Cybersecurity Under Pressure. Real Attacks, Real Lessons
autor: Antonio González
Nejnovější epizoda
Validating Automotive Supplier VEX Claims
Validating Automotive Supplier VEX Claims
O tomto podcastu
Cybersecurity Under Pressure examines real incidents, technical research and security decisions across industrial systems, railways and connected vehicles. Antonio González connects attack mechanisms with engineering constraints, operational resilience and product-security evidence. Explore OT and ICS security, automotive and railway cybersecurity, software supply chains and the decisions behind secure operations.
Epizody
Nejnovějších 20 z 151 epizod
- Validating Automotive Supplier VEX Claims · 32 minA supplier declares an automotive ECU not affected by a vulnerability identified in a software component. What evidence should the manufacturer request before relying on that…
- PLC Logic Changes During Live Production: An OT Pressure Test · 33 minWhat if a PLC program change is flagged while a factory remains in production and process indicators appear normal? This Wednesday episode uses a hypothetical engineering…
- Who Can End a Supplier Session When the Line Is Down? · 32 minA production line is stopped, and a supplier needs an engineering connection to diagnose the fault. In this explicitly hypothetical CUP scenario, the same legacy session can also…
- How Attackers Weaponized Evernote Against SCADA · 42 minWhat happens when a trusted note-taking workflow becomes a route into an industrial control environment? This episode examines an Evernote-to-SCADA attack path and the boundary…
- How Incomplete SBOMs Hide Critical Vulnerabilities · 42 minAn SBOM is only as useful as the components and relationships it captures. This episode examines how incomplete software bills of materials can hide critical vulnerabilities when…
- VMS Privilege Escalation: When Edit Rights Become Server Control | CUP Micro Brief · 2 minApplication edit rights and operating-system administration are not the same security boundary. This CUP Micro Brief shows how an over-privileged video-management service can…
- Stopping Fake Emergency Braking in Connected Cars · 42 minCan a connected vehicle reject a forged emergency-braking warning without suppressing a legitimate safety message? This episode examines false emergency electronic brake light…
- OT Maintenance Windows: Monitoring Temporary Access | CUP Focus · 5 minPlanned downtime concentrates contractors, temporary access, firmware changes and disabled alerts in the same period. This CUP Focus explains why maintenance windows require…
- Oldsmar Revisited: Remote Access and the Limits of the Evidence · 38 minEditorial context: The February 2021 Oldsmar incident was initially reported as an unauthorized remote-access attempt to alter water-treatment dosing. In 2023, the FBI said it…
- Railway Diagnostic Security: Protecting Privileged Access | CUP Micro Brief · 2 minA railway diagnostic platform may not execute the safety function, but it can expose topology, privileged sessions and a pivot path toward operational assets. This CUP Micro…
- Industrial 5G Security: Protecting the Wireless Conduit | CUP Focus · 6 minA wireless conduit cannot be protected like a copper port. This CUP Focus connects 5G device identity, subscriber credentials, edge routing and passive application monitoring…
- How Volt Typhoon Weaponizes Active Directory · 41 minVolt Typhoon turns trusted administration into a path toward critical infrastructure. This episode examines how stolen credentials, Active Directory compromise and…
- SBOM and VEX: Proving Vulnerability Reachability | CUP Focus · 4 minComponent presence and practical exposure are different facts. This CUP Focus explains how static and dynamic reachability analysis support VEX decisions, reduce false positives…
- Industrial Router Security: When SMS Authentication Fails Open | CUP Micro Brief · 3 minAn industrial router disables SMS password checks after five failed attempts. This CUP Micro Brief examines the availability logic behind the fail-open design and why it becomes…
- A Trusted Engineering Workstation Can Still Deploy a Malicious Flow · 37 minAn unauthenticated flow editor can turn an industrial gateway into a code-execution platform. This episode examines the Siemens SIMATIC IoT2050 Advanced case and the operational…
- Connected Vehicle Security: From Cloud API to In-Vehicle Control | CUP Focus · 4 minThe API gateway may validate a remote command while the internal vehicle network accepts it without equivalent checks. This CUP Focus explains why cloud authorization, telematics…
- A Station Identifier Is Not Proof of Station Identity · 52 minWhat happens when an EV charging backend accepts a station identifier without proving which station is actually connecting? This episode examines the Monta OCPP authentication…
- Vehicle-to-Grid Security: Coordinated Charging and Grid Risk | CUP Focus · 4 minV2G can support the energy system, but aggregated charging and discharging also create a coordinated control surface. This CUP Focus follows the path from distributed vehicle…
- BLE Vehicle Security: The Risk of a Shared Authentication Key | CUP Micro Brief · 2 minResearchers found two million aftermarket vehicle devices sharing one Bluetooth authentication key. This CUP Micro Brief shows how manufacturing convenience became a scalable…
- Clean Code Does Not Prove a Safe Process | CUP Micro Brief · 2 minClean code and verified binaries do not prove that a physical process is safe. This CUP Micro Brief explains how attackers can change parameters and references without changing…
