Decipher Security Podcast

Ransomware has become an ugly fact of life for enterprises, and incorporating it into threat models and disaster recovery plans is a must. Kelly Shortridge of Capsule8 joins Dennis Fisher to discuss her untested hypothesis that achieving an economic equilibrium with professional ransomware attackers could be beneficial for both sides. Read Kelly's piece on this hypothesis here .  Support the...

Brian Donohue of Red Canary joins Dennis Fisher to break down all the interesting talks and news from this week's Cyberwarcon conference, including Andy Greenberg's keynote on Sandworm and several sessions on influence operations. Read Brian's research and analysis on the Red Canary blog . Support the show

For more than 15 years, the Citizen Lab at the University of Toronto has been doing groundbreaking research into a variety of security, privacy, and civil liberties threats. Ron Deibert, the founder and director of the lab, joins Dennis Fisher to talk about the team's origins, its work uncovering GhostNet and other cyberespionage operations, and the current work investigating surveillance ven...

Chris Wysopal, co-founder and CTO of Veracode, joins Dennis Fisher to dive into the deep end of the application security pool and discuss the company's new State of Software Security report. Read the Decipher coverage of the SOSS report here .  Download the full report here . Support the show

When Mr. Robot premiered in 2015 it was an immediate hit not just in the hacker community but with wider audiences, as well. The show follows the exploits of Elliot Alderson, a troubled young loner who gets involved with a small group of other hackers called F-Society and runs up against a variety of adversaries connected to the monolithic E-Corp. The show has a number of deeply technical storylin...

Math is hard and because encryption relies on some pretty complex math, encryption is hard to get right. Kenneth White, product security lead at MongoDB and a member of the board of the Open Crypto Audit Project , joins Dennis Fisher to talk about the challenges of implementing encryption in modern environments and how shifting public policy is affecting enterprises and individual users who rely o...

The state of IoT security is not great, and despite increased pressure from lawmakers and regulators, vendors are actually going backward in some respects. A year-long study by the Cyber Independent Testing Lab of millions of IoT firmware binaries found that many manufacturers are removing various hardening technologies such as ASLR from their binaries over time. Dennis Fisher spoke with Parker Th...

Sometimes the most interesting careers don't follow a straight line, and that's certainly the case for Tanya Sam, the director of operations and partnerships at TechSquare Labs in Atlanta. Tanya spent years as an oncology nurse in Toronto and New York before moving to Atlanta and finding her way into the startup and security culture that thrives there and helping found a seed fund and in...

There are a lot of things you could say about Blackhat . Not many of them are kind. But of all the hacker movies that have been made, it's definitely one. It has many of the elements of a good spy thriller, and there's probably a very solid espionage movie hiding in there somewhere. It also has some pretty realistic hacking scenes, shady CIA operatives, and Thor. It's a lot , but Zo...

Spy Game isn't explicitly a sequel to Sneakers or Three Days of the Condor , but it's certainly a spiritual successor, with all of the high-stakes espionage, double-dealing, and shady characters that made those films classics. Also: Robert Redford. Spy Game serves as a master class in social engineering and influence operations and demonstrates exactly how powerful the art of persuasion...

Michael Coates, CEO and co-founder of cloud security startup Altitude Networks , has had a long and varied career. Beginning with a stint as a consultant breaking into banks and continuing through roles as head of security assurance at Mozilla and CISO at Twitter, he has helped protect hundreds of millions of users over the years. He spoke with Dennis Fisher about what he's learned about empo...

The security community is full of interesting characters who have had meandering, random paths to success, and Adam O'Donnell fits that description quite nicely. A gifted student who studied engineering and went on to earn a Ph. D. in computer science, O'Donnell has been a staff engineer, a startup founder, a political fundraiser, and a member of the famous Cult of the Dead Cow hacking g...

Joseph Menn's new book The Cult of the Dead Cow: How the Original Hacking Supergroup Might Just Save the World dives deep into the history of not just the cDc, but also the hacking culture that emerged in the 1980s and 1990s and has produced some of the most influential hackers, executives, artists, and even politicians working today. Dennis Fisher talks with Joe about the cDc's founding...

This week, several separate teams of researchers disclosed new speculative execution attacks against Intel processors. Dennis Fisher spoke with Daniel Gruss of TU Graz in Austria, one of the researchers who developed the Zombieload attack and helped work on some of the others, as well. Support the show

The publication of the Verizon Data Breach Investigations Report is an important event every year for the infosec community, and the 2019 version includes analysis of data from more than 41,000 incidents and more than 2,000 actual breaches. Dennis Fisher talks with Alex Pinto of Verizon Enterprise about the trends in this year's report, how the data is collected, synthesized and analyzed, and...

There are good movies, there are bad movies, and then there's Swordfish , a movie that exists in a world beyond your world. It has everything: John Travolta, Halle Berry, guns, an incoherent plot, 128-bit DES encryption, a multi-headed worm. Dennis Fisher, Zoe Lindsey, and Pete Baker break it all down and then we mercifully move on to Three Days of the Condor , a classic of the 1970s paranoia...

The Carbanak backdoor has been in use for many years by the infamous FIN7 attack team, and researchers at FireEye discovered files containing the source code for the malware on VirusTotal two years ago, but only recently published a detailed analysis of it. Dennis Fisher talks with Michael Bailey, who did much of the source code analysis, about the discovery, the work of pulling the code apart, an...

DNS hijacking and manipulation is a serious ongoing threat and researchers at Cisco Talos Intelligence Group recently uncovered one such campaign called Sea Turtle that has been running for more than two years. The attackers are well-resourced and likely backed by a nation state, and have targeted intelligence agencies, military organizations, and a DNS registry, among others. Craig Williams of Ta...

Dennis Fisher sits down with Mac security researcher Patrick Wardle to talk about his entry into entry, his development of the Objective See suite of Mac security tools, the state of Mac malware and his Objective By the Sea conference . Support the show

Dennis Fisher talks with hardware security researcher JoeFitzPatrick at the CanSecWest conference about the challenges of finding and verifying hardware implants and the questions people should ask when these stories emerge. Support the show

There are heist movies, there are hacker movies, and then there's Ocean's Eleven . Blessed with one of the all-time great ensemble casts and an airtight script, Ocean's Eleven combines brilliant social engineering tactics, clever hacking ideas, revenge, greed, and Julia Roberts. This is Deciphering Ocean's Eleven . Support the show

The first Mission: Impossible film gave us so many wonderful gifts: goofy Usenet searches, Apple PowerBook action shots, CIA mainframe hacking, and some great mid-career Tom Cruise running . Before the series turned into a high-stakes, high-budget action franchise, the original film was a fun, sometimes goofy heist story with a vein of technobabble running through it. This is Deciphering Mission:...

Dennis Fisher sits down with Fahmida Rashid, Mike Mimoso, and Jessy Irwin at the RSA Conference in San Francisco to talk about the major themes of the conference. Support the show

Dennis Fisher talks with Yonathan Klijnsma of RiskIQ about his new research into Magecart Group 4, the background and tactics of the web skimming group, and how the defender community responds through takedowns and other techniques. Read the RiskIQ report here . Read our coverage of Magecart here .  Support the show

Sneakers isn't just one of the best hacker movies of all time, it's one of the best movies ever. Full stop. The tale of a crew of outcasts with sketchy pasts who break into companies for a living (not a very good one), Sneakers has an all-star cast, a killer script, and a terrifyingly prescient story about information and its control over our lives in the modern age. This is Deciphering...