#14: The Prime Directive, malware, and having a ball

The Prime Directive in pentesting... "Don't do anything outside the scope document". It's like the Fight Club rule. You don't go outside the scope of the pentest. You don't go playing around in environments you shouldn't, even if it's there.

But what happens when the scope document was made by someone other than people with an intimate knowledge of the assets involved, and can be called ambiguous at best? Is this like Star Trek, where breaking the Prime Directive is bad, but you do your best to notify as best you can, and stop when or if someone raises a flag?

When your organization engages a company to do a pentest, defining what systems are being tested and locking your scope down is paramount to having a good operation. Even after the document is agreed upon, speaking with the pentester doing the operation can clear up any issues that can arise. If the pentester does happen to exceed scope, don't berate him unnecessarily. Thank him for notifying them of the findings, and then explain to them that they are outside of scope. If they continue to do so, you should report them. Often, they may have seen something so glaring that they are ethically bound to mention it. I know that if I was doing a pentest or evaluation and it was a bank or business I used, I would definitely find a way to let them know.

You want to get the most bang for your money, so you give the pentester a decent amount of time to test things. You may even want to run preliminary nmap scans, nikto scans (if web apps are involved), or vulnerability scanners. This is very important info for the beginning of a pentest, but often takes the longest to do by the pentester. This is menial stuff that is a waste of good pentesting time. Plus, a professional pentest shouldn't be adversarial in nature. Unless, of course, it's supposed to be... :)

I know in my last post, we were going to have an interview with Michael Gough (Twitter @hackerhurricane) from MI2 Security about Malware and APT attacks. In talking with him after our monthly ISSA meeting, we figured out that we could do a multi-part interview on Malware and APT. He also mentioned in our ISSA meeting that there had been 6 additional retailers that had been breached. We found out today (25 January) in a blog post from Brian Krebs, that Michaels' and it's subsidiary Aaron's Brothers were hit. That leaves 5 more retailers to through.

My guess is that WalMart is involved, and the only other one I'd imagine would be Kohl's... I don't know why, but those two are always on my mind when this story keeps coming up.

I never have had as much fun doing security as when I started this podcast, blog, and learning how to market ourselves. We are learning a lot about different subjects. It's also taken me out of my comfort zone quite a bit, because I'm not good at talking with people that I don't know, or soliciting input from strangers. I want to get my name, my brand out there, and my palms get sweaty just asking people if they'd like to come on our podcast. I'm sure that it will get easier. It's like learning to edit audio or video, you're gonna suck at it at first.

Episode 3 will be up late tomorrow night, just in time for your earballs to enjoy on your Monday morning commute. Hope you enjoy it. Our meeting with Michael Gough will take place Wednesday, and we'll be able to bring you that two or three parter in the weeks to come...

#13: Vulnerability Scanners -- Episode 2

Episode 2 podcast

It's an odd thing editing audio. Some people make it look so easy. It helps having only two people on the podcast. This is not my first podcast to be on. My other podcast "Major Technicality", I am merely a contributor. And Jared, our producer, and co-host, spends several hours making everything sound just so.

Anyway, the audio will sound better on this one. Mic levels were dialed in, audio was normalized, and the crackling in the Intro is gone.

I really had a good time talking about vulnerability scanners. It's hard to believe that they've been around for over 20 years, and yet they haven't changed all that much. They still use concepts like banner grabbing, port scanning/knocking, and best guesses to scan a system for vulnerabilities. They should never be used as an end all be all, and truly on taken with a grain of salt.

Question all findings, trust nothing...

Next Friday, we'll be flush from our monthly ISSA meeting, which Michael Gough, from MI2 Security, will be discussing malware infection, and we are hoping to be able to get a few minutes with him. We'll have the interview spliced into the podcast, and we'll be able to continue our discussion about malware. Our first Interview! SQUEEEE!

I would have loved to speak about the other web application security scanners, but I really have only used Burp Suite. Brian and I will be attending SEC542 at the SANS convention 3-8 February in Austin, and we will definitely have one or more podcasts about web application pentesting and security assessment of websites.

Here are the show notes for this week:

Episode 2 show notes

#12: Here it is folks! Episode #1!

I hate sound editing.  I hate the sound of my voice when it's not reverberating in my head.  But doing this was all worth it. HERE IT IS!!!!  Episode #1 of "Brake"ing Down Security!!!!!111ELEVENTY!!

It's all about hashes.  I have included the show notes below in case you want to do more research.

Here is the link to access it on LibSyn:

http://traffic.libsyn.com/brakeingsecurity/final1.mp3

LibSyn also gives us an easy RSS feed, and you can follow in your favorite Feed by using the following link:

http://brakeingsecurity.libsyn.com/rss

We will try to get into iTunes very soon, but I will be posting this on my LinkedIn, and Twitter.

There are errors... We are working out the issues.  Sometimes it only sounds like we are out of sync... we talk over each other...

Something for readers just of this blog... I will post the heretofore unpublished first try of our podcast...  I give you EPISODE 0!!!  A prequel, if you will.  This was our first try at the podcast in our office.  We jumped around a little too much, which is why we re-did it.  If you click here, you can listen to it.  Uncut, unedited...

http://traffic.libsyn.com/brakeingsecurity/old_ep1.mp3

https://docs.google.com/document/d/1k5tK4OsH6M--UidcvArbfW0rjOkHeSEDm1_UrF64iyY/edit?usp=sharing

Feedback is welcome, thank you...

#11: Well, it's an audio thing...

We recorded our first episode yesterday, and I thought it went great, however, there is a small issue with the audio.  I failed to change the switch on the back of the Snowball Microphone to setting '3', which makes the mic take audio from both the front and the back. So my co-host sounds great, as he was in the 'front', but I sound like I'm 10 feet away.

We aren't audio engineers... if we were, we would not be doing security. So I get to add to my repertoire of vast and varied skills.  One of these days, we'll be doing video editing for technical segments...  I can only imagine how that's going to do.

Also, there was some content issues we'd like to address as well.  Our first podcast is on the subject of Hashes, what they are, how they are used, and we even talked about how to make them more difficult to find any info from them (e.g. passwords, PII, etc).  We talked about collisions, hash stretching, and adding salt to make them resistant to rainbow tables.

So my colleague will listen to it, and if he is okay with it, I'll post it on Monday. Don't expect a ton of production values, Probably intro and outro music.  And we probably won't have our first interview for a couple of weeks.

If you are interested in doing a 10-20 minute interview about a security topic near and dear to your heart, please let me know.  Twitter is probably the best way.  I can be found @bryanbrake, or you can message me on LinkedIn.

This blog will still be used to put up the show notes, which will have links to information that we talked about. We will try to find real info, and not just a ton of Wikipedia articles. :)  Also, we will use this for additional opinion articles that could be podcast episodes later on...

Have a great weekend, or hope you had a good one (depending on when you read this)...

#10: It's really happening folks...

Hell yea!  The new podcast "Brakeing Down Security" will happen on 10 January 2014.  Also, I'll have a co-host!

Before you go "Aw hell, ANOTHER security podcast", don't you fret my army of followers.  I have been following the "I am the Calvary" mailing list for a while (and if you aren't, you should be), and there is a real need out there for training and awareness.  Both those in the IT industry who do it on a daily basis, that maybe don't understand why they are doing what they are doing, or maybe that college student looking to expand her/his knowledge of Information Security and may not have a good place to go.

In the past year or so, I have seen many excellent speakers at the Capital of Texas ISSA chapter, talk about the difficulties of getting people to understand something as simple as password complexity or why we can't have Post-its on our monitors. This podcast is to be for folks like that, so if you're looking for techniques on how to reverse engineer Windows binaries, or creating malware for fun and profit, this won't be your bag. Ideally, I'd like to get up to that point, but that is probably many years in the future.

We are hoping to bring you interviews from people in the industry, people from the Privacy realm, from Healthcare, from Legal, you name it...  What we want to show is how vast the industry truly is, so we may have a pentester on one month, and a lawyer specializing in Privacy law next month, or a compliance "check box weasel" the next month (I apologize to all the Compliance Officers out there).  We want to do multimedia stuff as well, but just learning the sound editing is gonna be a pain, not even sure how video editing will do.

We're not trying to be the next Pauldotcom or Network Security Podcast (who am I kidding, that'd be awesome!), but we just want to put ourselves out there to be another reference for people who may not want a deep technical discussion.

This is going to be a labor of love, plus, we get CPEs for doing research and preparing for the podcast, so there is a plus in that.

So look here, or on my Twitter feed @bryanbrake, or on my LinkedIn for the post to the podcast.  We'll most likely be using LibSyn for hosting, since I've been told by more than one person that they are pretty awesome.

I hope you enjoy it, we definitely want feedback and emails and constructive criticism

#09: ISSA, name change, macbook networking, data breaches, and the podcast

Yep, the blog name has been changed.  I figured that the original title was too wordy, and I'd be stupid not to use my given name... it's just too perfect.  So, I registered the domain to point here for the time being, the podcast will also be called 'Brakeing Security'.

It reminds me of the Simpsons episode, probably about 50 years ago, where Homer, Apu, Barney, and Moe were in a barbershop quartet called "The B Sharps".  It was funny the first few times, and it gets progressively less funny...  It's just like that...

I have decided that I need to stop being one of those guys who sit on the outside of their security organization and say 'Well, I'd have done it like this...'.  I have been elected by my peers as the Recording Secretary of the Capital of Texas ISSA chapter. I still don't understand the full powers I have, other than, you know... recording meetings/timekeeping, and making sure the rest of the board don't stab each other.  Sounds like fun!!!

My Mid-2012 Macbook Retina Pro is unable to access the wireless at work, so I decided that I would re-purpose my Minipwner (TP-703N) travel router to be a wireless AP for my work wireless.  It came rooted, so it wasn't that difficult.  I had to setup the travel router to allow for it to connect to the wireless AP at the office, get an IP of 192.168.1.x/24, but then turn around and forward packets to/from my Macbook Retina.

(generated using draw.io)


With all the info on the OpenWRT site, much of it is not updated, or is found in other spots all over the website.  The best info I was able to get all in one place was the "Routed Client" using MASQUERADE (http://wiki.openwrt.org/doc/recipes/routedclient#using.masquerade)

Well, after a few issues, mainly that they use newer 'iw' Linux commands, but other than most everything is the same.  My Macbook connects with a static 192.168.2.x address, and everything just works.

The real shame is that I had to sacrifice my MiniPwner to do it. It's a USB bus powered, which is nice, because it's small, and a portable battery pack will last days if you aren't plugging it directly into the PC/Laptop.  I was using it for a Kismet capture device, as well as doing some reverse SSH tunneling on the inside of our network back to my house, just to try it.

Nowadays, there's PwnPlug, Pineapples, and even Raspberry Pi running Kali to use these days.  The best thing about them is: They are very small, and you can hide them in out of the way places to attack networks, assuming you can get into an out of the way place in the business you are attempting to pentest.

In the past few weeks, we've heard about major data breaches, both from JP Morgan Chase (link), and then the uber heist of 40 million cards from Target (link). It really stops and gives me pause, cause any person in Information Security should be wondering 'When is my company next?' or worse 'Is my company already compromised, and I don't know it?'  What can be done?  IDS? log file analysis? firewall audits looking for connectivity no longer needed?  Are proper methods and processes in place to keep unauthorized connections from occurring?  The answer is all of this and more.  Your organization must want to be secure.  Forcing it on them like an older brother scaring your kid brother is only going to breed resentment down the line.  And if you suffer from chronic PCI requirements, it's the same thing.

Martin McKeay made a point that I did not realize previously...

It is unfortunate in our day and age, that we can do very little to fix the issue, and companies will still make out better than they were previously.  Is it because stock traders believe that they've learned their lesson, and it will never happen again?  Target and JP Morgan will survive, lick their wounds, and suffer no long lasting effects, until it happens again.  Companies should be made to suffer fines or perhaps additional scrutiny from the SEC when they do their yearly filings.  At a minimum, they should sign up all cards with fraud protection, instead of being an opt-in.  This would be costly for the orgs involved, because very few people opt-in to the fraud protection offered to them, but by not doing so, they are showing that they care very little for the security mess that they themselves have caused.

The new podcast "Brakeing Security" will start the week of January 6th.  I hope to have interviews, at least once a month (hopefully made up of Speakers from our ISSA meeting).  I want it to be no more than 30 minutes.  I don't have a PhD in sound editing, so it's gonna be a bit rough to start out.  I'm hoping to do a little bit of news, some opinion, technical segments, and an interview if I can scrounge one up.

My idea is that there is enough IS/Privacy/Security/Healthcare talent in the Austin area that I should be able to gain an audience from someone anyone.

If you are interested in doing an interview, or have a topic you'd like to talk about on 'Brakeing Security', I would like for you to contact me at 'brakeb@gmail.com' with a subject of "Brakeing Security", and we'll get together and talk about it. I'm pretty democratic, as the 10 domains of CISSP cover a vast amount of IS/IT and Regulatory items, if we can put a security bent on it, we can talk about it.  If you have a technical segment about a new security tool that you may be developing, or you are speaking at a convention soon, I'd be greatly pleased to have you on my podcast.

Have a great holiday and remember, tear up the boxes with all the TVs, Xbox, Laptops, etc.  Don't just put them out by the trash.  People don't need a reason to want to get into your house...

#08: France, CERN, and physical/personal security, and everything else

245 pageviews?!  What the hell?  I leave for holiday and come back, and it blows up!  Welcome to any new readers!! I promise to not disappoint. :D

I have been gone on holiday with my cruise group last month.  I had the utmost pleasure to visit the European Center for Nuclear Research or CERN.  This trip was one memory that will stick my mind for as long as I live.  Not just seeing the incredibly massive 15m long, 40 tonne (all Metric baby!) superconducting segments that ran the entire 17Km length of the LHC, but we also got to take an unexpected trip to the CMS, which was one of the two experiments that found enough sigma to confirm the Higgs Boson.  If you're interested, the Major Technicality podcast (@majortechnicality, or www.facebook.com/majortechnicality) will have it posted very soon.

One thing I did want to mention about my trip to CERN was the security controls in place.  Much of the main campus in Geneva was open, and they gave us pretty much carte blanche to visit the hallways, but to be quiet about it.  I was so enamored by the pure science of what was going on that I did not give the idea of physical or personal much of a thought.

There were no cameras, no access badges. Offices had locks, but the main campus appeared to be a recycled building from before the Cold War and the office sizes definitely had that feel.  I believed that everyone I looked in on as I walked by their office was comtemplating the very nature of the universe, or examining data to find that one thing, the one iota of information that would get them the next Nobel.  I hope I was not wrong.  Fantastic place.

My point was that a 'college' town like Geneva was incredibly "American" in it's attitudes.  Young people with their heads in their mobile devices (more Android than Apple oddly enough), and it just felt different, but no less safe.  I still carried my wallet in my front pocket, as I do in America, only out of habit.  I enjoyed the airports. No TSA, no body scanners... but in place of that, gentlemen with automatic rifles and paramilitary gear patrolled the airport.  It's interesting, we've spent billions of dollars "securing" our airports, inventing the DHS and TSA, when in fact, they are spending a fraction of that amount in Europe, and are arguably just as safe or safer even...

The heaviest security I saw was at the ATLAS project.  Cameras everywhere, badge access everywhere, including in the elevator, and the area just before you got into the experiment required an iris scan to get into the heart of of the machine. And the area with the iris scanner had a revolving door man trap operated by the control room.  When I asked our guide, who's name was 'Gerd' (hey Gerd!!!) he said that was to ensure that only necessary people could access the area, but also to protect people from the high energy radiation that gets kicked out by the ATLAS experiment.

I guess when we think of physical security, we often use it as a term to keep people out of sensitive areas, but security can be used as a protective mechanism, which I don't see that all that often.

Wireless security... Holy cow, I could not believe all the easy access to WPS enabled wifi.  If I lived in Geneva or Paris, I never would have needed to have bought Internet access.  Dozens of WPS enabled Wifi that could be easily cracked by Reaver.  All I needed was a few hours, and I'd have free, unfettered Internet. Which would have been a damn sight better than what we did have when we were able.  Hotels charge a lot for wifi, and my Verizon International data failed.  I need to get a hold of a good overseas phone that will at least allow me to access Google Maps...  But we travel over there so infrequently, doesn't really make much sense...

Well, now that I'm back from holiday, I really want to make this podcast deal happen.  Yes, I know everyone seems to have one, and "What's gonna make your podcast awesomer than everyone elses?"  Simple truth: it won't be.  I'm learning.  Hell, learning security is hard, but to learn rudimentary sound (video?) editing, as well as the bells and whistles of content creation (web page design, advertising/marketing, setup of interviews, etc) will be the real challenge.  Sitting down, spitting drivel into a microphone is easy.  I mean, look at all the talking heads on TV...  I'm at least 80% smarter than those people.  I just want to do a simple 30-40 minutes once a week (twice if I'm lucky), something really off the cuff, some security stories, and talk about security concepts I'm working on.  I'm dabbling with Python, and reading the Metasploit book written by @HackingDave (Dave Kennedy) and others, as well as doing my Pentester Academy stuff.  It's a full life.  But I would really like to do something that is mine.  I listen to enough podcasts that I realize I can't do much worse than the other folks.  And besides, even if no one listens, I'll be doing something I like.  I think "Adrift in the Security Sea Podcast" is too wordy.  I'll probably need to use an acronym to shorten it... like the A.S.S. Podcast... oh... well, guess that is off the table.  Well, it's a work in progress... I found some royalty-free music, worked on an intro... I just need to figure a few other things out...

Oh, went through a great class last Friday that discussed detecting malware in your network.  The folks over at @Mi2security, Michael Gough and Ian Robertson, showcased how the creation of a Master File Record, using file hashing, along with their brand new software Sniper Forensics Toolkit to reduce the ability for malware to take hold in a system.  It looks very promising, and I am going to try it at my home in the next few days.  Going to the class got you a 3 host license to try the software.  No Linux client yet, but they are diligently working on that.

Take care, and I'll update this post with the Major Technicality when it gets posted.  Take care... And tell your friends.