Error Code

EP 15: Tracking Threats (and Risks) Against OT Devices

This is the story about researchers who monitor the threats against IoT and OT systems, and the steps being taken to mitigate them.  Ishmael Valenzuela, Vice President of the threat research and Intelligence Team at BlackBerry, shares the latest insights from his company’s Cybersecurity Global Threat Intelligence Report. We talk about threats from Latin America and elsewhere, how firewalls alone won’t necessarily protect OT devices, how attackers and defenders are using AI technology, and how hospitals are seeing perhaps the most increase in threats.

EP 14: Hacking the Power Grid

There’s a lot of FUD around hacking the power grid. Most often, there’s a more common cause: Soot. Even Squirrels. Jori VanAntwerp, CEO of SynSaber. talks about the realities of the US power grid vs the myths. While there’s room to improve, there’s also a great amount of resilience already in the electrical system today.

EP 13: Hacking EV Charging Stations

How the rapid proliferation of EV charging stations is already leading to attacks on the stations and the vehicles themselves, and what we should do about it.  Charles Eagan, CTO of BlackBerry, talks about the rush to create these charging stations and the traditional problems with IoT – vulnerable versions of the OS, of the open source, and even some of the protocols being used. He also talks about how we can improve the security of software defined vehicles and their ecosystems.

EP 12: Adding ICS and OT to the National Cybersecurity Strategy

The Biden-Harris 2023 National Cybersecurity Strategy breaks with Cold War thinking and offers a bold new approach to today’s online offense and defense. Danielle Jablanski from Nozomi Networks breaks down the ambitious new policy which includes explicit mention of ICS and OT technologies for the first time.

EP 11: Window Snyder Is Building A Secure IoT and OT Framework

We’ve already seen botnets composed of compromised devices like routers and security cameras. So how do we secure them and our smart lightbulbs too? Window Snyder, CEO of Thistle Technologies, explains how new devices can be partitioned with failovers and then serviced with regular updates all monitored from a central dashboard. Even devices already in the field today can also be upgraded and secured in some cases.  

EP 10: The L0pht, According to Space Rogue

This is the story of Cris Thomas aka Space Rogue, who’s written perhaps the best book about the early days of hacking, Space Rogue: How the Hackers Known as the Loft Changed The World. Unlike a journalist merely chronicling events in Boston in the 1990s from the outside, Cris was on the inside. This is not only the story of the L0pht but it's also the story of his life, so he seamlessly provides the often missing context of the time with countless asides and anecdotes woven in instead of tacked on. In this episode of Error Code, Cris also drops a lot of names.

EP 09: Zhadnost

This is the story of Zhadnost, of how an IoT-based botnet was conscripted into an online war in the days immediately before the kinetic Ukraine invasion. Ryan Slaney of SecurityScorecard walks us through the timeline of these attacks and the evidence of attribution he found linking it to Russia’s GRU.

EP 08: A Matter Of Trust

What if a vulnerability exists in popular ICS devices, yet the only fix is to re-issue the hardware? This is true with some embedded security flaws. Ang Cui, founder and CEO of Red Balloon Security, talks about his company’s discovery of CVE-2022-38773, which affects the secure boot process in Siemens S7 1500 PLCs, and what the mitigations for devices using that might look like.

EP 07: Secure Medical IoT Devices

IoT can make patient care easier.. But how do we introduce new IoT medical devices into an ecosystem where we can’t even keep tabs on our legacy devices? Mohammad Waqas discusses conversations he’s had with hospitals about the device profiles they don’t necessarily know about – the over-the-counter glucose monitor app on an iPad that hasn’t gone through IT provisioning - and what they can do about it.

EP 06: Vastaamo

The Vastaamo data breach stands as one of the most heinous of internet crimes because of the 30,000 psychiatric records that were exposed and the lives it ruined. Antti Kurittu discusses his presentation at SecTor 2022, what we know thus far from the public record, and the news of the Finnish arrest warrant for the individual only previously known as “Ransomware_Man”.