Systemd as a Weapon: How PumaBot Exploits Linux Persistence

Daily Security Review

Player FM - Internet Radio Done Right

הוסף לפני nineteen שבועות

תוכן מסופק על ידי Daily Security Review. כל תוכן הפודקאסטים כולל פרקים, גרפיקה ותיאורי פודקאסטים מועלים ומסופקים ישירות על ידי Daily Security Review או שותף פלטפורמת הפודקאסט שלהם. אם אתה מאמין שמישהו משתמש ביצירה שלך המוגנת בזכויות יוצרים ללא רשותך, אתה יכול לעקוב אחר התהליך המתואר כאן https://he.player.fm/legal.

Fixable

1
How to get your confidence back 41:05

לפני 20 weeks41:05

הפעל מאוחר יותר

רשימות

לייק

אהבתי

41:05

When negative feedback shakes your confidence, it can be difficult to get back to feeling like yourself at work. In this episode, Anne and Frances help a struggling listener who has spent years toning herself down in the workplace after being told that she was too assertive — now, she feels that her modest approach is holding her back. Together, they use Anne and Frances’s “trust triangle” framework to explore how empathy, authenticity, and logic can help you rebuild confidence and trust with your colleagues, and share helpful confidence hacks for getting comfy with discomfort. What problems are you dealing with at work? Text or call 234-FIXABLE or email fixable@ted.com to be featured on the show. For the full text transcript, visit ted.com/podcasts/fixable-transcripts Want to help shape TED’s shows going forward? Fill out our survey ! Hosted on Acast. See acast.com/privacy for more information.…

לפני 22 ימים 18:38

MP3•בית הפרקים

Linux systems are under siege—particularly in the world of IoT and internet-exposed servers. In this episode, we dissect PumaBot, a new GoLang-based botnet that's turning Linux IoT devices into cryptomining workhorses. We’ll break down how attackers brute-force SSH credentials, install malware disguised as legitimate services, and use systemd for stealthy persistence.

We dive deep into ATT&CK technique T1501, where systemd services like redis.service or mysqI.service are hijacked or maliciously created to ensure malware survives system reboots. You'll learn how adversaries leverage GoLang’s cross-platform strengths and embed rootkits like pam_unix.so to capture credentials, all while evading detection with environment fingerprinting.

We also explore the broader implications: how cryptojacking continues to rise, what SSH brute-forcing says about current security hygiene, and why IoT devices remain a weak link in enterprise infrastructure. If you manage Linux systems or deploy connected devices, this episode is your tactical briefing on the latest threats—and what to look out for before your CPU cycles are stolen for someone else's crypto wallet.

145 פרקים

#Tech #News #Tech News #Daily Security Review

Systemd as a Weapon: How PumaBot Exploits Linux Persistence

Daily Security Review

published לפני 22 ימים

שתפו

MP3•בית הפרקים

145 פרקים

#Tech #News #Tech News #Daily Security Review

All episodes

Daily Security Review

1
Citrix NetScaler Flaws Expose Enterprise Networks: CVE-2025-5349 & CVE-2025-5777 38:12

לפני 12 hours38:12

38:12

Two newly disclosed critical vulnerabilities— CVE-2025-5349 and CVE-2025-5777 —have put Citrix NetScaler ADC and Gateway deployments at serious risk, exposing enterprise environments to potential data breaches and service disruptions. These flaws underscore the persistent challenges facing infrastructure teams, especially when balancing security patching with service availability. We dive deep into: 🔍 The technical mechanisms behind the NetScaler vulnerabilities and why they’re considered high risk ⚙️ The real-world difficulties of patching Citrix environments , including long installation times, session disruption concerns, and HA strategy failures 🛠️ Staged patching techniques , including gold image refresh for MCS, traffic redirection using VIP isolation, and Citrix’s official upgrade flow 🔒 A breakdown of the AAA (Authentication, Authorization, Accounting) model and its relevance for secure VPN access 🧠 Broader lessons from CWE-125 (Out-of-Bounds Read) and how SAST, SCA, and code reviews help developers catch software vulnerabilities before they reach production This episode ties together software security principles with enterprise infrastructure reality , highlighting how missteps in either domain can leave organizations exposed. Whether you're managing Citrix infrastructure or building secure software, this conversation bridges the gap between theory and practice.…

Daily Security Review

1
GerriScary: How CVE-2025-1568 Threatened Google’s Open-Source Supply Chain 35:21

לפני 15 hours35:21

35:21

CVE-2025-1568, dubbed "GerriScary" , has shaken the open-source ecosystem by exposing a fundamental weakness in Google’s Gerrit code review system—one that could have enabled attackers to infiltrate 18 of Google’s most widely used open-source projects, including Chromium, ChromiumOS, Dart , and Bazel . This episode breaks down how the vulnerability was discovered by researchers at Tenable using a subtle but powerful HTTP status code fingerprinting technique . A simple 209 response exposed whether a user had the “addPatchSet” permission on a given project. That small indicator opened the door to a potentially massive software supply chain compromise , allowing malicious patchsets to be injected silently into production workflows. We also explore the broader threat landscape with critical and actively exploited vulnerabilities , such as: 🔓 CVE-2023-0386 – A Linux kernel flaw exploited for root access 🧨 CVE-2025-23121 – Remote code execution on Veeam Backup Server 💣 CVE-2025-2783 – A Google Chrome zero-day used by the Trinper backdoor 📡 CVE-2023-33538 – Command injection in TP-Link routers, actively exploited 🔥 CVE-2024-1086 – Use-after-free in Linux netfilter, leading to system takeover From hardcoded keys in enterprise tools to command injections in home routers, we highlight how poor development practices continue to fuel real-world threats. But this isn't just about reacting to flaws. We dissect the NIST Secure Software Development Framework (SSDF) , now more relevant than ever. You’ll learn how the SSDF’s four core areas— Prepare, Protect, Produce, and Respond —provide a practical roadmap to building secure software, preventing flaws like GerriScary, and rapidly responding when the next critical CVE emerges. Whether you’re a software engineer, CISO, or security architect, this episode offers a grounded and urgent look at the real-world risks of unpatched systems, insecure third-party dependencies, and weak DevSecOps discipline —and how to fix them.…

Daily Security Review

1
Cisco & Atlassian Under Fire: High-Severity Flaws and What’s at Risk 53:38

לפני 18 hours53:38

53:38

Cisco and Atlassian have both released urgent security advisories in response to newly discovered high-severity vulnerabilities—and the implications are serious. Cisco’s firmware flaws impact Meraki MX and Z Series devices running AnyConnect VPN. A bug in the SSL VPN process allows authenticated attackers to crash the VPN server, causing repeated denial-of-service conditions. Cisco ClamAV also contains heap-based buffer overflow vulnerabilities that could crash antivirus defenses simply by scanning a malicious file. Proof-of-concept exploit code is already circulating—making exploitation only a matter of time. Atlassian isn’t faring much better. Their June 2025 bulletin disclosed 13 high-severity vulnerabilities across Bamboo, Bitbucket, Confluence, Jira, Crowd, and Service Management. Many of these are rooted in third-party dependencies like Netty, Apache Tomcat, and Spring Framework. From improper authorization to remote code execution and denial of service, the risks span multiple vectors. This episode breaks down: 🔧 Cisco CVEs (2025-20212, 2025-20271, 2025-20128, 2025-20234) 🛑 How malformed VPN attributes trigger a system crash 🧪 The risk of crashing ClamAV with OLE2 content 📦 Atlassian’s dependency-driven vulnerabilities (CVE-2025-22228, CVE-2024-47561, CVE-2024-39338 and more) 🔁 The challenges of managing firmware updates across Meraki networks 💣 The broader danger of unpatched systems and third-party bloat 📉 Real-world fallout: from Equifax to ProxyShell ☁️ Shared responsibility in cloud environments and how institutions often misinterpret it If you're running Cisco hardware, using Atlassian platforms, or relying on open-source libraries, this episode shows why you must have a clear patching strategy, strong third-party oversight, and internal security validation—before attackers find the gaps for you.…

Daily Security Review

1
Double Extortion, Biometric Data, and Donuts: How Play Ransomware Hit Krispy Kreme 50:51

לפני 21 hours50:51

50:51

A deep dive into one of the most aggressive ransomware groups operating today— Play —and their latest high-profile target: Krispy Kreme . Operating since 2022, the Play ransomware group has become notorious for its double extortion model , where sensitive data is exfiltrated before systems are encrypted. Victims are pressured not just by digital ransom notes but also through direct phone calls to company lines, creating a highly aggressive and disruptive extortion cycle. Play has targeted over 900 entities globally , from government institutions to media outlets and, most recently, the food industry. In November 2024, Krispy Kreme was forced to shut down online ordering in parts of the U.S. after detecting unauthorized access to its systems. The Play group claimed responsibility. Stolen data reportedly included names, Social Security numbers, banking credentials, biometrics , and even military IDs —a scale and sensitivity that elevates this attack far beyond typical retail breaches. We break down: 📛 The origins and global targeting footprint of Play ransomware 📤 Their TTPs: dynamic compilation, intermittent encryption, WinRAR compression, and data exfiltration via WinSCP ☎️ Their use of direct communication, including threatening phone calls to corporate numbers 🧠 Their links to Russian-affiliated cyber actors and similarities to other ransomware variants like Hive and Nokoyawa 🧬 The specific operational and reputational damage inflicted on Krispy Kreme 💥 The unique risks of biometric data exposure in ransomware cases 🛡️ Critical cybersecurity recommendations from CISA, including segmentation, offline backups, EDR, and least-privilege access 🧪 How businesses—regardless of industry—must rethink cybersecurity resilience in the face of industrialized extortion models Whether you're in tech, retail, or public infrastructure, this is a wake-up call: ransomware doesn’t discriminate by sector—it hunts for scale, pressure points, and poor preparation . #Ransomware #PlayRansomware #KrispyKremeHack #CyberSecurity #DoubleExtortion #DataBreach #InfoSec #CISA #HunterInternational #BiometricDataBreach #RetailSecurity #PodcastCybersecurity #CyberAttack #RansomwareTTPs #MITREATTACK…

Daily Security Review

1
Archetyp Market Seized: €250M Drug Empire Toppled by Operation Deep Sentinel 54:53

לפני 3 ימים54:53

54:53

In this episode, we unpack the dramatic takedown of Archetyp Market , a darknet marketplace that dominated the online drug trade since its launch in May 2020. With over €250 million ($290 million) in drug transactions, more than 600,000 users , and 17,000 listings , Archetyp wasn’t just another darknet forum—it was the largest dedicated drug market on the Tor network by 2024. The operation that brought it down, Operation Deep Sentinel , was a five-nation law enforcement effort led by Germany’s BKA , coordinated by Europol and Eurojust , and supported by the United States. Between June 11–13, 2025, authorities arrested the alleged German administrator in Barcelona , one moderator, and six top vendors. They also seized €7.8 million in assets , including crypto wallets, luxury vehicles, and the market’s backend infrastructure hosted in the Netherlands. This was the culmination of years of cyber-forensics, financial tracing, and cross-border intelligence work . But the story doesn’t stop with the arrests. We explore the deeper implications: how digital drug markets continue to evolve, why users easily migrate after shutdowns, and how operations like this shape law enforcement’s long-term cybercrime strategy. We’ll also touch on the philosophical roots of Archetyp’s founder—who modeled the site after Silk Road , with the aim of supporting drug liberalization in Europe—and why this ideological undertone didn't stop the authorities from dismantling the platform piece by piece. Tune in as we analyze the fall of Archetyp, the future of darknet markets, and the growing role of international cybersecurity cooperation in this high-stakes game of cat and mouse.…

Daily Security Review

1
KillSec Exploits Zero-Day to Breach Ocuco: 241K Patients Exposed 1:07:13

לפני 3 ימים1:07:13

1:07:13

In this episode, we break down one of 2025’s most significant healthcare cybersecurity incidents: the ransomware attack on Ocuco, a global eyecare software provider. On April 1st, 2025, threat actors from the KillSec ransomware group exploited CVE-2024-41197 — a critical authentication bypass in Ocuco’s INVCLIENT.EXE — to gain Administrator-level access and exfiltrate over 340GB of sensitive data , including patient names, SSNs, driver’s license numbers, and financial records. KillSec, a group known for combining ransomware with ideological messaging, claimed responsibility via their dark web leak site. Despite positioning themselves as hacktivists, their modus operandi follows a double extortion model , typical of financially motivated groups. Their tactics reflect a larger 2024–2025 trend: politically charged language masking ransom demands. We dive into the technical details of CVE-2024-41197, a zero-day (or possibly N-day) vulnerability with a CVSS score of 9.8 that allowed unauthenticated remote code execution. Ocuco learned of the breach the same day KillSec publicized it, and the company later reported the incident to the U.S. HHS and Ireland’s DPC under GDPR obligations. This episode also connects the dots across broader healthcare cybersecurity trends. With 458 ransomware attacks tracked in healthcare in 2024, and groups like LockBit 3.0, RansomHub, and BianLian still active, this incident reflects the sector's growing exposure to zero-day exploits, supply chain flaws, and AI-augmented social engineering. We end with a focused discussion on prevention: how organizations can strengthen software supply chain defenses, implement DevSecOps practices, and prepare breach response plans that comply with GDPR and HIPAA alike.…

Daily Security Review

1
DragonForce Ransomware: The Evolving Threat to Healthcare Data 39:12

לפני 3 ימים39:12

39:12

In this episode, we dive deep into the current state of cybersecurity in healthcare, where the growing sophistication of cyber threats has led to increasingly devastating breaches. We begin with a close look at the rise of Ransomware-as-a-Service (RaaS), focusing on DragonForce, a ransomware group that has transitioned from politically motivated attacks to financially-driven extortion campaigns. With their dual-extortion tactics, DragonForce is not just locking data but threatening to release stolen information, significantly amplifying the risk to healthcare organizations. The conversation then shifts to the real-world impact of cybercrime on healthcare. Data breaches do more than cause financial losses—they erode patient trust, which is crucial for effective healthcare delivery. Patients often experience fear and anxiety after their personal information is exposed, which can lead to a reluctance to share vital health details, ultimately impacting patient outcomes. We’ll also explore critical preventive measures and response strategies that healthcare organizations must adopt to safeguard sensitive data. From multi-layered phishing prevention tactics to robust incident response plans, these best practices are essential for maintaining the integrity and confidentiality of patient information. Finally, we discuss the importance of rebuilding trust in the wake of a breach, with practical recommendations for transparent breach reporting and fostering a culture of cybersecurity awareness. Tune in for expert insights on how healthcare can defend against these persistent threats and recover swiftly when the inevitable happens.…

Daily Security Review

1
Google’s $32B Bid for Wiz Faces DOJ Fire: A Cloud Security Power Play or Market Grab? 1:02:01

לפני 3 ימים1:02:01

1:02:01

In this episode, we break down the seismic implications of Google’s proposed $32 billion acquisition of Wiz , the world’s largest cybersecurity unicorn—and why this isn’t just another tech deal. At the core is the U.S. Department of Justice's antitrust investigation , triggered by concerns that the deal could tighten Google’s grip on a critical sector: multi-cloud cybersecurity . With Wiz already serving 40% of the Fortune 100 and boasting $500M in ARR, the acquisition could position Google as a dominant force in cloud-native application protection—potentially squeezing competitors and reshaping the market. We examine what’s driving this mega-deal, from Google’s desire to compete with Microsoft Defender for Cloud, to its push for a unified security stack that spans AWS, Azure, and Oracle Cloud. We also look at the staggering $3.2B breakup fee —10% of the deal value—which suggests that both companies anticipated regulatory roadblocks . This isn’t happening in a vacuum. We contextualize the deal within broader M&A trends in 2025 , including evolving deal structures, regional regulatory crackdowns in Europe and China, and a shifting landscape under the Trump administration in North America. Plus, we explore the booming cloud security market , projected to hit $270B by 2035, and what the DOJ’s actions could mean for future cloud M&A. Finally, we explore counterpoints from the UK's Cloud Services Market Report, which suggests that the cloud landscape remains competitive globally, with price wars, strong buyer power, and plenty of innovation. So is the DOJ overreacting—or is Google really aiming to own the future of cybersecurity? 📌 Topics covered: 🧠 Why Wiz became the crown jewel of cloud security 💰 The motivations behind Google’s biggest acquisition ever ⚖️ The DOJ’s case and the growing wave of antitrust scrutiny 🌍 Regional M&A shifts in the US, Europe, and China 📉 Price wars, competition, and market structure in cloud services 🛡️ The future of multi-cloud security, and who really controls it…

Daily Security Review

1
SimpleHelp Exploit Fallout: Ransomware Hits Utility Billing Platforms 1:03:42

לפני 4 ימים1:03:42

1:03:42

In this critical episode, we dive into the alarming exploitation of CVE-2024-57727, a vulnerability in SimpleHelp Remote Monitoring and Management (RMM) software actively leveraged by ransomware operators since early 2025. This isn't just a theoretical risk—it's already being used to compromise utility billing providers and downstream MSP customers through double extortion tactics. We examine how the trusted capabilities of RMM tools—remote control, patching, and backup—are being weaponized in Living Off the Land (LOTL) attacks, allowing adversaries to maintain persistence, evade detection, and move laterally across networks with ease. With input from CISA, NSA, FBI, MS-ISAC, and INCD, we explore why RMM platforms like SimpleHelp have become high-value targets and what this means for IT, OT, and ICS environments. The discussion covers: 🛠️ What makes RMM software such a potent attack vector ⚠️ The details and real-world impact of CVE-2024-57727 🔐 CISA’s recommended mitigations—from network segmentation to MFA, application controls, and zero-trust policies 📉 Supply chain risk: How MSP compromise can cascade across client networks 🧰 Detection techniques and critical indicators of compromise for SimpleHelp instances 🛡️ Why developers, MSPs, and SaaS providers must adopt security-by-design, auditable logging, and privilege minimization This episode is a must-listen for IT admins, MSPs, SOC teams, software vendors, and cybersecurity professionals tasked with protecting remote infrastructure. If your organization uses or builds RMM software—don’t miss this briefing.…

Daily Security Review

1
TeamFiltration and Token Theft: The Cyber Campaign Microsoft Never Saw Coming 1:01:04

לפני 4 ימים1:01:04

1:01:04

In this episode, we dissect UNK_SneakyStrike—a major account takeover campaign targeting Microsoft Entra ID users with precision and scale. Tracked by Proofpoint, this campaign began in December 2024 and has since escalated, leveraging TeamFiltration, a legitimate penetration testing tool, to enumerate users and launch password spraying attacks that have compromised over 80,000 accounts across 100+ cloud tenants. We explore how attackers are weaponizing red team tools, abusing Microsoft Teams and OneDrive APIs, and even exploiting refresh tokens for persistent access—turning standard identity infrastructure into their playground. With origins traced to AWS infrastructure in the U.S., Ireland, and the UK, the campaign represents a dangerous convergence of identity-based threats, cloud misconfigurations, and cross-cloud attack surfaces. Join us as we walk through: 🔹 The operational characteristics and attack patterns of UNK_SneakyStrike 🔹 Why password spraying remains effective—and undetected—in the cloud 🔹 How Microsoft Entra’s gaps, like token handling and user enumeration exposure, played a role 🔹 Real-world risks: unauthorized access, lateral movement, and long-term persistence 🔹 The importance of multi-factor authentication, Zero Trust, real-time threat intelligence from AWS's MadPot and Mithra, and security hygiene 🔹 Concrete mitigation strategies to reduce exposure to identity-focused attacks This is a must-listen for IT admins, CISOs, cloud security professionals, and anyone responsible for protecting digital identities in Microsoft and hybrid cloud environments.…

Daily Security Review

1
Three CVEs, One Risk: Arbitrary Code Execution in Nessus Agent for Windows 44:04

לפני 4 ימים44:04

44:04

In this episode, we dive deep into one of the most critical attack techniques in modern cyber warfare: privilege escalation—and how it recently hit center stage with three high-severity vulnerabilities discovered in Tenable’s Nessus Agent for Windows. We break down CVE-2025-36631, CVE-2025-36632, and CVE-2025-36633, which, when exploited, allow a non-administrative user to gain SYSTEM-level access, execute arbitrary code, delete critical files, or overwrite system content. These vulnerabilities, patched in version 10.8.5 of Nessus Agent, represent a textbook example of how privilege escalation paves the way for arbitrary code execution (ACE) and potential ransomware deployment. In the second half of the episode, we unpack: 🛠️ What privilege escalation is, including vertical and horizontal types 📊 Real-world exploitation paths on Windows systems 🔐 Why tools like BloodHound, winPEAS, and PowerUp are favorites among threat actors 📉 The security impact of misconfigured services, overprivileged accounts, and weak registry settings ✅ And most importantly: what your organization can do to detect, prevent, and mitigate privilege escalation attacks before they spiral out of control With privilege escalation playing a central role in everything from data breaches to ransomware infections, this episode is a must-listen for IT admins, security professionals, and anyone responsible for hardening their organization’s defenses. 🔄 Don't forget to patch your Nessus Agents, enforce least privilege, and audit your environments regularly.…

Daily Security Review

1
WestJet Cyberattack: Cracks in Aviation’s Digital Armor 25:52

לפני 4 ימים25:52

25:52

A major cyberattack has rocked Canada's second-largest airline, WestJet—crippling internal systems and prompting warnings for customers to monitor their accounts and change passwords. But this is more than just a corporate incident. It’s the latest sign of a broader, escalating crisis in aviation cybersecurity. In this episode, we examine the WestJet breach in the context of a rapidly evolving threat landscape. With airlines facing more than 1,000 cyberattacks each month, we unpack the critical vulnerabilities putting passenger safety, operational continuity, and public trust at risk. From DDoS attacks grounding flights at LOT Polish Airlines to phishing campaigns linked to the MH370 tragedy, history shows the aviation sector is an attractive and dangerous target. We dive into the technical and organizational weak points—unpatched systems, insecure networks, and undertrained personnel—that attackers continue to exploit. And we explore the international standards and frameworks designed to fight back: ISO 27001, ISO 22301, ISO 27032, and the NIST Cybersecurity Framework. Most importantly, we discuss how airlines and airports can move from reactive measures to proactive security—layered defenses, real-time detection, and rapid incident response. Whether you're in cybersecurity, aviation, or simply a frequent flyer, this episode breaks down why the WestJet incident is a loud alarm the entire industry must heed. 🔐 Key Talking Points: What we know about the June 2025 WestJet cyberattack Aviation’s unique cybersecurity vulnerabilities Lessons from past incidents (LOT, Malaysia Airlines, etc.) How global frameworks like ISO and NIST can strengthen defenses Why personnel training is just as critical as technical tools…

Daily Security Review

1
Silent Surveillance: The Hidden Risks in 40,000+ Unsecured Cameras 49:37

לפני 5 ימים49:37

49:37

In this episode, we dig into a disturbing yet underreported national security threat: the exploitation of internet-connected surveillance cameras—especially those manufactured in the People’s Republic of China—as a cyber weapon against U.S. critical infrastructure. Drawing from recent DHS intelligence briefings and independent cybersecurity analyses, we uncover how these seemingly benign devices are being used by PRC state-sponsored actors for espionage, system disruption, and even real-time support for physical attacks. We break down how default settings, weak passwords, firmware neglect, and open internet access leave tens of thousands of cameras vulnerable. We explore the scale of exposure—over 14,000 vulnerable devices in the U.S. alone—and how this exposure extends across vital sectors including energy, utilities, transportation, and tech. We also discuss the alarming potential for compromised cameras to feed attackers sensitive system information, map out network layouts, and manipulate operational technologies. Finally, we go beyond the headlines to talk mitigation: What can organizations do right now? What responsibilities do vendors and policymakers have in tightening security standards? And how do we balance real cybersecurity needs with the practical realities of widespread camera deployment? Whether you're in IT, government, or just concerned about digital privacy, this episode will open your eyes to what your cameras might be seeing—and who else might be watching.…

Daily Security Review

1
Paragon’s Promise vs. Reality: How Graphite Is Being Used Against Journalists and Activists 1:10:32

לפני 5 ימים1:10:32

1:10:32

In this episode, we dive deep into the alarming revelations surrounding Graphite , a powerful spyware tool developed by Israeli firm Paragon Solutions. Promoted as a “responsible alternative” to the NSO Group’s Pegasus, Graphite is now implicated in the surveillance of journalists, humanitarian activists, and civil society figures—contrary to the vendor’s public claims. We’ll examine new forensic findings by Citizen Lab and how notifications from Apple and WhatsApp revealed targeting in Italy and potentially Canada. Confirmed cases include members of the refugee aid group Mediterranea Saving Humans and journalists critical of the Italian government. We also explore Paragon’s controversial ties with Italy’s intelligence agencies, the rejection of its offer to help investigate the abuse, and the murky termination of the spyware contract. Beyond the political implications, we address the technical side of zero-click attacks, the difficulty of detection, and the real fears expressed by ordinary users on platforms like Reddit. This conversation unpacks not just what happened—but what it means for privacy, transparency, national security, and the future of global surveillance regulation.…

Daily Security Review

1
zeroRISC Secures $10M to Commercialize OpenTitan and Reinvent Supply Chain Security 51:51

לפני 6 ימים51:51

51:51

zeroRISC just raised $10 million to bring OpenTitan—the first open-source silicon Root of Trust—to market. In this episode, we break down what this funding means for the future of supply chain security, and why investors are betting on open hardware to fix vulnerabilities baked into modern chips. We explore how geopolitical tension, forced labor enforcement (like the UFLPA), and cyber threats are forcing companies to look deeper into their supply chains—including third-party IP and sub-suppliers. We also look at the real-world implications of secure silicon for IoT, data centers, and critical infrastructure. From tamper-resistant firmware updates to attestation against AI deepfakes, we explain why zeroRISC’s Integrity Management Platform may shift control back to device owners—and how open-source innovation is becoming a national security imperative.…

ברוכים הבאים אל Player FM!

Player FM סורק את האינטרנט עבור פודקאסטים באיכות גבוהה בשבילכם כדי שתהנו מהם כרגע. זה יישום הפודקאסט הטוב ביותר והוא עובד על אנדרואיד, iPhone ואינטרנט. הירשמו לסנכרון מנויים במכשירים שונים.

תקשיבו ל-500+ נושאים

דומה לDaily Security Review

Mini Mic Pro Wireless Microphone for iPhone, iPad, Android, Lavalier Microphone for Video Recording - 2 Pack iPhone Mic Crystal Clear Recording with USB-C for Podcast, ASMR

TurboTax Deluxe 2024 Tax Software, Federal & State Tax Return [PC/MAC Download]

Amazon eGift Card - Amazon Logo (Animated)

פודקאסטים ששווה להאזין

Daily Security Review « » Systemd as a Weapon: How PumaBot Exploits Linux Persistence

Systemd as a Weapon: How PumaBot Exploits Linux Persistence

פודקאסטים ששווה להאזין

ברוכים הבאים אל Player FM!

2024 Topps Baseball Complete Set Factory Sealed Box Set - Baseball Complete Sets

Apple AirTag. Keep Track of and find Your Keys, Wallet, Luggage, Backpack, and More. Simple one-tap Set up with iPhone or iPad

2025 Topps Series 1 Baseball Trading Card MLB Jumbo Fat Pack

Clean Skin Club Clean Towels XL™, 100% USDA Biobased Face Towel, Disposable Face Towelette, Eczema Association Accepted, Makeup Remover Dry Wipes, Ultra Soft, 50 Ct, 1 Pack

דומה לDaily Security Review

מדריך עזר מהיר

Daily Security Review « »
Systemd as a Weapon: How PumaBot Exploits Linux Persistence