Episode186

From Paul's Security Weekly
Jump to: navigation, search
Palo Alto Networks
Tenable Network Security
The SANS Institute
Pwnie Express
Black Hills Information Security
BlackSquirrel
Onapsis

Sponsors

  • Tenable Network Security - This episode sponsored by Tenable network security. Tenable is a developer of enterprise vulnerability, compliance and log management software, but most notably the creators of Nessus, the worlds best vulnerability scanner. Tenable Security Center software extends the power of Nessus through reporting, remediation workflow, IDS event correlation and much more. Tenable also offers a Nessus Professional Feed to detect vulnerabilities in your network today! Tenable – Unified Security Monitoring!
  • Core Security - This episode is also sponsored by Core Security Technologies, helping you penetrate your network. Now version 10.0 with WiFi-fu good to go! Rock out with your 'sploit out! Listen to this podcast and qualify to receive a 10% discount on Core Impact, the worlds best penetration testing tool.
  • Trustwave Spiderlabs - Trustwave's SpiderLabs - providing advanced information security services to planet Earth. Visit them online at trustwave.com/spiderlabs!

Shameless Plugs & General Announcements

Security Weekly - Episode 186 - For Thursday February 11th, 2010

  • QuahogCon - This will be the next conference that we will be attending. We will have t-shirts and other special things to give away and sell. No, we are not selling the interns (who will both be there, btw). So come and enjoy what's sure to be a great Con!

Episode Media

mp3 pt 1

mp3 pt 2

Guest Interview: David Hoelzer

INFO

David is most often associated with the SANS Institute as the author of more than twenty days of SANS courseware and as a high scoring instructor and expert in a variety of Information Security fields.

Before founding Cyber-Defense, David served as the Director of GIAC, the world renowned security certification associated with The SANS Institute. While in this post, David oversaw the entire certification program and the creation of a number of GIAC certifications. Most notably, he brought the original GIAC Security Expert (GSE) certification to life, serving as the primary exam author and grader for what is widely considered to be the most difficult certification in the security field.

Prior to his association with SANS, David served as a senior network engineer and later as the security project manager for Standard Microsystems Corporation. David is currently the Chief Information Security Officer for CyberDefense, the parent company of Enclave Forensics. Within Enclave Forensics he serves as the Director of Research and a principal forensic examiner. In addition to day to day responsibilities, he has acted as an expert witness for the Federal Trade Commission and continues to teach at major SANS conferences, training security professionals from organizations including NSA, USDA Forest Service, Fortune 500 security engineers and managers, DHHS, various DoD sites, national laboratories and many colleges and universities. From time to time David also speaks nationally and internationally on various security topics. David holds a B.S.,I.T, Summa Cum Laude.

David is also an adjunct research associate of the UNLV Center for Cybersecurity Research, a SANS Technology Institute Fellow and a Research Fellow with the Identity Theft and Financial Fraud Research Operations Center (ITF/FROC), an NSA center of excellence.

Questions

  1. How did you get your start in information security?
  2. Where does compliance fit into the security program? Is compliance security? If its not, why do we need it?
  3. How can organizations best protect themselves from the so-called 0day threat?
  4. Imagine this scenario: You have just been put into the position of an IT auditor, what tips do you have for that person?
  5. What advice do you have for people just getting theit start in information security?
  6. Does certification matter?
  7. When is an audit, vulnerability scan, penetration test, and ethical hack approporiate?
  8. What are some of the greatest security challenges that we face today? Web applications? Client-side attacks?
  9. How can information security professionals best educate management about security? I used to use the word "Sell" but I don't anymore...
  10. What is your favorite security conferece and why?

Dan Crowley Windows File Pseudonyms

Here to discuss what he recently presented at Shmoocon.

Stories For Discussion

  1. Ownage via Twitpic - [Larry] - I wonder where the inspiration came from? Maybe my tweet about Adam Savage posting pics from his iPhone to twitter while standing in front of his house. Because of the nature of the iPhone, location data automatically gets added to photos…
  2. Pwning with PAINT?!? - [Mick] - Really? We can't have anything secure anymore? Sigh...
  3. We know what's in your wallet. - [Larry] Ok, well, this one is a little bit self serving. I will say that it is about time that we are finally getting the message about P2P over-sharing out to the masses.
  4. Botnet vs. Botnet - [Mick] - It's Zombie vs. Zombie in the cage match of the decade! There WILL be blood!
  5. Priva C. Eagle returns! - [Mick] - I'm thinking the Pre will be ditched in favor of tin cans and string.
  6. Buzz? More like BZZT! - [Mick] - Google Buzz made its debut and it's not all it could be. And yes, I *am* a hypocrite thank you very much.
  7. China takes down hacker site - [Mick] - Oh good show China! Way to start working on your tarnished image.
  8. Hacker site is back up! - [Mick] - weeeeeeell. That didn't last too long.
  9. Wireless More Security Than Wired? - [Paul] - Its an interesting topic, when I designed a wireless network it was more secure than the wired network. Seriously! With PEAP and 802.11x you had a layer of security that the wired network did not have. This is different though, and the article clasmes that ATMs and POS devices sound an alarm when you cut the cable, but with wireless there is no cable. Yea, seriously? "it¿s easier for a hacker to cut a wired connection than to cut a wireless connection" So, 2.4GHz jamming is hard? I have a laptop with a wireless card that would prove you wrong...
  10. Proprietary DECT Encryption Really Broken Now - [Paul] - Researchers have broken the cipher for DECT encryption. Meaning, if they collect enough traffic, they can decrypt the calls. First, don't ever rely on "proprietary encryption". Second, sounds very similar to WEP, and we all know how that went. They state this, "Sniffing an encrypted conversation with a USRP antenna and the average PC, an attacker would need to collect about four hours of data to break the key in typical scenarios." If you're lucky, maybe there's a teenage who will talk for hours. You can find Karsten Nolh' s web site here , but details of the paper have not yet been published. This project also uses a USRP, and now I just have to get one of these as it can be used to monitor not only DECT, but Bluetooth and GSM. Very handy (and oh, can't forget the obligatory FU FCC)
  11. P2P Snoopers Know whats in your wallet - [Paul] - What's in your wallet? (Lockpick set, condoms, Larry's phone number for booty calls, password to bank account). The problem is the world may know what's in your wallet. Two researchers from the critically acclaimed Security Weekly podcast, Larry Pesce and Mick Douglas, presented at Shmoocon the treasures that can be found laying around on P2P networks. They've also developed a tool to help automate discovery, but no official work on the release of said tool. Don't you hate it when people talk about a tool, then don't release it?
  12. Beat The New Anti-Texting Driving Laws! - [Paul] - Hide it in a book, they are still legal to use when driving. As are those gigantic maps, isn't an iPhone GPS better than a full-size map?
  13. Fonera Power-Over-Ethernet - [Paul] - This is such as cool hack! You can power yout Fonera from your USB port using POE!
  14. MiFi - Authentication Matters! - Love this one, a POST request to the configuration CGI gets through without authentication, FTW!
  15. Who should security report to? - [Security Weekly] - This one can be tricky. I've worked for a place where I was reporting through IT, and if I went to another organization, the secrity operations would not exist. So, its a balance, have security people who are actually responsible for security report up though IT, then have security do policy, procedures, vuln management, pen testing and incident reponse. will this work for everyone? no, but its a good start.

Other Stories Of Interest