Security stories, probed ports, and a second look at headlines
AT&T ThreatTraq is a security roundtable in which participants such as Matt and Stan take turns explaining a story, from an app-controlled coffee machine that was reverse-engineered to a compromised GitHub account. Episode titles keep listing a segment called Internet Weather, a ranked rundown of the most-probed ports and what might explain the spikes.
PRESS PLAY
AT&T ThreatTraq is a security roundtable that carries the AT&T name, and it closes with a disclaimer that the opinions belong to the participants. The format is simple. One participant sets up a story, often by addressing someone by name, and that person explains what happened and why it matters. Matt, Stan, Karen and Manny are among the voices. The stories are concrete. In one, someone from Avast reverse-engineered an app-controlled coffee machine, and the panel chose not to name the manufacturer, noting only that its devices had a history of security problems. In another, Stan looks into a report that Microsoft's private GitHub had been exposed and finds something smaller: one employee's account was compromised, the attacker released roughly a gigabyte of about 500 gigabytes downloaded, and researchers found little that looked like Microsoft's proprietary information. A Ruby gems story, based on Reversing Labs research that Stan found through ThreatPost, follows lookalike libraries that carried a file named AAA.png. It was actually an executable. Once installed, it checked the clipboard and replaced any Bitcoin wallet address being copied. Technical terms get explained as they come up, so Ruby gems are introduced simply as libraries that save developers from rewriting code. Then there is Internet Weather, which recurs across episode titles. It is a ranked readout: the ten most-probed ports by volume, then the ports drawing the most individual sources. In one list, Telnet on port 23 is at the top, with MS SQL, SMB, remote desktop, SSH and Android Debug Bridge further down. When port 81 jumps six places, the explanation points to a 360.com write-up about an IoT botnet that targets the web server usually found there. One closing remark adds a caution: botnets sometimes pivot to vulnerabilities that are a year to three years old, which makes such shifts hard to predict. The MAC randomization discussion is just as practical. If a device's address keeps changing, a VPN product that used to recognize a returning user asks for authentication again, and anyone tracking a stolen device by that address loses the trail. In the year-in-review episode, the participants grade their own predictions from the previous year, with Matt acting as the judge. The discussion of one forecast, about software bills of materials, includes the line 'Software is no longer written. It's assembled.', and its author admits the prediction was wishful thinking. They also mention a skeptical post by Rob Graham, described as an independent writer, that went up on the alienvault.com blog two weeks later. Other episode titles name web shells, malware analysis tools, security algorithms, a Chrome warning, Android apps, GitHub credentials, Sphinx and Anubis. The archive is large, and full video of the program is on YouTube.
Made for: Suits a listener who follows security news and wants each story explained in plain terms, with real specifics like port numbers, file names and how an attack worked. It also suits someone who wants a running read on which services attackers are scanning for.
What sets it apart: The Internet Weather rundown of the most-probed ports gives the show a data thread that runs alongside the news stories. The roundtable also checks alarming headlines against what researchers actually found, as with the compromised GitHub account.
AT&T ThreatTraq is a roundtable discussion of current cyber security trends, observations, and recommendations from AT&T Security's Malware team.
Short reviews from the PlayNext desk, based on the episodes we processed.
An unsecured coffee machine opens into a grounded look at MAC randomization and forensic traceability.
An unsecured IoT coffee machine gives AT&T ThreatTrack a neat way into security basics that connected hardware can still miss. Avast's teardown of an older app-controlled brewer, priced around $200-$250, finds no encryption, authentication, or code signing, leaving space to…
An unsupported IoT coffeemaker and changing MAC addresses frame the tradeoffs among convenience, privacy, and forensic tracking.
An unsupported app-controlled coffeemaker opens this single-episode review into a grounded pass at IoT security. Avast's reverse engineering of an older device with no encryption, authentication, or code signing gives the segment a clear object lesson: a $200-$250 convenience…
Technology's mechanisms, power's consequences.
Dave, Joe, and Maria break down phishing kits, deepfakes, and social-engineering scams weekly.
A roundtable discussion about a security researcher reverse engineering an IoT coffee machine to expose its lack of encryption, authentication, and code signing.
A roundtable discussion about a Microsoft employee's compromised GitHub account exposing 500GB of source code.
A roundtable discussion reviewing past cybersecurity predictions, specifically the traction of software bill of materials in 2019.
A roundtable discussion about recent Apple iOS security issues, including a potential email exploit discovered by ZecOps and Apple's patch.
A roundtable discussion on a recent cybersecurity threat where malicious Ruby gems steal Bitcoin addresses from clipboards.
A roundtable discussion about a service that helps malware writers find security flaws and backdoors in their software.
A roundtable discussion analyzing the week's most probed network ports and emerging cybersecurity threats.
A roundtable discussion about a security researcher reverse-engineering an IoT coffee machine to expose its lack of encryption, authentication, and code signing.