Paul's Security Weekly Subscribe

Vulnerability Management, Security Program Controls/Technologies, Security Staff Acquisition & Development

Uncovering a Major Linux PolicyKit Security Vulnerability: Pwnkit – Wheel – PSW #727

February 9, 2022

Qualys researcher, Wheel, will discuss the discovery of the 12 year old Linux vulnerability in PolicyKit - which Qualys had dubbed, PwnKit. Wheel will provide an overview of the vulnerability and then dive into a technical discussion of the research.

Segment Resources:

https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034

Full episode and show notes

Announcements

CRA's Business Intelligence Unit has launched its next survey on Zero Trust! What are Your Barriers to Zero Trust Implementation? Take our survey and enter to win a $500 Tango card by visiting https://securityweekly.com/zerotrust. Report results will be released at our upcoming Zero Trust E-Summit in March!

Guest

. Wheel

Researcher at Qualys

http://qualys.com/

“Wheel” is a member of the Qualys Research Team responsible for finding zero-days.

Host

Paul Asadoorian

Principal Security Evangelist at Eclypsium

https://securitypodcaster.com

Related

Vulnerability Management

Supply Chains, Firmware, And Patching – Jason Kikta – BTS #29

May 8, 2024

Jason joins us to discuss the current enterprise landscape for defending against supply chain attacks, remediating firmware issues, and the current challenges with patch management. This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them!

Vulnerability Management

Tetris, APT42, Kimsuky, Android, ChatRTX, MITRE, Computer Dating, Josh Marpet, More – SWN #384

May 7, 2024

Tetris, APT42, Kimsuky, Android, ChatRTX, MITRE, Computer Dating, Josh Marpet, and more, on this Edition of the Security Weekly News.

Application security

Hacking AI Bias with Human Techniques – Keith Hoodlet – ASW #284

May 6, 2024

We already have bug bounties for web apps so it was only a matter of time before we would have bounties for AI-related bugs. Keith Hoodlet shares his experience winning first place in the DOD's inaugural AI bias bounty program. He explains how his education in psychology helped fill in the lack of resources in testing an AI's bias. Then we discuss ...