Changes

From Security Weekly Wiki
Jump to navigationJump to search
5,224 bytes added ,  00:56, 11 October 2014
m
Text replacement - "PaulDotCom SANS" to "Security Weekly SANS"
= Announcements & Shameless Plugs =
Live from the PaulDotCom G-Unit Studios Welcome to PaulDotCom Security Weekly, Episode 120 121 for August 28stSeptember 4th, 2008
Welcome to PaulDotCom Security Weekly, a show for security professionals, by security professionals.
* [http://pauldotcomsecurityweekly.com/sans/ PaulDotCom Security Weekly SANS Click-Through] - Go there, register for fabulous SANS training! Go now!
* [http://www.whitewolfsecurity.com/ice2.htm ICE (Integrated Cyber Exercise) - Oct. 1-3 at SANS Las Vegas!] - Interview in this episode!
* NS2008! Paul giving keynote: Things That Go Bump In The Network: Embedded Device (In)Security and teaching SEC535, Network Security Projects Using Hacked Wireless Routers! Don't forget our live podcast immediately following!
* A retraction about no java on the blackberry. I'm an idiot, the OS is java based. duh.
 * [http://www.sans.org/mentor/details.php?nid=12904 "I met you yesterday at SANS and was wondering if you could help me promote my mentor session of SEC508 starting on September 23rd. If you could forward this invitation onto your network of contacts, that would be awesome."] - Evan* Beer, Facebook, Linkedin, Twitter =Episode Media= [http://media.libsyn.com/media/pauldotcom/pauldotcom-SW-episode121pt1.mp3 mp3 pt 1] [http://media.libsyn.com/media/pauldotcom/pauldotcom-SW-episode121pt2.mp3 mp3 pt 2] = White Wolf Interview = * So, tell us about this year's ICE games at SANS Las Vegas! * What are the rules? * What kind of systems will there be to hack into? * How does the scoring work? * Will there be fabulous prizes? * How does the game work each night? * What tools will be available to each team? = Interview: Kismet - Mike Kershaw, Renderman, Thorn = * So, for those that may not know, what is Kismet? Why should you use it? What platforms does it run on? * What are the differences in the branches of Kismet? (Stable, dev, and new-core) * Describe some of the challenges to wireless sniff, wireless IDS, and wardriving * What hardware do you recommend for wireless penetration testing? * So, whats in the book? What do people learn from reading the book? * Tell us about wi-spy and how it integrates * How can IT professionals use Kismet to help them in their jobs? Detect Rogue access points? * What are some interesting or creative usages for Kismet?
= Listener Feedback: Listener Scott Is Evil =
= Stories Of Interest =
[http://www.whitewolfsecurity.com/publications/biometric_locks.php Hacking Biometric Locks] [http://securityvulns.com/Udocument435.html VMware Releases A TON of Patches] - [Paul Asadoorian] - Patches still pending for VM Fusion, WTF! You should patch, its important, especially because the security of multiple machines is at risk, in a platform independent kind of way. [http://www.heise-online.co.uk/security/Chinese-resarchers-use-heartbeats-against-implant-hacking--/news/111463 Body entropy?] - [Larry] - We talked about hacking medical implants a few weeks back. These researchers are utilizing a biometric footprint to derive the key. They measure the interval between 16 heartbeats down to the millisecond, and combine it with photoplethysmograp (PPG - the measurement of light absorption under the skin relative to pulse), and use it to generate a 64 bit key. Now, cetainly a 64 bit key might be weak, but it is an interesting concept... [http://blog.ncircle.com/blogs/vert/archives/2008/09/the_browser_with_bling.html Chrome is Shiny, but scratches easily] - [Paul Asadoorian] - Oh hey look, a new web browser! And look, vulnerabilities in the new web browser! Who would have thought? All software has vulnerabilities, especially new software. People have been hacking away at Firefox for quite some time, and they do a decent job of keeping things patched. Sure, they implement new features, which then could present software vulnerabilities, but they get fixed in a timely manner, a manner which best fits with my security requirements, so I am sticking with Firefox. Lets not even talk about IE, a browser still plagued with security flaws, and ones that don't get fixed until MS decides to bless us with their holy than thou bi-monthly patches. [http://packetstormsecurity.org/0809-exploits/google-download.txt Chrome File download] - [Larry] - Sure, everyone is all over Google Chrome. Neat security model, but will it work. Aside form all of the neat-ness and failures, the browser is already being evaluated for security. Nerex has found that a very simple javascript allows for executables (or other content) to be downloaded, but not executed, to a victim machine without any user intervention. Safari does this, and apple bills it as a feature. :-( [http://howto.wired.com/wiki/Secure_Your_iPhone "Securing" Your iPhone] - [Paul Asadoorian] - I was excited about this article, until I read it. The first two items are implementing a 4 digit pass code, because that provides security, right. Then make sure your phone locks, well duh. And somehow re-mapping my home button protects my information, at least it prevents people from bypassing the lock and accessing my address book. Is that really security or just a workaround? The best part about the article? The screenshot of the iPhone shows they have 3 apps that need updating, doesn't keeping your software up-to-date apply to your phone as well? Also, none of this protects your information as it flys in clear text over open wireless networks... [http://www.hackinthebox.org/index.php?name=News&file=article&sid=28049 CSI Stick] - [Larry] - A neat little tool for cell phone "forensics" that works with Motorola and Samsung phones. This tool collects all of the SMS data, pictures, placed phone calls, e-mails, and phonebooks. The device runs $200 and requires a PC to attach it to. I wonder how this would compare to ay, LadyAda's simcard reader (at $17) for the kit. This goes along to some practices that Paul and I have done - having someone unsuspecting hand us their cell phone - which contains personal, potentially sensitive data! [http://www.bitpim.org/ bitpim] was the software mentioned by Mike Kershaw for accessing other phones with AT style commands. [http://www.theregister.co.uk/2008/09/03/mythbusters_gagged/ Mythbusters Prevented From Running RFID Hacking Show] - [Paul Asadoorian] - Conflicting stories abound, it appears that CC companies do not want RFID shortcomings to be public knowledge. I don't think that talking about RFID hacking and vulnerabilities is a crime, so look for some things coming soon.:''[http://www.adamsavage.com/ Adam Savage] (Mythbusters co-host) discussed this as The Last H.O.P.E. You can see the relevant part of his talk [http://www.youtube.com/watch?v=X034R3yzDhw here] on youtube.''
[http://securityvulnsfeeds.feedburner.com/Udocument435.html VMware Releases A TON of Patches~r/elwoodnet/~3/382326799/48559370 Information must be free] - [PaulDotComLarry] - Patches still pending Along the lines of the MIT charlie card hackers, one group being told to be quiet about a weakness or vulnerability is bad, because that just opens the door for VM Fusionothers to start talking about it. The Mythbusters wanted to talk about the huge insecurities in RFID, WTF! and contactless payment systems based on rfid on the show. You should patchwhen they set up a call with the manufacturers to get specs, its importantthe lawyers got involved and it appears that Discovery got pressured into not running the story. However, especially because researchers have been saying that this stuff is bad for a long time. Remember the security of multiple machines is at risk, in story about reading paypass data with a platform independent kind of waymodified reader? It just didn't make it to prime time TV. [http://www.theregister.co.uk/2008/09/04/mythbusters_rfid_backtrack/a possible backpedal]
[http://blogwww.ncircleschneier.com/blogs/vertblog/archives/2008/09/the_browser_with_blingsecurity_roi_1.html Chrome is Shiny, but scratches easilySecurity ROI] - [PaulDotComLarry] - Oh hey look, There is just too much to talk about here in a new web browser! few short lines. And look, vulnerabilities in the new web browser! Who would have thoughtDoes RIO for security work? All software has vulnerabilities, especially new software. People have been hacking away at Firefox for quite some time, and they do a decent job is the RIO more of keeping things patched. Sure, they implement new features, which then could present software vulnerabilities, but they get fixed in a timely manner, soft cost (IE preventing a manner which best fits with my security requirementsbreach, so I am sticking with Firefox. Lets not even talk about IE, a browser still plagued with security flawsremediating, cleanup and ones that donlegal/community view issues) Let't get fixed until MS decides to bless us with their holy than thou bi-monthly patchess discuss.
[http://howtowww.wireddarkreading.com/wiki/Secure_Your_iPhone "Securing" Your iPhonedocument.asp?doc_id=162800&f_src=darkreading_section_297 HP Adds Smart Card Readers to HP Printers] - [PaulDotComPaul Asadoorian] - I was excited about this articleOkay, until I read it. The first two items are implementing here's a 4 digit pass codenewsflash, because that provides authentication is not the major security, right. problem on printers and multi-function devices!!!!! Then make sure your phone locksHow about implementing software without vulnerabilities, well duh. And somehow re-mapping my home button protects my informationusing secure protocols to transfer data, at least it prevents people from bypassing hardening the lock operating system, and accessing my address book. Is that really security or just a workaround? The best part about encrypting the articlefiles/filesystem? The screenshot of the iPhone shows they Now you have 3 apps that need updatingno excuse, doesn't keeping your software up-to-date apply if you are building on technologies such as smart cards to your phone as well? Alsothese devices, none you can implement all of this protects your information as it flys in clear text over open wireless networks..the other security measures.
[http://www.theregisterphiprivacy.co.uk/2008/09/03/mythbusters_gaggednet/ Mythbusters Prevented From Running RFID Hacking Show?p=634 Paper records too] - [PaulDotComLarry] - Conflicting stories aboundWhile not really a tech problem, it appears don;t forget about all of that stuff that CC companies do not want RFID shortcomings to be public knowledgeyou print. I don't think that talking about RFID hacking guess ultimately it comes down to appropriate record retention (backup tapes anyone) and vulnerabilities is appropriate storage. Want lots of data, go after the backup tapes, or where they were stored. This gentleman was able to buy the contents of a crimestorage unit at auction for $25, contents sight unseen. the contents had medical data, so look ripe for some things coming soonidentity theft. What if this had been your backup tapes?
[http://www.darkreadingshadowserver.comorg/documentwiki/pmwiki.aspphp?doc_idn=162800&f_src=darkreading_section_297 HP Adds Smart Card Readers to HP PrintersStats.BotCounts Botnet Counts: For Good Measure] - [PaulDotComPaul Asadoorian] - OkaySome really cool graphs on the number of botnet drones, here's a newsflash, authentication is not yes they have sharply increased over the major security problem on printers and multi-function devices!!!!! past few months. How about implementing software without vulnerabilitiesHowever, using secure protocols to transfer dataeven more frightening, hardening the operating systemnumber of C&C servers increased ([http://www.shadowserver.org/wiki/pmwiki.php?n=Stats.BotnetCharts Reference]). This means, more drones and more individual botnets, confirming suspiciouns that botnets are more abundant and perhaps purpose built to avoid detection and encrypting eventual shutdown. The reason, seems to correlate with the files/filesystem? rising SQL injection flaws. Now you have no excuseSQL injection flaws, ah yes, if you I've responded to incidents where these flaws are rampent. I also think that targeted phishing attacks are building on technologies such more common as smart cards to these deviceswell, you can implement all of the other security measuresespecially in university settings.
[http://www.shadowserverschneier.orgcom/wikiblog/pmwikiarchives/2008/09/software_to_fac.php?n=Stats.BotCounts Botnet Counts: For Good Measurehtml Hacking so easy my mom can do it] - [PaulDotComLarry] - Some really cool graphs on the number of botnet drones, yes they have sharply increased over the past few months. However, even more frightening, the number of C&C servers increased ([http://www.shadowserver.org/wiki/pmwiki.php?n=Stats.BotnetCharts Reference]). This means, more drones and more individual botnets, confirming suspiciouns that botnets are more abundant and perhaps purpose built to avoid detection and eventual shutdown. The reason, seems Software to correlate with cook the rising SQL injection flaws. SQL injection flaws, ah yes, I've responded to incidents where these flaws are rampent. I also think that targeted phishing attacks are more common as well, especially in university settingsbooks at restaraunts.

Navigation menu