Security Take Two - Real. Serious. Security. https://securitytaketwo.com/ Security Take(s) Two aims to provide insight, depth, and breadth on topics important to the Information Security community. The title hints at our seasoned security hosts, Ben Verschaeren and Chester Wisniewski’s look back at security headlines after the fact. The world is full of hot takes and Security Take(s) Two aims to revisit these topics once the truth is known, discovering lessons that can be applied to avoid a similar fate. Tue, 24 Feb 2026 21:20:18 -0800 hourly 1 en-us Copyright 2024 Ben Verschaeren and Chester Wisniewski Real. Serious. Security. Ben Verschaeren and Chester Wisniewski episodic Ben Verschaeren and Chester Wisniewski hosts@securitytaketwo.com Security Take(s) Two aims to provide insight, depth, and breadth on topics important to the Information Security community. The title hints at our seasoned security hosts, Ben Verschaeren and Chester Wisniewski’s look back at security headlines after the fact. The world is full of hot takes and Security Take(s) Two aims to revisit these topics once the truth is known, discovering lessons that can be applied to avoid a similar fate. Security Take(s) Two aims to provide insight, depth, and breadth on topics important to the Information Security community. The title hints at our seasoned security hosts, Ben Verschaeren and Chester Wisniewski’s look back at security headlines after the fact. The world is full of hot takes and Security Take(s) Two aims to revisit these topics once the truth is known, discovering lessons that can be applied to avoid a similar fate. Chester Wisniewski hosts@securitytaketwo.com https://securitytaketwo.com/images/Logo-3000.jpg Security Take Two - Real. Serious. Security. https://securitytaketwo.com/ no noHugo -- gohugo.io Sony Part 2 [012] https://securitytaketwo.com/sony-part-2/ Tue, 24 Feb 2026 21:20:18 -0800 https://op3.dev/e,pg=f23ce580-fea6-013c-e804-02cacb2c6223/securitytaketwo.com/episodes/012-STT-SonyPart2.mp3 Chester Wisniewski and Ben Verschaeren 012 Sony Part 2 Security Take(s) Two - Sony Part 2 Security Take(s) Two - Sony Part 2 Security Take(s) Two - Sony Part 2 Our last episode covered Sony’s cybersecurity woes from 2005 until 2011, we pick up where we left of in the midst of the 50 days of LulzSec. This episode covers everything up until the alleged theft of the PS5 root signing keys in January 2026. So much s0wnage and so little time…

2014 Sony Pictures hack - Wikipedia
Lizard Squad - Wikipedia
Kim Dotcom May Have Just Saved Holiday Gaming - Gizmodo
Hackers Used Sophisticated SMB Worm Tool to Attack Sony - Security Week
Hacker group claims it breached Sony’s PlayStation Network and stole information - Business Insider
‘All Of Sony Systems’ Allegedly Hacked By New Ransomware Group - Kotaku
Ransomed.vc group claims hack on ‘all of Sony systems’ - CyberDaily.au
Sony Confirms Data Breach - Gamerant
Sony confirms data breach impacting thousands in the U.S. - Bleeping Computer
CTRL-ALT-CHAOS - Elliott & Thompson
PS5 ROM Keys Leak: What Happened, Why it Matters, and How it Impacts Security? - PC Quest
PS5 Open to Hacks and Jailbreak as ROM Keys Leak – Report - PlayStation Lifestyle
Sony Pictures Statement Related To Lulzsec Attack - Sony
Member Of LulzSec Hacking Group Sentenced To Over Year In Federal Prison For 2011 Intrusion Into Sony Pictures Computer Systems - Department of Justice
Sony Online President’s Flight Diverted After Hacker Bomb Threat - Kotaku
Update on Sony Investigation - FBI
TA14-353A: Targeted Destructive Malware - Seclists
PlayStation Network Update - Sony
American and Dutch Teenagers Arrested on Criminal Charges for Allegedly Operating International Cyber-Attack-For-Hire Websites- Department of Justice
PlayStation social media accounts briefly hacked - We Live Security
PlayStation Social Media Accounts Hacked - Security Week
Breach letter - Sony victim
#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability - CISA
Sony Confirms Data Stolen in Two Recent Hacker Attacks - Security Week

]]> 44:02false no Sony Part 1 [011] https://securitytaketwo.com/sony-part-1/ Sat, 31 Jan 2026 15:42:59 -0800 https://op3.dev/e,pg=f23ce580-fea6-013c-e804-02cacb2c6223/securitytaketwo.com/episodes/011-STT-SonyPart1.mp3 Chester Wisniewski and Ben Verschaeren 011 Sony Part 1 Security Take(s) Two - Sony Part 1 Security Take(s) Two - Sony Part 1 Security Take(s) Two - Sony Part 1 When it comes to information security, Sony has had a bit of a tough go of it. In fact, there have been so many incidents, Ben and Chet decided to make this a multi-part series. This post covers 2005 to mid-2011 which we are referring to as part 1. From rootkits, to DDoS, stolen credit cards and SQL injection, Sony has been through a lot. These are opportunities to reflect for the rest of us, though. We can recognize some of the weaknesses we ourselves may still have and hopefully take away lessons on hardening our own defences.

Firewall Times - Sony Data Breaches: Full Timeline Through 2023
LinkedIn - Sony PlayStation Network Hack (2011) - A Deep Dive
ON THE PLAYSTATION 3 - GeoHot’s first post about hacking the PS3
Reuters - Sony PlayStation suffers massive data breach
EFF - Updated Sony BMG DRM Spotter’s Guide
EDN - The Sony PlayStation 3 hack deciphered: what consumer-electronics designers can learn from the failure to protect a billion-dollar product ecosystem
Wikipedia - Sony BMG copy protection rootkit scandal
CSO - New PS3 hack claims to be the most powerful yet
YouTube - The Light It Up Contest – geohot
VG247 - SOE: 12,700 old CC numbers, 10,700 DD records breached
The Register - Sony says data for 25 million more customers stolen
Wikipedia - George Hotz
Medium - Meet Cyber: How “Anonymous” Hacked Sony PlayStation And Breached the Data of 77 Million Gamers\

]]> 38:47false no WannaCry [010] https://securitytaketwo.com/wannacry/ Tue, 19 Aug 2025 21:43:06 -0700 https://op3.dev/e,pg=f23ce580-fea6-013c-e804-02cacb2c6223/securitytaketwo.com/episodes/010-STT-WannaCry.mp3 Chester Wisniewski and Ben Verschaeren 010 WannaCry Security Take(s) Two - WannaCry Security Take(s) Two - WannaCry Security Take(s) Two - WannaCry May 12, 2017 was memorable for many in the information security industry, but it was also memorable in health care, manufacturing, shipping and more as the WannaCry worm laid waste to unpatched Windows machines the world over. May it be the last widespread worm we need to cover on this podcast…

Wikipedia - WannaCry
Microsoft - MS17-010
The Hacker News - TSMC Chip Maker Blames WannaCry Malware for Production Halt
Arstechnica - NSA Leaking Shadow Brokers Just Dumped Its Most Damaging Release Yet
NCCIC - What is WannaCry/WanaCryptor
Arstechnica - An NSA Derived Ransomware Worm is Shutting Down Computers Worldwide
NIH - NHS ransomware attack spreads worldwide
Wired - Accidental Kill Switch Slowed Friday’s Massive Ransomware Attack
Zero Day - U.S. Government Disclosed 39 Zero-Day Vulnerabilities in 2023, Per First-Ever Report
Arstechnica - Wanna Decryptor Kill Switch Analysis
Sophos - WannaCry Aftershock
Microsoft - Customer Guidance For WannaCrypt Attacks
The Hacker News - WannaCry Ransomware Bitcoin
Gov.UK - Foreign Office Minister condemns North Korean actor for WannaCry attacks
White House - Press Briefing on the attribution of the WannaCry malware attack to North Korea\

]]> 35:01false no LulzSec [009] https://securitytaketwo.com/lulzsec/ Mon, 30 Jun 2025 15:12:32 -0700 https://op3.dev/e,pg=f23ce580-fea6-013c-e804-02cacb2c6223/securitytaketwo.com/episodes/009-STT-LulzSec.mp3 Chester Wisniewski and Ben Verschaeren 009 LulzSec Security Take(s) Two - LulzSec Security Take(s) Two - LulzSec Security Take(s) Two - LulzSec For 50 days in mid-2011 the hacker world and even the wider pop-culture world was enthralled by a rampant series of brazen hacks conducted by a splinter group of anonymous who called themselves LulzSec. They claimed it was “just for the lulz”, but as we explore in this episode, there was much more to this than simply the lulz.

Wikipedia - LulzSec
Wired - Anonymous’ Most Notorious Hacker Is Back, and He’s Gone Legit
BBC - LulzSec hacker helps FBI stop over 300 cyber attacks
BBC - LulzSec hacker group handed jail sentences
Purdue University - Hacktivism: The Short Life of LulzSec
Parmy Olson’s book - “We are Anonymous”
Chester Wisniewski speaking on LulzSec for the BBC - 2011

]]> 49:08true yes ILOVEYOU [008] https://securitytaketwo.com/iloveyou/ Sun, 04 May 2025 11:52:35 -0700 https://op3.dev/e,pg=f23ce580-fea6-013c-e804-02cacb2c6223/securitytaketwo.com/episodes/008-STT-ILOVEYOU.mp3 Chester Wisniewski and Ben Verschaeren 008 ILOVEYOU Security Take(s) Two - ILOVEYOU Security Take(s) Two - ILOVEYOU Security Take(s) Two - ILOVEYOU May 4, 2000 many people in world woke up to a love letter in their INBOX. It wasn’t your typical love letter, this one was one of the world’s most destructive email worms and it quickly spread to infect an estimated 10% of the world’s PCs. For a longer write-up on ILOVEYOU, see my LinkedIn Post.

Wikipedia - ILOVEYOU
CNN - ‘I love you’: How a badly-coded computer virus caused billions in damage and exposed vulnerabilities which remain 20 years on
WIRED - The 20-Year Hunt for the Man Behind the Love Bug Virus
GAO - CRITICAL INFRASTRUCTURE PROTECTION “ILOVEYOU” Computer Virus Highlights Need for Improved Alert and Coordination Capabilities
ELECTRONIC COMMERCE ACT OF 2000- CHAN ROBLES VIRTUAL LAW LIBRARY
How ILOVEYOU worm became the first global computer virus pandemic
BBC - Love Bug’s creator tracked down to repair shop in Manila\

]]> 31:37false no Uber [007] https://securitytaketwo.com/uber/ Fri, 04 Apr 2025 22:02:31 -0700 https://op3.dev/e,pg=f23ce580-fea6-013c-e804-02cacb2c6223/securitytaketwo.com/episodes/007-STT-Uber.mp3 Chester Wisniewski and Ben Verschaeren 007 Uber Security Take(s) Two - Uber Security Take(s) Two - Uber Security Take(s) Two - Uber Uber has suffered many breaches over the years, so this podcast has focused just on breaches that involved external parties and not internal employee abuse of privileges. There is much to learn from Uber’s misfortune and in this episode we cover 5 distinct hacks and a couple of third-party breaches impacting Uber customers and drivers.

The Uber data breach cover-up: A timeline of events
Uber Pays $148 Million Over Yearlong Cover-Up Of Data Breach
Uber driver info stolen yet again: This time from law firm
Uber accidentally leaks personal data for hundreds of drivers
Teen on Musk’s DOGE Team Graduated from ‘The Com’
Uber Breaches (2014 & 2016)
Teqtivity Breach Notification Statement
Uber Investigating Breach of Its Computer Systems
Federal Trade Commission Gives Final Approval to Settlement with Uber
Uber Paid Hackers to Delete Stolen Data on 57 Million People
FTC: Uber Failed To Protect 100,000 Drivers In 2014 Hack
Uber Data Breaches: Full Timeline Through 2023
Uber was breached to its core, purportedly by an 18-year-old. Here’s what’s known
The Uber Hack’s Devastation Is Just Starting to Reveal Itself
Uber Breach 2022 – Everything You Need to Know
Case Study: The Uber Hack

]]> 47:26false no Transport for London [006] https://securitytaketwo.com/transportforlondon/ Fri, 07 Mar 2025 18:22:45 -0800 https://op3.dev/e,pg=f23ce580-fea6-013c-e804-02cacb2c6223/securitytaketwo.com/episodes/006-STT-TransportforLondon.mp3 Chester Wisniewski and Ben Verschaeren 006 Transport for London Security Take(s) Two - Transport for London Security Take(s) Two - Transport for London Security Take(s) Two - Transport for London The Transport for London (Operator of the London UK region’s transit network) was crippled by a cyber attack in September, 2024 that had widespread impacts on it’s operation. Fortunately safety was not a casualty, but we explore a bit of the nuance in incident response, segmnentation and other important lessons from this hack.

Boy arrested over London transport cyber hack
TfL writes to 5,000 cyber attack customers
TfL cyber attack: What you need to know
Cyber security recovery
TfL provides update on ongoing cyber security incident - 12 September
TfL cyber attack cost over 30 million pounds to date
TfL cyberattack bites into profits with 30 million pounds spent on recovery
“An utter shitshow”: Inside the Transport for London cyberattack

]]> 33:42false no SamSam [005] https://securitytaketwo.com/samsam/ Tue, 14 Jan 2025 22:28:08 -0800 https://op3.dev/e,pg=f23ce580-fea6-013c-e804-02cacb2c6223/securitytaketwo.com/episodes/005-STT-SamSam.mp3 Chester Wisniewski and Ben Verschaeren 005 SamSam Security Take(s) Two - SamSam Security Take(s) Two - SamSam Security Take(s) Two - SamSam SamSam may not be the most well known ransomware group, but they triggered a pivotal change when then began operations at the end of 2015. Over the course of nearly 3 years they demonstrated the profitability of extorting businesses instead of consumers and paved the path from $1000 ransom demands to the astronimical sums we see today. Allegedly operating from Iran they demonstrated sanctions evasion, the use of LOLbins and tested the waters for what amounts could be extorted from Western businesses. This podcast explores their operations and explains how they changed the ransomware landscape.

US Department of Justice indictment, wanted poster and victim list
Sophos report: SamSam: The Almost Six Million Dollar Ransomware

]]> 37:22false no City of Atlanta [004] https://securitytaketwo.com/cityofatlanta/ Sun, 17 Nov 2024 16:37:03 -0800 https://op3.dev/e,pg=f23ce580-fea6-013c-e804-02cacb2c6223/securitytaketwo.com/episodes/004-STT-CityofAtlanta.mp3 Chester Wisniewski and Ben Verschaeren 004 City of Atlanta When the City of Atlanta was hit by the ransomware group SamSam in 2018 it made headlines worldwide. Headlines often cited costs ranging from $2.6 million all the way up to $17 million, often presented as the costs incurred for not paying the $52,000 ransom. Ben and Chet dive into the archives to determine what series of events lead to these exceptional expenses.

Coverlink case study on the City of Atlanta
Wired - Atlanta spent $2.6 million to recover from ransomware scare
Archive.org Rendition InfoSec report
Archive.org Emergency procurement spending by the City of Atlanta
Wikipedia - Atlanta government ransomware attack
Reuters - Atlanta Officials Reveal Worsening Effects of Cyber Attack
TechTarget - Atlanta ransomware attack cost city more than $5 million\

January 2018: An audit reveals 1,500 to 2,000 vulnerabilities in Atlanta’s IT systems, highlighting complacency regarding cybersecurity.

March 22, 2018: Atlanta’s Department of Information Management detects outages in various internal and customer applications.

March 22, 2018: The City of Atlanta shuts down numerous digital services, including the court system database and airport Wi-Fi, to contain the situation. The attack is publicly acknowledged as a ransomware attack using SamSam ransomware.

March 22-27, 2018: Atlanta collaborates with the FBI, Department of Homeland Security, and Secret Service, while engaging security firms like SecureWorks for investigation. Government computers are advised to remain offline.

May 2018: Atlanta restores its online payment systems.

June 2018: Atlanta Police Department resumes full digital operations. Reports surface estimating that a third of the city’s software programs are still offline or partially disabled. The attack resulted in permanent data loss, including legal documents and police dashcam footage.

November 26, 2018: The US Department of Justice indicts two Iranian hackers, Faramarz Shahi Savandi and Mohammad Mehdi Shah Mansouri, for the attack, alleging their involvement in the SamSam group and the creation of the SamSam ransomware.

Post-attack period: Atlanta allocates $2.7 million to contractors for recovery, with later estimations suggesting a total cost of $17 million, including $6 million for initial response and $11 million for system repairs and replacements.

]]> 30:35false no 3CX [003] https://securitytaketwo.com/3cx/ Wed, 18 Sep 2024 12:16:39 +1000 https://op3.dev/e,pg=f23ce580-fea6-013c-e804-02cacb2c6223/securitytaketwo.com/episodes/003-STT-3CX.mp3 Chester Wisniewski and Ben Verschaeren 003 3CX In this episode, Chet and Ben dive deep into the 3CX supply chain attack, tracing it back from the initial compromise to the unfolding investigations and findings over several months. We explore how the threat actors, likely linked to North Korea, managed to infiltrate a trusted software supply chain and what the security community uncovered along the way.

3CX Security Alert
Mandiant Initial Results
Mandiant Full Report
Sophos Report on DLL Sideloading
Kaspersky Labs Report
Google TAG Report on Chrome 0-day
Kim Zetter Blog
Kim Zetter’s 3CX Article\

]]> 38:49false no Garmin [002] https://securitytaketwo.com/garmin/ Thu, 15 Aug 2024 20:12:06 -0700 https://op3.dev/e,pg=f23ce580-fea6-013c-e804-02cacb2c6223/securitytaketwo.com/episodes/002-STT-Garmin.mp3 Chester Wisniewski and Ben Verschaeren 002 Garmin Security Take(s) Two - Garmin Security Take(s) Two - Garmin Security Take(s) Two - Garmin Episode 2 covers the 2020 ransomware attack against technology giant, Garmin. In this episode, Chester kept track of his sources and provided the following links as additional reading and source materials used in this episode:
https://www.wired.com/story/garmin-ransomware-hack-warning/
https://www.bleepingcomputer.com/news/security/garmin-outage-caused-by-confirmed-wastedlocker-ransomware-attack/
https://www.bleepingcomputer.com/news/security/evil-corp-blocked-from-deploying-ransomware-on-30-major-us-firms/
https://news.sky.com/story/garmin-obtains-decryption-key-after-ransomware-attack-12036761
https://www.wired.com/story/garmin-outage-ransomware-attack-workouts-aviation/
https://www.theverge.com/2020/8/4/21353842/garmin-ransomware-attack-wearables-wastedlocker-evil-corp
https://web.archive.org/web/20200819201313/https://areteir.com/wp-content/uploads/2020/07/Ransomware-WastedLocker-1.pdf
https://x.com/Arete_Advisors/status/1286653508771614721?prefetchTimestamp=1723669546016\

]]> 31:05false no Medibank [001] https://securitytaketwo.com/medibank/ Sun, 21 Jul 2024 14:47:36 -0700 https://op3.dev/e,pg=f23ce580-fea6-013c-e804-02cacb2c6223/securitytaketwo.com/episodes/001-STT-Medibank.mp3 Chester Wisniewski and Ben Verschaeren 001 Medibank Security Take(s) Two - Medibank Security Take(s) Two - Medibank Security Take(s) Two - Medibank In our inaugural podcast we dive into the hack and breach of Medibank Private Health Insurance, an Australian medical insurance provider that lead to the leak of health records on 9.1 million Australians.

Beatings will continue until show notes improve…

]]> 46:01false no Pilot [000] https://securitytaketwo.com/pilot/ Sun, 26 May 2024 14:33:52 -0700 https://op3.dev/e,pg=f23ce580-fea6-013c-e804-02cacb2c6223/securitytaketwo.com/episodes/000-STT-Pilot.mp3 Chester Wisniewski and Ben Verschaeren 000 Pilot Welcome to Security Take(s) 2 - Pilot episode Welcome to Security Take(s) 2 - Pilot episode Welcome to Security Take(s) 2 - Pilot episode In our pilot episoed we each share a little about our backgrounds in information security and lay out the concept behind what this podcast will share with its listeners.

]]> 08:49false no