Brakeing Down Security Podcast Blog: January 2017

Sunday, January 29, 2017

2017-003-Amanda Berlin at ShmooCon

Amanda Berlin attended Shmoocon this year, and sat down with a few people. She discussed a bit with John about what HackEd is about (http://hackeducate.com/)

Amands writes: "I had an amazing time at my 3rd #Shmoocon. I was able to interview a handful of really cool people working on several different types of infosec education. I was able to watch a few talks, spend some time in the lockpick village, as well as go to Shmoocon Epilogue. It’s always amazing to watch people talk about what they are passionate about, and Shmoocon is a great relaxed environment where that happens frequently."

James Green @greenjam94
Aaron Lint @lintile
Jon? @hackeducate

Melanie Rich-Wittrig @securitycandy

Amanda Berlin attended ShmooCon this year, and sat down with a few people. She discussed a bit with John about what HackEd is about (http://hackeducate.com/)

Melanie Rich-Wittrig (@securitycandy) discusses how she's empowering kids to get into information security, even as early as age 10 or 11. She discusses how she motivates by teaching CTF and hacking concept, and gamifying by using point systems.

www.securitycandy.com

RSS: http://www.brakeingsecurity.com/rss

Direct Link: http://traffic.libsyn.com/brakeingsecurity/2017-003-ShmooCon_Audio.mp3

YouTube:

----------

HITB announcement:

“Tickets are on sale, And entering special code 'brakeingsecurity' at checkout gets you a 10% discount". Brakeing Down Security thanks #Sebastian Paul #Avarvarei and all the organizers of #Hack In The Box (#HITB) for this opportunity! You can follow them on Twitter @HITBSecConf. Hack In the Box will be held from 10-14 April 2017. Find out more information here: http://conference.hitb.org/hitbsecconf2017ams/

---------

Join our #Slack Channel! Sign up at https://brakesec.signup.team

#RSS: http://www.brakeingsecurity.com/rss

#Google Play Store: https://play.google.com/music/m/Ifp5boyverbo4yywxnbydtzljcy?t=Brakeing_Down_Security_podcast

#SoundCloud: https://www.soundcloud.com/bryan-brake

Comments, Questions, Feedback, or Suggestions? Contact us via Email: bds.podcast@gmail.com

#Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir

#Facebook: https://www.facebook.com/BrakeingDownSec/

#Tumblr: http://brakeingdownsecurity.tumblr.com/

#Player.FM : https://player.fm/series/brakeing-down-security-podcast

#Stitcher Network: http://www.stitcher.com/s?fid=80546&refid=stpr

#TuneIn Radio App: http://tunein.com/radio/Brakeing-Down-Security-Podcast-p801582

----------

Here is a new episode of Brakeing Down Security Podcast!

Saturday, January 21, 2017

2017-002: Threat Lists, IDS/IPS rules, and mentoring

In your environment, you deal with threats from all over the world. Many groups out there pool resources to help everyone deal with those #threats. Some come in the form of threat #intelligence from various intelligence companies, like #Carbon #Black, #FireEye, and #Crowdstrike.

But what if your company cannot afford such products, or are not ready to engage those types of companies, and still need need protections? Never fear, there are open source options available (see show notes below). These products aren't perfect, but they will provide a modicum of protection from 'known' bad actors, SSH trolls, etc.

We discuss some of the issues using them, discuss how to use them in your #environment.

Lastly, we discuss #mentorship. Having a good mentor/mentee relationship can be mutally beneficial to both parties. We discuss what it takes to be a good mentee, as well as a good mentor...

RSS: www.brakeingsecurity.com/rss

Direct Download: http://traffic.libsyn.com/brakeingsecurity/2017-002-mentoring_threat_lists.mp3

iTunes:

YouTube:

----------

HITB announcement:

---------

----------

Show Notes:

HANGOUTS: https://hangouts.google.com/call/w7rkkde5yrew5nm4n7bfw4wfjme

2017-002-Threat Lists, IDS/IPS rulesets, and infosec mentoring

Threat Lists (didn’t have much time to research :/)
1. THIS EXACTLY - http://blogs.gartner.com/anton-chuvakin/2014/01/28/threat-intelligence-is-not-signatures/
2. 1. Don’t use threat list feeds (by IP/domain) as threat intelligence
  2. Can use them for aggressively blocking, don’t use for alerting
3. https://isc.sans.edu/suspicious_domains.html
4. https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt
5. http://iplists.firehol.org/
6. https://zeltser.com/malicious-ip-blocklists/
7. https://medium.com/@markarenaau/actionable-intelligence-is-it-a-capability-problem-or-does-your-intelligence-provider-suck-d8d38b1cbd25#.ncpmqp9cx
8. Spamhaus: https://www.spamhaus.org/
9. leachers
1. Open rulesets - You can always depend on the kindness of strangers
  1. Advantage is that these are created by companies that have worldwide reach
  2. Updated daily
  3. Good accompanying documentation
2. You can buy large rulesets to use in your own IDS implementation
  1. Depends on your situation if you want to go managed or do yourself
  2. Regardless you need to test them
3. Managed security services will do this for you
  1. I don’t recommend unless you have a team of dedicated people or you don’t care about getting hacked- signatures are way too dynamic, like trying to do AV sigs all by yourself
  2. Only a good idea for one-off, targeted attacks
4. DIY
IDS/IPS rulesets
1. https://securityintelligence.com/signature-based-detection-with-yara/
2. http://yararules.com/
3. http://resources.infosecinstitute.com/yara-simple-effective-way-dissecting-malware/
Yara rules
1. For Mentors
2. 1. Set expectations & boundaries
  2. Find a good fit
  3. Be an active listener
  4. Keep open communication
  5. Schedule time
  6. Create homework
  7. Don’t assume technical level
  1. Ask questions
  2. Do your own research
  3. Find a good fit
  4. Put forth effort
  5. It’s not the Mentor’s job to handhold, take responsibility for own learning
  6. Value their time
  7. Come to each meeting with an agenda
3. For Mentees
4. Mentoring frameworks?
InfoSec Mentoring
1. https://t.co/mLXjfF1HEr
2. https://gist.github.com/AFineDayFor/5cdd0341a2b384c20e615dcedeef0741
Podcasts

Here is a new episode of Brakeing Down Security Podcast!

Wednesday, January 11, 2017

2017-001: A New Year, malware legislation, and a new cast member!

We start Brakeing Down Security with a huge surprise! A 3rd member of the podcast! Amanda #Berlin (@infosystir) joins us this year to help us educate people on #security topics. During the year, she'll be getting us some audio from various conventions and giving us her perspective working as an #MSSP, as well as a blue team (defender).

We start out talking about new #California l#egislation about making #malware illegal. What are politicans in California thinking? We work through that and try to find some understanding.

With all the various secure messaging systems out there, we discuss how why secure messaging systems fail so poorly with regards to #interoperability and the difficulties in getting average non-infosec people to adopt one. We also discuss #Perfect #Foward #Security and how it prevents people from decrypting old messages, even if the key is compromised.

----------

HITB announcement:

---------

---Show Notes---

News story:

http://www.latimes.com/politics/la-pol-sac-crime-ransomware-bill-20160712-snap-story.html

“If this legislation gives prosecutors the tools that they didn’t have before, where are the cases that they have lost because they didn’t have these tools?” said Brandon Perry, a senior consultant for NTT Com Security. “Authorities are focused on prosecuting criminals that they can’t even find, as opposed to educating the victims to prevent this from happening again and again.”

Ransomware won’t infect you if you watch training videos:

http://thehackernews.com/2017/01/decrypt-ransomware-files.html

Secure messaging - stuck in an Apple ecosystem

Too many, no interoperability

Signal, Whisper, Wickr, Wire, WhatsApp, FB messenger

I uninstalled Signal… can’t convince people to adopt something if everyone cannot message one another --BrBr

OpenPGP is ‘dangerous’

http://arstechnica.com/information-technology/2016/12/signal-does-not-replace-pgp/

Forward Secrecy - https://en.wikipedia.org/wiki/Forward_secrecy

“A public-key system has the property of forward secrecy if it generates one random secret key per session to complete a key agreement, without using a deterministic algorithm.” (input given gives the same output every time)

Perfect Forward Secrecy - “In cryptography, forward secrecy (FS; also known as perfect forward secrecy[1]) is a property of secure communication protocols in which compromise of long-term keys does not compromise past session keys.

Ms. Amanda’s pentest homework:

“https://docs.google.com/document/d/17NJPXpqB5Upma2-6Hu5svBxd8PH0Ex7VgCvRUhiUNk8/edit”

Here is a new episode of Brakeing Down Security Podcast!