TAO Hijack Routers – WSWiR Episode 107

Tons of Patches, NSA Booby-Trapped Routers, and Alleged Iranian Hackers

If you don’t have time to follow all the information security stories popping up each week, you can let our weekly video and blog post summarize the important stuff for you.

In today’s show, I recite the big list of security patches you need to get this week, talk about how the NSA is intercepting and hacking routers to foreigners, and weigh in on whether or not the security industry is blaming advanced attacks on “nation-state” actors a bit too freely. Press play on YouTube for all the details, and don’t forget to check out the Reference section for links to other interesting InfoSec stories.

Hope you have a great weekend, and be careful shopping online!

(Episode Runtime: 8:25)

Direct YouTube Link: https://www.youtube.com/watch?v=LdOHsV88z4Y

Episode References:

• Microsoft’s May Patch Day Summary – WGSC
  • May’s Internet Explorer (IE) alert – WGSC
  • Consolidated Office security alert – WGSC
  • Consolidated Windows security alert – WGSC
• Adobe’s May Patch Day Summary – WGSC
• Latest Chrome update fixes three critical vulnerabilities – ThreatPost
• Apple’s Patch Day Summary – WGSC
• More details on NSA’s TAO team intercepting and booby-trapping routers – The Guardian
• Fireeye’s Saffron Rose report on alleged Iranian nation-state sponsered hacking [PDF] – Fireeye
• Krypt3ia’s blog post saying Operation “Flying Kittens” is more likely normal hacktivists – Krypt3ia’s blog

Extras:

• Research on fake SSL certs used in MitM attacks (most actually security devices decrypting SSL)  – Linshunghuang.com
• Bitly shares details about breach, and promises two token authentication – Bitly
• Vulnerabilities found in Estonia’s online voting system – PCWorld
• Snowden explains why he asked Putin tough questions – The Guardian
• Teenager responsible for Krebs’ SWAT attacks arreseted – KrebsonSecurity
• DayZ developers network breached, source code allegedly stolen – Segmentnext.com
• Old EoP flaw finally fixed in Linux kernel – Ars Technica
• Main Dogecoin wallet temporarily shuts down due to breach – ITPortal
• GCHQ being sued for alleged mobile hacking – The Register
• Mozilla capitulates to DRM in Firefox – The Guardian
• CC skimmers found on stamp vending machines – KrebsonSecurity
• General Hayden accidentally admits that they kill using metadata – Youtube
• Google Docs click jacking flaw – M-austin Blog
• Elderwood gand still releasing more 0day IE exploits – ComputerWorld
• Fake AV found in Google and Microsoft’s online app markets – NetworkWorld

— Corey Nachreiner, CISSP (@SecAdept)

Share This: