Archive for the ‘insight’ Category
Thursday, February 26th, 2009
I was fortunate enough to have the honor of interviewing Brady Forest today. I thought I’d ask him some questions that would be relevant to the hackers / MAKE folks / tinkerers in the crowd. I’m pleased to say that from what I’ve been told there’s a fair possibility that if you’ve done soldering before and have any interest in doing live tinkering at a conference, Etech should show up on your radar.
Aten: How much of your life does Etech consume?
Brady: it consumes… I start working 10 months in advance. In some ways 14 months in advance. 10 months is the theme for the following year, its my first conference of the year, so it gets my attention. I’d like to have as many worthwhile things as possible crammed into into that time – the conference is only four days. Every facet of the conference has to be interesting. There is tech/art in the halls, events in the evenings. Its broad.
Aten: What is your background?
Brady: I have an engineering degree, worked in management, integrations – then did a friends music startup kind of like pandora which was then bought by bought by MS, done some music, worked at a google news competitor, then ended up in search as a project manager. Did evangelism/blogging sort of half product, half watching the outside world. I talked to O’Reilly and after some negotiations I ended up coming aboard.
(more…)
Posted in insight, interview, technology | 1 Comment »
Monday, January 19th, 2009
Tags: and, be safer, consulting, diego, for, hacker, hacking, hire, information, infosec, infrastucture, it, san, security, technology, us
Posted in insight, rants, review | 1 Comment »
Thursday, January 1st, 2009
I thought that doing security101 at places like oggis may have been a tactical mistake because I want people to actually learn and benefit from some of this stuff, so having the discussion broken by the wait staff frequently simply murdered all the momentum the discussion had and the event turned into a hacking 101 lab where I just demonstrated attacks.
That being the case doing a security101 class in an actual classroom environment where I can have the attendees comfortable and perhaps even have a projector would likely be far far better. Phelan was gracious enough to let me usurp the january installment of refreshsd to give my security101 talk in a more meaningful and more formal environment. Refresh this month is on the 13th – see refreshsd.org for details, or see the meetup group.
Here is my proposed curriculum:
Basic networking
- How do computers talk?
- what is a packet?
- whats IN a packet?
clear text versus encryption (http, ftp, dns)
how websites pass information around
How to tell if the site you’re on is passing your information encrypted or not.
Some network voodoo – watching the stream
-driftnet
-dsniff
-watching dns queries
(the next three may or may not be permitted depending on qualcomms network configuration)
basic man in the middle example
faking ssl certs
changing dns
Hope to see you all there!
Tags: 101, class, course, hacking, refresh, refreshsd, san diego, sd, sec101, security, security101, teaching
Posted in insight, training | No Comments »
Tuesday, December 16th, 2008
Everyone knows that there are vunlerabilities from time to time and you should upgrade things like wordpress, windows, osx and other pieces of software commonly used by lots of people. One thing that people don’t take into account is the actual times and dates of the proof of concept (POC), subsequent weaponization of the exploit (if it came from a nefarious source) then the vendors patch and announcement (if they even notice or care).
Lets take the most recent exploit that came out for internet explorer as our example. The first easily referencable date I could find for this exploit.
Thats right – Four days from POC to “publically downloadable and available for anybody to use“.
The day I’m writing this post (Monday Night, Dec 16) The microsoft investigation page still says they’re investigating. If they have any sense tomorrows ‘patch tuesday’ security patch should contain a fix.
That being said – It’s been a week and there is no patch. What does that mean for the end user, CEO, Marketing folks, Sales people, Graphic Artists and other people who arent focused on security all the time?
- Everyone running IE7 in your enterprise/company/network is vulnerable (and still is, as of Dec 15)
- If this is exploited there is a fair chance that nobody will know until there is a patch, or the antivirus vendors catch up.
- If this is exploited on 0-day, then an attacker has been in your network FOR A WEEK ALREADY.
- Once the fix comes out the hole is patched..
- But it’s very likely entirely separate attacks were used once IE7 was exploited, so applying the patch to fix IE7 won’t fix any damage the attacker has done
Not everyone has to be security concious all the time. For that theres people like us!
Heres something I see every day: The list of new exploits that come out on milw0rm.com (which is just one of the many sites that exist for publishing known exploits):
Look at the third one down on Dec 15 
Tags: exploits, milw0rm, security, timeline
Posted in insight, review | 2 Comments »
Tuesday, December 9th, 2008
Again I find myself in a postion where I am in need of full time work. I was able to sustain myself as a full time freelancer for 8 months (not too shabby!), but now it seems the market is drying up and while not for a lack of effort on my part to find sales people or to promote myself by basically bribing people with a 10% commission I’ve not been able to get enough business to sustain myself any longer. I’ll not go into any of the nasty business of clients who decided they didn’t feel like paying me, or clients that had me draw up proposals only to vanish into the ether – because this post is about fun stuff!
All that being said – I like to be clever. I like to use ingenuity to do basically what everyone else does but put a fancy little twist on it. Historically when someone is looking for a job, they will hit some job search sites like monster and dice and then send their resume to people – never knowing if it gets seen with human eyes, or ever gets any attention. Who knows? Does your resume even get read? If it does, how soon? Wouldnt it be nice to see the time correlation between when you sent your resume to someone and when they actually looked at it – or even if they looked at it at all?
(more…)
Tags: apache, grep, grepping, howto, information, log, reporting, reports, visibility
Posted in insight, training | No Comments »
Wednesday, November 26th, 2008
So security101 went fairly well – people didn’t show up until later, and I had spent too much time screwing aroung with ettercap and MITM attacks to have enough battery to complete the entirety of the talk with all the examples I had hoped for.
Some of the attendees ended up asking lots of questions so the ‘flow’ I had envisioned sort of went out the window – but I’d much rather have people interested and actively asking me questions: It shows interest. I’d rather have interest then have them all silent while I blather on and on.
We all ended up at my place afterwards and I was giving short demos on MITM dns tomfoolery, rewriting all queries for microsoft.com to linux.com, and doing SSL MITM attacks against hotmail using ettercap. Pretty fun stuff!
I’ll be holding the class again for anybody that missed it the first time and wants to have it again, but I haven’t chosen a date yet.
If you’re interested in a date, please leave a comment! I’d like to hold the class when more people can attend.
Tags: postmorem, sec101, security101, training
Posted in insight, rants, review, speculation, training | No Comments »
