From Security Weekly Wiki
Jump to navigationJump to search

Episode Media

Episode 319


Announcements & Shameless Plugs

PaulDotCom Security Weekly - Episode 319 for Thursday February 7th, 2013

  • The Stogie Geeks Show! - Kick some ash with the Stogie Geeks, Thursday nights at 8:30PM EST. Come have a cigar with us!

Interview: Wendy Nather

Wendy Nather is Research Director of the 451 Research Enterprise Security Practice. With over 20 years of IT experience, she built and managed the IT security program at the Texas Education Agency, where she directed multimillion-dollar initiatives for a statewide external user base of over 50,000. She has also provided security guidance for the datacenter consolidation of 27 Texas state agencies.

  1. How did you get your start in information security?
  2. What are some of the major security problems organizations face today?
  3. What is the number one thing organizations are doing wrong when it comes to security?
  4. In the SEIM space, what are people doing right? What are people doing wrong?
  5. How has the firewall changed over the years and where does it fit into your defenses?
  6. What kinds of things do you recommend people look for in a penetration test?
  7. What is the best form of self-assessment people can do to secure their environments?
  8. I've come up with the 3-legged stool of vulnerability management: 1) Network-based scanning 2) Patch verification 3) Configuration auditing for compliance and system hardening What are your thoughts on that?
  9. What is predominately more of a problem for security: Lack of staffing, lack of the right staffing, burned out staff, poor management at a higher level?
  10. What are the top 3 things that C-level executives misunderstand about security?
  11. What is the most challenging thing you've had to face in your career and how did you overcome it?

Five Questions:

  1. If you were a serial killer, what would be your weapon of choice?
  2. Three words to describe yourself?
  3. If you had to write a book about yourself, what would it be?
  4. Stranded on a dessert island, which tablet would you take with you if you could only choose one: iPad, Android or Surface?
  5. In the popular game of ass grabby-grabby would you prefer to go first or second?


  • Join us on our 4th ever Google+ Hangout! Add PaulDotCom on Google+ and join us in the Google Hangout.
  • Special Mardi Gras recording on Tuesday the 12th featuring a special appearance by Jack Daniel's beads!
  • We are in the process of archiving and cataloging our technical segments, please visit the PaulDotCom Technical Library and we indexed all of the interviews we have conducted. We are also working on updating all of the articles, so check the newsletter or if you want to help in exchange for some free guidance and security training please email me.

Tech Segment: Active Defense Harbinger Distribution with Ethan Robish

Ethan Robish is a researcher with Black Hills Information Security and is here to give us some of the background on a suite of tools for the Offensive Countermeasures class - Active Defense Harbinger Distribution.

The Active Harbinger Defense Distribution (ADHD) is a Linux distro based on Ubuntu 12.04 LTS. It comes with many tools aimed at active defense preinstalled and configured. The purpose of this distribution is to aid defenders by giving them tools to "strike back" at the bad guys.

ADHD has tools whose functions range from interfering with the attackers' reconnaissance to compromising the attackers' systems. Innocent bystanders will never notice anything out of the ordinary as the active defense mechanisms are triggered by malicious activity such as network scanning or connecting to restricted services.

The ADHD project has now been released and can be found at Sourceforge. The version used in the Tech Segment is 0.4.1 and the tools demoed are Honey Badger and Nova.


Paul's Stories

  1. Anatomy of a bug – how Mac OS X chokes if you say “FILE” | Naked Security - Pretty neat crash bug in OS X. OS X is growing as a target for attackers even more than ever before (not that that's saying all that much).
  2. 48th Largest Prime Number Discovered - Wow, that's just geeky. Prime numbers are so sexy, and I guess this is a case where size matters.
  3. Joy of Tech™: Vine - Its so true, as technology becomes even more of a part of our lives, our attention span shortens. A 3-minute video is way too long. Our show is way too long. Prime numbers are way too big.
  4. A Gift For Hackers [Video] - More stuff on printer hacking. Why is that the easiest problems to solve often take the most time? We seem to be caught up in compliance, firewalls, application security, but we leave a printer exposed to the Internet.
  5. Federal Reserve confirms its Web site was hacked - Turns out there was no money in it though...
  6. Improve your security in four easy but rarely implemented steps - So while this article talks about your Google account, its a lesson for enterprise security. Password length is important, force users to use longer passwords. Two-factor authentication is key to preventing password attacks. Review your settings, I've been researching configuration auditing, and I want to hear from people who are doing this well. Not only harden your systems, but keep up with it and maintain your own standard. Yea, its hard. Yea, it requires that people work together, but it has huge benefits. The last one is more of the same, know your environment. I want to know how many people actually scan the perimeter on a regular basis.
  7. China is world's most malware-ridden nation - So all those attacks coming from China are really just coming from whoever controls the malware. Just sayin'
  8. Critical bug threatens hospital systems - If there are bugs in the hospital, I'm worried. Obamacare joke anyone?

Larry's Stories

We told you… - [Larry] - …HD Moore scanned and exploited. What did we tell you? To shut off uPNP., before it was because if you're too stupid to configure outbound rules on your firewall and allow a tool to do it for you on an ad-hoc as needed basis, you should not be needing inbound connections. Now, there is a single Packet UDP exploit for it, for amlost every device - of which there are millions of devices connected to the internet based on HD's scanning.

Lucky 13, Lucky Strike - [Larry] - The attacks against SSL just keep coming. First the number 5, then BEAST, then CRIME. Now combine Beast with 13, and researchers have been able to reverse cyphertext to plaintext for SSL/TLS by abusing the padding Oracle, CBC, and the TLS MAC Calculation. Math Hard. My question is, when will TLS/SL be broken for the common man (IE Wright's Law), and who is working on the replacement - this stuff takes time and needs academic/peer review.

[Intel Gigabit packet of death] - [Larry] - Need more info…

Facebook Graph Search - [Larry] - Wow, neat stuff. too bad I'm waitlisted for beta access. Let's discuss...

Jack's Remembrances of Girls Gone Wild

Remembrances? I don't remember anything. Get off my lawn.

  1. Catch22's in Vulnerability Management and interesting thread on the Daily Dave. Make sure you follow it through to Marc Maiffret and Ron Gula's comments.

Allison's Stuff (last time I went wild I broke a computer)

  1. I published my GCIA gold paper so I'm just gonna link it here I wrote it about digital watermarks. Some techniques used, and how to detect them. Educate yourself! Maybe I'll make a tech segment out of this stuff later.