Podcast Episode 17: 3 Severe WordPress Plugin Vulnerabilities
Mikey Veenstra joins us to talk about three WordPress plugins with severe vulnerabilities affecting well over 150,000 WordPress installations. Two plugins have been patched, one has not. With Mark under deadline for a film project, Mikey also talks some security news with Kathy. We cover a Docker vulnerability, anatomy of a SIM port attack, zero-day Windows exploits released by a disgruntled security researcher, two large scale data leaks affecting millions of people, and revisit the Baltimore ransomware problem and how the NSA’s Eternal Blue tool was used in the attack.
Here are approximate timestamps in case you want to jump around:
1:00 Interview with Mikey Veenstra on 3 severe WordPress plugin vulnerabilities
13:00 The news, and where’s Mark?
13:30 Docker vulnerability not yet patched
16:24 Anatomy of a SIM port attack
20:17 Microsoft zero-day exploits on Github
25:34 XSS vulnerability discovered in Slimstat plugin
26:26 Over 49 million Instagram users data exposed
29:28 First American Financial leaked hundreds of millions title insurance records
34:20 How an NSA malware tool was used in the Baltimore ransomware attack
Find us on your favorite app or platform including iTunes, Google Podcasts, Spotify, YouTube, SoundCloud and Overcast.
Click here to download an MP3 version of this podcast. Subscribe to our RSS feed.
This week in the news we cover:
- Docker is vulnerable to symlink-race attack.
- A Coinbase user illustrates details of a SIM port hack that cost him over $100,000. This cautionary tale of SMS two-factor authentication is an important read.
- A disgruntled security researcher is posting Local privilege escalation (LPE) Windows exploits on GitHub.
- Researchers at GoDaddy security have posted details of an XSS vulnerability in the Slimstat plugin, affecting over 100,000 sites.
- A leak of over 49 million users’ data from Instagram has been found by a security researcher.
- First American Financial, a title insurance company, leaked hundreds of millions of records going back to 2003.
- The New York Times reported that the Baltimore ransomware attack in its third week was facilitated by Eternal Blue, a tool developed by the NSA stolen in the Shadow Brokers leak two years ago.
You can find Mark on Twitter as @mmaunder, Kathy as @kathyzant and Mikey at @heyitsmikeyv. Please don’t hesitate to post your feedback in the comments below.
Comments