Episode431

From Paul's Security Weekly
Jump to: navigation, search


Paul's Security Weekly - Episode 431 - 6:00PM

Episode Media

MP3

Intro, Sponsors & Announcements

Paul

This week we interview Phil Young and Chad Rikansrud on the topic of hacking mainframes and their recent Defcon presentation. Stories of the week will include Barbie Swiss Army knives, evil Cisco firmware, and some possible ways to give your security team a fighting chance. All that and more so stay tuned!

Larry

Broadcasting live from G Unit Studios in Rhode Island, the show where exploits run wild, packets aren’t the only things getting sniffed, systems aren't the only things getting penetrated, functions are the only things getting wrapped, bits aren't the only things getting banged and the cocktails flow steady its Paul’s Security Weekly!

  • This segment is sponsored by The SANS institute the most trusted source for computer security training, certification and research. visit www.sans.org to learn more
  • And by Tenable Network Security, creators of Nessus, the world's best vulnerability scanner! Jumpstart your security program today and evaluate SecurityCenter CV, THE continuous monitoring solution. www.tenable.com
  • Brought to you by Black Hills Information Security, the leaders in penetration testing and active defense. Email consulting@blackhillsinfosec.com to request a quote today!

Now, fire up a packet capture, pour yourself an adult beverage, and give the intern control of your botnet...

Larry: Here's your host, <FUNNY COMMENT HERE> Paul Asadoorian!"

Paul: Hello everyone and welcome to Paul's Security Weekly - Episode 431 for Thursday, August 20th 2015

Announcements

EmbedVideo received the bad id "EC48dLB1Wr4"" for the service "youtube".
  • Purchase Hack Naked T-Shirts and stickers online at http://shop.securityweekly.com get yours today! For a limited time only use the discount code "HACKNAKEDSUMMER" and get 50% your order! Its a summer blow-out sale and ends on September 23, 2015 (The first official day of fall).
  • Larry teaching SANS 617 Wireless Ethical Hacking and Defense coming up in Las Vegas, NV, September 14-19, and the Pentest Hackfest in November in Washington, DC and lots more places so be certain to check the SANS web site for more course offerings!

Guest Interview: Phil Young and Chad Rikansrud - 6:05PM-6:55PM

Chad Rikansrud Bio

Chad Rikansrud (aka Bigendian Smalls) has been making, breaking, programming and networking computers since Google was Gopher and AOL trial CDs were more than just hipster coasters. Currently he leads a technology department at a large financial institution, and is charged with the integrity, availability and security of the enterprise's mainframe data.

Recently, he's teamed up with Phil "Soldier of Fortran" Young to both develop a serious penetration testing methodology and toolset for the mainframe, and to educate and recruit people to dig into this amazing platform. Chad spoke on this topic with Phil at the most recent DEFCON and is giving another talk about Mainframe Security at the upcoming Derbycon 5.0!

Links

  1. Personal Website
  2. Personal Website
  3. Twitter
  4. GitHub

Phil Young Bio

Phil Young, aka Soldier of Fortran, is a mainframe security researcher and pentester. He works full time testing mainframes and their security. He has spoken on the topic of mainframe security at BlackHat, DEFCON, Shmoocon, BSidesLV and others. In his spare time he also runs the 'Internet Mainframe Project' dedicated to finding cool tn3270 screens on the internet for some scary sounding mainframes. He's developed multiple tools for the platform including SET'n'3270, a tn3270 'phisher', an NMAP TN3270 emulator as and custom scripts/libraries to help with pen these massive beasts.

Links

  1. Personal Website
  2. Personal Website
  3. Github
  4. GitHub
  5. Twitter

Find all the things (slides, video, Githubs) on Phil's web site: http://mainframed767.tumblr.com/

Questions/Topics

  1. How did you get your start in information security?
  2. Are there CVE's for IBM's z/OS?
  3. Does IBM and its customers not care about security or are they content with security through obscurity?
  4. How old are some of the protocols and associated manuals and books you reference?
  5. Certainly Nmap is up-to-date and can scan a Mainframe?
  6. Tell us about the Nmap modules you wrote
  7. What are the attack vectors and vulnerabilities that led to your successful exploits?
  8. How easy/difficult is it to discover, write and test exploits? (Assuming you can run z/OS in a VM)
  9. What's in store for the future of mainframe security?

Five Questions

  1. Three words to describe yourself.
  2. If you were a serial killer, what would be your weapon of choice?
  3. If you wrote a book about yourself, what would the title be?
  4. In the popular game of ass grabby-grabby, do you prefer to go first or second?
  5. Choose two celebrities to be your parents.

Stories of the Week - 7:00PM-8:00PM

EmbedVideo received the bad id "z9U8cLQtTk0"" for the service "youtube".

Sponsors

  • Brought to you by Pwnie Express - Check out the community edition and turn your Nexus 7 into a lean and mean pen testing machine. For all those hard to reach places, there's Pwnie Express, visit them on the web at http://pwnieexpress.com
  • And by Onapsis the leading provider of solutions to protect ERP systems from cyber-attacks. Customers can secure their SAP and Oracle business-critical platforms from espionage, sabotage and financial fraud risks. Visit them on the web at http://www.onapsis.com/
  • And by Netsparker, the developers of the ONLY false positive free web application security scanners, enabling you to automatically identify vulnerabilities and security flaws in all your websites, web applications and web services. Netsparker scanners are available in two editions, Netsparker Desktop and Netsparker Cloud, the enterprise level online scanning service. For more information visit their website on https//www.netsparker.com/securityweekly/

Announcements

  • Submit your B-Sides Tampa CFP here. This is a four night cruise, the conference is two full days at sea with a stop in Cozumel Mexico. Accepted talks receive a free cabin for two.

Day 1 - depart in the afternoon

Day 2 - Sea day (BSides day 1)

Day 3 - Cozumel, Mexico

Day 4 - Sea day (BSides day 2)

Day 5 - Back at Tampa

Paul's Stories

  1. Yet another Android security flaw: This time EVERYTHING is affected
  2. DIY Swiss Army Barbie multi-tool is ready for anything
  3. Industrial Control System Owners Unaware of Internet Connectivity
  4. Attackers are hijacking critical networking gear from Cisco
  5. Four Often Overlooked Factors to Give Your Security Team a Fighting Chance
  6. Vulnerabilities Identified in Several WordPress Plugins
  7. Facebook Awards $100
  8. Ambient Sound Could Be The New Two-Factor Authentication System
  9. Uber is going on a security hiring binge
  10. Linus Torvalds on the state of software security
  11. Microsoft Drops Rush Internet Explorer Fix For Remote Code Exec Hole
  12. Zero Day Flaw Found In Mac OS X Yosemite Security Update

Larry's Stories

  1. Domain admin in 17 seconds
  2. DNS Love
  3. SEP pwnages
  4. FCC fines for wifi dos