Archive for the ‘Uncategorized’ Category

Toorcon 13 talk: Why DLP won’t save you

Thursday, October 20th, 2011

Posted in Uncategorized | No Comments »

Zipline – a VPN security product.

Wednesday, December 16th, 2009

How many of those wordpress, joomla, drupal blogs, web2.0 products of various sort and other websites do you go to that are encrypted using SSL(https)? How many times a day to you enter your credentials, or use cookie based (the ‘remember me’ checkbox type) authentication on websites a day? Do you find yourself in coffee shops, or other public wifi frequently and sometimes wonder who is watching your traffic?

I know I do. Up until now I’ve been using SSH tunnels to get my traffic back home where I know nobody is running a packetsniffer. The trouble with SSH tunnels though is that they’re fickle, and often drop. I wanted a better solution – so I made one.

www.atenlabs.com/zipline

(more…)

Tags: , , , , , , , , , , , , , , , ,
Posted in Uncategorized | 2 Comments »

State of the pwnion.

Thursday, August 6th, 2009 
message begins
Personal details were revealed, emails, chat logs – pretty scary stuff – and very sobering. A clear demonstration that things like cross site scripting and the spreading of malware (likely for the use of cascading spam or addition to botnets) is the least of our problems. Also clear proof that people who consider themselves security folks have to be very wary of using creature comforts such as reusing passwords or even operating a wordpress blog (3 updates in a month?! and 2.8.2 is vulnerable? gaw!).
The textfile the group distributed was called zf05.txt and after skimming it’s abundantly clear that wordpress played a huge part in these folks getting rooted. Almost every example was sort of an ‘all in one’ server that was used for ‘whatever’. Its also become clear that jam packing one server with a bunch of services makes it more vulnerable to compromise. Ever heard of KISS? “Keep it simple, stupid”. It’s used very commonly among engineers, computer people – you name it. Anyone that has to build things or design things. The minute you start adding complexity for no reason the proverbial altimeter begins its decline.
People who fake tech exacerbate things. There are groups that call themselves “tech” when in reality they are simply PR or Marketing. The Web 2.0 craze has hypnotized people into putting almost everything they think and do ‘behind the scenes’. They let someone else worry about it. Some ruby programmers I’ve met are incapable of manually issuing a sql query. Others are incapable of interacting with sql unless they have phpmyadmin. These folks generate a requirement to artificially make systems more complex and less secure entirely to suit their evergrowing hatred of looking things up themselves or actually learning anything about the technology they use every day. The easiest way to think about it is this: Think of some people. Now think of these people all owning cars. Think of these people now requiring something as simple as an oil change, a tire change, or a simple tune up. Now think of these people taking their cars to a shop to get work done – for whatever reason: maybe they lack the tools, maybe their HOA doesn’t allow them to perform work on their cars on the grounds (those HOA people desperately need to be stabbed in the lungs, by the way) or maybe they just don’t know how. Now lets imagine these people have the work done, and are talking to the mechanics as they are preparing the invoice behind the counter. The mechanic begins to explain how their oil was changed, and these people abjectly refuse to learn or understand how this works even from a top-level non-technical aspect – they plug their ears and yell “NO! NO! AAALALALALA!! NOT LISTENING NO NOOOO! ALLALAAAAAA!”.
These people strongly support a fancy new term. “Cloud Computing”. Cloud computing will make this worse for everyone.
Let me jump away for a moment. I’d like to point out a fact. The attackers that distributed zf05.txt made a valid point – a point I’ve tried to make to peers, friends and clients alike – If your site/data are on shared hosting and you consider them secure that may mitigate some amount of risk. But if the other people hosting their data are vulnerable and your data is on the same system, you’re still vulnerable.
Now we have some ingredients – lets make a stew. Lets take these bits of information and put them all together and let it simmer.
- Non technical people whos requirements and behavior are insecure and promote systems being rooted
- Systems with lots of various services running on them
- A new trend of mashing these systems together to form giant systems that do the same thing, ending up being bigger and more powerful
- Commonly used software being exploited within a week of a patch.
Mix in a bowl with a wisk until creamy. Add a teaspoon of extra virgin olive oil to a cast-iron skillet. Add a bit of freshly cracked pepper to the oil and some freshly pressed/minced garlic. Let simmer until the pepper and garlic begin to bubble, then pour the mixture from the bowl into the skillet and add a squeeze of fresh key lime if you wish. Cook until firm or golden brown, flip once, then serve! Let stand for 10 minutes to cool. What do you get? What does it smell like? (Well if people actually taste of chicken then that may make one hell of a breakfast omlette). We dont know. Here’s why we don’t know:
- “Business people” like the idea of getting rid of systems administrators and IT overhead
- “Cloud Computing” does not have a security model yet
- There are no standards – this stuff is too new
- Far too many people are comfortable being hacked, and say “oh there’s nothing important on that sit/box”
.. Really, guys? You don’t use that same wordpress password everywhere? For your bank, for gmail, for your car insurance or your mobile provider to login? If a blackhat gets that password you’re really okay with it? If thats the case, I’d like you to kindly leave the internet, never to return. Please – do us all a favor, for the people that like keeping their privates private and their secrets secret, go away.
So we’re going to take all of these insecurities, vulnerabilities and holes – package them up with non-technical people demanding insecure practices so that they don’t have to learn or think and we’re going to replicate this ad nauseum and store the results in one gigantic computer grid system? Awesome. Maybe I should trade in my whitehat for a black one – since thats obviously where all the focus, media, fear and money are going to be. Or maybe I’ll just make my white hat bigger – perhaps people will come to their senses and listen to fact and reason. Perhaps not. I guess we’ll see.
I’m not the only one, either…
http://darkreading.com/securityservices/security/app-security/showArticle.jhtml?articleID=218102139&cid=RSSfeed
http://www.sensepost.com/blog/3706.html – open the ppt, this was the defcon talk. they pwned amazon ec2.
http://evilpacket.net/ – see the ‘theft of a rackspace cloud api key’. These guys got root on the rackspace/mosso cloud.

I was late to hear – by a day. Thats 10 years in internet time, we all know. If you’re not in InfoSec you probably didn’t hear. Maybe you heard somewhere, irc, twitter, other bits of the intarnets that Kevin Mitnick got hacked. Everyone chuckled. As it turns out a whole bunch of people got compromised. People I know personally who I consider friends. Rob Fuller, Dan Kaminsky, the Hak5 group and a handful of others, including Kevin Mitnick.

Personal details were revealed, emails, chat logs – pretty scary stuff – and very sobering. A clear demonstration that things like cross site scripting and the spreading of malware (likely for the use of cascading spam or addition to botnets) is the least of our problems. Also clear proof that people who consider themselves security folks have to be very wary of using creature comforts such as reusing passwords or even operating a wordpress blog (3 updates in a month?! and 2.8.2 is vulnerable? gaw!).

(more…)

Tags: , , , , , , , , , , , , , , , , , , , , ,
Posted in insight, rants, review, speculation, technology, Uncategorized | 1 Comment »

Speaking at ToorCamp!

Wednesday, May 13th, 2009

[EDIT] Unfortunately, I am no longer able to make this event. I’m sad, I really really wanted to go. [/EDIT]

I’m excited to announce that my talk was accepted and I’ll be speaking at ToorCamp this year! I’ll be giving a heavily augmented version of my peoplehacking talk, and including subject matter about kinesics, NLP and lie-detecting methodology.

If you’re into hacking people, or have any aspirations to get better at spotting liars, show up – if I have my way this will be a ‘kaminsky style’ talk – except I drink scotch.

Posted in Uncategorized | No Comments »

Hacking without computers

Wednesday, May 13th, 2009

I’ve mentioned to folks before that “security isn’t what you think it is”. Every device is suspect, even printers. Here’s an example video I’ve made demonstrating how an attacker can gain an administrative shell on an XP box using an iPod Touch and Metasploit. This video is best viewed in high-def.



Tags: , , , , , , ,
Posted in Uncategorized | 2 Comments »

Twitter phishing scam

Monday, January 5th, 2009

So here’s the scoop:

The phishers phish more than just banking websites – twitter is vulnerable to this just like any other websites that take login information.

That being the case the phish is simple: You’re sent to a website that looks just like twitter, but isnt.

The site isnt twitter – so don’t give them your password!

Apparently people dont think phishers target twitter (well maybe not after today). Some high profile accounts were hacked today:

Britney Spears, Rick Sanchez from CNN, Fox News, Facebook, Barack Obama and The Huffington Post.

The need for security is everpresent. Please, watch where you’re going.

If you think you’ve been compromised, change your passwords immediately – and that doesn’t mean adding a 1 to the end of it.

I’ll be adding this subject matter to the security 101 talk happening at RefreshSD in San Diego at the Qualcomm campus on the 13th.

Posted in Uncategorized | No Comments »

Security101, but better!

Monday, December 1st, 2008

A friend of mine, Damon (@dacort) recently put together a formal class to illustrate some of the vulnerabilities he’s found.

This class was geared more towards php and rails rather than a sort of ‘introduction to personal security’, and went over things like cross site scripting, cross site request forgery, sql injection, and using really neat tools that I didn’t know about to enumerate databases behind vulnerable web apps.

REALLY REALLY neat stuff. If you’ve been to any of my talks, you should watch Damons.

He can be found over at startupsecurity.info

StartPad Countdown 2 – Startup Security: Hacking and Compliance in a Web 2.0 World

View SlideShare presentation

Posted in Uncategorized | No Comments »