Risky Business #786 -- Oracle is lying
On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:
Yes, Oracle Health and Oracle Cloud did get hacked
The fallout from Signalgate continues
North Korean IT workers pivot to Europe
Honeypot data suggests a storm is brewing for Palo Alto VPNs
Canadian Anon gets arrested for hacking Texas GOP
This week’s episode is sponsored by Trail of Bits. Tjaden Hess, a Principal Security Engineer at Trail of Bits who specialises in cryptography, joins the show this week to talk about what a responsible crypto-currency exchange cold wallet setup looks like, and … contrasts that with Bybit.
This episode is also available on Youtube.
Show notes
Oracle Health breach compromises patient data at US hospitals
FBI probes Oracle hack tied to healthcare extortion: Report - Becker's Hospital Review | Healthcare News & Analysis
Oracle Still Denies Breach as Researchers Persist
Hacker linked to Oracle Cloud intrusion threatens to sell stolen data | Cybersecurity Dive
Publius on X: "🚨 SIGNAL SCANDAL: Katherine Maher, the leftist NPR CEO, is currently the Chair of the Board of Signal! WHAT ARE THE ODDS? https://t.co/jWNTeAt3Jz" / X
Mike Waltz Is Losing Support Inside the White House - WSJ
Waltz and staff used Gmail for government communications, officials say - The Washington Post
Pete Hegseth, Mike Waltz, Tulsi Gabbard: Private Data and Passwords of Senior U.S. Security Officials Found Online - DER SPIEGEL
Even More Venmo Accounts Tied to Trump Officials in Signal Group Chat Left Data Public | WIRED
You Need to Use Signal's Nickname Feature
SignalGate Is Driving the Most US Downloads of Signal Ever | WIRED
Wickr - Wikipedia
When Getting Phished Puts You in Mortal Danger – Krebs on Security
DPRK IT Workers Expanding in Scope and Scale | Google Cloud Blog
How the FBI Tracked, and Froze, Millions Sent to Criminals in Massive Caesars Casino Hack
Defense contractor to pay $4.6 million over third-party provider’s security weakness | The Record from Recorded Future News
Surge in Palo Alto Networks Scanner Activity Indicates Possible Upcoming Threats
CISA warns new malware targeting Ivanti zero-day vulnerability | Cybersecurity Dive
Canadian hacker arrested for allegedly stealing data from Texas Republican Party | The Record from Recorded Future News
British intel intern pleads guilty to smuggling top secret data out of protected facility | The Record from Recorded Future News
DeFi Security: With So Many Hacks, Will It Ever Be Safe? - Ep.170
Dan Guido, cofounder and CEO of Trail of Bits, and Taylor Monahan, founder and CEO of MyCrypto, discuss all the recent hacks in DeFi, how it can be made more safely and who is responsible.
We tackle:
the Hegic security incident: whose responsibility it was to make sure the contract was secure — the auditor (Trail of Bits) or the team (Hegic) — what Trail of Bits was saying in its audit summary, and how to read between the lines of an audit summary
how long an audit should be
upgradeability: particularly around when more advanced technology and contracts interface with older technology/contracts
centralization vs. decentralization: whether contracts can be made safely while maintaining adhering to the principle of decentralization, why Taylor would prioritize centralization and security, and how teams can create different levels of risk for users
bug bounties: why asking what amount they should be is the wrong question
the security threats posed by oracles
and what a checklist for DeFi teams might look like
Thank you to our sponsors!
Crypto.com: https://crypto.com
Kraken: https://www.kraken.com
Stellar: https://www.stellar.org
Episode links:
Dan Guido: https://twitter.com/dguido
Trail of Bits: https://www.trailofbits.com
Taylor Monahan: https://twitter.com/tayvano_
MyCrypto: https://mycrypto.com
Initial tweet by Hegic calling the security issue a typo: https://twitter.com/HegicOptions/status/1253937104666742787?s=20
Hegic tweet saying, “It’s not a security issue”: https://twitter.com/HegicOptions/status/1253954145113038849?s=20
Trail of Bits saying it will no longer work with Hegic: https://twitter.com/dguido/status/1254260725431894020?s=20
Taylor breaks down the audit summary: https://twitter.com/MyCrypto/status/1254058121342803968?s=20
Molly Wintermute’s Medium post on requesting a week audit vs. three-day review: https://medium.com/@molly.wintermute/post-mortem-hegic-unlock-function-bug-or-three-defi-development-mistakesthat-i-feel-sorry-about-5a23a7197bce
Unconfirmed episode with Haseeb Qureshi on the Lendf.me attack: https://unchainedpodcast.com/haseeb-qureshi-on-the-unbelievable-story-of-the-25-million-lendf-me-hack/
Unchained interview showing Matt Luongo's approach to kill switches and upgradeability with tBTC: https://unchainedpodcast.com/tbtc-what-happens-when-the-most-liquid-crypto-asset-hits-defi/
Discussion of the bZx attacks on Unchained: https://unchainedpodcast.com/the-bzx-attacks-unethical-or-illegal-2-experts-weigh-in/
Issue with Curve contract: https://blog.curve.fi/vulnerability-disclosure/
Compound bug bounty program: https://compound.finance/docs/security#bug-bounty
Taylor on “upgradeability makes things more insecure”: https://twitter.com/tayvano_/status/1222564979657723904?s=20
Synthetix oracle incident, allowing a bot to profit $1 billion: https://unchainedpodcast.com/how-synthetix-became-the-second-largest-defi-platform/
Taylor’s tips on how to get more ROI on an audit: https://twitter.com/MyCrypto/status/1254061500244713474?s=20
Tips to follow before getting an audit: https://blog.openzeppelin.com/follow-this-quality-checklist-before-an-audit-8cc6a0e44845/
Resources for security in DeFi:
crytic/building-secure-contractsGuidelines and training material to write secure smart contracts - crytic/building-secure-contractsgithub.com
https://consensys.github.io/smart-contract-best-practices/
https://forum.openzeppelin.com
https://swcregistry.io
https://diligence.consensys.net/blog/2020/03/new-offering-1-day-security-reviews/
Learn more about your ad choices. Visit megaphone.fm/adchoices
Meet Algo, your personal VPN in the cloud (Interview)
The commercial VPN industry is a minefield to navigate and many open source solutions are a pain to use or ill-suited for the task. Algo VPN, on the other hand, is a self-hosted personal VPN designed for ease of deployment and security. It uses the securest industry standards, builds on rock-solid solutions like WireGuard and Ansible, and runs on an ever-growing list of cloud hosting providers.
On this episode Dan Guido –CEO of security firm Trail of Bits and Algo’s creator– joins Jerod to discuss the project in depth.
Join the discussion
Changelog++ members support our work, get closer to the metal, and make the ads disappear. Join today!
Sponsors:
DigitalOcean – DigitalOcean’s developer cloud makes it simple to launch in the cloud and scale up as you grow. They have an intuitive control panel, predictable pricing, team accounts, worldwide availability with a 99.99% uptime SLA, and 24/7/365 world-class support to back that up. Get your $100 credit at do.co/changelog.
Algolia – Our search partner. Algolia’s full suite search APIs enable teams to develop unique search and discovery experiences across all platforms and devices. We’re using Algolia to power our site search here at Changelog.com. Get started for free and learn more at algolia.com.
Brain Science – For the curious! Brain Science is our new podcast exploring the inner-workings of the human brain to understand behavior change, habit formation, mental health, and being human. It’s Brain Science applied — not just how does the brain work, but how do we apply what we know about the brain to transform our lives.
Featuring:
Dan Guido – GitHub, X
Jerod Santo – Website, GitHub, LinkedIn, Mastodon, X
Show Notes:
About Trail of Bits
Meet Algo, the VPN that works
Algo on GitHub
Most VPN Services are Terrible
An Analysis of the Privacy and Security Risks of Android VPN Permission-enabled Apps (PDF)
101 VPN products run by just 23 companies
Every “free” VPN
No one is going to risk jail for your $5/mo
A story of the entire VPN industry, in 4 acts. Starring NordVPN.
WireCutter’s review of the best VPN service for 2019
WireGuard
Getting 2FA Right in 2019
Something missing or broken? PRs welcome!