121: Ed · Darknet Diaries summary

Key takeaways

Social engineering attacks exploit human vulnerabilities, making them a primary concern in cybersecurity.
Penetration testing requires careful scope definition to avoid causing harm, especially in sensitive environments like hospitals and medical facilities.
Proactive security testing of connected medical devices and IoT products is essential to prevent real-world harm and protect safety.
Effective communication of security risks should include the potential impact on safety and business operations, not just technical details.
Collaboration between industry stakeholders, including regulators, manufacturers, and security researchers, is crucial for improving device security and consumer safety.

Summary

The Vulnerability of Human and Digital Security

This section discusses how simple actions like sending an email can lead to major security breaches, exemplified by the story of Barbara Kokorin, a Shark Tank judge who lost $400,000 due to a spoofed email. The key point here is that social engineering attacks, like fishing scams, target human vulnerabilities rather than technical flaws. The episode emphasizes that even educated individuals can fall victim to these scams, highlighting the importance of awareness and training in cybersecurity.

Insights from Ed Skoudis on Penetration Testing and Security Assessment

Ed Skoudis shares his extensive background in cybersecurity, starting from a childhood fascination with computers and hacking, to a career focused on penetration testing and security teaching. He explains the process of security assessments, particularly in high-stakes environments like hospitals, where scope must be carefully defined due to the sensitive nature of the systems involved. Skoudis recounts detailed stories of testing hospital networks, discovering vulnerabilities, and the importance of operating within scope to avoid unintended harm, all while demonstrating the real-world implications and ethical considerations of penetration testing.

Security in Medical Devices and IoT Devices

This part covers the work of Bo Woods from I am The Cavalry, who advocates for security in medical devices and IoT technology. He describes initiatives like the DEFCON Biohacking Village Device Lab, where companies and security researchers collaborate to test the security of medical equipment in a controlled environment. The discussion highlights the tension between innovation, usability, and security in connected devices used in healthcare, emphasizing the need for proactive testing and cooperation between manufacturers and hackers to safeguard patient safety.

Challenges and Responsibilities in Penetration Testing and Security Research

Throughout the episode, Skoudis discusses the importance of scope, ethics, and responsible disclosure in penetration testing. He recounts incidents like exploiting a medical device used during surgery and finding vulnerabilities in a toy that could potentially harm children. These stories illustrate the potential dangers of security flaws if misused and underline the ethical obligation to communicate risks clearly and responsibly. The episode stresses that cybersecurity professionals must balance technical findings with business and safety implications, always operating within legal and ethical boundaries.

Show notes

In this episode we hear some penetration test stories from Ed Skoudis (twitter.com/edskoudis). We also catch up with Beau Woods (twitter.com/beauwoods) from I am The Cavalry (iamthecavalry.org).

Sponsors

Support for this show comes from Axonius. Securing assets — whether managed, unmanaged, ephemeral, or in the cloud — is a tricky task. The Axonius Cybersecurity Asset Management Platform correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action. Axonius gives IT and security teams the confidence to control complexity by mitigating threats, navigating risk, decreasing incidents, and informing business-level strategy — all while eliminating manual, repetitive tasks. Visit axonius.com/darknet to learn more and try it free.

Support for this show comes from Zscalar. Zscalar zero trust exchange will scrutinize the traffic and permit or deny traffic based on a set of rules. This is so much more secure than letting data flow freely internally. And it really does mitigate ransomware outbreaks. The Zscaler Zero Trust Exchange gives YOU confidence in your security to feel empowered to focus on other parts of your business, like digital transformation, growth, and innovation. Check out the product at zscaler.com/darknet.

Support for this podcast comes from Cybereason. Cybereason reverses the attacker’s advantage and puts the power back in the defender’s hands. End cyber attacks. From endpoints to everywhere. Learn more at Cybereason.com/darknet.

View all active sponsors.

Attribution

Darknet Diaries is created by Jack Rhysider.

Editing by Damienne. Assembled by Tristan Ledger. Sound designed by Andrew Meriwether.

Episode artwork by odibagas.

Audio cleanup by Proximity Sound.

Theme music created by Breakmaster Cylinder.