The Iranian amateurs are scoring some quick hits, while their professionals are planning. I would expect to see some major impacts from both types of adversaries.

https://twitter.com/kbrackson/status/1213334433807265793

Iranian amateurs are going to have a field day with low hanging fruit. I doubt many of them are thinking about prosecution or retaliation right now, so expect to see a lot of attacks from 5kr1p7 k1dd13z, criminals, and probably some of their legitimate professionals.

Airplanes rely on CANbus, a protocol designed in the 1980s with no adversarial threat modeling. Any device on that taps into that bus can send commands to any other device, which will happily execute them - without authentication or authorization other than presence on the bus. For instance, we know cars’ engine, steering, and brakes, which use CANbus, can be controlled by sending commands from the radio. This should never happen in normal circumstances, yet it’s possible under adversarial conditions because of the CANbus architecture.

Inspired by a @hacks4pancakes thread.

I end up spending ~$10K/yr out of pocket to speak at and help run conferences. Not for biz-dev, just for fun and to make a difference. Many, many others in the infosec community do too.

Some thoughts from 5+ years of my expensive hobby. Speakers: it’s alright to ask for some help with travel or outright cover it if you’re not telling your company. Worst case the con says no.

I usually ask events to cover travel (except small nonprofits), sometimes an honorarium from _blatantly_ commercial ones.

Yesterday it was revealed that 750,000 @Medtronic pacemakers are potentially vulnerable to unauthenticated radio frequency attack, causing battery drain or alter how it works.

Don’t panic, it sounds worse than it is! fda.gov/MedicalDevices… Mitigating factor 1: The attacker would have to be close to the victim. The RF spec says 20 feet, but we all know that can be extended with a directional antenna and a high power radio. That’s still way less bad than if it’s vulnerable across the Internet. Physical isolation.

This response perpetuates stereotypes about @defcon and about cybersecurity that are no longer true, if they ever were. It puts in writing the degree to which many of their executives and board are ignorant of good security practice in 2018.

https://twitter.com/ericgeller/status/1034093081770053634

Let’s start at the top. @thedarktangent is a member of @CFR_org, a fellow with @AtlanticCouncil, former CSO of @ICANN, and advises @DHSgov. These groups aren’t likely to be undermining US national security any time soon.

At the @NTIAgov multistakeholder process on software component transparency. Expecting sparks here today. ntia.doc.gov/SoftwareTransp… Auditing a single application with 100M Lines of Code: 300+ 3rd party components, from 150+ sources, 25% are individuals' names with little more detail.

This is a hard problem for tracking, it's a bigger issue for security and quality.