Jay Beale discusses his K8s class at BlackHat, Kubernetes developments, and mental health
Release Date: 07/17/2025
Password issues for Danish org, mimosas at midnight, and SocVel quiz
BrakeSec Education Podcast
This episode discusses the breach of Denmark's CPR register with a weak password, CrowdStrike's identification of the ARTEX AI pen test tool, a double-cross in the Gentleman ransomware gang, and the Silent Ransom Group's $200 million earnings from stolen data. Chapters 00:00 Denmark's CPR register breached through an admin password of 123456 10:52 SocVel quiz Q1: China-linked attack on South Africa's air traffic control 15:34 Q2: How a New Jersey engineer who ransomed his employer was caught 22:40 Q3: CrowdStrike finds the ARTEX AI pentest tool used in attacks 25:35 Q4: The Gentleman...
info_outline
BSides SD announcement, finding fraudulent workers, Flock flocks things up, insider threat checks
BrakeSec Education Podcast
BSides San Diego's call for papers opens October 1, a teardown of Flock Safety's license-plate cameras published by Micah Lee turns up 53 hard-coded credentials and a Wi-Fi password of "security", new research says two-thirds of fraudulent hires are caught by gut feeling rather than security controls, LG explains what its smart TVs do and don't listen to, and CISA's Insider Threat Mitigation Guide ties it back to the fake-worker problem. Plus a first live test of Bryan's home-built Twitch/YouTube chat bridge. Chapters 00:00 Correction: BSides San Diego 2027 is March 27, not April 3 as...
info_outline
Youtube exclusive! Mick Douglas discussing Sensible AI use poilcy, RAGs, and how to get up to speed for your business' sake
BrakeSec Education Podcast
Youtube Video: Questions and topics: (please feel free to update or make comments for clarifications) * Everyone wants us to use AI, but only when it benefits them * “Don’t use AI to submit your resume to our company” * “Do know how to use AI” * “Don’t use AI to answer the interview questions” * AI implementations range from “super easy” to “crazy easy” * If you already know how to use AI * Setting it up wrong can really hurt your company * Tasks in AI that can get you into trouble *...
info_outline
Jay Beale discusses his K8s class at BlackHat, Kubernetes developments, and mental health
BrakeSec Education Podcast
Youtube Video at: https://www.youtube.com/watch?v=yHPvGVfPgjI Jay Beale is a principal security consultant and CEO/CTO for InGuardians. He is the architect of multiple open source projects, including the Peirates attack tool for Kubernetes (in Kali Linux), the Bustakube CTF Kubernetes cluster, and Bastille Linux. Jay created and leads the Kubernetes CTF at DEF CON and previously helped in the Kubernetes project's Security efforts. He’s co-written eight books and given many public talks at Black Hat, DEF CON, RSA, CanSecWest, Blue Hat, ToorCon, DerbyCon, WWHF, HushCon and others. He...
info_outline
Socvel intel threat quiz, Pearson Breached, nintendo bricking stuff, and kevintel.com
BrakeSec Education Podcast
socvel.com/quiz if you want to play along! Check out the BrakeSecEd Twitch at join the Discord: https://bit.ly/brakesecDiscord Music: Music provided by Chillhop Music: https://chillhop.ffm.to/creatorcred "Flex" by Jeremy Blake Courtesy of Youtube media library
info_outline
Bronwen Aker - harnessing AI for improving your workflows
BrakeSec Education Podcast
Guest Info: Name: Bronwen Aker Contact Information (N/A): Time Zone(s): Pacific, Central, Eastern –Copy begins– Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time based on new information and experiences, and do not represent views of past, present, or future employers. Recorded: Show Topic Summary: By harnessing AI, we can assist in being...
info_outline
post-bsides SD discussion, EPSS, the answer I should have given, and 'Lord Brake'
BrakeSec Education Podcast
Check out the BrakeSecEd Twitch at or Youtube: https://youtube.com/c/BDSPodcast join the Discord: https://bit.ly/brakesecDiscord https://arxiv.org/abs/2302.14172 - EPSS whitepaper https://www.linkedin.com/posts/jayjacobs1_epss-threatintel-vulnerabiltymanagement-activity-7308146548767404032-RubN https://www.first.org/epss/ https://events.zoom.us/ev/AmoNH3baC7HVqDlDmgUtd2uCmTCMwJXfkR8mG6I5OxzbW01nhRMQ~AoEYQz5ROK4ybE4iX9b0PL-1utz4z0nbyrTjT4lskH_08_zfesR_Q_rNlA - BHIS training with Bronwen Aker on 03 April 2025 Music: Music provided by Chillhop Music:...
info_outline
March23: buy browser extensions, attackers don't need exploits, socvel CTI quiz
BrakeSec Education Podcast
Check out the BrakeSecEd Twitch at https://twitch.tv/brakesec Join the Discord! https://bit.ly/brakesecDiscord Questions and topics: (please feel free to update or make comments for clarifications) * https://techoreon.com/http-flaw-in-apple-passwords-left-iphones-vulnerable/ * https://darkmarc.substack.com/p/attackers-dont-need-exploits-when * https://www.techzine.eu/news/security/129713/the-browser-is-riddled-with-bugs-2025-may-squash-them/ * https://medium.com/@vanvleet/compound-probability-you-dont-need-100-coverage-to-win-a2e650da21a4 (interesting article on quantifying attack risk by...
info_outline
steam distributes malware in game form, RDP open from DOGE servers, hacking a supply chain for 50K
BrakeSec Education Podcast
Youtube VOD: – supply chain issues can crop up anywhere… are you blocking people from steam and popular software downloads online? <- 100 digits of pi <- periodic table song Additional information / pertinent LInks (Would you like to know more?): https://www.socvel.com/quiz/ https://xphantom.nl/posts/Offensive-Security-Lab/ Show points of Contact: Amanda Berlin: Brian Boettcher: Bryan Brake: Brakesec Website: Youtube channel: discord: https://discord.gg/brakesec Twitch Channel: Music: "Flex" by Jeremy...
info_outline
Tanya Janca Talks secure coding, Semgrep Academy, and community building, and more!
BrakeSec Education Podcast
Check out the BrakeSecEd Twitch at https://twitch.tv/brakesec Join the Discord! https://discord.gg/brakesec #youtube VOD (in 1440p): Questions and topics: Bsides Vancouver discussion Semgrep Community and Academy Building communities What are ‘secure guardrails’ Reducing barriers between security and developers How to sell security to devs: “hey, if you want to see us less, buy/use this?” “Security is your barrier, but we have goals that we can’t reach without your help.” https://wehackpurple.com/devsecops-worst-practices-artificial-gates/ How are you seeing things...
info_outlineYoutube Video at: https://www.youtube.com/watch?v=yHPvGVfPgjI
Jay Beale is a principal security consultant and CEO/CTO for InGuardians. He is the architect of multiple open source projects, including the Peirates attack tool for Kubernetes (in Kali Linux), the Bustakube CTF Kubernetes cluster, and Bastille Linux. Jay created and leads the Kubernetes CTF at DEF CON and previously helped in the Kubernetes project's Security efforts. He’s co-written eight books and given many public talks at Black Hat, DEF CON, RSA, CanSecWest, Blue Hat, ToorCon, DerbyCon, WWHF, HushCon and others. He teaches the highly-rated Black Hat class, “Attacking and Protecting Kubernetes, Linux, and Containers.” He has served on the review board of the O’Reilly Security Conference, the board of Mitre’s CVE-related Open Vulnerability and Assessment Language, and been a member of the HoneyNet project. He’s briefed both Congress and the White House.
Questions and topics: (please feel free to update or make comments for clarifications)
* Kubernetes vs. Docker vs. LXC vs. VMs - why did you settle on K8s?
* What’s new with k8s? Version 1.33? Do you always implement the latest version in your CTF, or something that is deliberately vulnerable? (https://www.loft.sh/blog/kubernetes-v-1-33-key-features-updates-and-what-you-need-to-know)
* When you are making a CTF, what’s your methodology? Threat model then verify? Code review? Github pull requests?
* Story time; Not the first year you’ve done this(?), have participants ever surprised you finding something you didn’t expect?
* If I’m running K8s at my workplace, what should be bare minimum k8s security I should implement? Any security controls that I should implement that might cause performance or are ‘nice-to-have’ but may run counter to how orgs use k8s that I should be concerned about implementing?
Additional information / pertinent LInks (Would you like to know more?):
https://kubernetes.io/
DEF CON Kubernetes CTF: https://containersecurityctf.com/
Black Hat training: https://www.blackhat.com/us-25/training/schedule/index.html#0-day-unnecessary-attacking-and-protecting-kubernetes-linux-and-containers-45335
https://www.bustakube.com/
https://github.com/inguardians/peirates
Rory McCune’s blog: https://raesene.github.io/
https://www.oreilly.com/library/view/production-kubernetes/9781492092292/ - O’Reilly book: Production Kubernetes
Show points of Contact:
Amanda Berlin: https://www.linkedin.com/in/amandaberlin/
Brian Boettcher: https://www.linkedin.com/in/bboettcher96/
Bryan Brake: https://linkedin.com/in/brakeb
Brakesec Website: https://www.brakeingsecurity.com
Youtube channel: https://youtube.com/@brakeseced
Twitch Channel: https://twitch.tv/brakesec