Firewalls Don't Stop Dragons Podcast
Securing Your Home Network
· Summarized
Key takeaways
- Securing home networks is increasingly important as many devices remain connected to the internet 24/7.
- Recent police actions against ransomware gangs signal progress in combating cybercrime.
- Security flaws in TPM 2.0 highlight significant vulnerabilities that could impact countless devices.
- The Biden administration’s cybersecurity strategy aims to impose stricter regulations on critical infrastructures.
- The LastPass breaches demonstrate the complexity and sophistication of targeted cyberattacks.
- Browser synchronization features pose security risks for sensitive workplace data.
- The purchase of tracking data raises serious ethical questions about privacy violations.
- Law enforcement's access to home surveillance footage underscores the need for better privacy controls.
- Cell-site simulators represent a troubling trend in mass surveillance practices by federal agencies.
- Healthcare data leaks amplify the urgent need for strict privacy regulations in telehealth.
Summary
Introduction to Home Network Security
In episode 315 of 'Firewalls Don't Stop Dragons', host Carrie Parker discusses the importance of securing home networks, especially as more devices are connected to the internet. The episode reviews various cybersecurity tips to protect personal devices from being compromised by hackers.
Ransomware Gang Raids
The podcast begins with a report on successful police raids in Germany and Ukraine against members of a ransomware gang responsible for significant attacks, including on hospitals. Authorities are investigating potential further leads stemming from this action.
TPM 2.0 Security Flaw
Parker discusses newly discovered vulnerabilities in the Trusted Platform Module (TPM) 2.0 spec, which could affect billions of devices. The summary highlights the potential risks involved, including the exploitation of sensitive data due to local accounts being compromised.
Biden Administration’s Cybersecurity Strategy
The episode addresses the Biden administration's unveiling of a national cybersecurity strategy that includes new regulations on critical infrastructure and software manufacturers. Parker notes the challenges of bipartisan support for these regulatory changes and their implications.
Insight on LastPass Breaches
LastPass recently provided more details regarding its severe security breaches, indicating that hackers targeted a DevOps engineer's home computer. The stolen data included sensitive corporate vault information, casting doubt on LastPass's security protocols.
Risks of Browser Synchronization
Listeners are cautioned about using browser synchronization features that can inadvertently expose sensitive information, especially for employees working from home, as illustrated by a Kaspersky article.
Privacy Violations in Tracking Data
A shocking report reveals how a Catholic organization purchased tracking data of gay priests to potentially expose them. This raises serious ethical concerns about privacy violations through data collection methods employed by corporations.
The Implications of Surveillance Technology
Discussion highlights police practices of obtaining video footage from private citizens through doorbell cameras, leading to privacy concerns over law enforcement's access to home surveillance data.
Cell-Site Simulator Misuse
Parker covers an inspector general report that shows the misuse of cell-site simulators by ICE and the Secret Service. These devices conduct mass surveillance without appropriate authorization, violating privacy rights.
Telehealth Data Leaks
The podcast concludes with troubling reports of data breaches in telehealth platforms, highlighting Cerebral’s sharing of mental health data with advertisers, thereby emphasizing the need for stronger privacy protections in health data.
Dear Carrie & Network Security Tips
The 'Dear Carrie' segment responds to a listener's question about securing home video cameras, advising against exposure to the public internet and discussing device encryption. Parker also summarizes key tips from the NSA guide on home network security.
Sponsors
- Apple’s HomeKit Secure Video · If you use Apple’s HomeKit Secure Video, your data remains private and secure, as the encryption keys are held by you, and only you can access the recorded data.
- NSA · The NSA has released a comprehensive guide on home network security tips to help keep your devices secure.
Show notes
Our devices are connected to the Internet 24/7 and the only thing separating them from the bad guys is usually your home router. In the era of smart devices and the Internet of Things (IoT), we also now have many more doohickeys connected to the Internet - most of them with crappy security. If one of those devices is compromised, the bad guys now have a beachhead from which to probe and attack all your other devices. In today's show, we'll review some important cybersecurity tips for our home network and connected devices.
In other news: police raid homes of alleged ransomware gang; locally exploitable TPM 2.0 security flaws found; White House unveils comprehensive cybersecurity strategy; new LastPass breach details show specific employee was targeted at home; browser synchronization features may compromise employer systems; Catholic group buys data to target gay priests; private home webcams are a goldmine for police evidence gathering; telehealth companies leak sensitive patient data; ICE and Secret Service admit to using cell-site simulators to collect mass surveillance data.
Article Links
[The Verge] Police raid homes of alleged hackers who attacked hospital systems https://www.theverge.com/2023/3/6/23627238/hackers-ransomware-raid-german-ukrainian-police
[TechSpot] Two security flaws in the TPM 2.0 specs put cryptographic keys at risk https://www.techspot.com/news/97824-two-security-flaws-tpm-20-specs-put-cryptographic.html
[The Washington Post] Biden unveils cyber strategy that takes more aggressive regulatory approach https://www.washingtonpost.com/national-security/2023/03/02/cybersecurity-biden/
[Ars Technica] LastPass says employee’s home computer was hacked and corporate vault taken https://arstechnica.com/information-technology/2023/02/lastpass-hackers-infected-employees-home-computer-and-stole-corporate-vault/
[Kaspersky] Disable browser synchronization in the office https://www.kaspersky.com/blog/disable-browser-sync-enterprise/47460/
[The Washington Post] Catholic group spent millions on app data that tracked gay priests https://www.washingtonpost.com/dc-md-va/2023/03/09/catholics-gay-priests-grindr-data-bishops/
[Electronic Frontier Foundation] Report: ICE and the Secret Service Conducted Illegal Surveillance of Cell Phones https://www.eff.org/deeplinks/2023/03/report-ice-and-secret-service-conducted-illegal-surveillance-cell-phones
[POLITICO] The privacy loophole in your doorbell https://www.politico.com/news/2023/03/07/privacy-loophole-ring-doorbell-00084979
[TechCrunch] Telehealth startup Cerebral shared millions of patients’ data with advertisers https://techcrunch.com/2023/03/10/cerebral-shared-millions-patient-data-advertisers/
[NPR] Personal information of members of Congress exposed in health data breach https://www.npr.org/2023/03/09/1162191035/personal-information-of-u-s-house-members-exposed-in-health-data-breach
Securing Your Home Network: https://firewallsdontstopdragons.com/how-to-secure-your-home-network/
Further Info
Apple’s HomeKit Secure Video: https://support.apple.com/en-us/HT210538
Shodan: https://www.shodan.io/
What’s My IP? https://www.whatismyip.com/
NSA home network security (PDF): https://media.defense.gov/2023/Feb/22/2003165170/-1/-1/0/CSI_BEST_PRACTICES_FOR_SECURING_YOUR_HOME_NETWORK.PDF
What a VPN Is (and Isn't): https://firewallsdontstopdragons.com/what-a-vpn-is-and-isnt/
Get your Dragon Swag! https://fdsd.me/merch
Send me your questions! https://fdsd.me/qna
Support our mission! https://fdsd.me/support
Subscribe to the newsletter: https://fdsd.me/newsletter
Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book
Would you like me to speak to your group about security and/or privacy? https://fdsd.me/speakerrequest
Generate secure passphrases! https://d20key.com/#/
Table of Contents
Use these timestamps to jump to a particular section of the show.
0:00:16: News preview
0:02:16: Police raid homes of alleged health system hackers
0:04:16: Two security flaws in the TPM 2.0 spec
0:08:50: White House unveils aggressive cyber strategy
0:14:41: LastPass breach details sophisticated attack
0:25:09: Bbrowser synchronization can create risk to corporate systems
0:30:49: Catholic group bought app data that tracked gay priests
0:33:53: Ring doorbell data dragnet
0:43:09: ICE Conducted Illegal Surveillance of Cell Phones
0:46:36: Cerebral shared millions of patients’ data with advertisers
0:49:59: Personal information of members of Congress exposed in health data breach
0:52:19: Dear Carey: secure, privavy home web cameras
0:59:00: Tip of the Week: Securing Your Home Network
1:05:52: Wrap-up and looking ahead
Follow this show on AudioBrevity and new episodes get summarized for you. Create a free account