This week Jonathan Bennett and Katherine Druckman chat with Andres Almiray about JReleaser, the Java release automation tool that’s for more than just Java, and more than just releases. What was the original inspiration for the tool? And how does JReleaser help avoid a string of commits trying to fix GitHub Actions? Listen to find out!
Continue reading “FLOSS Weekly Episode 794: Release Them All With JReleaser”
First up this week is the story of EvilVideo, a clever telegram exploit that disguises an APK as a video file. The earliest record we have of this exploit is on June 6th when it was advertised on a hacking forum.
Researchers at ESET discovered a demo of the exploit, and were able to disclose it to Telegram on June 26th. It was finally patched on July 11. While it was advertised as a “one-click” exploit, that’s being a bit generous, as the ESET demo video shows. But it was a clever exploit. The central trick is that an APK file can be sent in a Telegram chat, and it displays what looks like a video preview. Tap the “video” file to watch it, and Telegram prompts you to play it with an external player. But it turns out the external player in this case is Android itself, which prompts the target to install the APK. Sneaky.
Continue reading “This Week In Security: EvilVideo, Crowdstrike, And InSecure Boot”
This week Jonathan Bennett and Aaron Newcomb chat with Jay Khatri, the co-founder of Highlight.io. That’s a web application monitoring tool that can help you troubleshoot performance problems, find bugs, and improve experiences for anything that runs in a browser or browser-like environment. Why did they opt to make this tool Open Source? What’s the funding model? And what’s the surprising challenge we tried to help Jay solve, live on the show? Listen to find out!
Continue reading “FLOSS Weekly Episode 793: Keeping An Eye On Things With Hilight.io”
In the past week, AT&T has announced an absolutely massive data breach. This is sort of a multi-layered story, but it gives me an opportunity to use my favorite piece of snarky IT commentary: The cloud is a fancy way to talk about someone else’s servers. And when that provider has a security problem, chances are, so do you.
The provider in question is Snowflake, who first made the news in the Ticketmaster breach. As far as anyone can tell, Snowflake has not actually been directly breached, though it seems that researchers at Hudson Rock briefly reported otherwise. That post has not only been taken down, but also scrubbed from the wayback machine, apparently in response to a legal threat from Snowflake. Ironically, Snowflake has confirmed that one of their former employees was compromised, but Snowflake is certain that nothing sensitive was available from the compromised account.
At this point, it seems that the twin problems are that big organizations aren’t properly enforcing security policy like Two Factor Authentication, and Snowflake just doesn’t provide the tools to set effective security policy. The Mandiant report indicates that all the breaches were the result of credential stealers and other credential-based techniques like credential stuffing. Continue reading “This Week In Security: Snowflake, The CVD Tension, And Kaspersky’s Exit — And Breaking BSOD”
This week Jonathan Bennett and Jeff Massie chat with Sylvestre Ledru about the Rust Coreutils! Why would we want to re-implement 50 year old utilities, what’s the benefit of doing them in Rust, and what do the maintainers of the regular coreutils project think about it?
The RADIUS authentication scheme, short for “Remote Authentication Dial-In User Service”, has been widely deployed for user authentication in all sorts of scenarios. It’s a bit odd, in that individual users authenticate to a “RADIUS Client”, sometimes called a Network Access Server (NAS). In response to an authentication request, a NAS packages up the authentication details, and sends it to a central RADIUS server for verification. The server then sends back a judgement on the authentication request, and if successful the user is authenticated to the NAS/client.
The scheme was updated to its current form in 1994, back when MD5 was considered a cryptographically good hash. It’s been demonstrated that MD5 has problems, most notably a chosen-prefix collision attack demonstrated in 2007. The basis of this collision attack is that given two arbitrary messages, it is possible to find a pair of values that, when appended to the end of those messages, result in matching md5 hashes for each combined message. It turns out this is directly applicable to RADIUS.
Continue reading “This Week In Security: Blast-RADIUS, Gitlab, And Plormbing”
This week David Ruggles chats with Jonathan Bennett about his origin story! What early core memory does Jonathan pin his lifelong computer hobby on? And how was a tense meeting instrumental to Jonathan’s life outlook? And how did Jonathan manage to score a squashable brain toy from an equipment manufacturer? Watch the whole show to find out!
Continue reading “FLOSS Weekly Episode 791: It’s All About Me!”
