Logo

    128: Gollumfun (Part 1)

    en-usNovember 15, 2022
    What childhood experiences influenced Brett Johnson's criminal behavior?
    How did Brett Johnson start earning money illegally?
    Who were Brett's criminal associates mentioned in the story?
    What methods did Brett use to launder his money?
    What factors contributed to Brett's eventual downfall?

    Podcast Summary

    • The Origins of Brett Johnson's Criminal BehaviorBrett Johnson's childhood experiences and lack of family support led him down a path of crime where he used illegal activities to gain cash, in an attempt to buy love and overcome his fear of losing loved ones.

      Brett Johnson's criminal behavior stems from his childhood which was marred by abuse, neglect and a mother who always tested people's love. His father was an army brat who turned to mining coal and tried his hand at various illegal activities. Brett has inherited the worst of both his parents with a criminal mindset from his mother and a fear of losing loved ones from his father. He uses illegal activities to gain cash, which he uses to buy love. His childhood experiences and lack of family support led him down a path of crime, resulting in being dubbed as the original internet Godfather.

    • Stealing and Shoplifting as a Means of SurvivalWhen faced with tough times, people will resort to desperate measures to survive. Family can stick together and support each other, even if it means breaking the law.

      Brett and his sister Denise, during their tough times, had to resort to stealing food and other necessities to survive. They had to be careful not to make any noise, waste water and food as it would set off their abusive grandfather. When their mother came back and found they had stolen things, instead of becoming angry, she joined them and started shoplifting with them. They had to go on road trips to different malls to steal clothes and jewelry. This shows how adversity can push people to do the unthinkable and how family can stick together during tough times.

    • Brett Johnson's Journey towards RedemptionWith the right guidance and support, even individuals with a troubled past can turn their lives around and reach their full potential.

      Brett Johnson's criminal behavior started at a young age when he shoplifted and stole. He was influenced by his mother who was involved in criminal acts like drug trafficking and charity fraud. After his sister's shoplifting incident, she stopped, but Brett continued. At fifteen, he committed his first violent crime, assaulting a woman on an elevator. Later, he found a teacher who saw his potential in academics and drama and excelled in high school. He graduated and got a full ride scholarship to San Jose State University. This shows that people can change and turn their lives around with the right guidance and support.

    • The Power of Education in Breaking Free from Control.Education can be a way out of tough situations, but it's important to stay grounded and make the most of the opportunity. Don't let the past control your future.

      Breaking free from the grasp of a controlling parent or situation can be tough. But education provides a way out. Jack's sister managed to get a full scholarship at a college that saw through her mother's manipulative behavior. She turned out to be a Teacher of the Year. In Brett's case, he faked a car accident to get out of Hazard and attend college, but ended up quitting his job and getting into fraud. Education can provide a way out of a challenging situation, but it's important to stay grounded and make the most of the opportunity.

    • From Phone Lists to Beanie Baby Scams: Brett’s Criminal EvolutionDelaying victims can discourage them from complaining, making it easier for criminals to continue their illegal activities. It’s important to report any suspicious behavior to law enforcement.

      Brett's criminal activity started with stealing phone lists of Kiwanis Club and creating his own club, for which he got arrested and spent three months in jail, leading to financial struggles for his family. He stumbled upon eBay and then started selling fake beanie babies online. Brett's first scam involved selling a blue elephant that he couldn't dye blue and instead posted a real picture of it online to trick the buyer into sending him $1,500. He delayed the victim enough to avoid confrontation and never got caught. Brett learned the lesson that delaying victims can make them give up and not complain to law enforcement, reinforcing the idea of continuing criminal activity.

    • Brett Johnson's Advancing Criminal Activities and the Consequences He FacedGetting involved in criminal activities can lead to legal troubles and damage relationships. It's important to avoid illegal activities and make ethical choices to prevent unnecessary consequences.

      Brett Johnson's criminal activities started with stealing computers and progressed to selling pirated software, which he learned to do by watching Inside Edition. He then sold autographed baseballs with forged signatures and printed fake certificates of authenticity. When caught, he was given the option to send the buyers their money back or go to jail. His criminal activities were so numerous that he couldn't keep track of all of them, and he even forgot some. Johnson's activities not only led to legal trouble but also strained his relationship with his wife, who eventually found out about his criminal life and was angry with him for deceiving her.

    • Criminals can become even better through law enforcement's actions.Law enforcement might unintentionally teach criminals how to be better by making them more careful and creative with their tactics.

      The consequence of just law enforcement visiting trains you to become more careful next time and this can make you an even better criminal. Brett learned how to install mod chips in PlayStations and started earning cash while doing it. He started doing the same for cable boxes, satellite DSS signals, and made a lot of money using PayPal. To launder the money, he bought a fake driver's license from a guy named Fake ID Man, who ripped him off. Brett was angry and found a website called Counterfeit Library. He got on the forum there and made friends with Mr. X and Beelzebub who were involved in various crimes and scams and offered to make him an ID.

    • The Importance of Reputation Systems and the Consequences of Fraudulent ActivitiesBuilding trust through reputation systems is crucial in online marketplaces. Committing fraudulent activities can lead to severe consequences and damage personal relationships. Always prioritize honesty and integrity in all aspects of life.

      A reputation system was added to the Counterfeit Library forum, which helped buyers to trust the sellers. The vouching feature made buyers accountable for the seller's reliability. Mubin, a skilled man from Pakistan, offered to take IT certification tests and handed them over to the buyers with their desired names for a fee. Brett started committing various crimes using a fake ID named Steven Schwecki. Susan, Brett's wife, discovered his criminal activities when the cops started investigating him, leading to their strained relationship. Brett manipulated Susan for six years, and they finally ended things when she cheated on him. He found out about her infidelity when she minimized her computer screen, which led to their separation.

    • From heartbreak to crime: A tale of one man's downward spiralSeeking help is important, but falling into unhealthy habits to impress someone can lead to trouble. Criminal activities have consequences and can attract undesired attention.

      Brett's relationship ended when he caught his girlfriend cheating. He sought help from a criminal psychologist, who helped him with his suicidal thoughts and loneliness. However, he started drinking and visiting strip clubs where he met Elizabeth. In an attempt to impress her, he turned to online crimes like making fake IDs and committing fraud. This behavior was fueled by Elizabeth's love for expensive things, which gave him the incentive to commit these crimes. Eventually, they caught the attention of Dmitry Golubov, a spammer who had been watching their activities with Counterfeit Library.

    • How CarderPlanet Revolutionized Credit Card FraudCarderPlanet pioneered the CVV1 hack that allowed fraudsters to withdraw cash from ATMs using stolen credit cards. They also relied on money mules and track data to make money, ushering in a new era of credit card fraud.

      CarderPlanet was the start of credit card fraud as we know it today. It all started when Dmitry convinced Brett about his stolen credit card information by making him order $9,000 worth of computers with it. This led to the CVV1 hack which enabled carders to buy credit cards from customers of certain banks and write them to blank cards, allowing them to withdraw cash from ATMs. The Ukrainians relied on money mules to put cash in their pockets, and they provided the track data. Money mules had to send 60% of their take back to the Ukrainians, and they'd send more cards. The whole operation revolved around buying stuff with stolen credit cards and cashing them out to make money.

    • Gollumfun's role in the rise of ShadowCrewGollumfun's expertise in carding, database exploration, and fraudulent income tax returns helped ShadowCrew grow by attracting new members and improving moderation.

      ShadowCrew, a website exclusively dealing with fake IDs, faced low demand and limited membership until Gollumfun created an area for carding and convinced Ukrainians to join. He also began examining database dumps on the site and using the California State Death Index to file fraudulent income tax returns for dead people, making a lot of money. Counterfeit Library, their earlier website, faced overrun and lack of moderation due to members of a large forum flooding the site with troll posts. Gollumfun moved to ShadowCrew to facilitate better moderation and added new forums, becoming a moderator and admin on the site.

    • The rise and fall of cybercrime before the era of Tor, dark web, and Bitcoin.Cybercriminals cannot escape attention from law enforcement despite critical mass and anonymity. Greed and carelessness can lead to downfall, and clear rules and regulations are necessary to prevent criminal activities.

      The story highlights the rise of cybercrime and how easy it was to commit a crime before the era of Tor, dark web, and Bitcoin. Criminal behavior attracted more criminals, leading to more significant crimes. The lack of clear rules and regulations made it easy for the individuals to conduct criminal activities. The story emphasizes that even with critical mass and high-anonymity, cybercriminals cannot escape attention from the Secret Service or other law enforcement agencies. The founder was scared of getting attention from law enforcement and had three key rules in place but was unable to follow them. The story also reflects how one's greed can lead to downfall as the individuals in the story were caught due to sheer carelessness.

    • The Risks and Consequences of Operating Illegal WebsitesDespite the temptation, illegal activities such as operating scam websites may result in serious legal consequences, strains on personal relationships and do not typically lead to long-term success or fulfillment.

      Operating illegal websites and scams can lead to serious legal consequences, including arrests, warrants, and forfeiting the ability to be bailed out. Even with successful scams, the risks outweigh the rewards, and associates, customers, or partners could be the very ones to inform law enforcement. Personal relationships can also suffer, whether it be romantic or work-related. Despite being ahead of his time with ShadowCrew as a darknet marketplace, and making $160,000 in tax refund fraud, Brett Johnson realized the danger he and others were in, and retired from the site while still conducting tax scams. Illegal activities can be tempting, but in the end, they do not usually result in long-term success or fulfillment.

    Recent Episodes from Darknet Diaries

    149: Mini-Stories: Vol 3

    149: Mini-Stories: Vol 3

    In this episode we hear EvilMog (https://x.com/Evil_Mog) tell us a story about when he had to troubleshoot networks in Afghanistan. We also get Joe (http://x.com/gonzosec) to tell us a penetration test story.

    Sponsors
    Support for this show comes from Varonis. Do you wonder what your company’s ransomware blast radius is? Varonis does a free cyber resilience assessment that tells you how many important files a compromised user could steal, whether anything would beep if they did, and a whole lot more. They actually do all the work – show you where your data is too open, if anyone is using it, and what you can lock down before attackers get inside. They also can detect behavior that looks like ransomware and stop it automatically. To learn more visit www.varonis.com/darknet.

    Support for this show comes from Axonius. The Axonius solution correlates asset data from your existing IT and security solutions to provide an always up-to-date inventory of all devices, users, cloud instances, and SaaS apps, so you can easily identify coverage gaps and automate response actions. Axonius gives IT and security teams the confidence to control complexity by mitigating threats, navigating risk, decreasing incidents, and informing business-level strategy — all while eliminating manual, repetitive tasks. Visit axonius.com/darknet to learn more and try it free.

    Support for this show comes from ThreatLocker®. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com.

    Darknet Diaries
    en-usSeptember 03, 2024

    148: Dubsnatch

    148: Dubsnatch

    Ever wondered how far a fan would go to get a sneak peek of their favorite artist’s unreleased tracks? In this episode, we uncover the audacious story of some teens bent on getting their hands on the newest dubstep music before anyone else.

    Sponsors
    Support for this show comes from Varonis. Do you wonder what your company’s ransomware blast radius is? Varonis does a free cyber resilience assessment that tells you how many important files a compromised user could steal, whether anything would beep if they did, and a whole lot more. They actually do all the work – show you where your data is too open, if anyone is using it, and what you can lock down before attackers get inside. They also can detect behavior that looks like ransomware and stop it automatically. To learn more visit www.varonis.com/darknet.

    Support for this show comes from Axonius. The Axonius solution correlates asset data from your existing IT and security solutions to provide an always up-to-date inventory of all devices, users, cloud instances, and SaaS apps, so you can easily identify coverage gaps and automate response actions. Axonius gives IT and security teams the confidence to control complexity by mitigating threats, navigating risk, decreasing incidents, and informing business-level strategy — all while eliminating manual, repetitive tasks. Visit axonius.com/darknet to learn more and try it free.

    Support for this show comes from ThreatLocker®. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com.


    Darknet Diaries
    en-usAugust 06, 2024

    147: Tornado

    147: Tornado

    In this episode, Geoff White (https://x.com/geoffwhite247) tells us what happened to Axie Infinity and Tornado cash. It’s a digital heist of epic proportions that changes everything.

    This story comes from part of Geoff’s book “Rinsed” which goes into the world of money laundering. Get yours here https://amzn.to/3VJs7pb.

    Darknet Diaries
    en-usJuly 02, 2024

    146: ANOM

    146: ANOM

    In this episode, Joseph Cox (https://x.com/josephfcox) tells us the story of anom. A secure phone made by criminals, for criminals.

    This story comes from part of Joseph’s book “Dark Wire” which you should definitely read. Get yours here https://www.hachettebookgroup.com/titles/joseph-cox/dark-wire/9781541702691.

    Darknet Diaries
    en-usJune 04, 2024

    145: Shannen

    145: Shannen
    Shannen Rossmiller wanted to fight terrorism. So she went online and did. Read more about her from her book “The Unexpected Patriot: How an Ordinary American Mother Is Bringing Terrorists to Justice”. An affiliate link to the book on Amazon is here: https://amzn.to/3yaf5sI. Thanks to Spycast for allowing usage of the audio interview with Shannen. Sponsors Support for this show comes from Varonis. Do you wonder what your company’s ransomware blast radius is? Varonis does a free cyber resilience assessment that tells you how many important files a compromised user could steal, whether anything would beep if they did, and a whole lot more. They actually do all the work – show you where your data is too open, if anyone is using it, and what you can lock down before attackers get inside. They also can detect behavior that looks like ransomware and stop it automatically. To learn more visit www.varonis.com/darknet. Support for this show comes from Axonius. The Axonius solution correlates asset data from your existing IT and security solutions to provide an always up-to-date inventory of all devices, users, cloud instances, and SaaS apps, so you can easily identify coverage gaps and automate response actions. Axonius gives IT and security teams the confidence to control complexity by mitigating threats, navigating risk, decreasing incidents, and informing business-level strategy — all while eliminating manual, repetitive tasks. Visit axonius.com/darknet to learn more and try it free. Support for this show comes from ThreatLocker®. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com. Learn more about your ad choices. Visit podcastchoices.com/adchoices

    144: Rachel

    144: Rachel
    Rachel Tobac is a social engineer. In this episode we hear how she got started doing this and a few stories of how she hacked people and places using her voice and charm. Learn more about Rachel by following her on Twitter https://twitter.com/RachelTobac or by visiting https://www.socialproofsecurity.com/ Daniel Miessler also chimes in to talk about AI. Find out more about him at https://danielmiessler.com/. Sponsors Support for this show comes from Varonis. Do you wonder what your company’s ransomware blast radius is? Varonis does a free cyber resilience assessment that tells you how many important files a compromised user could steal, whether anything would beep if they did, and a whole lot more. They actually do all the work – show you where your data is too open, if anyone is using it, and what you can lock down before attackers get inside. They also can detect behavior that looks like ransomware and stop it automatically. To learn more visit www.varonis.com/darknet. Support for this show comes from Axonius. The Axonius solution correlates asset data from your existing IT and security solutions to provide an always up-to-date inventory of all devices, users, cloud instances, and SaaS apps, so you can easily identify coverage gaps and automate response actions. Axonius gives IT and security teams the confidence to control complexity by mitigating threats, navigating risk, decreasing incidents, and informing business-level strategy — all while eliminating manual, repetitive tasks. Visit axonius.com/darknet to learn more and try it free. Support for this show comes from ThreatLocker®. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com. Learn more about your ad choices. Visit podcastchoices.com/adchoices

    143: Jim Hates Scams

    143: Jim Hates Scams
    Jim Browning has dedicated himself to combatting scammers, taking a proactive stance by infiltrating their computer systems. Through his efforts, he not only disrupts these fraudulent operations but also shares his findings publicly on YouTube, shedding light on the intricacies of scam networks. His work uncovers a myriad of intriguing insights into the digital underworld, which he articulately discusses, offering viewers a behind-the-scenes look at his methods for fighting back against scammers. Jim’s YouTube channel: https://www.youtube.com/c/JimBrowning Sponsors Support for this episode comes from NetSuite. NetSuite gives you visibility and control of your financials, planning, budgeting, and of course - inventory - so you can manage risk, get reliable forecasts, and improve margins. NetSuite helps you identify rising costs, automate your manual business processes, and see where to save money. KNOW your numbers. KNOW your business. And get to KNOW how NetSuite can be the source of truth for your entire company. Visit www.netsuite.com/darknet to learn more. This episode is sponsored by Intruder. Growing attack surfaces, dynamic cloud environments, and the constant stream of new vulnerabilities stressing you out? Intruder is here to help you cut through the chaos of vulnerability management with ease. Join the thousands of companies who are using Intruder to find and fix what matters most. Sign up to Intruder today and get 20% off your first 3 months. Visit intruder.io/darknet. This show is sponsored by Shopify. Shopify is the best place to go to start or grow your online retail business. And running a growing business means getting the insights you need wherever you are. With Shopify’s single dashboard, you can manage orders, shipping, and payments from anywhere. Sign up for a one-dollar-per-month trial period at https://shopify.com/darknet. Learn more about your ad choices. Visit podcastchoices.com/adchoices

    142: Axact

    142: Axact
    Axact sells fake diplomas and degrees. What could go wrong with this business plan? Sponsors Support for this episode comes from NetSuite. NetSuite gives you visibility and control of your financials, planning, budgeting, and of course - inventory - so you can manage risk, get reliable forecasts, and improve margins. NetSuite helps you identify rising costs, automate your manual business processes, and see where to save money. KNOW your numbers. KNOW your business. And get to KNOW how NetSuite can be the source of truth for your entire company. Visit www.netsuite.com/darknet to learn more. Support for this show comes from ThreatLocker®. ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com. This show is sponsored by Shopify. Shopify is the best place to go to start or grow your online retail business. And running a growing business means getting the insights you need wherever you are. With Shopify’s single dashboard, you can manage orders, shipping, and payments from anywhere. Sign up for a one-dollar-per-month trial period at https://shopify.com/darknet. Learn more about your ad choices. Visit podcastchoices.com/adchoices

    141: The Pig Butcher

    141: The Pig Butcher
    The #1 crime which results in the biggest financial loss is BEC fraud. The #2 crime is pig butchering. Ronnie Tokazowski https://twitter.com/iHeartMalware walks us through this wild world. Sponsors Support for this episode comes from NetSuite. NetSuite gives you visibility and control of your financials, planning, budgeting, and of course - inventory - so you can manage risk, get reliable forecasts, and improve margins. NetSuite helps you identify rising costs, automate your manual business processes, and see where to save money. KNOW your numbers. KNOW your business. And get to KNOW how NetSuite can be the source of truth for your entire company. Visit www.netsuite.com/darknet to learn more. Support for this show comes from Drata. Drata streamlines your SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR & many other compliance frameworks, and provides 24-hour continuous control monitoring so you focus on scaling securely. Listeners of Darknet Diaries can get 10% off Drata and waived implementation fees at drata.com/darknetdiaries. This show is sponsored by Shopify. Shopify is the best place to go to start or grow your online retail business. And running a growing business means getting the insights you need wherever you are. With Shopify’s single dashboard, you can manage orders, shipping, and payments from anywhere. Sign up for a one-dollar-per-month trial period at https://shopify.com/darknet. Learn more about your ad choices. Visit podcastchoices.com/adchoices

    Related Episodes

    2020-013- part 2, education security, ransomware, april mardock, Nathan McNulty, and Jared folkins

    2020-013- part 2, education security, ransomware, april mardock, Nathan McNulty, and Jared folkins

    April Mardock - CISO - Seattle Public Schools

    Jared Folkins - IT Engineer - Bend La Pine Schools

    Nathan McNulty - Information Security Architect - Beaverton School District

     

    OpSecEdu - https://www.opsecedu.com/

    Slack

     

    https://www.a4l.org/default.aspx 

     

    https://clever.com/ 

     

    BEC - https://www.trendmicro.com/vinfo/us/security/definition/business-email-compromise-(bec) 

     

    https://www.k12cybersecurityconference.org/ 

     

    https://acpenw.sched.com/ 



    Bypassing security controls - https://www.goguardian.com/blog/technology/how-students-bypass-school-web-filters-and-how-to-stop-them/ 

     

    https://community.spiceworks.com/topic/2077711-chromebook-google-docs-bypassing-filters 

    https://www.mobicip.com/blog/here%E2%80%99s-how-kids-bypass-apple%E2%80%99s-parental-control-tools 

     

    https://www.phantomts.com/2020/01/11/kids-can-bypass-communication-limit-feature-on-ios-13-3/ 

     

    https://www.ocregister.com/2009/02/17/students-accused-of-changing-grades-using-teachers-password/ 

     

    Security persons at education institutions of varying sizes.

     

    https://www.darkreading.com/threat-intelligence/ransomware-crisis-in-us-schools-more-than-1000-hit-so-far-in-2019/d/d-id/1336634

    https://www.forbes.com/sites/leemathews/2019/09/25/yet-another-u-s-school-district-has-been-ravaged-by-malware/ 

     

    https://www.zdnet.com/article/texas-school-district-falls-for-scam-email-hands-over-2-3-million/



    Why are schools soft targets?

    Is money/budget the reason schools get the raw deal here?

    Why is ransomware such an appealing attack?

     

    How complex is the school environment?
        Mobile, tablets, hostile users, hostile external forces

     

    Adding technology too quickly? Outpacing the infrastructure in schools?







    Just ideas for some questions. - Jared

     

    Do you find vendors are very responsive in the education space when receiving a vulnerability report?

    https://www.edweek.org/ew/articles/2019/09/10/parent-who-criticized-his-sons-math-program.html

    When students, who you are trying to educate, when they are found doing something inappropriate, how do Districts handle it?

    https://ktvz.com/news/2017/11/08/mtn-view-hs-bomb-threat-traced-to-eugene-14-year-old/

    What challenges do Security people in education face when partnering with their user base?

    Unlike a corporate setting, many educators and students need to install different software throughout the year, how is that handled?

    How did April, Nathan, and Jared meet?



    Is the technology stack in your various school systems changed much in the last 10 years? Have you moved to cloud based, or do you still have an IT shack at the school systems with physical machines? 

     

    Localadmins are not granted… (excellent!)

     

    Check out our Store on Teepub! https://brakesec.com/store

    Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com

    #Brakesec Store!:https://www.teepublic.com/user/bdspodcast

    #Spotifyhttps://brakesec.com/spotifyBDS

    #Pandorahttps://pandora.app.link/p9AvwdTpT3

    #RSShttps://brakesec.com/BrakesecRSS

    #Youtube Channel:  http://www.youtube.com/c/BDSPodcast

    #iTunes Store Link: https://brakesec.com/BDSiTunes

    #Google Play Store: https://brakesec.com/BDS-GooglePlay

    Our main site:  https://brakesec.com/bdswebsite

    #iHeartRadio App:  https://brakesec.com/iHeartBrakesec

    #SoundCloudhttps://brakesec.com/SoundcloudBrakesec

    Comments, Questions, Feedback: bds.podcast@gmail.com

    Support Brakeing Down Security Podcast by using our #Paypalhttps://brakesec.com/PaypalBDS OR our #Patreon

    https://brakesec.com/BDSPatreon

    #Twitter@brakesec @boettcherpwned @bryanbrake @infosystir

    #Player.FM : https://brakesec.com/BDS-PlayerFM

    #Stitcher Network: https://brakesec.com/BrakeSecStitcher

    #TuneIn Radio App: https://brakesec.com/TuneInBrakesec

    Stanley McChrystal on the Military, Leadership, and Risk

    Stanley McChrystal on the Military, Leadership, and Risk

    Stan McChrystal has spent a long career considering questions of risk, leadership, and the role of America’s military, having risen through the Army’s ranks ultimately to take command of all US and NATO forces in Afghanistan, a force representing 150,000 troops from 45 countries. Retiring as a four-star general in 2010, he has gone on to lecture at Yale and launched the McChrystal Group, where he taps that experience to help organizations build stronger teams and devise winning strategies. His latest book, which he tells Tyler will be his last, is called Risk: A User’s Guide.

    He joined Tyler to discuss whether we’ve gotten better or worse at analyzing risk, the dangerous urge among policymakers to oversimplify the past, why being a good military commander is about more than winning battlefield victories, why we’re underestimating the risk that China will invade Taiwan, how to maintain a long view of history, what set Henry Kissinger apart, the usefulness of war games, how well we understand China and Russia, why there haven’t been any major attacks on US soil since 9/11, the danger of a “soldier class” in America, his take on wokeness and the military, what’s needed to have women as truly senior commanders in the armed forces, why officers with bad experiences should still be considered for promotion, how to address extremists in the military, why he supports a draft, the most interesting class he took at West Point, how to care for disabled veterans, his advice to enlisted soldiers on writing a will, the most emotionally difficult part and greatest joys of his military career, the prospect of drone assassinations, what he eats for his only meal of the day, why he’s done writing books, and more.

    Read a full transcript enhanced with helpful links, or watch the full video.

    Recorded October 6th, 2021

    Other ways to connect

    Thumbnail photo credit: Leading Authorities, Inc.

    2020-014-Server Side Request Forgery defense, Tanya Janca, AppSec discussion

    2020-014-Server Side Request Forgery defense, Tanya Janca, AppSec discussion

    Tanya's AppSec Course

    https://www.shehackspurple.dev/server-side-request-forgery-ssrf-defenses

    https://www.shehackspurple.dev

    Server-side request forgery - https://portswigger.net/web-security/ssrf

    What are differences between Stored XSS and SSRF? 

    This requires a MITM type of issue?

    Doesn’t stored XSS get stored on the server?

    What conditions must exist for SSRF to be possible?

    What mitigations need to be in place for mitigation of SSRF? CORS? CSP?

    Would a WAF or mod_security be effective?

    Can it be completely mitigated or are there still ways around it?

    Part2 -next week

     

    Github actions - https://github.com/features/actions

    How are these written? 

    It looks like a marketplace format? How do they maintain code quality?

    What does it take setup the actions?

    It looks like IFTTT for DevOps?

    What kind of integrations does it allow for? Will it handle logins or API calls for you?

    Is it moderated in some way? What’s the acceptance criteria for these?

    What are you trying to accomplish by using Github Actions?
    What are the benefits of using these over XX product?

    What is gained by using this?

     



    Mention twitch Channel and when (join the mailing list)

    Github actions “Twitch.tv/shehackspurple”

     

    Coaching, Project Management, Scrum Management

     

    Alice and Bob learn Application Security - Wylie - Fall/Winter 2020



    Links:

    https://shehackspurple.dev

    https://mailchi.mp/e2ab45528831/shehackspurple

    https://twitter.com/shehackspurple

    https://dev.to/shehackspurple

    https://medium.com/@shehackspurple 

    https://www.youtube.com/shehackspurple  

    https://www.twitch.tv/shehackspurple

    https://www.linkedin.com/in/tanya-janca

    https://github.com/shehackspurple/

    Tanya Janca

     

    https://SheHacksPurple.dev

     

    Check out our Store on Teepub! https://brakesec.com/store

    Join us on our #Slack Channel! Send a request to @brakesec on Twitter or email bds.podcast@gmail.com

    #Brakesec Store!:https://www.teepublic.com/user/bdspodcast

    #Spotifyhttps://brakesec.com/spotifyBDS

    #Pandorahttps://pandora.app.link/p9AvwdTpT3

    #RSShttps://brakesec.com/BrakesecRSS

    #Youtube Channel:  http://www.youtube.com/c/BDSPodcast

    #iTunes Store Link: https://brakesec.com/BDSiTunes

    #Google Play Store: https://brakesec.com/BDS-GooglePlay

    Our main site:  https://brakesec.com/bdswebsite

    #iHeartRadio App:  https://brakesec.com/iHeartBrakesec

    #SoundCloudhttps://brakesec.com/SoundcloudBrakesec

    Comments, Questions, Feedback: bds.podcast@gmail.com

    Support Brakeing Down Security Podcast by using our #Paypalhttps://brakesec.com/PaypalBDS OR our #Patreon

    https://brakesec.com/BDSPatreon

    #Twitter@brakesec @boettcherpwned @bryanbrake @infosystir

    #Player.FM : https://brakesec.com/BDS-PlayerFM

    #Stitcher Network: https://brakesec.com/BrakeSecStitcher

    #TuneIn Radio App: https://brakesec.com/TuneInBrakesec

    Ep 22: Fostering effective group collaboration in schools; increasing the number of women in cybersecurity

    Ep 22: Fostering effective group collaboration in schools; increasing the number of women in cybersecurity
    Don't just listen, join the conversation! Tweet us at @AcademicaMedia or with the hashtag #BigIdeasinEducation with questions or new topics you want to see discussed.

    This week, Mike and Ryan divulge into the topic of group work and collaboration of students in an educational setting. Ryan briefly summarizes an Edutopia article written by author Michael Ralph. He discusses with Mike about the reliance of group work in a classroom environment. Mike introduces a topic relevant to the technological industry of cybersecurity. He discusses the under-representation of women in the field of cybersecurity and the demand of commitment it takes to achieve success in this industry. Tune in!

    Hosts: Ryan Kairalla (@ryankair); Michael Hernandez (@edtechmichael)
    Producer: Ross Ulysse