Podcast - Episode 286 - BatBadBut What?

This week on the podcast, we cover a research post describing a code injection vulnerability caused by how nearly every high-level programming language runs on Windows. We also discuss a series of vulnerabilities in LG televisions that allow remote attackers to root the device before ending with a chat about new adversarial tactics for delivering malware via GitHub.

The 443 Podcast - Episode 285 - A Postmortem of Microsoft's Security Incident

This week on the podcast, we cover a report from the Department of Homeland Security's Cyber Safety Review Board that analyzes Microsoft's Exchange Online 2023 security incident in excruciating detail. Before that, we cover CISA's new rules around cyber incident reporting and an unsealed indictment against 7 Chinese nationals.

The 443 Podcast - Episode 284 - A Bad Month for Software Supply Chains

This week on the podcast, we cover a software supply chain attack years in the making that was days away from a devastating global impact. After that, we cover Facebook's Project Ghostbusters and its impact on user privacy before ending with another software supply chain attack that successfully compromised developers in the gaming world.