7 ms·

Here's Episode 002 Detection and Response, released within the hour: https://www.youtube.com/watch?v=QZ0cpBocl3c https://www.youtube.com/watch?v=QZ0cpBocl3c Pro

Here's Episode 002 Detection and Response, released within the hour: https://www.youtube.com/watch?v=QZ0cpBocl3c https://www.youtube.com/watch?v=QZ0cpBocl3c Probably the best one yet.

O__________O 4y ago
Thanks! _______________________ EP002: Detection and Response (3rd video) Summary: Covers Google’s Incident Response Team and targeted attacks against security experts. Links to topics mentioned in video: - https://wikipedia.org/wiki/Union_Fire_Company https://wikipedia.org/wiki/Union_Fire_Company - https://wikipedia.org/wiki/Incident_response_team https://wikipedia.org/wiki/Incident_response_team - https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/ https://blog.google/threat-analysis-group/new-campaign-targe... - https://blog.google/threat-analysis-group/update-campaign-targeting-security-researchers/ https://blog.google/threat-analysis-group/update-campaign-ta... _________________ Response: Targeted attacks and insider threats specifically for security professionals have been around forever. Fake profiles, trust-based pig back attacks, watering hole attacks, hack the hacker, honeypots, bribes, blackmail, break-ins, etc — aka hunting the keys to the kingdom. Prior examples: - https://www.latimes.com/archives/la-xpm-2000-sep-19-fi-23373-story.html https://www.latimes.com/archives/la-xpm-2000-sep-19-fi-23373... - https://www.cnet.com/news/privacy/google-china-insiders-may-have-helped-with-attack/ https://www.cnet.com/news/privacy/google-china-insiders-may-... - https://www.theverge.com/2014/2/24/5441386/ethical-hacking-organization-website-defaced-with-snowden-passport https://www.theverge.com/2014/2/24/5441386/ethical-hacking-o... - https://wikipedia.org/wiki/Vault_7 https://wikipedia.org/wiki/Vault_7 - https://www.businessinsider.com/fireeye-hacked-nation-state-red-team-fbi-2020-12 https://www.businessinsider.com/fireeye-hacked-nation-state-...
- markoman 4y ago
  And now comes: EP003: Red Team https://www.youtube.com/watch?v=TusQWn2TQxQ https://www.youtube.com/watch?v=TusQWn2TQxQ (4th video, in 0th indexing) Things are getting interesting! The next video (004) is titled 'BUG HUNTERS'. I think it refers to bug bounty programs?
  - O__________O 4y ago
    Summary: Just covers Google Red Team and highlights a USB based key injection attack, paired with phishing and session jacking, ending in an failed attempt to physically enter Google. Response: Red Teams get a lot of hype and even more rules of engagement, which results in false sense of security. ____________ Related links: - https://en.m.wikipedia.org/wiki/Crash_test_dummy https://en.m.wikipedia.org/wiki/Crash_test_dummy - https://en.m.wikipedia.org/wiki/Red_team https://en.m.wikipedia.org/wiki/Red_team - https://en.m.wikipedia.org/wiki/Certified_Ethical_Hacker https://en.m.wikipedia.org/wiki/Certified_Ethical_Hacker - https://blog.google/technology/safety-security/meet-the-team-responsible-for-hacking-google/ https://blog.google/technology/safety-security/meet-the-team... - https://cloud.withgoogle.com/cloudsecurity/podcast/ep71-attacking-google-to-defend-google-how-google-does-red-team/ https://cloud.withgoogle.com/cloudsecurity/podcast/ep71-atta... - https://sre.google/books/ https://sre.google/books/ - https://portswigger.net/daily-swig/amp/whid-elite-weaponized-usb-gadgets-boast-multiple-features-for-the-stealthy-red-teamer https://portswigger.net/daily-swig/amp/whid-elite-weaponized... - https://opensource.googleblog.com/2020/03/usb-keystroke-injection-protection.html?m=1 https://opensource.googleblog.com/2020/03/usb-keystroke-inje... - https://www.emergingtechbrew.com/stories/2022/06/14/how-microsoft-and-google-use-ai-red-teams-to-stress-test-their-system https://www.emergingtechbrew.com/stories/2022/06/14/how-micr...
- markoman 4y ago
  And here is EP004 BUG HUNTERS: https://www.youtube.com/watch?v=IoXiXlCNoXg https://www.youtube.com/watch?v=IoXiXlCNoXg
  - O__________O 4y ago
    Hmmm... page loads, but clicking play results in an error; 76 views, 5 likes. ________ EDIT: Able to access the videos via the direct non-web links, but any of the ones with audio baked in are not accessible; the ones without audio do play. Assuming it’s glitch and will fix it itself.
    - deleted 4y ago
      [deleted]
  - O__________O 4y ago
    Summary: Covers Google Bug Bounty program including interviews with staff and the top bounty hunters. Response: As mentioned in the video, Knuth’s bounty program was largely to help him feel better about publishing a book with errors; checks are largely symbolic and rarely cashed, since they’re only worth few dollars. Similarly, black market for bugs continues to offer higher payouts than white hat markets. It’s an issue and building communities alone around bug bounties will neither fix it, nor stop true adversaries from developing talent and technology that exceeds current capacities, capabilities, etc. Obviously, complex problem, but if Google is going to market and position themselves as a community resource for protecting people, they need to be direct and honest about the limits of reality and the constraints they’re forced to work within; for example, that their interests, nation states, etc - frequently have security concerns that conflict with user security. _______________________ Links related to video: - https://wikipedia.org/wiki/Bounty_(reward) https://wikipedia.org/wiki/Bounty_(reward) - https://wikipedia.org/wiki/The_Art_of_Computer_Programming https://wikipedia.org/wiki/The_Art_of_Computer_Programming - https://wikipedia.org/wiki/Knuth_reward_check https://wikipedia.org/wiki/Knuth_reward_check - https://securitymagazine.com/articles/95726-google-launches-bug-hunters-community https://securitymagazine.com/articles/95726-google-launches-... - https://wikipedia.org/wiki/Market_for_zero-day_exploits https://wikipedia.org/wiki/Market_for_zero-day_exploits _______________________ Meta: YouTube bug to playing video with audio is fixed. Also, appears this is last full episode in the series; full playlist is now up here: https://m.youtube.com/playlist?list=PL590L5WQmH8dsxxz7ooJAgmijwOz0lh2H https://m.youtube.com/playlist?list=PL590L5WQmH8dsxxz7ooJAgm...
- markoman 4y ago
  EP005: 'Project Zero' https://www.youtube.com/watch?v=My_13FXODdU https://www.youtube.com/watch?v=My_13FXODdU Obviously, this is about Zero-day vulns In the beginning they relate this to an English castle in Normandy that was defeated when in 1204 the French attackers climbed through the latrine chute to get inside. They like to start these off with some vague connection to a historical event. Its pretty general but does have some valuable key points despite the slick infomerical feel.

Here's Episode 002 Detection and Response, released within the hour: https://www.youtube.com/watch?v=QZ0cpBocl3c https://www.youtube.com/watch?v=QZ0cpBocl3c Probably the best one yet.

O__________O 4y ago

Thanks! _______________________ EP002: Detection and Response (3rd video) Summary: Covers Google’s Incident Response Team and targeted attacks against security experts. Links to topics mentioned in video: - https://wikipedia.org/wiki/Union_Fire_Company https://wikipedia.org/wiki/Union_Fire_Company - https://wikipedia.org/wiki/Incident_response_team https://wikipedia.org/wiki/Incident_response_team - https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/ https://blog.google/threat-analysis-group/new-campaign-targe... - https://blog.google/threat-analysis-group/update-campaign-targeting-security-researchers/ https://blog.google/threat-analysis-group/update-campaign-ta... _________________ Response: Targeted attacks and insider threats specifically for security professionals have been around forever. Fake profiles, trust-based pig back attacks, watering hole attacks, hack the hacker, honeypots, bribes, blackmail, break-ins, etc — aka hunting the keys to the kingdom. Prior examples: - https://www.latimes.com/archives/la-xpm-2000-sep-19-fi-23373-story.html https://www.latimes.com/archives/la-xpm-2000-sep-19-fi-23373... - https://www.cnet.com/news/privacy/google-china-insiders-may-have-helped-with-attack/ https://www.cnet.com/news/privacy/google-china-insiders-may-... - https://www.theverge.com/2014/2/24/5441386/ethical-hacking-organization-website-defaced-with-snowden-passport https://www.theverge.com/2014/2/24/5441386/ethical-hacking-o... - https://wikipedia.org/wiki/Vault_7 https://wikipedia.org/wiki/Vault_7 - https://www.businessinsider.com/fireeye-hacked-nation-state-red-team-fbi-2020-12 https://www.businessinsider.com/fireeye-hacked-nation-state-...

markoman 4y ago
And now comes: EP003: Red Team https://www.youtube.com/watch?v=TusQWn2TQxQ https://www.youtube.com/watch?v=TusQWn2TQxQ (4th video, in 0th indexing) Things are getting interesting! The next video (004) is titled 'BUG HUNTERS'. I think it refers to bug bounty programs?
- O__________O 4y ago
  Summary: Just covers Google Red Team and highlights a USB based key injection attack, paired with phishing and session jacking, ending in an failed attempt to physically enter Google. Response: Red Teams get a lot of hype and even more rules of engagement, which results in false sense of security. ____________ Related links: - https://en.m.wikipedia.org/wiki/Crash_test_dummy https://en.m.wikipedia.org/wiki/Crash_test_dummy - https://en.m.wikipedia.org/wiki/Red_team https://en.m.wikipedia.org/wiki/Red_team - https://en.m.wikipedia.org/wiki/Certified_Ethical_Hacker https://en.m.wikipedia.org/wiki/Certified_Ethical_Hacker - https://blog.google/technology/safety-security/meet-the-team-responsible-for-hacking-google/ https://blog.google/technology/safety-security/meet-the-team... - https://cloud.withgoogle.com/cloudsecurity/podcast/ep71-attacking-google-to-defend-google-how-google-does-red-team/ https://cloud.withgoogle.com/cloudsecurity/podcast/ep71-atta... - https://sre.google/books/ https://sre.google/books/ - https://portswigger.net/daily-swig/amp/whid-elite-weaponized-usb-gadgets-boast-multiple-features-for-the-stealthy-red-teamer https://portswigger.net/daily-swig/amp/whid-elite-weaponized... - https://opensource.googleblog.com/2020/03/usb-keystroke-injection-protection.html?m=1 https://opensource.googleblog.com/2020/03/usb-keystroke-inje... - https://www.emergingtechbrew.com/stories/2022/06/14/how-microsoft-and-google-use-ai-red-teams-to-stress-test-their-system https://www.emergingtechbrew.com/stories/2022/06/14/how-micr...
markoman 4y ago
And here is EP004 BUG HUNTERS: https://www.youtube.com/watch?v=IoXiXlCNoXg https://www.youtube.com/watch?v=IoXiXlCNoXg
- O__________O 4y ago
  Hmmm... page loads, but clicking play results in an error; 76 views, 5 likes. ________ EDIT: Able to access the videos via the direct non-web links, but any of the ones with audio baked in are not accessible; the ones without audio do play. Assuming it’s glitch and will fix it itself.
  - deleted 4y ago
    [deleted]
- O__________O 4y ago
  Summary: Covers Google Bug Bounty program including interviews with staff and the top bounty hunters. Response: As mentioned in the video, Knuth’s bounty program was largely to help him feel better about publishing a book with errors; checks are largely symbolic and rarely cashed, since they’re only worth few dollars. Similarly, black market for bugs continues to offer higher payouts than white hat markets. It’s an issue and building communities alone around bug bounties will neither fix it, nor stop true adversaries from developing talent and technology that exceeds current capacities, capabilities, etc. Obviously, complex problem, but if Google is going to market and position themselves as a community resource for protecting people, they need to be direct and honest about the limits of reality and the constraints they’re forced to work within; for example, that their interests, nation states, etc - frequently have security concerns that conflict with user security. _______________________ Links related to video: - https://wikipedia.org/wiki/Bounty_(reward) https://wikipedia.org/wiki/Bounty_(reward) - https://wikipedia.org/wiki/The_Art_of_Computer_Programming https://wikipedia.org/wiki/The_Art_of_Computer_Programming - https://wikipedia.org/wiki/Knuth_reward_check https://wikipedia.org/wiki/Knuth_reward_check - https://securitymagazine.com/articles/95726-google-launches-bug-hunters-community https://securitymagazine.com/articles/95726-google-launches-... - https://wikipedia.org/wiki/Market_for_zero-day_exploits https://wikipedia.org/wiki/Market_for_zero-day_exploits _______________________ Meta: YouTube bug to playing video with audio is fixed. Also, appears this is last full episode in the series; full playlist is now up here: https://m.youtube.com/playlist?list=PL590L5WQmH8dsxxz7ooJAgmijwOz0lh2H https://m.youtube.com/playlist?list=PL590L5WQmH8dsxxz7ooJAgm...
markoman 4y ago
EP005: 'Project Zero' https://www.youtube.com/watch?v=My_13FXODdU https://www.youtube.com/watch?v=My_13FXODdU Obviously, this is about Zero-day vulns In the beginning they relate this to an English castle in Normandy that was defeated when in 1204 the French attackers climbed through the latrine chute to get inside. They like to start these off with some vague connection to a historical event. Its pretty general but does have some valuable key points despite the slick infomerical feel.