No Rapid Rundown this time! But you can get links to all the past episodes in Season 5, here:Never Mind the Ears, Here's Security Nation

No Rapid Rundown this time! But you can get links to all the past episodes in Season 5, here:<ul><li><a href="https://www.rapid7.com/blog/post/2022/12/21/never-mind-the-ears-heres-security-nation/" rel="nofollow" target="_blank">Never Mind the Ears, Here's Security Nation</a></li></ul>

Tod and Jen and Jennifer on Season 5 of Security Nation

Interview linksJeremi on Password NihilismThe Rails bug Jeremi referencedRapid Rundown linksRisky Business Newsletter on fake PoCs: "GitHub aflood with fake and malicious PoCs"The cited paper: "How security professionals are being attacked: A study of malicious CVE proof of concept exploits in GitHub"Also relevant is Honeysploit by Curtis BrazzellLike the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.

Interview links<ul><li><a href="https://youtu.be/XnAzkUOSmt8?t=29273" rel="nofollow" target="_blank">Jeremi on Password Nihilism</a></li><li><a href="https://www.rapid7.com/db/vulnerabilities/ruby_on_rails-cve-2019-5420/" rel="nofollow" target="_blank">The Rails bug Jeremi referenced</a></li></ul>Rapid Rundown links<ul><li>Risky Business Newsletter on fake PoCs: "<a href="https://riskybiznews.substack.com/p/risky-biz-news-github-aflood-with" rel="nofollow" target="_blank">GitHub aflood with fake and malicious PoCs</a>"</li><li>The cited paper: "<a href="https://arxiv.org/abs/2210.08374" rel="nofollow" target="_blank">How security professionals are being attacked: A study of malicious CVE proof of concept exploits in GitHub</a>"</li><li>Also relevant is <a href="https://curtbraz.medium.com/exploiting-the-exploiters-46fd0d620fd8" rel="nofollow" target="_blank">Honeysploit by Curtis Brazzell</a></li></ul>Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like <a href="https://podcasts.apple.com/us/podcast/security-nation/id1124543784#see-all/reviews" rel="nofollow" target="_blank">Apple Podcasts</a>.

Jeremi Gosney on the Psychology of Password Hygiene

James Kettle

Interview LinksPrior Security Nation episode in which loads of PortSwigger references were dropped:https://www.rapid7.com/blog/post/2021/08/18/security-nation-daniel-crowley/New research from James about browser-powered desync attacks:https://portswigger.net/research/browser-powered-desync-attacksRapid Rundown LinksSemi-secret Fortinet advisory: https://twitter.com/Gi7w0rm/status/1578398457227878407CVE Details as they come: https://www.rapid7.com/blog/post/2022/10/07/cve-2022-40684-remote-authentication-bypass-vulnerability-in-fortinet-firewalls-web-proxies/Existence of Fortinet CVE-2022-40684 PoC posted, but not the PoC itself:https://twitter.com/Horizon3Attack/status/1579285863108087810The Hidden Harms of Silent Patches: https://www.rapid7.com/blog/post/2022/06/06/the-hidden-harm-of-silent-patches/Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.

Interview Links<ul><li>Prior Security Nation episode in which loads of PortSwigger references were dropped:<ul><li><a href="https://www.rapid7.com/blog/post/2021/08/18/security-nation-daniel-crowley/" rel="nofollow" target="_blank">https://www.rapid7.com/blog/post/2021/08/18/security-nation-daniel-crowley/</a></li></ul></li><li>New research from James about browser-powered desync attacks:<ul><li><a href="https://portswigger.net/research/browser-powered-desync-attacks" rel="nofollow" target="_blank">https://portswigger.net/research/browser-powered-desync-attacks</a></li></ul></li></ul>Rapid Rundown Links<ul><li>Semi-secret Fortinet advisory: <ul><li><a href="https://twitter.com/Gi7w0rm/status/1578398457227878407" rel="nofollow" target="_blank">https://twitter.com/Gi7w0rm/status/1578398457227878407</a></li></ul></li><li>CVE Details as they come: <ul><li><a href="https://www.rapid7.com/blog/post/2022/10/07/cve-2022-40684-remote-authentication-bypass-vulnerability-in-fortinet-firewalls-web-proxies/" rel="nofollow" target="_blank">https://www.rapid7.com/blog/post/2022/10/07/cve-2022-40684-remote-authentication-bypass-vulnerability-in-fortinet-firewalls-web-proxies/</a></li></ul></li><li>Existence of Fortinet CVE-2022-40684 PoC posted, but not the PoC itself:<ul><li><a href="https://twitter.com/Horizon3Attack/status/1579285863108087810" rel="nofollow" target="_blank">https://twitter.com/Horizon3Attack/status/1579285863108087810</a></li></ul></li><li>The Hidden Harms of Silent Patches: <ul><li><a href="https://www.rapid7.com/blog/post/2022/06/06/the-hidden-harm-of-silent-patches/" rel="nofollow" target="_blank">https://www.rapid7.com/blog/post/2022/06/06/the-hidden-harm-of-silent-patches/</a></li></ul></li></ul>Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like <a href="https://podcasts.apple.com/us/podcast/security-nation/id1124543784#see-all/reviews" rel="nofollow" target="_blank">Apple Podcasts</a>.

James Kettle of PortSwigger on Advancing Web-Attack Research

Interview LinksCheck out Panasonic's delightful PSIRT page – especially if you have a vulnerability in one of Panasonic's many, many products to report.Rapid Rundown LinksCheck out Inti's research on "oops, we made a surveillance system" at notmyplate.com.Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.

Interview Links<ul><li>Check out Panasonic's delightful <a href="https://holdings.panasonic/global/corporate/product-security.html" rel="nofollow" target="_blank">PSIRT page</a> – especially if you have a vulnerability in one of Panasonic's many, many products to report.</li></ul>Rapid Rundown Links<ul><li>Check out <a href="https://twitter.com/intidc" rel="nofollow" target="_blank">Inti's</a> research on "oops, we made a surveillance system" at <a href="https://notmyplate.com/" rel="nofollow" target="_blank">notmyplate.com</a>.</li></ul>Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like <a href="https://podcasts.apple.com/us/podcast/security-nation/id1124543784#see-all/reviews" rel="nofollow" target="_blank">Apple Podcasts</a>.

Taki Uchiyama of Panasonic on Product Security and Incident Response

Lisa Olson

Interview LinksCheck out the CVE blog post on handling cloud vulnerabilities.Read up on the rules for assigning CVEs.See an example cloud CVE affecting Microsoft Azure.Read the Microsoft Security Response Center’s blog post on cloud vulnerabilities.Rapid Rundown LinksCheck out Dominic White’s tweet on iOS remembered networks.Read the update on the recently released RFC 9293.Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.

Interview Links<ul><li>Check out the <a href="https://www.cve.org/Media/News/item/blog/2022/09/13/Dispelling-the-Myth-CVE-ID" rel="nofollow" target="_blank">CVE blog post</a> on handling cloud vulnerabilities.</li><li>Read up on the rules for <a href="https://www.cve.org/ResourcesSupport/AllResources/CNARules#section_7-4_requirements_for_assigning_a_cve_id" rel="nofollow" target="_blank">assigning CVEs</a>.</li><li>See an <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42306" rel="nofollow" target="_blank">example cloud CVE</a> affecting Microsoft Azure.</li><li>Read the Microsoft Security Response Center’s <a href="https://msrc-blog.microsoft.com/2022/07/28/anatomy-of-a-cloud-service-security-update/" rel="nofollow" target="_blank">blog post</a> on cloud vulnerabilities.</li></ul>Rapid Rundown Links<ul><li>Check out <a href="https://twitter.com/singe/status/1569417348628496386" rel="nofollow" target="_blank">Dominic White’s tweet</a> on iOS remembered networks.</li><li>Read the update on the recently released <a href="https://www.rfc-editor.org/rfc/rfc9293.txt" rel="nofollow" target="_blank">RFC 9293</a>.</li></ul>Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like <a href="https://podcasts.apple.com/us/podcast/security-nation/id1124543784#see-all/reviews" rel="nofollow" target="_blank">Apple Podcasts.</a>

Chris Levendis and Lisa Olson on Cloud CVEs

Gordon “

Interview LinksCheck out Nmap if, for some reason, you haven’t already.Learn about Npcap, the packet capture library tool that Gordon and his company also offer.Watch Gordon and HD Moore, the creator of Metasploit, chat about the evolution of network scanning on YouTube.Rapid Rundown LinksRead the Bleeping Computer story on hackers using DeFi bugs to steal cryptocurrency.Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.

Interview Links<ul><li>Check out <a href="https://nmap.org/" rel="nofollow" target="_blank">Nmap</a> if, for some reason, you haven’t already.</li><li>Learn about <a href="https://npcap.com/" rel="nofollow" target="_blank">Npcap</a>, the packet capture library tool that Gordon and his company also offer.</li><li>Watch Gordon and HD Moore, the creator of Metasploit, chat about the evolution of network scanning on <a href="https://www.youtube.com/watch?v=aOqlwsfgUuI" rel="nofollow" target="_blank">YouTube</a>.</li></ul>Rapid Rundown Links<ul><li>Read the Bleeping Computer story on <a href="https://www.bleepingcomputer.com/news/security/fbi-hackers-increasingly-exploit-defi-bugs-to-steal-cryptocurrency/" rel="nofollow" target="_blank">hackers using DeFi bugs to steal cryptocurrency</a>.</li></ul>Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like <a href="https://podcasts.apple.com/us/podcast/security-nation/id1124543784#see-all/reviews" rel="nofollow" target="_blank">Apple Podcasts</a>.

Gordon “Fyodor” Lyon on Nmap, the Open-Source Security Scanner

Learn more about some of our favorite presentations from the Vegas conferences, including: Susan Paskey on threat hunting in MFA logsJeremi Gosney on "passwords, but nihilism" (an apparently unscheduled, live threat modeling exercise on password risks)Patrick Wardle on Zoom LPE vulnerabilitiesGaurav Keerthi, Pete Cooper, and Lily Newman on global policy challengesJake Baines on Cisco ASA vulnerabilities and weaknesses (check out the blog post, too)Jonathan Leitschuh on fixing OSS vulnerabilities at scaleEugene Lim on so many iCal standards within standards Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.

Learn more about some of our favorite presentations from the Vegas conferences, including: <ul><li><a href="https://bsideslv.org/talks#1264635" rel="nofollow" target="_blank">Susan Paskey</a> on threat hunting in MFA logs</li><li><a href="https://twitter.com/jmgosney?lang=en" rel="nofollow" target="_blank">Jeremi Gosney</a> on "passwords, but nihilism" (an apparently unscheduled, live threat modeling exercise on password risks)</li><li><a href="https://forum.defcon.org/node/241830" rel="nofollow" target="_blank">Patrick Wardle</a> on Zoom LPE vulnerabilities</li><li><a href="https://forum.defcon.org/node/243003" rel="nofollow" target="_blank">Gaurav Keerthi, Pete Cooper, and Lily Newman</a> on global policy challenges</li><li><a href="https://forum.defcon.org/node/241939" rel="nofollow" target="_blank">Jake Baines</a> on Cisco ASA vulnerabilities and weaknesses (check out the <a href="https://www.rapid7.com/blog/post/2022/08/11/rapid7-discovered-vulnerabilities-in-cisco-asa-asdm-and-firepower-services-software/" rel="nofollow" target="_blank">blog post</a>, too)</li><li><a href="https://forum.defcon.org/node/242207" rel="nofollow" target="_blank">Jonathan Leitschuh</a> on fixing OSS vulnerabilities at scale</li><li><a href="https://forum.defcon.org/node/241931" rel="nofollow" target="_blank">Eugene Lim</a> on so many iCal standards within standards</li></ul> Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like <a href="https://podcasts.apple.com/us/podcast/security-nation/id1124543784#see-all/reviews" rel="nofollow" target="_blank">Apple Podcasts</a>.

Jen and Tod on Hacker Summer Camp 2022

Interview linksLearn all about Defaultinator.Read up on the Raspberry Pi default password vulnerability.Check out the GitHub repositories for Defaultinator.Rapid Rundown linksRead Derek Abdine's disclosures on Arris and Arris-like routers.Check out the Security Boulevard article on keeping PoCs secret.Peruse Matt Blaze’s tweet thread on teaching physical security secrets despite complaints from locksmiths.Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.

Interview links<ul><li>Learn all about <a href="https://defaultinator.com/" rel="nofollow" target="_blank">Defaultinator</a>.</li><li>Read up on the <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-38759" rel="nofollow" target="_blank">Raspberry Pi default password vulnerability</a>.</li><li>Check out the <a href="https://github.com/defaultinator" rel="nofollow" target="_blank">GitHub repositories</a> for Defaultinator.</li></ul>Rapid Rundown links<ul><li>Read <a href="https://derekabdine.com/blog/2022-arris-advisory" rel="nofollow" target="_blank">Derek Abdine's disclosures</a> on Arris and Arris-like routers.</li><li>Check out the <a href="https://securityboulevard.com/2022/07/are-proof-of-concepts-benefiting-cybercriminals/" rel="nofollow" target="_blank">Security Boulevard article</a> on keeping PoCs secret.</li><li>Peruse <a href="https://twitter.com/mattblaze/status/1553244850304290817" rel="nofollow" target="_blank">Matt Blaze’s tweet thread</a> on teaching physical security secrets despite complaints from locksmiths.</li></ul>Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like <a href="https://podcasts.apple.com/us/podcast/security-nation/id1124543784#see-all/reviews" rel="nofollow" target="_blank">Apple Podcasts</a>.

Curt Barnard on Defaultinator (Black Hat Arsenal Preview)

Jacques Chester

Interview LinksA Closer Look at CVSS ScoresRapid Rundown LinksBleeping Computer story: PyPI mandates 2FA for critical projects, developer pushes backTwitter thread on deleting atomicwrites, and undeleting itPyPi issues mentionedhttps://github.com/pypi/warehouse/issues/11625https://github.com/pypi/warehouse/issues/11805https://github.com/pypi/warehouse/issues/11798Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.

Interview Links<ul><li><a href="https://theoryof.predictable.software/articles/a-closer-look-at-cvss-scores/" rel="nofollow" target="_blank">A Closer Look at CVSS Scores</a></li></ul>Rapid Rundown Links<ul><li>Bleeping Computer story: <a href="https://www.bleepingcomputer.com/news/security/pypi-mandates-2fa-for-critical-projects-developer-pushes-back/" rel="nofollow" target="_blank">PyPI mandates 2FA for critical projects, developer pushes back</a></li><li><a href="https://twitter.com/untitaker/status/1545465529187565569?s=20&amp;t=WjtPhIMs88nwDqXk9A_ghg" rel="nofollow" target="_blank">Twitter thread</a> on deleting atomicwrites, and undeleting it</li></ul>PyPi issues mentioned<ul><li><a href="https://github.com/pypi/warehouse/issues/11625" rel="nofollow" target="_blank">https://github.com/pypi/warehouse/issues/11625</a></li><li><a href="https://github.com/pypi/warehouse/issues/11805" rel="nofollow" target="_blank">https://github.com/pypi/warehouse/issues/11805</a></li><li><a href="https://github.com/pypi/warehouse/issues/11798" rel="nofollow" target="_blank">https://github.com/pypi/warehouse/issues/11798</a></li></ul>Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like <a href="https://podcasts.apple.com/us/podcast/security-nation/id1124543784#see-all/reviews" rel="nofollow" target="_blank">Apple Podcasts</a>.

Jacques Chester of Shopify Talks CVSS Scores

Pete Cooper

Interview LinksRevisit our first episode with Peter and Irene from Season 4.Read the paper on the UK government’s cybersecurity strategy through 2030.Rapid Rundown LinksCheck out the article on so-called pig-butchering scams.Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.

Interview Links<ul><li>Revisit our <a href="https://www.rapid7.com/blog/post/2021/11/04/pete-cooper-and-irene-pontisso-of-the-uk-cabinet-office-on-their-cybersecurity-culture-competition/" rel="nofollow" target="_blank">first episode with Peter and Irene</a> from Season 4.</li><li>Read the <a href="https://www.gov.uk/government/publications/government-cyber-security-strategy-2022-to-2030" rel="nofollow" target="_blank">paper</a> on the UK government’s cybersecurity strategy through 2030.</li></ul>Rapid Rundown Links<ul><li>Check out the <a href="https://maxread.substack.com/p/whats-the-deal-with-all-those-weird" rel="nofollow" target="_blank">article</a> on so-called pig-butchering scams.</li></ul>Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like <a href="https://podcasts.apple.com/us/podcast/security-nation/id1124543784#see-all/reviews" rel="nofollow" target="_blank">Apple Podcasts</a>.

Pete Cooper and Irene Pontisso on the Results of the UK Government’s Security Culture Challenge

Security Nation is a podcast dedicated to celebrating the champions in the cybersecurity community who are advancing security in their own ways. We also cover the latest developments in infosec that you should know about.

Interview LinksFollow Steve on Twitter, and give the SpiderFoot official account a follow while you’re at it.Check out the SpiderFoot website and GitHub page, and learn more about the SaaS version, SpiderFoot HX.Learn about the latest SpiderFoot 4.0 release with YAML correlation rules. Read Steve’s blog, especially his posts on the 10 years developing SpiderFoot and the misuse of OSINT to claim election fraud.Rapid Rundown LinksRead the full paper, “A Closer Look at CVSS Scores.”Follow the author, Jacques Chester, on Twitter.Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.

Interview Links<ul><li>Follow Steve on <a href="https://twitter.com/binarypool" rel="nofollow" target="_blank">Twitter</a>, and give the <a href="https://twitter.com/spiderfoot" rel="nofollow" target="_blank">SpiderFoot official account</a> a follow while you’re at it.</li><li>Check out the SpiderFoot <a href="https://www.spiderfoot.net/" rel="nofollow" target="_blank">website</a> and <a href="https://github.com/smicallef/spiderfoot" rel="nofollow" target="_blank">GitHub page</a>, and learn more about the SaaS version, <a href="https://www.spiderfoot.net/hx/" rel="nofollow" target="_blank">SpiderFoot HX</a>.</li><li>Learn about the <a href="https://www.spiderfoot.net/spiderfoot-4-0-open-source-release/" rel="nofollow" target="_blank">latest SpiderFoot 4.0 release</a> with YAML correlation rules. </li><li>Read Steve’s <a href="https://medium.com/@micallst" rel="nofollow" target="_blank">blog</a>, especially his posts on the <a href="https://medium.com/@micallst/lessons-learned-from-my-10-year-open-source-project-4a4c8c2b4f64" rel="nofollow" target="_blank">10 years developing SpiderFoot</a> and the <a href="https://medium.com/@micallst/misusing-osint-to-claim-election-fraud-cfb89c858c3a" rel="nofollow" target="_blank">misuse of OSINT to claim election fraud</a>.</li></ul>Rapid Rundown Links<ul><li>Read <a href="https://theoryof.predictable.software/articles/a-closer-look-at-cvss-scores/" rel="nofollow" target="_blank">the full paper</a>, “A Closer Look at CVSS Scores.”</li><li>Follow the author, Jacques Chester, on <a href="https://twitter.com/jacques_chester" rel="nofollow" target="_blank">Twitter</a>.</li></ul>Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like <a href="https://podcasts.apple.com/us/podcast/security-nation/id1124543784#see-all/reviews" rel="nofollow" target="_blank">Apple Podcasts</a>.

Steve Micallef of SpiderFoot on Open-Source Intelligence

Phillip Maddux

Interview LinksCheck out the latest on HoneyDB.Interested in participating in the project? Head to the HoneyDB Agent Docs.Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.

Interview Links<ul><li>Check out the latest on <a href="https://honeydb.io/" rel="nofollow" target="_blank">HoneyDB</a>.</li><li>Interested in participating in the project? Head to the <a href="https://honeydb-agent-docs.readthedocs.io/en/latest/" rel="nofollow" target="_blank">HoneyDB Agent Docs</a>.</li></ul>Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like <a href="https://podcasts.apple.com/us/podcast/security-nation/id1124543784#see-all/reviews" rel="nofollow" target="_blank">Apple Podcasts</a>.

Phillip Maddux on HoneyDB, the Open-Source Honeypot Data Project

Richard Roberts

Interview LinksCheck out Omer and Richard’s paper.Learn more about Omer’s work and Richard’s work.Rapid Rundown LinksRead the news about the change in DOJ policy toward ethical hackers.Visit the Rapid7 blog on the same topic.Dive into Harley’s great Twitter thread on the topic.Read up on the HiQ and Missouri cases mentioned.Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.

Interview Links<ul><li>Check out <a href="https://www.cs.umd.edu/~akgul/papers/vpn-ads.pdf" rel="nofollow" target="_blank">Omer and Richard’s paper</a>.</li><li>Learn more about <a href="https://www.cs.umd.edu/~akgul/" rel="nofollow" target="_blank">Omer’s work</a> and <a href="https://www.cs.umd.edu/~ricro/" rel="nofollow" target="_blank">Richard’s work</a>.</li></ul>Rapid Rundown Links<ul><li><a href="https://www.bleepingcomputer.com/news/security/us-doj-will-no-longer-prosecute-ethical-hackers-under-cfaa/" rel="nofollow" target="_blank">Read the news</a> about the change in DOJ policy toward ethical hackers.</li><li>Visit the <a href="https://www.rapid7.com/blog/post/2021/06/03/supreme-court-narrows-cfaa/" rel="nofollow" target="_blank">Rapid7 blog </a>on the same topic.</li><li>Dive into <a href="https://twitter.com/HarleyGeiger/status/1527388233360756741?s=20&amp;t=BOqjNh2Ay6A6d5RCrAfUmg" rel="nofollow" target="_blank">Harley’s great Twitter thread</a> on the topic.</li><li>Read up on the <a href="https://cdn.ca9.uscourts.gov/datastore/opinions/2022/04/18/17-16783.pdf" rel="nofollow" target="_blank">HiQ</a> and <a href="https://www.stltoday.com/news/local/govt-and-politics/essential-reading-governor-threatens-post-dispatch-after-discovery-of-data-vulnerability/collection_647c5ddb-fac9-5f83-8da9-f6dd58da9d70.html#1" rel="nofollow" target="_blank">Missouri</a> cases mentioned.</li></ul>Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like <a href="https://podcasts.apple.com/us/podcast/security-nation/id1124543784#see-all/reviews" rel="nofollow" target="_blank">Apple Podcasts</a>.

Omer Akgul and Richard Roberts on YouTube VPN Ads

Interview LinksLearn more about Kali Linux.Check out what they’re up to over at Offensive Security.Follow g0tmi1k on Twitter, and check out his blog.Rapid Rundown LinksRead the Krebs on Security article on the upcoming password changes.Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.

Interview Links<ul><li>Learn more about <a href="https://www.kali.org/" rel="nofollow" target="_blank">Kali Linux</a>.</li><li>Check out what they’re up to over at <a href="https://www.offensive-security.com/" rel="nofollow" target="_blank">Offensive Security</a>.</li><li>Follow g0tmi1k on <a href="https://twitter.com/g0tmi1k?lang=en" rel="nofollow" target="_blank">Twitter</a>, and check out his <a href="https://blog.g0tmi1k.com/" rel="nofollow" target="_blank">blog</a>.</li></ul>Rapid Rundown Links<ul><li>Read the <a href="https://krebsonsecurity.com/2022/05/your-phone-may-soon-replace-many-of-your-passwords/" rel="nofollow" target="_blank">Krebs on Security article</a> on the upcoming password changes.</li></ul>Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like <a href="https://podcasts.apple.com/us/podcast/security-nation/id1124543784#see-all/reviews" rel="nofollow" target="_blank">Apple Podcasts</a>.

Jim O’Gorman and g0tmi1k on Kali Linux

Whitney Merrill

Interview LinksFollow Whitney on Twitter, and check out her website.Submit a CFP for this year’s Crypto &amp; Privacy Village at DEF CON.Rapid Rundown LinksRead Neil Madden’s blog post on psychic signatures.Follow Neil Madden on Twitter.Check out Project Wycheproof on GitHub.Learn about Mount Wycheproof (the actual mountain).Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.

Interview Links<ul><li>Follow Whitney on <a href="https://twitter.com/wbm312" rel="nofollow" target="_blank">Twitter</a>, and check out her <a href="https://whitneymerrill.com/" rel="nofollow" target="_blank">website</a>.</li><li><a href="https://cfp.cryptovillage.org/" rel="nofollow" target="_blank">Submit a CFP</a> for this year’s Crypto &amp; Privacy Village at DEF CON.</li></ul>Rapid Rundown Links<ul><li>Read <a href="https://neilmadden.blog/2022/04/19/psychic-signatures-in-java/" rel="nofollow" target="_blank">Neil Madden’s blog post</a> on psychic signatures.</li><li>Follow Neil Madden on <a href="https://twitter.com/neilmaddog" rel="nofollow" target="_blank">Twitter</a>.</li><li>Check out <a href="https://github.com/google/wycheproof" rel="nofollow" target="_blank">Project Wycheproof</a> on GitHub.</li><li>Learn about <a href="https://en.wikipedia.org/wiki/Mount_Wycheproof" rel="nofollow" target="_blank">Mount Wycheproof</a> (the actual mountain).</li></ul>Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like <a href="https://podcasts.apple.com/us/podcast/security-nation/id1124543784#see-all/reviews" rel="nofollow" target="_blank">Apple Podcasts</a>.

Whitney Merrill on the Crypto & Privacy Village (and the Latest in Data Privacy)

Kate Stewart

Interview LinksRead Project Zephyr’s blog post on Amnesia33.Get Linux’s perspective on SBOM.Listen to our previous episode on SBOM with Josh Corman and Audra Hatch.Check out Zephyr’s Renode dashboard.Learn about the Software Package Data Exchange (SPDX) specification from ISO.Rapid Rundown LinksRead the story on the npm protestware.Peruse the issue logged against the project on Github.See Dark Reading’s homage to Mike Murray.Watch Mike Murray talk about hiring hackers.Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.

Interview Links<ul><li>Read Project Zephyr’s <a href="https://zephyrproject.org/zephyr-security-update-on-amnesia33/" rel="nofollow" target="_blank">blog post</a> on Amnesia33.</li><li>Get Linux’s perspective on <a href="https://www.linux.com/featured/sboms-supporting-safety-critical-software/" rel="nofollow" target="_blank">SBOM</a>.</li><li>Listen to our <a href="https://securitynation.simplecast.com/episodes/advocating-for-tech-literacy-and-transparency-a-discussion-with-i-am-the-calvarys-josh-corman-and-audra-hatch" rel="nofollow" target="_blank">previous episode on SBOM</a> with Josh Corman and Audra Hatch.</li><li>Check out Zephyr’s <a href="https://zephyr-dashboard.renode.io/" rel="nofollow" target="_blank">Renode dashboard</a>.</li><li>Learn about the <a href="https://www.iso.org/standard/81870.html" rel="nofollow" target="_blank">Software Package Data Exchange (SPDX) specification</a> from ISO.</li></ul>Rapid Rundown Links<ul><li>Read the story on the <a href="https://www.bleepingcomputer.com/news/security/third-npm-protestware-event-source-polyfill-calls-russia-out/" rel="nofollow" target="_blank">npm protestware</a>.</li><li>Peruse the <a href="https://github.com/Yaffle/EventSource/issues/202" rel="nofollow" target="_blank">issue logged against the project</a> on Github.</li><li>See Dark Reading’s <a href="https://www.darkreading.com/vulnerabilities-threats/in-appreciation-mike-murray" rel="nofollow" target="_blank">homage to Mike Murray</a>.</li><li>Watch Mike Murray <a href="https://www.youtube.com/watch?v=QpyT5supwZY" rel="nofollow" target="_blank">talk about hiring hackers</a>.</li></ul>Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like <a href="https://podcasts.apple.com/us/podcast/security-nation/id1124543784#see-all/reviews" rel="nofollow" target="_blank">Apple Podcasts</a>.

Kate Stewart on Open-Source Projects at the Linux Foundation

David Rogers

Interview LinksListen to David’s previous Security Nation episodeGive him a follow on Twitter.Read up on the PTSI bill.Learn who the heck Mystic Meg is.Check out ETSI (not the home crafts marketplace).Rapid Rundown LinksDownload Rapid7’s Vulnerability Intelligence Report.Check out AttackerKB.Listen to Caitlin Condon, lead author of the report, on Duo’s Decipher podcast.Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.

Interview Links<ul><li>Listen to David’s <a href="https://www.rapid7.com/resources/security-nation-david-rogers/" rel="nofollow" target="_blank">previous Security Nation episode</a></li><li>Give him a follow on <a href="http://@drogersuk" rel="nofollow" target="_blank">Twitter</a>.</li><li>Read up on the <a href="https://www.gov.uk/guidance/the-product-security-and-telecommunications-infrastructure-psti-bill-product-security-factsheet" rel="nofollow" target="_blank">PTSI bill</a>.</li><li>Learn who the heck <a href="https://www.thesun.co.uk/topic/mystic-meg/" rel="nofollow" target="_blank">Mystic Meg</a> is.</li><li>Check out <a href="https://www.etsi.org/" rel="nofollow" target="_blank">ETSI</a> (not the home crafts marketplace).</li></ul>Rapid Rundown Links<ul><li>Download Rapid7’s <a href="https://www.rapid7.com/blog/post/2022/03/28/analyzing-the-attack-landscape-rapid7s-annual-vulnerability-intelligence-report/" rel="nofollow" target="_blank">Vulnerability Intelligence Report</a>.</li><li>Check out <a href="https://attackerkb.com" rel="nofollow" target="_blank">AttackerKB</a>.</li><li>Listen to Caitlin Condon, lead author of the report, on <a href="https://duo.com/decipher/decipher-podcast-caitlin-condon" rel="nofollow" target="_blank">Duo’s Decipher podcast</a>.</li></ul>Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like <a href="https://podcasts.apple.com/us/podcast/security-nation/id1124543784#see-all/reviews" rel="nofollow" target="_blank">Apple Podcasts</a>.

David Rogers on IoT Security Legislation

Bob Lord

Interview LinksFollow Bob on Twitter.Check out the DNC Security Checklist.Rapid Rundown LinksRead the paper on VPN influencer ads on YouTube.Give the lead author, Omer, a follow on Twitter.Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.

Interview Links<ul><li>Follow Bob on <a href="https://twitter.com/boblord" rel="nofollow" target="_blank">Twitter</a>.</li><li>Check out the <a href="https://dnc.org/security" rel="nofollow" target="_blank">DNC Security Checklist</a>.</li></ul>Rapid Rundown Links<ul><li><a href="https://www.cs.umd.edu/~dml/papers/vpn-ads-oakland22.pdf" rel="nofollow" target="_blank">Read the paper</a> on VPN influencer ads on YouTube.</li><li>Give the lead author, Omer, a <a href="https://twitter.com/_oakgul/status/1502038508558503937" rel="nofollow" target="_blank">follow on Twitter</a>.</li></ul>Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like <a href="https://podcasts.apple.com/us/podcast/security-nation/id1124543784#see-all/reviews" rel="nofollow" target="_blank">Apple Podcasts</a>.

Bob Lord on Securing the DNC

Interview LinksLearn more about Metasploit, AttackerKB, and Recog.Read Matthew’s blog post on open-source security.Remind yourself about Log4Shell (if you dare).Read up on Linus’s Law.Rapid Rundown LinksRead the Bleeping Computer article about DDoS amplification.Check out the original USENIX paper.

Interview Links<ul><li>Learn more about <a href="https://www.rapid7.com/products/metasploit/" rel="nofollow" target="_blank">Metasploit</a>, <a href="https://attackerkb.com/" rel="nofollow" target="_blank">AttackerKB</a>, and <a href="https://github.com/rapid7/recog" rel="nofollow" target="_blank">Recog</a>.</li><li>Read Matthew’s <a href="https://www.rapid7.com/blog/post/2022/01/19/open-source-security-getting-to-the-root-of-the-problem/" rel="nofollow" target="_blank">blog post</a> on open-source security.</li><li>Remind yourself about <a href="https://www.rapid7.com/blog/post/2021/12/10/widespread-exploitation-of-critical-remote-code-execution-in-apache-log4j/" rel="nofollow" target="_blank">Log4Shell</a> (if you dare).</li><li>Read up on <a href="https://en.wikipedia.org/wiki/Linus%27s_law" rel="nofollow" target="_blank">Linus’s Law</a>.</li></ul>Rapid Rundown Links<ul><li>Read the <a href="https://www.bleepingcomputer.com/news/security/content-filtering-devices-abused-for-65x-ddos-amplification/" rel="nofollow" target="_blank">Bleeping Computer article</a> about DDoS amplification.</li><li>Check out the original <a href="https://geneva.cs.umd.edu/papers/usenix-weaponizing-ddos.pdf" rel="nofollow" target="_blank">USENIX paper</a>.</li></ul>

Matthew Kienow on Open-Source Security and the Recog Framework

Amit Serper

Interview LinksFollow Amit on Twitter at @0xAmit.Read Amit’s blog post on the Autodiscover leak.Rapid Rundown LinksRead up on the vulnerability disclosure metrics from Google’s Project Zero.Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like Apple Podcasts.

Interview Links<ul><li>Follow Amit on Twitter at <a href="https://twitter.com/0xAmit?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor" rel="nofollow" target="_blank">@0xAmit</a>.</li><li><a href="https://www.guardicore.com/labs/autodiscovering-the-great-leak/" rel="nofollow" target="_blank">Read Amit’s blog post</a> on the Autodiscover leak.</li></ul>Rapid Rundown Links<ul><li>Read up on the vulnerability disclosure metrics from Google’s <a href="https://googleprojectzero.blogspot.com/2022/02/a-walk-through-project-zero-metrics.html" rel="nofollow" target="_blank">Project Zero</a>.</li></ul>Like the show? Want to keep Jen and Tod in the podcasting business? Feel free to rate and review with your favorite podcast purveyor, like <a href="https://podcasts.apple.com/us/podcast/security-nation/id1124543784#see-all/reviews" rel="nofollow" target="_blank">Apple Podcasts</a>.

Amit Serper on Finding Leaks in Autodiscover

Tod Beardsley is charming, brilliant, and devastatingly handsome.

Best Podcast Ever

Great insight! I hear this Jack guy is a really swell guy... ;)

The Passion of Security Pros

Security Nation

Josh Corman

Audra Hatch

On this week’s episode of Security Nation, Josh Corman and Audra Hatch of I Am The Cavalry share insights into the software bill of materials (SBoM) and software transparency. Stick around for our Rapid Rundown, where Tod breaks down the latest iPhone bug that wasn’t and Sophos bug that was.

Advocating for Tech Literacy and Transparency: A Discussion with I Am The Calvary’s Josh Corman and Audra Hatch

Casey Ellis

On our latest episode of Security Nation, we caught up with Casey Ellis, founder and CTO at Bugcrowd. Joining us during the 2020 RSA Conference, he takes the time to discuss normalizing vulnerability disclosure, the safe harbor debate, and the legal implications of crowdsourced security testing.Stick around for our Rapid Rundown, where Tod breaks down the recent controversy on online vs. mail-in voting, and gives the inside scoop on Rapid7’s newest project, AttackerKB.

Where Tech Meets Legal: Discussing Crowdsourced Security Testing with Bugcrowd’s Casey Ellis

The Best Multi-Part Documentaries, with documentaries on Obama, Federer vs Nadal, the making of Star Wars, Netflix vs Blockbuster and more. Add episodes you're interested into your queue below!

Best Multi-Part Documentaries

The best episodes for anyone looking to learn more about topics such as happiness, fulfillment, depression and psychology/mental health in general. With interviews with industry experts, personal stories of individuals, this topic has lessons applicable to everyone. Add episodes you're interested into your queue below!