"That’s Not Supposed to Happen" - PSW #951
Summary
Hosted by Paul Asdorian, this episode of Security Weekly covers a resurgence in supermarket and blood bank refrigerator hacks, highlighting the persistent security risks of IoT devices. The panel also discusses a massive $6 billion Binance crypto theft resulting from compromised employee laptops, a critical Linux TCP kernel flaw that many distributions have not patched, and the rapid acceleration of AI-assisted vulnerability discovery. Additional topics include hackers displaying porn on public digital billboards and data exfiltration via USB power states.
Topics discussed
Episode intro and news headlines
Show introduction and sponsor read
Government Security Virtual Summit promotion
Supermarket refrigerator hacks and tech debt
AI hallucinations in security testing
Motives for shenanigans and Soylent discussion
Prison podcast recommendation
Digital billboard hacks and IoT vulnerabilities
Prevalence of vulnerable IoT devices
AI finding critical software bugs
Exploitability vs. bug discovery and verification
AI-generated technical debt and decommissioning
Linux TCP kernel flaw and multi-path issues
Using AI for vulnerability research questions
ThreatLocker sponsor read
Binance $6 billion theft and key handling
FBI IC3 report and crypto tracing
Binance engineer compromise and regulatory gaps
Crypto risks in consumer apps like PayPal
Spectre ER side-channel attack on air-gapped systems
AI agents attacking Thai emergency networks
Android TV botnet and Chinese ODM supply chain
Botnet scale and data collection by TV makers
Streaming service costs and bundling
Intentional backdoors and competitive intelligence
Google outing the Android TV campaign
Botnet geography and GDPR implications
Building a home phone system with AI and Asterisk
Hacker Syndicate event promotion
Railway vs. Primcode AI agent hacking incident
Ethical concerns of AI agents and OpenAI/Hugging Face
Plausible deniability with AI agents
Responsibility for autonomous vehicles and Cruise
Tesla self-driving experiences and safety concerns
UEFI firmware value and security issues
Custom firmware on Echo and car botnet jokes
Avanti RCE pattern and vendor risk management
Management interfaces on public internet
Electric Boat and submarine manufacturing
DLP challenges in government spaces
Data access controls and authoritative sources
Vulnerability disclosure processes and data protection
Toilet incident response plan joke
AI weaponization of exploits and ROI models
Listen ad-free on Castria