David Bombal

Hosted by David Bombal

TechnologyInterviews guests

Website RSS feed

Episodes

500

Latest episode

Oct 2026

Language

About the show

Want to learn about IT? Want to get ahead in your career? Well, this is the right place! On this channel, I discuss Python, Ethical Hacking, Networking, Network Automation, CCNA, Virtualization and other IT related topics. This YouTube channel has new videos every week! Subscribe for technical, detailed, no fluff content. David’s details: Discord: https://discord.com/invite/usKSyzb Twitter: https://www.twitter.com/davidbombal Instagram: https://www.instagram.com/davidbombal LinkedIn: https://www.linkedin.com/in/davidbombal Facebook: https://www.facebook.com/davidbombal.co Website: http://www.davidbombal.com YouTube: https://www.youtube.com/davidbombal All the best! David

Listen to episodes

60 recent

October 26, 202619 min

#616: How Police Can Track Your Phone

Big thanks to ThreatLocker for sponsoring my trip to Black Hat USA 2026 and also for sponsoring this video. To start your free trial with ThreatLocker please use the following link: https://www.threatlocker.com/davidbombal Your phone can be tricked into connecting to a fake cell tower. These devices are commonly known as Stingrays, cell-site simulators or IMSI catchers. They can be used to identify and locate phones in an area, and some attacks can interfere with the security of your cellular connection. At Black Hat and DEF CON, I spoke to Cooper Quintin, Senior Staff Technologist at the Electronic Frontier Foundation (EFF), about Rayhunter. Rayhunter is an open-source project from the EFF designed to detect suspicious cellular activity using inexpensive mobile hotspot hardware. In this interview, Cooper explains how Stingrays and IMSI catchers work, why your phone can connect to a fake cell tower, what an IMSI is, how cellular downgrade attacks work, what a null cipher is, how Rayhunter detects suspicious activity, and what the EFF has learned from real-world deployments. We also get into mobile forensic extraction, phone searches at the border, biometrics vs PINs and passwords, and the bigger question of how much surveillance power governments and law enforcement should have. Thanks to ThreatLocker for sponsoring my trip to Black Hat and DEF CON and for sponsoring this video. #CyberSecurity #Privacy #Hacking // Cooper Quintin’s SOCIAL // EFF Website: https://www.eff.org/about/staff/coope... LinkedIn: / cooper-quintin-932029125 Website: https://cooperq.com/ // Web Page REFERENCE // https://www.eff.org/deeplinks/2025/03... https://www.eff.org/ https://ssd.eff.org/ // David's SOCIAL // Discord: discord.com/invite/usKSyzb Twitter: www.twitter.com/davidbombal Instagram: www.instagram.com/davidbombal LinkedIn: www.linkedin.com/in/davidbombal Facebook: www.facebook.com/davidbombal.co TikTok: tiktok.com/@davidbombal YouTube: / @davidbombal Spotify: open.spotify.com/show/3f6k6gE... SoundCloud: / davidbombal Apple Podcast: podcasts.apple.com/us/podcast... // MY STUFF // https://www.amazon.com/shop/davidbombal // SPONSORS // Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com // MENU // 0:00 - Intro 0:52 - Cooper Quintin introduction 01:18 - Rayhunter tool by EFF 02:45 - Stingrays used by law enforcement 05:05 - How the Rayhunter works 08:44 - Threatlocker sponsor segment 09:59 - Rayhunter results 12:06 - Concerns of Stingrays 14:02 - Why should people care 15:17 - Concerns of mobile forensic extraction tools 17:17 - Password vs biometric 18:04 - Conclusion Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel! Disclaimer: This video is for educational purposes only. #cybersecurity #bhusa26 #privacy

October 20, 202615 min

#615: How is AI Changing Cybersecurity?

Big thanks to Cisco & Splunk for sponsoring my trip to .Conf 2026 and also for sponsoring this video. // Kamal Hathi’s’ SOCIAL // LinkedIn: / kamal-hathi // Hanlin Fang’s SOCIAL // LinkedIn: / hanlinfang // Jessica Oppenheimer’s SOCIAL // LinkedIn: / jessbair // Craig Woolley’s SOCIAL // LinkedIn: / craig-woolley-783059111 // Tom Smit’s SOCIAL // LinkedIn: / tsmit50 // Bruce Snell’s SOCIAL // LinkedIn: / brucesnell-security // Heath Johnson’s SOCIAL // LinkedIn: / heathjohnsonvm // Paul Bannister’s SOCIAL // LinkedIn: / paul-bannister // Hao Yang’s SOCIAL // LinkedIn: / hao-yang-bb6ab429 // Robert Castley’s SOCIAL // LinkedIn: / robertcastley // Leila Reyhani’s SOCIAL // LinkedIn: / leila-reyhani // David's SOCIAL // Discord: discord.com/invite/usKSyzb Twitter: www.twitter.com/davidbombal Instagram: www.instagram.com/davidbombal LinkedIn: www.linkedin.com/in/davidbombal Facebook: www.facebook.com/davidbombal.co TikTok: tiktok.com/@davidbombal YouTube: / @davidbombal Spotify: open.spotify.com/show/3f6k6gE... SoundCloud: / davidbombal Apple Podcast: podcasts.apple.com/us/podcast... // MY STUFF // https://www.amazon.com/shop/davidbombal // SPONSORS // Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com // MENU // 0:00 - How to stay in control in the world of AI 00:38 - Visualizing data with Splunk 02:24 - Born observable // Observability for AI 04:36 - Cisco Data Fabric 06:43 - Hunt and investigation // Security threats 08:10 - Data foundation 09:08 - The cost of AI and the ROIs 09:41 - Red vs blue team with AI 11:46 - Visualizing AI security 13:00 - Targeted autonomy 14:02 - .conf26 summary 15:26 - Conclusion Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel! Disclaimer: This video is for educational purposes only. #splunk #cybersecurity #ai

October 20, 202643 min

#614: Learn Malware Analysis with Ghidra and x64dbg (for free)

Want to learn how to reverse engineer malware? Lindsay Kaye joins me to demonstrate malware analysis using Ghidra and x64dbg, two free tools you can use to develop your skills. Lindsay is the author of Dissecting the Dark Web. In this interview, we take apart a data theft tool used by LockBit affiliates and examine BlackMatter ransomware. You’ll see how malware detects a debugger, hides strings, and loads functions at runtime. We also run ransomware in a lab VM to show what happens to the victim’s files. We discuss: • How ransomware gangs steal data before encrypting it • How static and dynamic analysis work together • Finding malware indicators in Sysmon logs • Why ransomware can print physical ransom notes • How reputation and trust work in criminal forums • How to start reverse engineering by compiling your own C programs and examining them in Ghidra If you have some programming knowledge and want to understand how malware works, this is a practical look at the skills involved. // Sponsored SEGMENT // Big thank you to Proton Pass for sponsoring this video. To sign up for Proton Pass, please use the following link https://proton.me/davidbombal to get Proton Pass free. // Link to No Starch Website for Lindsay Kaye’s Book // Order Dissecting the Dark Web on No Starch: https://nostarch.com/dissecting-the-d... Use Coupon Code KAYE25 for 25% off Dissecting the Dark Web at NoStarch.com // Lindsay Kaye’s SOCIALS // Website: https://www.lindsaymkaye.com/ LinkedIn: / lindsaymkaye Human Security Website: https://www.humansecurity.com/people/... // David's SOCIAL // Discord: discord.com/invite/usKSyzb Twitter: www.twitter.com/davidbombal Instagram: www.instagram.com/davidbombal LinkedIn: www.linkedin.com/in/davidbombal Facebook: www.facebook.com/davidbombal.co TikTok: tiktok.com/@davidbombal YouTube: / @davidbombal Spotify: open.spotify.com/show/3f6k6gE... SoundCloud: / davidbombal Apple Podcast: podcasts.apple.com/us/podcast... // MY STUFF // https://www.amazon.com/shop/davidbombal // SPONSORS // Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com // MENU // 0:00- Coming Up 0:40 - Intro (Lindsey's Book) 02:49 - Lindsey's Background 03:30 - Proton Ad 05:44 - Interesting Book Topics 07:18 - Demo Starts 10:57 - How To Follow Along With The Book 14:12 - x64 Debuggng 20:21 - Writing Rules With Stealbit 23:27 - Analysing Ransomware 28:10 - Building Your Ransomware 31:05 - Reputations On The Dark Web 32:52 - Analysing Dark Web Malware 37:30 - Running The Ransomware 41:00 – Questions to Lindsay 42:17 – How to Connect with Lindsay 42:39 – Final thoughts Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel! Disclaimer: This video is for educational purposes only. #defcon #reverseengineering #darkweb

October 12, 202627 min

#613: Think You’re Private Online? Watch This

Big thank you to DeleteMe for sponsoring this video. Use my link join https://joindeleteme.com/Bombal or use the QR code in the video to get 20% off. How private are the apps you use every day? I sit down with Thorin Klosowski from the Electronic Frontier Foundation (EFF) to discuss online privacy, secure messaging, VPNs and the data we share with AI tools. We look at Signal, WhatsApp and Telegram, discuss privacy tradeoffs across Windows, Linux, Android and iPhone, and ask what you should assume about email and cloud storage. Thorin also walks through EFF’s free Surveillance Self-Defense guides to help you create a security plan and decide what to focus on first. If you work in cybersecurity, or you simply want to help your family protect their privacy, this conversation gives you a starting point without assuming everyone needs the same tools. In this interview: Why “I have nothing to hide” misses the point How to think about passwords, two-factor authentication and security planning Why messaging defaults and privacy settings matter What a VPN can and cannot do for your privacy AI features, cloud storage and questions to ask about your data Phone and computer privacy tradeoffs, email and encryption Which privacy setting or app are you going to review first? Let me know in the comments, and subscribe for more cybersecurity and privacy conversations. // Thorin Klosowski’s SOCIALS // Website: https://www.eff.org/about/staff/thori... EFF LinkedIn: https://www.linkedin.com/company/eff?... // Web page REFERENCE // https://ssd.eff.org/ // David's SOCIAL // Discord: discord.com/invite/usKSyzb Twitter: www.twitter.com/davidbombal Instagram: www.instagram.com/davidbombal LinkedIn: www.linkedin.com/in/davidbombal Facebook: www.facebook.com/davidbombal.co TikTok: tiktok.com/@davidbombal YouTube: / @davidbombal Spotify: open.spotify.com/show/3f6k6gE... SoundCloud: / davidbombal Apple Podcast: podcasts.apple.com/us/podcast... // MY STUFF // https://www.amazon.com/shop/davidbombal // SPONSORS // Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com // MENU // 0:00 - Coming Up 0:40 – Intro & about the EFF 02:50 – DeleteMe Sponsored Section 05:08 – Surveillance & Self-Defence Tools 08:41 – Tool Guides, AI Privacy & Cloud Storage 13:29 – Messaging Apps to use 16:27 – Operating Systems to use 21:16 – How Secure is Email & Encryption 23:22 – Security Tips for Activists & Protestors 26:53 – Closing & Conclusion Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel! Disclaimer: This video is for educational purposes only. #Privacy #CyberSecurity #EFF

October 8, 202618 min

#612: How Hackers Trick AI Into Giving Up Secrets (Demos and free labs)

Big thanks to Proton Drive for sponsoring this video. You can use my link http://proton.me/drive/davidbombal to sign up for Proton Drive and get 40% discount. // Free AI labs // Prompt Injection Taxonomy: https://arcanum-sec.github.io/arc_pi_... AI Security Resource Hub: https://arcanum-sec.github.io/ai-sec-... // Jason Haddix’s SOCIALS // X: https://x.com/Jhaddix?lang=en Github: https://github.com/Arcanum-Sec Website: https://arcanum-sec.com/ // David's SOCIAL // Discord: discord.com/invite/usKSyzb Twitter: www.twitter.com/davidbombal Instagram: www.instagram.com/davidbombal LinkedIn: www.linkedin.com/in/davidbombal Facebook: www.facebook.com/davidbombal.co TikTok: tiktok.com/@davidbombal YouTube: / @davidbombal Spotify: open.spotify.com/show/3f6k6gE... SoundCloud: / davidbombal Apple Podcast: podcasts.apple.com/us/podcast... // MY STUFF // https://www.amazon.com/shop/davidbombal // SPONSORS // Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com // MENU // 0:00 -Coming Up 0:48 - Jason Haddix at DEF CON 01:36 - Sponsor – Proton Drive 03:31 - AI Chatbot Penetration Testing 04:11 - The Prompt Injection Taxonomy 06:19 - Bypassing AI Guardrails & Classifiers 07:15 - DEF CON AI Hacking CTF 08:31 - Why AI Security Testing Is Different 10:18 - Instagram AI Account Takeover Demo 14:39 - AI Meeting Transcript Prompt Injection Demo 17:28 - How to Start Learning AI Security 18:18 - Final Thoughts Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel! Disclaimer: This video is for educational purposes only. #ai #aihacking #promptinjection

October 1, 202622 min

#611: Building AI Agents? Set Up These Guardrails First

Big thanks to ‪@Cisco‬ & ‪@Splunkofficial‬ for sponsoring my trip to .Conf 2026 and also for sponsoring this video. AI agents can do things you never intended. So how do you monitor their behavior, spot security problems and decide what they should be allowed to do? I’m joined by Splunk’s Kamal Hathi at .conf26 to discuss AI agent security, observability and what an agentic SOC means for the people working in cybersecurity. Kamal explains why setting a goal isn’t enough. You need visibility into what your agents are actually doing, clear guardrails and human oversight for important decisions. We also discuss why monitoring only a sample of agent activity can leave gaps, and how focused small language models could help reduce evaluation costs. In this interview, we cover: • Known agents, unregistered agents and unexpected behavior • AI evaluations, guardrails and zero trust • Automating SOC alert triage while keeping humans in control • Using AI to create SOAR playbooks • Running models locally for privacy, cost and control • Choosing between local models and cloud models • Whether you should still study computer science in 2027 If you’re building AI agents, working in cybersecurity or deciding what to learn next, this conversation will give you plenty to think about. // Kamal Hathi’s’ SOCIAL // LinkedIn: / kamal-hathi // David's SOCIAL // Discord: discord.com/invite/usKSyzb Twitter: www.twitter.com/davidbombal Instagram: www.instagram.com/davidbombal LinkedIn: www.linkedin.com/in/davidbombal Facebook: www.facebook.com/davidbombal.co TikTok: tiktok.com/@davidbombal YouTube: / @davidbombal Spotify: open.spotify.com/show/3f6k6gE... SoundCloud: / davidbombal Apple Podcast: podcasts.apple.com/us/podcast... // MY STUFF // https://www.amazon.com/shop/davidbombal // SPONSORS // Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com // MENU // 0:00 - Coming Up 0:43 - Intro 02:25 - Security Against AI 06:26 - Collecting Data on your AI 08:33 - AI Hallucinations 10:48 - Is Life Like Sci-Fi? 14:09 - Will AI Replace You? 17:16 - Not Giving Your Information to AI 18:50 - Kamal's Prediction for the Future of AI 20:20 - Final Thoughts 21:29 - What Should you Study in 2027? 22:00 - Conclusion Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel! Disclaimer: This video is for educational purposes only. #SplunkConf26 #Splunk #Cisco

October 1, 202622 min

#610: WiFi Pineapple Pager: What Can It Actually Do?

Big thank you to proton VPN for sponsoring the video. To get 70% off your Proton VPN subscription use the following link: https://protonvpn.com/davidbombal Note: Hak5 did not pay me to make this video. But, for full transparency: Darren was kind enough to give me some cool Hak5 gadgets. Get your own using my link below. // Buy Hak5 coolness here (Affiliate Link): // Buy Hak5: https://davidbombal.wiki/gethak5 WiFi hacking without opening your laptop? ‪@DarrenKitchen‬ from ‪@hak5‬ joins me to talk about the WiFi Pineapple Pager and what this little Linux device can actually do. Darren shares the story behind the Pager, explains its support for 2.4, 5, and 6 GHz WiFi, and walks us through features including wireless reconnaissance, eventtriggered alerts, and community-created payloads. We also discuss how Bash and DuckyScript helpers let users build their own functionality, and how Pager Portal makes it possible to download payloads directly onto the device. How does it compare with the WiFi Pineapple Mark VII and Enterprise? We look at the different use cases, from portable testing to remotely auditing a client’s wireless network. And yes, someone has already made it run Doom. This is an interview and feature overview with the creator, covering the ideas, technology, and community behind the WiFi Pineapple Pager. // Darren Kitchen SOCIAL // YouTube: / darrenkitchen Website: https://hak5.org/pages/hack-across-am... X: https://x.com/hak5darren // Hak5 WEBSITE // https://shop.hak5.org/ // Previous YouTube video with Darren REFERENCE // Hacking Gadgets Every Cybersecurity Pro should know: • Hacking Gadgets Every Cybersecurity Pro Sh... // David's SOCIAL // Discord: discord.com/invite/usKSyzb Twitter: www.twitter.com/davidbombal Instagram: www.instagram.com/davidbombal LinkedIn: www.linkedin.com/in/davidbombal Facebook: www.facebook.com/davidbombal.co TikTok: tiktok.com/@davidbombal YouTube: / @davidbombal Spotify: open.spotify.com/show/3f6k6gE... SoundCloud: / davidbombal Apple Podcast: podcasts.apple.com/us/podcast... // MY STUFF // https://www.amazon.com/shop/davidbombal // SPONSORS // Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com // MENU// 0:00 - Intro 0:35 - Coolest hacking tool // Hak5 WiFi Pineapple Pager 03:10 - Proton VPN sponsor segment 05:28 - History of the WiFi Pineapple 08:53 - WiFi Pineapple Pager overview 12:17 - The community 15:55 - Easy to get started 16:50 - WiFi Pineapple Mk7 18:53 - WiFi Pineapple Enterprise 21:23 - Supported WiFi frequencies 22:43 - Conclusion Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel! Disclaimer: This video is for educational purposes only. #wifipineapplepager #wifi #hackinggadgets

October 1, 202639 min

#609: How Hackers Target Satellites Through Ground Control Systems

Big thanks to DeleteMe for sponsoring this video. Protect your business with DeleteMe by using the following Link: https://joindeleteme.com/bombal-biz You’ll also get a free year of social media protection for every seat you purchase. How do you hack a satellite? The attack can start on the ground. Watch a mission control demo showing how web vulnerabilities can change a simulated spacecraft’s orbit. At DEF CON, I meet Milenko and Andrzej, the authors of The Spacecraft Hackers Handbook, to explore spacecraft cybersecurity. They explain the infrastructure behind satellite operations, what the Via sat attack actually targeted, and why protecting spacecraft requires both security and space engineering knowledge. Then Andrzej demonstrates previously patched vulnerabilities in an older version of mission control software. Using Burp Suite, he shows how path traversal exposes configuration files and how cross-site scripting can trigger a spacecraft command through an operator’s browser. We cover: • Why satellite security extends to systems on the ground • How path traversal and XSS affect mission control software • Telemetry, telecommands, CCSDS and the SDLS security layer • How GPS supports timing as well as navigation • Python examples, a prepared lab VM and learning resources • The authors’ nine satellite cybersecurity challenges on Hack The Box • Skills and career opportunities in spacecraft cybersecurity The demonstration uses a spacecraft simulator. The vulnerabilities shown were disclosed to the vendor and patched. // Link to No Starch Website for Milenko and Andrzej’s Book// The Spacecraft Hacker’s Handbook: https://nostarch.com/spacecraft-hacke... Use Coupon Code SPACE25 for 25% off The Spacecraft Hacker’s Handbook. // Milenko Starcik’s SOCIALS // Website: https://visionspace.com/team/milenko-... Website 2: https://starcik.space/ // Andrzej Olchawa’s SOCIALS // Website: https://visionspace.com/author/a-olch... Website 2: https://andy.codes/ X: https://x.com/0x4ndy // Online Resources // https://spacesecurity.club https://github.com/orgs/spacecrafthac... // Blog Post REFERENCE // https://www.hackthebox.com/blog/hack-... // David's SOCIAL // Discord: discord.com/invite/usKSyzb Twitter: www.twitter.com/davidbombal Instagram: www.instagram.com/davidbombal LinkedIn: www.linkedin.com/in/davidbombal Facebook: www.facebook.com/davidbombal.co TikTok: tiktok.com/@davidbombal YouTube: / @davidbombal Spotify: open.spotify.com/show/3f6k6gE... SoundCloud: / davidbombal Apple Podcast: podcasts.apple.com/us/podcast... // MY STUFF // https://www.amazon.com/shop/davidbombal // SPONSORS // Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com // MENU // 0:00 - Intro 0:52 - How Russia hacked satellites 02:12 - The Spacecraft Hacker's Handbook 03:23 - VisionSpace 04:04 - DeleteMe sponsor segment 05:29 - Growth in satellites launched 06:28 - What would losing satellites mean 07:12 - Protocols explained 08:00 - Misconceptions of satellite hacking 09:28 - Threat level of satellite hacking 10:39 - Upcoming demo explained 12:20 - Who is the book for? 16:46 - A gap 17:48 - Other recommendations 19:49 - Hacking satellite demo overview 20:34 - Hacking satellite demo walkthrough 33:54 - Demo next steps 34:29 - Demo walkthrough continued 38:51 - Conclusion Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel! Disclaimer: This video is for educational purposes only. #sattelitehacking #spacecraftcybersecurity #defcon

September 19, 202652 min

#608: Before You Deploy AI Agents, Understand These Attacks

Big thanks to Proton VPN for sponsoring this video. You can use my link: https://protonvpn.com/davidbombal to get 70% off your Proton VPN subscription How do you hack an AI system? And what happens when one malicious instruction spreads between AI agents? I’m joined by Harriet, author of Practical AI Security, to explore how AI models and agents can be manipulated, with practical Python demonstrations. You'll see an image classifier misidentify a rifle, a demonstration of prompt injection spreading across five agents, and how memory poisoning can plant instructions that affect an agent later. We discuss why securing AI takes more than blocking prompt injection, how machine learning creates different security challenges, and what you need to understand before deploying agents in your organisation. Want to learn this yourself? Harriet explains how to get started with her collection of 30+ free Python notebooks, including examples you can explore in Google Colab. We also discuss the skills involved in AI security and how people from different backgrounds can contribute. Topics include: • Adversarial machine learning and image manipulation • Prompt injection and attacks spreading between agents • Memory poisoning and model backdoors • AI supply chain security • Learning AI security with Python • AI security careers, training and fundamentals // Link to No Starch Website for Harriet Farlow’s Book // Order Practical AI Security on No Starch: https://nostarch.com/practical-ai-sec... Use Coupon code FARLOW25 for 25% off Practical AI Security // HarrietHacks Labs REFERENCE // https://labs.harriethacks.com/ // Harriet Farlow’s AI Security Fundamentals Course REFERENCE // https://aisecurityfundamentals.com/ // Harriet Farlow’s SOCIALS // Website: https://harriethacks.com/about/ LinkedIn: / harriet-farlow-654963b7 Instagram: / harriethacks // David's SOCIAL // Discord: discord.com/invite/usKSyzb Twitter: www.twitter.com/davidbombal Instagram: www.instagram.com/davidbombal LinkedIn: www.linkedin.com/in/davidbombal Facebook: www.facebook.com/davidbombal.co TikTok: tiktok.com/@davidbombal YouTube: / @davidbombal Spotify: open.spotify.com/show/3f6k6gE... SoundCloud: / davidbombal Apple Podcast: podcasts.apple.com/us/podcast... // MY STUFF // https://www.amazon.com/shop/davidbombal // SPONSORS // Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com // MENU // 0:00 - Intro 01:05 - Harriet Farlow AI security background 05:55 - Proton VPN sponsor segment 08:02 - Practical AI Security book // AI Security 10:40 - Who's the book for 11:32 - Harriet's YouTube channel 12:32 - AI security course 14:27 - Practical demos 15:41 - Hacking an AI demo // Learning how AIs work 22:22 - Hacking an AI summary 24:40 - Hacking an AI visualizations 28:48 - AI deceiving another AI 33:09 - Hacking an AI visualizations continued 34:07 - Rushing to the AI market 36:26 - Adversarial patch explained 38:12 - Vibe coded visuals 40:27 - More visualization 44:04 - Growth of interest in AI security 45:09 - No advanced skills required 49:40 - Get in contact with Harriet Farlow // Conclusion Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel! Disclaimer: This video is for educational purposes only. #aisecurity #aiagents #defcon

September 19, 202631 min

#607: How Hackers Steal Your Accounts Even With 2FA Enabled

Big thanks to ThreatLocker for sponsoring my trip to Black Hat USA 2026 and also for sponsoring this video. To start your free trial with ThreatLocker please use the following link: https://www.threatlocker.com/davidbombal Is Microsoft Defender enough to protect your PC? Malware researcher Leo joins me at Black Hat to discuss antivirus, Windows security and how hackers steal your accounts. We explore how infostealers target saved passwords and session tokens, why two-factor authentication cannot prevent every account takeover, and how a message from a compromised friend’s account can lead to an infection. Leo shares practical starting points for investigating your computer, including Autoruns for startup entries, TCPView for linking connections to applications, and Wireshark for examining network traffic. We also discuss password managers, account recovery planning, Windows telemetry and why switching operating systems does not eliminate security risks. In this interview: • Microsoft Defender’s strengths and limitations • Free tools for investigating suspicious Windows activity • How infostealers and initial access brokers operate • Stolen session tokens and the limits of 2FA • Fake download sites, malicious ads and targeted phishing • Preparing recovery options before your accounts are compromised • Security and privacy trade-offs across Windows, Linux and macOS // Leo’s SOCIAL // YouTube: / @pcsecuritychannel X: https://x.com/leotday Discord: / discord // David's SOCIAL // Discord: discord.com/invite/usKSyzb Twitter: www.twitter.com/davidbombal Instagram: www.instagram.com/davidbombal LinkedIn: www.linkedin.com/in/davidbombal Facebook: www.facebook.com/davidbombal.co TikTok: tiktok.com/@davidbombal YouTube: / @davidbombal Spotify: open.spotify.com/show/3f6k6gE... SoundCloud: / davidbombal Apple Podcast: podcasts.apple.com/us/podcast... // MY STUFF // https://www.amazon.com/shop/davidbombal // SPONSORS // Interested in sponsoring my videos? Reach out to my team here: sponsors@davidbombal.com // MENU // 0:00 - Coming Up 0:35 - Intro 0:48 - Leo's Background & How Malware Has Evolved 03:27 - How to Detect Malware on Your Computer 05:21 - Best Sysinternals Tools for Malware Analysis 08:21 - Windows Device Tracking & Privacy Concerns 10:42 - Would you Recommend Windows in 2026? 11:59 - Privacy Laws & the Future of Tracking 12:50 - How Telemetry Helps Catch Cybercriminals 14:02 - ThreatLocker Sponsor 15:18 - How Hackers Actually Get Into Systems 16:42 - How to Protect Yourself From Getting Hacked 19:12 - Do You Really Need Antivirus? 21:35 - Security Advice for Home Users 25:59 - Why Smart People Still Get Hacked 26:59 - What Happens After Your Credentials Are Stolen 28:06 - Linux vs Mac vs Windows 29:40 - Is Windows Really Targeted More by Malware? 31:18 - Conclusion & Outro Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel! #malware #bhusa2026 #microsoftdefender