Category: Security

Great post on the RNC AWS file leak discovery from UpGuard

Great post on the RNC AWS file leak discovery from UpGuard

UpGuard’s post on their discovery of the RNC data is trending big time on the netsec subreddit. I highly recommend going to read the post if you want to know what they found. But in a nutshell, it all centers around the misconfiguration of permissions to the AWS S3 bucket where the database was stored.

I would like to say that the carelessness that was shown here is surprising, but unfortunately it’s not anything new. As I get deeper into the cloud, I see more and more parallels from my straight networking days. Permissions have always been an issue with networks in general, and now that Amazon, Microsoft, and other cloud providers are making it so easy to provision resources in the public cloud, the implications of faulty permissions are huge. This is just one example of a slew of problems, but it just so happens to be a VERY BIG example. We’re talking the potential exposure of data on nearly all 200 million US registered voters, plus the inner workings of the GOP in the last election. And no one really knows how long it was out there.

One last thing: when you go read the post, be sure to read the whole thing. Not only does the article talk about what was exposed; it also goes into the implications of that exposure that go beyond just your basic “muh data” There is some very targeted… almost metadata… about people that are derived from some sophisticated data analytics, which could lead to some very specific targeting. Kinda eerie.

An Information Security Place Podcast – 01-22-14

An Information Security Place Podcast – 01-22-14

 

Jim, Dan, and Michael have a lot of catching up to do. We talk about a lot of stuff because a lot of stuff has been happening. From RSA, NSA, QSAs… security is busy! Show notes below!

Show Notes:

InfoSec News Update –

  • 123456 is the new best of the worst – Link
  • RSA Conf and those skipping it this year – Link
  • Fixing a flawed VA medical records system: Tenacity pays off for a researcher – Link
  • Do you believe the Obamacare website is secure? These guys don’t – Link1, Link2, Link3
    • Discussion Topic – The Failure Themes of the Target Breach:

    • Massive Props to Brian Krebs on his coverage of the whole debacle – Krebsonsecurity.com
    • AntiVirus Takes it on the Chin …Again – Link
    • Egress Filter Much? – Link
    • Credit Card Processing Fundamentally flawed – Link
    • EMPHATIC POINT OF THE PODCAST!! Complacent with Compliance … again PCI!= security

      Music Notes: Special Thanks to the guys at RivetHead for use of their tracks – http://www.rivetheadonline.com/

    • Intro: “Stay Alive“ – Rivethead
    • Segment 1 – “CricketBat” – RivetHead
    • Segment 2 – “Burn Us Down” – Early Morning Rebel
    • Outro: “Zero Gravity“ – RivetHead

    Link to MP3

Giving Grammy security advice

Giving Grammy security advice

So Grammy got a computer. No, not my Grammy. Just some random Grammy out there got a computer. How do I know? Because someone who set up her computer wanted their family to know that Grammy got a computer and now could get emails. So that person sent out an email to “Mom” and a few other folks from Grammy’s email, letting them know that Grammy was now high tech and ready to rock on the Intertubes, Googles, and Facebooks. But that person inadvertently sent the email to my gmail account.

It’s actually a common mistake. I got my gmail account real early when you still had to get invited. So I got to choose an address that could work for a lot of folks with my last name (I’ll be waiting for everyone to guess it and start sending the spam). So here’s what they sent:

Grammy email

I’m not one to let a mistake like this go. One, because I didn’t want Mom to miss out on Grammy’s email address. And two, I thought Grammy might need a security primer to get her going with the new computer. So I decided to reply (with respect of course):

Grammy email reply

Grammy, I doubt you’ll ever see this post. But I wish you all the best. Stay secure.

An Information Security Place Podcast – The HouSecCon 2013 Episode

An Information Security Place Podcast – The HouSecCon 2013 Episode

 

Quick show this time. Jim, Dan, and Michael are all at HouSecCon 2013 in Houston, TX on October 18. They found a quiet room away from all the conference noise and recorded a fast podcast. Jim and Dan talk about their talks, and Michael talks about the fun and stress of being the HouSecCon organizer. Michael also shares some details about his new gig with HP Fortify on Demand.

Enjoy!

Music Notes: Special Thanks to the guys at RivetHead for use of their tracks – http://www.rivetheadonline.com/

  • Intro – Stay Alive – Rivethead
  • Outro – Zero Gravity – RivetHead

Link to MP3

An Information Security Place Podcast – 09-06-13

An Information Security Place Podcast – 09-06-13

 

We’re in rare form today. A lot of fun sprinkled with the occasional good nugget of information security news and discussion.

Show Notes:

InfoSec News Update –

  • New OSX Metasploit Module or Time is not on your Side! – Link
  • If your session belongs to a user with Administrative Privileges (the user is in the sudoers file and is in the “admin group”), and the user has ever run the “sudo” command, it is possible to become the super user by running `sudo -k` and then resetting the system clock to 01-01-1970.

  • Communication is key – Link
  • Hacking Fantasy Football – Link
  • China Shifts to newer Exploits – Link
  • Now that folks are patching CVE-2012-0158

  • FTC smacks Internet-Connected home security cameras – Link
  • CSRF Protection wiithout nonce or random tokens – Link
  • British Parliament loves them some Pr0n! – Link
  • Samsung adding security to Android – Link
  • Gartner pushing SAST & DAST T together – Link
  • The blog is old, but this years Magic Quadrant has them merged into a
    single report. Is this a good or bad thing?

  • HouSecCon Update! – Link

Discussion Topic –

  1. 10 Golden Rules of the Outstanding CISO – Link

Music Notes: Special Thanks to the guys at RivetHead for use of their tracks – http://www.rivetheadonline.com/

  • Intro – Stay Alive – Rivethead
  • Segment 1 – Synchroncity II – RivetHead
  • Segment 2 – Deaf Ears – RivetHead
  • Outro – Zero Gravity – RivetHead

Link to MP3

An Information Security Place Podcast – 8-20-13

An Information Security Place Podcast – 8-20-13

 

We’re back to work.

Show Notes:

InfoSec News Update –

  • Scan the Entire Internet in less than 45 minutes!! – Article Link and tool link
  • Zuckerberg’s Profile Hacked – Link
  • FDA Issues Guidelines on Wireless Medical Devices – Link
  • OWASP Top 10 Update – Link
  • Malware Sandboxing Not Working – Link
  • Sparty: MS Sharepoint and Frontpage Audit Tool – Link
  • HouSecCon Update!Link

Discussion Topic –

  1. The Threat of Social Engineering – Jigsaw FTW
  2. Link 1
  3. Link 2

Music Notes: Special Thanks to the guys at RivetHead for use of their tracks – http://www.rivetheadonline.com/

  • Intro – Stay Alive – Rivethead
  • Segment 1 – – RivetHead
  • Segment 2 – – RivetHead
  • Outro – Zero Gravity – RivetHead
  • Link to MP3

Innovation Sandbox at RSA – a Lesson in Security AND Oratory Skills

Innovation Sandbox at RSA – a Lesson in Security AND Oratory Skills

While attending the 2013 RSA Conference last week, I took a chance and attended the presentations in the Innovation Sandbox Showdown. If you haven’t been to these or aren’t familiar with them, this is where security startups show their wares to a panel of venture capitalists and infosec experts for the title of “Most Innovative”. The catch is that each vendor representative has 3 minutes to do a presentation about their company. After they finish, they have 2 minutes to answer questions from the panel. These time limits are STRICTLY enforced, meaning that the mic is turned off when the time ends. No exceptions.

As I watched the showdown, a couple of points started forming in my head. The first was from the standpoint of a security professional with an interest in new security technologies. The second was from the was from the standpoint of an orator. So let’s start with the first one.

First – The Security professional

Each of the vendors seemed to attack the big issues of today, like cloud, malware, browser security, BYOD, etc. But you know what? I’m just a little tired of it all. Every year, we have more vendors. And every year, they fall away. And as I write this section of this post, I just want to stop and scream. So many products, and I keep getting reminded of Jeremiah Grossman’s post about increasing the attack surface with more security products. Yes, I know this doesn’t exactly equate. Every time a product comes out does not mean you are going to put it in your network. But there is this overload that has been coming and coming, and we have reached it.

So many of these issues – like BYOD – can be fixed using stuff you have in your security toolbox now. That doesn’t mean there isn’t a need for point products sometimes. But like Jeremiah said, bad guys shift tactics. And the more products there are guarding your network, the more they look for holes in those products. So it is smart to look at what you have and be smart about what you buy for security. Yes, we need innovation. But innovation is not limited to product vendors. You can innovate within your own enterprise. You can act differently, be more proactive, watch more closely, and use the tools you have. Let’s stop the cycle of buy, install, follow the shift, buy, install, follow the shift. Start hardening, start reviewing your risk, start learning your business, start determining your gaps, start creating a program.

Are there problems that can only be solved with a new product? Probably. But first we start doing things right instead of perpetuating the fraud that we have to constantly rely on others to innovate for us.

Second – The Orator

I have performed quite a few talks over my career. I have talked to fairly large audiences (200-300), and I have spoken with small, intimate audiences. Both have different challenges. With those talks, I have had plenty of time to prepare for the presentation. I practiced my talk, polished my slides, and then ran through it again. I have also done Toastmaster-like events where you have a random topic, little time to prepare, and only a few minutes to talk. The Innovation Sandbox has elements of both. Like Toastmasters, you don’t have a lot of time to talk. But like typical talks, you have time to prepare for the talk (i.e.practice), and you have time to polish the message.

    Prepare, Prepare, Prepare – then Prepare Some More

Bobby Unser (Al Unser’s brother) said, “Success is where preparation and opportunity meet.” What struck me was how little the speakers seemed to prepare, and how badly their presentation was done. Even with this huge opportunity to speak in front a crowd that could possibly spell success for their company, they did not prepare. I just don’t get that.

    Polish

Run the presentation with folks outside your company. Don’t talk in the echo chamber, or all you will get back is people saying it is great, it is wonderful, we’re gonna kill the ball with this presentation. Seriously people, you must let others hear the talk. Get feedback. Figure out where your doing stuff wrong, where you can adjust. Figure out out to get your message down in 3 minutes. And some advice: if you let others hear your stuff and they have no criticism, there are two possibilities: your presentation is phenomenal, or you picked the wrong people to listen to your presentation. In the immortal words of Sheldon Cooper, “Of those two scenarios, which one do you think is more likely?”

    Attack the Problem

Many wanted to talk more about their management team, like a great management team was all your company needs to attract venture capital or get people’s attention. I get that it is probably a factor, but as someone pointed out on Twitter (paraphrasing because I can’t find the tweet): “If your management team is famous, they need no introduction – if they’re not, they still don’t.” In other words, focus on the perceived problem and how you solve it. I had a really hard time figuring out a lot about their companies with the presentations. Most of my questions were answered when folks on the panel started asking their questions. That is fail-city in my book.

All right, I’m done ranting. I feel clean again. For now…

An Information Security Place Podcast – Episode 04 for 2012

An Information Security Place Podcast – Episode 04 for 2012

 

Holy crap, we recorded an episode. That’s all I got to say about that…

Show Notes:

InfoSec News Update –

  • Howard Schmidt is Retiring – Link Here
  • Vulnerability Stats of Publicly Traded Companies – Link Here
  • Tool Update – Threadfix from Denim Group – Link Here
  • The Mission Impossible Self-Destructing SATA SSD Drive – Link Here
  • The WAF Wars – Link 1 / Link 2 / Link 3
  • PwnieExpress Releases PwnPlugUI/OS 1.1 – Link Here
  • App for scanning faces to gauge age at bars – Link Here
  • Business Logic Testing defined – Link 1
  • ErrataSec – Wants your hotel PCAP Files – Link 1 / Link 2

Discussion Topic –

  1. Should specific security efforts be validated when the program as a whole is crap? Link Here

Music Notes:?Special Thanks to the guys at RivetHead for use of their tracks – http://www.rivetheadonline.com/

Tour Dates:

  1. June 1 – Dallas – Curtain Club

Intro – RivetHead – The 13th Step”
News Bed – RivetHead – “Beautiful Disaster”
Discussion Bed – RivetHead – “Difference”
Outro – RivetHead – “Zero Gravity”

Link to MP3

An Information Security Place Podcast – Episode 03 for 2012

An Information Security Place Podcast – Episode 03 for 2012

 

Today’s show is Michael interviewing Kevin Riggins. Kevin is an Enterprise Security Architect for a Fortune 500 financial services company. Kevin and Michael have some great conversation about Kevin’s job, what he is doing at RSA, where he blogs, the book he coauthored, etc. (look below in the show notes for links to everything).

Then a fun discussion starts about cloud, risk, mobility, risk in the cloud, risk in mobility, risk of mobility integrated with the cloud, and so on. Good stuff all around.

Here’s some links to stuff about Kevin and other stuff we talked about in the show.

  • Management Team Member for the Society of Information Risk Analysis – link
  • Coauthor on The Cloud Security Rules – link
  • Kevin blogs at Infosecramblings – link
  • Twitter pages – link and link and link
  • An Information Security Place Podcast – Episode 02 for 2012

    An Information Security Place Podcast – Episode 02 for 2012

     

    Thanks go to Jeremiah Grossman for sitting down with Michael for some great discussion. Jeremiah is the CTO at Whitehat Security and a very well known figure in the InfoSec industry. Jeremiah and Michael talk about Hawaii, sharks, security philosophy, RSA, stage fright, Jeremiah’s TED talk (not published as of the posting of this entry), and the age of the InfoSec industry and whether young folks are coming into the fold.

    You can find Jeremiah at Whitehat (link above) and his blog, and you can follow him and on Twitter as well. Jeremiah will be giving a talk and participating on panel at RSA as well, so be sure to attend those if you are going to the RSA Conference 2012.

    H.323 “hacking” without coding in 2006

    H.323 “hacking” without coding in 2006

    Recently some news came out from NY Times and HD Moore where he was doing some targeted scanning and found a bunch of open H.323 videoconference systems open and ready for viewing. What he found was that a lot of these systems are deployed outside of the firewall on the Internet without any security and with auto-answer turned on, and these were sometimes installed in sensitive board rooms, etc. Then, along came some videoconferencing guy who said some of HD’s claims were bunk. Then Rapid7 and HD fired back, and yada, yada, yada (you can read a better run down here at Computerworld).

    What I find funny about this is that this has been an issue for a long time. Back when I was an InfoSec manager, I put in a videoconferencing system in 2006 to facilitate some communication with a sister company. When we set it up originally, I found that there were a lot of issues with putting an H.323 device behind a firewall. NAT broke it pretty easily, and I ended up putting it on the outside of the firewall for a time when we needed to setup a session, and I tore it down immediately after (we ultimately setup a private T-1 between us so we would have no issues – there was some sensitive info going across the line in those sessions). But when I was getting it setup for the first time and doing some testing, I found that the Polycom unit I was using had some test sites already in the address book. So I connected to a few of those to make sure things were working. I even had folks on the other end try to connect to me (yes, there were people on the other side just kinda hanging out. In fact, there were a few sites where it was like, you guessed it, a Google+ hangout – it was kinda fun and weird at the same time).

    But after discovering that, I decided to turn on a bit of Google-fu and see if there were other sites out there that were also open. And again, the answer was yes. Google linked to a lot of sites (like this one) that had a list of “test” H.323 locations ready for connection. But what I quickly found out was that many of these “test” units did not seem to be for testing purposes at all (or maybe they had been at one time but someone forgot to secure them after they had been repurposed to a “real” site). Many were companies that often had these VC units setup in sensitive areas. Some of these had their audio and connected TV’s turned on, and people in the room would notice when a connection occurred. But very often i found that some had their audio and TV’s turned off, or the folks in the room ignored the connection signal. Basically, what HD said here:

    …we did prove that most VC equipment provided little or no warning when an attacker dialed into the system. In most cases, the television set is off unless a call is expected. If the television is off, there is little indication that a call is in progress. The reason for this is two-fold;

    First – the base unit, not the camera, is usually what has an indicator that turns on when a call is in progress. The base units are often stashed behind a cabinet, near the floor, or generally out of sight.

    Second – newer cameras (specifically, the Polycom HDX series) are extremely quiet while being panned or zoomed and the only indication they provide is the direction they are facing. We conducted a “blind” test where the conference room VC unit was accessed during a Rapid7 general staff meeting. Twenty minutes into the meeting, nobody had noticed the camera swinging from the rest position to pointing at a participant’s laptop screen, zoomed in to capture his email and keystrokes.

    After connecting to a couple of them and hearing and seeing snippets of very sensitive discussions and realizing that these cameras were very good at zooming into documents, I decided to stop it. I am kinda bummed that I didn’t write about it in my blog back then (at least I don’t remember doing so, and I can’t find it in my archives), but oh well. I didn’t do any cool coding like HD did, and I am pretty sure this would still be a problem today anyway.

    So basically, HD is right, and the VC dude is wrong. This is a problem. I know. I have seen this first hand by my own actions. I heard things that I wish I would not have heard about (maybe that is why I didn’t publish anything back then). Not crazy guvment secrets or anything, but it still was information that I could have used to hurt folks or profit from if I was that kind of person.

    So IT and security folks, take a look at your videoconferencing setups. Realize that there are a lot of bad settings turned on by default, so make sure you lock them down. Get them off the Internet. Pay attention to where they are located. This can cause you a big headache.

    [UPDATE: After re-reading my post and after reading the first comment, I want to say something. I am not saying that HD didn’t do something cool, and I am not trying to disparage his work in any way. HD uses code, and he does it very well. I don’t have the mad skillz that he does, and putting those scans together is pretty dang cool. I am glad someone with his platform showed that this was an issue that needed to be addressed. I was merely trying to point out that the issue has been around for a while and that I found it in other ways that didn’t involve coding.]

    Symantec’s latest statement on source code theft

    Symantec’s latest statement on source code theft

    This is from a local Houston Symantec source, but is widely available to everyone. Current on date of posting. We’ll see what shakes out.

    “Symantec can confirm that a segment of its source code used in two of our older enterprise products has been accessed, one of which has been discontinued. The code involved is approximately six years old. Symantec’s own network was not accessed, but rather that of a third-party entity. This does not affect Symantec’s Norton products for our consumer customers. We are still gathering information on the details and are not in a position to provide specifics on the third party involved. Presently, we have no indication that the code disclosure impacts the functionality or security of Symantec’s solutions. Furthermore, there are no indications that customer information has been impacted or exposed at this time. Symantec recommends that users keep their solutions updated which will ensure protection against any new possible threats that might result from this incident. Given the early stages of the investigation, we have no further details to disclose at this time but will provide updates as we confirm additional facts.”

    A blog post by @m1a1vet

    Security Lesson from A Mouse Story

    Security Lesson from A Mouse Story

    I was going through some old blog posts, and one I found contained the following story:

    Mouse Story

    A mouse looked through the
    crack in the wall to see the farmer and his wife open a package.
    “What food might this contain?” The mouse wondered –
    he was devastated to discover it was a mousetrap.
    Retreating to the farmyard,
    the mouse proclaimed the
    warning.
    “There is a mousetrap in the house! There is a mousetrap
    in the house!”
    The chicken clucked and scratched, raised her head and
    said, “Mr. Mouse, I can tell this is a grave concern to you
    but it is of no consequence to me.
    I cannot be bothered by it.”
    The mouse turned to the pig and told him, “There is a
    mousetrap in the house! There is a mousetrap in the house!”
    The pig sympathized, but said,
    “I am so very sorry, Mr. Mouse,
    but there is nothing I can do about it but pray.
    Be assured you are in my prayers.”
    The mouse turned to the cow and said, “There is a
    mousetrap in the house!
    There is a mousetrap in the house!”
    The cow said, “Wow, Mr. Mouse.
    I’m sorry for you,
    but it’s no skin off my nose.”
    So, the mouse returned to the house, head down and dejected,
    to face the farmer’s mousetrap– alone.
    That very night a sound was heard throughout the house –
    like the sound of a mousetrap catching its prey.
    The farmer’s wife rushed to see what was caught. In the
    darkness, she did not see it was a venomous snake
    whose tail the trap had caught.
    The snake bit the farmer’s wife.
    The farmer rushed her
    to the hospital and she returned home with a fever.
    Everyone knows you treat a fever with fresh chicken soup,
    so the farmer took his hatchet to the farmyard for the soup’s
    main ingredient.
    But his wife’s sickness continued,
    so friends and neighbors came
    to sit with her around the clock.
    To feed them, the farmer butchered the pig.
    The farmer’s wife did not get well; she died.
    So many people came
    for her funeral, the farmer
    had the cow slaughtered to provide enough meat for all of them.
    The mouse looked upon it all from his crack in the wall with great sadness.
    So, the next time you hear someone is facing a problem and think it doesn’t concern you,
    remember –
    when one of us is threatened,
    we are all at risk.

    I posted that back in 2006 (crap, I am getting old), and I said it had some security points. But the post also said that I was hungry when I was writing it (coincidentally, I am hungry right now also – huh, maybe I’m just always hungry…), so I didn’t break those down. Well fans, let me remedy that situation now. Here’s the lesson:

    Your insecurity affects us all. If you know there is a security problem (whether that be by your own discovery or through someone else warning you), and you have the power to either fix it or influence someone who does have the power, then get ‘er done.

    I know there are all kinds of caveats to that as far as risk, process, etc. But the raw edge needs to be there. Ignoring a problem does not make it go away. In today’s world of hactivism and hacking for hire, there are just too many attacks coming from too many angles. Test, fix, retest, fix, retest, fix, and so on. Stop screwing around.

    This rant brought to you by @m1a1vet

    An Information Security Place Podcast – Episode 01 for 2012

    An Information Security Place Podcast – Episode 01 for 2012

     

    Wow! 6 Months…and 2 job changes later, we are finally back to recording! YEAH!….Here the latest show from our intrepid hosts.

    Show Notes:

    InfoSec News Update –

    • The Hacker News Hacking Awards : Best of Year 2011 – Link Here
    • Japan’s Anti-Virus Virus – Link Here
    • Nginx (pronunciation: “engine-ex”) becomes #2 web server
    • Saudi hackers break into Israeli site – Link Here
    • 3 Surefire Ways to Tick Off an Auditor – Link Here
    • OWASP AJAX Crawling Tool – Link1 / Link2

    Discussion Topic – 2012 Breach Report

    1. Care2 Discloses Breach; Company Has Nearly 18 Million Members – Link Here
    2. AntiSec hit California and NY Law Enforcement Sites – Link Here
    3. Anonymous Nabs 50,000 Credit Card Numbers From Security Think Tank – Link Here

    Music Notes:Special Thanks to the guys at RivetHead for use of their tracks – http://www.rivetheadonline.com/

    Tour Dates:

    1. Jan 6 – Dallas – Curtain Club
    2. Jan 27 – Dallas – Trees
    3. Jan 28 – Dallas – Trees
    4. Mar 2 – Dallas – Curtain Club – 7th Album CD Release Party
    5. Mar 3 – Houston – BFE Rock Club
    6. Mar 24 – Fort Worth – The Rail Club
    7. May 5 – Dallas – Renos Chop Shop

    Intro – RivetHead – The 13th Step”

    News Bed – RivetHead – “Beautiful Disaster”

    Discussion Bed – RivetHead – “Difference”

    Outro – RivetHead – “Zero Gravity”

    Link to MP3

    Quit publishing my info. I said stop! Now!

    Quit publishing my info. I said stop! Now!

    My wife and I homeschool, so we include our kids in a lot of extracurricular “stuff” to hopefully keep them well-rounded. One of the things my oldest son does is take a Lego engineering class at a small local school that caters to homeschoolers.

    Last year, when we first signed up for the school, we found out that they published a report on the Web that listed the personal information (names of parents and kids, emails, street address, phone numbers, etc.) of all the families of the attendees. This was meant to be a resource for the attendees of the school, which is somewhat understandable since the homeschool community is fairly close knit. But when I saw that our info was included by default, AND that the report was secured by just a password, AND that password was emailed to everyone on the list, I kinda freaked a bit. So my wife sent out an email requesting that our info be pulled from the list.

    I honestly expected a fight of some kind since I have seen small groups like this that just don’t get security and that a password just ain’t enough, but I was pleasantly surprised to find that they complied immediately with the request. All’s fixed, right? Well, it was for a few months. Now they are publishing a new list. But no big deal, right? We’ll just request to be removed again, right? Nope. Now they are acting as I expected them to last year. They are pushing back because, in their words, “they don’t have the time to reformat the report”. In fact, the email response in general was completely rude.

    So I thought I would send off an email to them with a little bit of attitude of my own.

    As to the matter of this directory, the last time the database was published, My wife and I were given the option of having our personal information deleted from the report. When we opted to be removed, there was no argument about whether or not anyone has the time to remove this information, and the request was acted upon quickly. So you can imagine our surprise when we received your reply when we asked to be removed again.

    I understand that it takes time to format the report, and I understand that you are busy. But as a parent that pays tuition to your school, I fail to understand how this request can be so blatantly refused. In fact, I fail to understand why the information is needed by anyone outside of the staff at the school. If other parents have requested this information, then it should be provided on an opt-in basis, not by default.

    While it may seem paranoid to you that we do not wish to have our personal information included in this database, I hope you understand our concern for privacy in this day and age. My career is in information security, so I know on a technical level how easily this type of report is compromised, and how the personal data can be misused.

    Please remove our personal information from the report at your earliest convenience.

    We’ll see what comes back.

    Viewing InfoSec from another angle – a personal reflection

    Viewing InfoSec from another angle – a personal reflection

    A while back I tweeted about my acceptance of the Security Technology Advocate role at Accuvant.

    To be clear, I am not going to be fully transitioned into the role until Jan 1, 2012. But I have been doing some work in the new gig, and I have already experienced a lot of changes on how I approach security and how I view my chosen profession. Let me ‘splain.

    So part of my new role entails evangelizing Accuvant to the world. And one of the ways I will do that is to create content for the world to see, meaning blog posts, podcasts, webcasts, etc. And the best thing about creating that content is that I have a near endless source of expertise from Accuvant. We have l33t peeps from all angles of InfoSec, including security research, risk, compliance, network and web app pen testing, security technologies, secure infrastructure, development, and on and on (you can go view some of this material at http://www.accuvant.com/results/podcasts – forgive the shakiness please).

    And while this is rewarding, it is also giving me a way of looking at InfoSec that I never have had before. What I mean by that is that I have almost always been an active part of InfoSec. I have either been a security consultant, engineer, or manager. I have had to delve into the world because I was immersed in it by necessity. I was looking for ways to improve my security or the security of others. I was looking for solutions to problems that plagued me or others. And while that entailed often talking to experts, be they from Accuvant or somewhere else, I was usually viewing their input as directly related to fixing something that was broken. And while I have interviewed a few folks over the years for the podcast or blog, I still was thinking of how their answers applied to issues with which I was dealing.

    But now, for the first time, I am not always talking to security experts for the direct purpose of solving a problem (well, I am solving the problem of needing content to perform the duties of my job, but you get where I am coming from hopefully). I am talking to them to get opinions on topics that are relevant to the topic of security in order to solve the problems of others with whom I do not have a direct relation. Does that make sense?

    Let me use Charlie Miller as an example (cuz he’s famous and stuff). I interviewed Dr. Miller a few months back at DerbyCon. It was a fun interview comparing IOS and Android security, and I approached it as one security professional talking to another security professional. But at the same time, it struck me that I was not really talking to Charlie as a fellow security professional in the traditional sense. I was not getting information from Charlie to take back to a client. I was simply performing an information gathering task for the purposes of indirectly giving other folks information. I was not going to directly take that data and apply it to a problem on which a client or I were working. I was going to let others do that. I was now becoming an “information broker” of sorts (most of what I have read defines “information broker” as someone who finds and provides analysis of the information, which I have not really done to this point).

    I am not sure if the impact of this is coming out in this article. It is kind of difficult to define this feeling if you the reader have not been there (or maybe it isn’t difficult to define and you are nodding your head an saying “dang, this guy writing down some awesome thoughts here – I wish I could be that awesome”). And I know that Brian Kerbs, Bill Brenner, and folks like them that do this all the time (albeit much better than I), will be expressing a collective “duh”. But it really has made a difference in how I see the industry, even in just a short period of time.

    Honestly, though I say it has affected how I view the industry, I really don’t have a grip on what those effects will be yet. I don’t know what this will do to my career. I sincerely do not want to move out of being an information security professional, so I will do my best to keep up my skills to some degree. And I don’t know how this will affect how I approach problems in the future, or how I will interact with people who ask my advice on security issues. I mentioned two of the top journalists in the InfoSec field above. To the best of my knowledge, neither of them were security practitioners before they started covering InfoSec (that is not meant to be a knock on either of those gentlemen – both have my highest respect). So it makes me wonder how that will affect my approach.

    Will it make me ensure that those experts I interview know of my experience before we talk? In the past, I experienced disdain from “experts” during interviews when I was wearing a press badge at a conference. I wanted deeper insight, so I asked very technical questions that they were not used to getting from journalists, and that made them change the way they looked at me pretty quickly (and prompted a couple of “who are you” kind of questions).

    I’m just not sure yet. But however I move forward, I am excited about the change.

    Be an InfoSec Berean

    Be an InfoSec Berean

    In the Bible (no, this is not a sermon – yes, this is InfoSec relevant), there was this group that Paul ran into called the Berean Jews. (Acts 17:10-15 if you want to look it up). These Bereans were shown in the scriptures to be diligent people who checked the facts. Verse 11 says:

    Now the Berean Jews were of more noble character than those in Thessalonica, for they received the message with great eagerness and examined the Scriptures every day to see if what Paul said was true. (emphasis added)

    So basically, the Bereans were not going to accept anything at face value. They immediately went back to scripture and checked out to see if what Paul was saying was true, and then they made up their minds.

    Now what got me thinking about this particular group and how it applied to InfoSec was the article at Infosec Island by Scot Terban entitled “Infosec: The World’s Largest Rube Goldberg Device”. Scot has some pointed things to say about the different vendors and “experts” selling they toys and wares in the industry, and his points are good. But this theme has been in InfoSec (and other industry) blogs since I started reading them (I have written a few myself): do not fall for the sales pitch and the marketing.

    This is just good common sense, right?Then why in the name of Mordor do we have to keep saying this? Is this for the benefit of the new folks in the industry? Is this because people just like a good rant session? Is it because someone STILL has not learned this lesson? Is it because there are a lot of lazy folks out there?

    Now I am not hitting Scot here. I have zero problem with writing the post (and in fact, his overall theme was not about this really at all). It just struck me that if you have to be reminded to be an “InfoSec Berean” when the sales person calls or when you read an article comparing different technologies, then you are wrong. No, we don’t have a convenient set of scriptures to go to (except for NIST or something like that, which Scot points out). This is more about doing your due diligence to prove or disprove claims made by sales or marketing. Get some documentation. Get some references. Do a proof of concept (not always practical, I know). Make sure there is proof of the claims. Don’t accept it at face value, just like the Berean Jews.

    And, in my finest adult-preachin-at-you voice, don’t make me tell you again!

     

    An Information Security Place Podcast – Episode 05-2011

    An Information Security Place Podcast – Episode 05-2011

     

    I am tired of making excuses about us being late, so here is friggin’ episode #05-2011. Have fun!

    Show Notes:

    InfoSec News Update –

    Discussion Topic – Scoping too small…

    Music Notes:

    Special Thanks to the guys at RivetHead for use of their tracks – http://www.rivetheadonline.com/

    Tour dates:

    • July 9 – with Powderburn, Earthrot, and more – Tomcats West in Fort Worth, TX
    • July 24 – with Creeper, Phantom X, and more – Oriley’s in Dallas, TX

    Intro – RivetHead – “Stirring It Up Again”
    News Bed – RivetHead – “Beautiful Disaster”
    Discussion Bed – RivetHead – “Difference”
    Outro – RivetHead – “Zero Gravity”

    Link to MP3

    An Information Security Place Podcast – Episode 04-2011

    An Information Security Place Podcast – Episode 04-2011

     

    Hey, all three of us are here, and on schedule…. somebody check the temp outside :)

    Show Notes:

    InfoSec News Update –

     

    • TexSecConTriangle.com coming soon – HouSecCon, BSidesDFW, and LasCon
    • Gonzales Update – Link Here
    • Dropbox Pwnage –Link Here
    • TX exposes 3.5 Mill records – Link Here
    • Yet another Security Company Fail – Link Here
    • IPhone keylogger – Link Here
    • Law Firms Under Siege – Link Here

    Discussion Topic – Reading the Fine Print in Cloud Computing – Link Here

    Music Notes:

    Special Thanks to the guys at RivetHead for use of their tracks – http://www.rivetheadonline.com/

    Tour dates:

    • Apr 20, 2011 – Sevendust, RIVETHEAD and TBA – Trees – Dallas, TX
    • May 7, 2011 – Powderburn and RIVETHEAD – BFE Rock Club – Houston, TX
    • Jun 4, 2011 – RIVETHEAD, The Razorblade Dolls, Horror Cult and more – The Rail – Fort Worth, TX
    • Jul 9, 2011 – RIVETHEAD, Powderburn, Earthrot and more – Tomcats West – Fort Worth, TX

    Intro – RivetHead – “Stirring It Up Again”
    News Bed – RivetHead – “Beautiful Disaster”
    Discussion Bed – RivetHead – “Difference”
    Outro – RivetHead – “Zero Gravity”

    Link to MP3


    An Information Security Place Podcast – Episode 03-2011

    An Information Security Place Podcast – Episode 03-2011

     

    So it took a bit longer this time due to scheduling, and bodily harm on Michael’s part… but we finally got another episode recorded. Enjoy.

    Show Notes:

    InfoSec News Update –

    Discussion Topic – How Detailed is Your DR Plan?

    Music Notes:

    Special Thanks to the guys at RivetHead for use of their tracks – http://www.rivetheadonline.com/

    Tour dates:

    • Apr 20, 2011 – Sevendust, RIVETHEAD and TBA – Trees – Dallas, TX
    • May 7, 2011 – Powderburn and RIVETHEAD – BFE Rock Club – Houston, TX
    • Jun 4, 2011 – RIVETHEAD, The Razorblade Dolls, Horror Cult and more – The Rail – Fort Worth, TX
    • Jul 9, 2011 – RIVETHEAD, Powderburn, Earthrot and more – Tomcats West – Fort Worth, TX

    Intro – RivetHead – “Stirring It Up Again”

    News Bed – RivetHead – “Beautiful Disaster”
    Discussion Bed – RivetHead – “Difference”
    Outro – RivetHead – “Zero Gravity”


    Link to MP3


    An Information Security Place Podcast – Episode 02-2011

    An Information Security Place Podcast – Episode 02-2011

     

    We have a little bit of innuendo humor on this episode, and we all break into some hysterics (it’s all in the geek toys section, so fast forward if you want to hear all that). Around that is some information and opinion on InfoSec stuff. We figured we would throw that in there because of the name of the podcast, but whatever…

    Show Notes:

    InfoSec News Update –

    • HouSecCon 2011 Call for Papers – Link Here
    • Busting DLP Myths or Playing with Hype? Link Here
    • Google collecting kid’s info (including last 4 of SSN) for Doodling contest – Link Here
    • Smartphone security threats overdramatized – Link Here
    • 7 Deadly Sins – Link Here
    • Another certification debate – Link Here
    • Abusing HTTP Status Codes to Expose Private Information – Link Here

    Geek Toys –

    Discussion Topic – Saying No to Bad Patents – Link 1 / Link 2 / Link 3

    Music Notes:

    Special Thanks to the guys at RivetHead for use of their tracks – http://www.rivetheadonline.com/

    Tour dates:

    • Feb 26th – in Carlsbad NM
    • March 19 – The American Airlines Center at the Dallas Stars Hockey Game

    Intro – RivetHead – “Stirring It Up Again”
    News Bed – RivetHead – “Beautiful Disaster”
    Discussion Bed – RivetHead – “Difference”
    Outro – RivetHead – “Zero Gravity”

    Link to file

    InfoSec is a Waffle (just like life)

    InfoSec is a Waffle (just like life)

    I was running through some Twitter posts from some friends / colleagues / random InfoSec folks, and I saw one from Jack Daniel that led me to his latest blog post.  In the post, Jack quickly covers the topic of preaching to the choir and staying in our own infosec echo chamber.  He says it is fine to listen to and have discussions with like-minded people in conferences, etc, but he also correctly points out that it becomes a problem “when we never leave these enclaves”, and how we need to “share what we learn” and “get our teeth kicked in by the realities of the real world, business needs, people’s priorities and biases”.

    And as I read through the post, it struck me how much it reminded of the sermon at my church from yesterday (Jack kinda reminds me of Jesus sometimes – it’s the beard thing – but that’s not where I am going here).  In the sermon, the pastor talked about how “the World is a Waffle”.  He demonstrated by showing how when you pour syrup on a pancake, it immediately spreads out over the pancake, but when you pour syrup on a waffle, it gets stuck in each chamber of the waffle.  His point was that many of us never venture out to talk to others outside of our comfortable little group, and how we could show a lot of people a lot of love if we would just dare to get uncomfortable.

    That is really just human nature.  There are a few of us out there who are cool with getting to know all kinds of people, who actually feel comfortable when they feel uncomfortable (if that makes sense).  But most of us are not like that.  We want to stay in our little area of comfort.  And that is very true when it comes to our chosen profession.  We are just human, after all, so we like it when people agree with us or at least like to talk about the same thing we do.  But if we would just get out and converse, get to know people, get out of our shell, we would not only learn a lot of new stuff and new perspectives, we would actually teach them a thing or two!

    Just try it.  You might like it!

    An Information Security Place Podcast – Episode 01-2011

    An Information Security Place Podcast – Episode 01-2011

     

    Thomas Jefferson said, “Delay is preferable to error.” Martin Luther said, “Who waits until circumstances completely favor his undertaking will never accomplish anything.” So depending on which quote you like, we either took a long time to record a new episode so we would do it right, or we are just a bunch of slackers. I prefer the former, but I am biased…

    In either case, we’re back, and in the immortal words of Rivethead, we’re “Stirring It Up Again” (you’ll read about Riverthead below and hear about them in the podcast).  Jim, Dan, and I got together on a cold and stormy night (at least in Houston and Denver) to talk about all things InfoSec.  Show notes are below.  Oh, and yes, we are going with a new theme for numbering our episodes.  I think it takes away the pressure a little myself since I don’t have to worry about huge numbers for episodes.  Of course, I’ll have to count now, which sucks (thanks Jim).

    Show Notes:

    InfoSec News Update –

    • Study shows non-compliance more expensive than compliance (study was sponsored by Tripwire) – Article Link / Report Link
    • Security Fail – When Trusted IT members go bad!! – Link Here
    • “It’s a CIO’s worst nightmare: You get a call from the Business Software Alliance (BSA), saying that some of the Microsoft software your company uses might be pirated.

      You investigate and find that not only is your software illegal, it was sold to you by a company secretly owned and operated by none other than your own IT systems administrator,
      a trusted employee for seven years. When you start digging into the admin’s activities, you find a for-pay porn Web site he’s been running on one of your corporate servers.
      Then you find that he’s downloaded 400 customer credit card numbers from your e-commerce server.

      And here’s the worst part: He’s the only one with the administrative passwords.”

    • Looking back at old security news – have we made progress?? – Link Here (Registration required for full article)
    • A SLOW Death! – Link Here
    • Egypt gets Internet connection back – Link Here
    • Ever Cookie’s Anyone? – Link Here

    Discussion Topic #1 – CSRF and Clickjacking – Link Here

    Music Notes:

    Special Thanks to the guys at RivetHead for use of their tracks – http://www.rivetheadonline.com/

    Tour dates:

  • Feb 19th – Playing Curtain Club Dallas, TX
  • Feb 26th –  in Carlsbad, NM
  • March 19th – American Airlines Center at a Dallas Stars Hockey game
  • Intro – RivetHead – “Stirring It Up Again”
  • Outro – RivetHead – “Zero Gravity”
  • Link to MP3

    An Information Security Place Podcast – Episode 36

    An Information Security Place Podcast – Episode 36

     

    So do we suck or what? Sorry that its taken so long for us to get another episode out… things have been crazy busy for all of us.

    Anyway for this episode, Dan and Jim found themselves with 30 minutes or so of spare time, not much of a script, and working mics (Michael was working on a couple of proposals and an RFP that is due in two days); so they sat down and simply recorded an unscripted show of rambling about things that are going on for the moment.

    Info Sec News Moments:

    • Kudos to MS’ IE 8 Add Campaign – Link Here
    • Jim’s 4.5 Seconds of fame – DenverGov website Hack – Link Here
    • Android and the SMS Rootkit Hack – Link Here
    • Google Ditching Windows due to Security Concerns – Link Here
    • Denver OWASP – SnowFroc Con – Link Here

    Music Notes:

    Link to MP3

    An Information Security Place Podcast – Episode 35

    An Information Security Place Podcast – Episode 35

     

    Episode 35 is here. The format is different today. Instead of you listening to Dan, Jim, and me yap about news and pontificate about security topics, you are going to hear a talk I gave at the Texas Technology Summit in early April 2010. The talk title and synopsis are below, along with a link to the slide deck.

    Title: Breaking Down the Enterprise Security Assessment

    Synopsis: Many enterprise security assessments look at too few attack vectors or do not dig far enough into the attack vectors once a vulnerability has been discovered. Come join a discussion on the breakdown of a security assessment, explore the essential attack vectors, and debate the depth to which the assessment should go.

    Link to MP3

    Link to slides

    An Information Security Place Podcast – Episode 33

    An Information Security Place Podcast – Episode 33

     

    Yes, the logo is weird this time.  If you can’t tell what it is, maybe this will help.  For the first time ever (and probably the only time since I don’t get to Atlanta much), An Information Security Place Podcast has joined forces with the  Southern Fried Security Podcast to create a joint episode.  Can you see it now??  Yes, that is the logo for An Information Security Place Podcast placed over Colonel Sander’s face (he is the patron saint for the SFS podcast).  Yea,  I thought it was actually kinda freaky, too.  but what else do I have to do with my time??

    So we joined forces for a couple of reasons:

    1. Because I was in Atlanta to speak about security assessments at the local NAISG chapter.
    2. I begged Martin to let me post it up as episode 33 over here since Dan, Jim and I haven’t had a chance to record yet, and this makes it all better!

    So we stayed in the same room where the event was held and got irradiated by a myriad of computer and sound equipment while recording the podcast.  I had to wear someone’s headset, and now I have some kind of weird rash and some minor swelling around my ears.  And to make it even more fun, Mike Rothman sat across from us the whole time and heckled us.  What a night.

    Actually, I had an awesome time.  Very good times with very good friends.  Thanks to the whole Atlanta NAISG crew and the SFS podcast crew (Andy Willingham, Martin Fisher, and Steve Ragan) for inviting me in with typical southern hospitality (even though Steve is a Yankee).

    As to show notes, I am lazy.  I am only going to have one note (below) because it is the one news item that I brought along and the ONLY one that Andy didn’t include in his notes (in fairness, I never sent him the link).  Here’s a link to the SFS podcast site with the rest of the notes.   (Hey, Andy did the hard work – why duplicate efforts??)

    • Caleb Sima says that developers shouldn’t learn anything about security – Link here

    Link to MP3

    iTunes picked up the wrong episode

    iTunes picked up the wrong episode

    Just realized that iTunes picked up Episode 31 instead of episode 32 on the latest post. I had to delete the enclosure in WordPress and then recreate it. Not sure what happened. If you subscribe to the podcast via iTunes, you may need to delete Episode 32 and then update. Sorry about that!

    Vet

    An Information Security Place Podcast – Episode 32

    An Information Security Place Podcast – Episode 32

     

    OK, holy crap.  We expected this episode to be pretty short since Jim was not around to add his golden commentary, but we got to yappin’ and churned out almost an hour of content (I use that term loosely).  So enjoy the show!

    Show Notes:

    InfoSec News Update –

    • Iran Shutters Google’s Gmail Service, offering own email for citizens – Link here
    • Security Scoreboard – Link here
    • Brian Kreb’s has blog post used by scammers – Link here and Sophos article link here
    • The Death of Product Reviews (Mike Rothman at Securosis) – Link here
    • TSA agent arrested for molestation – Link here
    We won’t get intot he details here because this guy is sick, but I had to point out this line from the TSA blog about the issue:
    “TSA holds the highest standards for our workforce and this individual’s actions do not reflect on the more than 50,000 men and women who work every day to keep the traveling public safe.”
    • Hacker threat forces DoH to close appraisal site (Political Activist?) – Link here
    Discussion Topic – Smaller, more intimate security conferences (Security B-Sides, Schmoocon, etc)