Alle afleveringen
746 afleveringen, van nieuw naar oud
-
7MS #295: Interview with Kevin Keane
25 januari 2018 · 59 min
Today I'm excited to be joined by my friend and advisor Kevin Keane (Twitter / LinkedIn) who is a lawyer, blogger, keynote speaker, business advisor, and just all around great guy. Kevin and I sit down to talk about: Lees meer
How SMBs can take some productive security baby steps
How to get the most value out of your next security consultant engagement
Can breaches ever be funny?
What is the Trust Calculus?
Do I need to care about GDPR?
That and much more is coming up today on this special interview edition of the 7 Minute Security podcast!
-
7MS #294: GDPR Me ASAP
18 januari 2018 · 11 min
GDPR in a nutshell Lees meer
GDPR, in a nutshell, is a set of legal regulations focused on the privacy of personal information for EU citizens - no matter where they are. Entities that store and/or process personal information about EU citizens must clearly explain to the citizens what data is being stored and processed, and any parties the data is being shared with. The citizens must opt-in and agree to each instance or reason that their data is being stored and processed. The citizens also must be able to, at any time, request a copy of the data or request that it be deleted.
How does GDPR define "personal data"
As "any information relating to an identified or identifiable natural person."
When do GDPR regulations start being enforced?
May 25, 2018.
What are the key roles organizations need to be aware of as it relates to handling data under GDPR regulations?
Two primary roles:
Controller
An entity that determines the purposes, conditions and means of the processing of personal data
Processor
An entity which processes personal data on behalf of the controller
What are the GDPR lawful basis for processing data?
Consent: the individual has given clear consent for you to process their personal data for a specific purpose.
Contract
Legal obligation
Vital interests
Public task
Legitimate interests
Are there any good step-by-step guides to GDPR compliance?
This site lays things out at a high level with a 12-step program, if you will.
How can I learn more about GDPR?
This http://gdprandyou.ie/ site is a great GDPR primer, and this PDF from Imperva is good as well. I also googled GDPR for dummies and found some good results too :-)
-
7MS #293: How to Become a Packtpub Author - Part 2
4 januari 2018 · 15 min
Back in episode 280 I talked about how I started working with PacktPub to start authoring a video course on vulnerability scanning using Kali. Lees meer
Since that episode I've found that recording and editing high quality video clips is taking waaaaaayyyyyyyyyyy longer than I'd like, but it's worth it to create good stuff! PacktPub authored a tool called Panopto to make videos, but I found it a little frustrating to work with, so I'm going with the following janky - but functional - recording setup:
Record raw video using iShowU
Pull that video into iMovie and cleanup all the mistakes
Record audio in Quicktime
Pull audio clips into iMovie and edit those to match up with what's happening in the video
Export video as 1080p
Additionally, here are a few little tweaks that help the content creation match up with PacktPub's requirements:
Resolution should be 1920x1080 (full HD) - I just bought a secondary monitor for this. Specifically, an HP 22cwa.
I set my .bashrc file to use all white for the terminal prompt. See this article which helped me out.
In Terminal I created a PacktPub profile that has font as Monospace Regular 20pt.
-
7MS #292: OFF-TOPIC - How I Nearly Killed My Sister with a Snowball
28 december 2017 · 12 min
Hey folks, I had originally planned to cover the CredDefense toolkit but I couldn't get it working. I'm basically having the same issue that someone reported here. Sooooo....will have to save that for next week. Lees meer
In the meantime, this episode features a story about how I nearly knocked a retina out of my sister's face with an ice ball when I was about 8 years old. Yep, she's still mad about it, but I think 2018 is the year for forgiveness!
Enjoy, and we'll talk to you in 2018. Blessings to you and yours!
-
7MS #291: The Quest for Critical Security Controls - Part 4
21 december 2017 · 13 min
Did I mention I love the Critical Security Controls? I do. And here's an absolute diamond I found this week: Lees meer
This site (http://www.auditscripts.com/free-resources/critical-security-controls/) offers awesome CSC-mapping tools (and they're free!), specifically:
A spreadsheet with how the CSCs map to other popular frameworks like ISO and NIST
A manual assessment tool for measuring your org - or someone else's org - against the CSCs. Flippin' sweet right? RIGHT!
Also, be sure to come and Slack chat with us, as my pal hackernovice is building a tool called MacMon to help you satisfy CSC #1!
Lastly, I built an LOL-worthy pentesting recon tool called SSOTT (Scan Some of the Things) that might help you automate some NMAPing, DIRBing, NIKTOing, and the like. Cheggitout!
-
7MS #290: Interview with Joe Klein
14 december 2017 · 52 min
My pal and former coworker Joe Klein joins me in the virtual studio to discuss: Lees meer
His career as a diesel mechanic and insurance guru
How to leave a stable job, take a huge pay cut and start a risky infosec internship (sounds like the name of a broadway musical!)
The start of his new career as a SOC analyst
The importance of having a career cheerleader/mentor
Being hungry for knowledge and certifications without being ashamed or afraid to look like a newb
CompTIA Security+ and Cisco CCNA Cyber Ops certs
The proper pronunciation of the word "dude"
How to do a proper Arnold Schwarzenegger impression
Other references made in the episode:
Arnold Schwarzenegger the love poet
Joe welcomes your comments, concerns, insults and questions via email (listen to today's episode for the address!) or Twitter.
-
7MS #289: I'm Dipping My Toes in Windows Forensics
7 december 2017 · 14 min
Two weird things happening in this episode: Lees meer
I'm not in the car, and thus not endangering myself and others while podcasting and driving!
My once beloved lav mic made a trip through the Johnson family's washer and dryer. I don't know that she'll ever record anything again. We'll see once it fully dries out (fingers crossed).
I spent some time this last week getting back into Windows systems forensics, which has been really fun. If you want a play-by-play guide with some fantastic, practical, hands-on advice, grab yourself a copy of the Blue Team Handbook: Incident Response Edition. I also started a forensics page on BPATTY.
Also, I picked up a Google Home Mini for $30 and can honestly say it quickly has found a special place in my tech/geek heart...even if it is recording everything I say and sending it to the NSA. But a small device that will play Michael Buble's Christmas album as soon as I command it with my voice? Worth the privacy sacrifice.
Finally, if you're in the St. Paul, MN area tomorrow and wanna hear me come talk about "Blue Team on a Budget," come to the Government IT Symposium - more info here.
-
7MS #288: I'm BURPing a Lot
1 december 2017 · 15 min
Sorry the podcast is late this week - but it's all for good reasons! I'm busy as a bee doing a ton of pentesting so I have a smattering of random security stuff to share with you: Lees meer
Mac High Sierra root bug
Did you hear about this? Basically anybody could log in as user root on your system without a password because...there isn't a password! Read the Twitter thread where I originally read the news here, read about the root account madness here, and then read how the fix broke file sharing here.
BPATTY ROCKS!
I tried to wiki-fy my BPATTY project to make it a bit easier to read, so head to bpatty.rocks and let me know what you think!
I'm BURPing a lot
I can't tell you how fun it has been to get back in the pentesting saddle and hack some Web sites these past few weeks. Here are a few tips/tricks others taught me that have helped me get back in the swing of things:
In Burp, state files are being depreciated in favor of project files. Read more here
For BApp extensions, here are a few that help you get the job done:
retire.js looks for old/outdated/vulnerable Javascript libraries
Software vulnerability scanner helps you find vulnerable software, such as old versions of IIS
CO2 has a bunch of tricks up its sleeve - my favorite of which is helping you craft sqlmap commands with the right flags
More on today's show!
-
7MS #287: Introducing 7 Minute Security LLC
22 november 2017 · 12 min
Well, after over-teasing this last week, I'm excited to announce that I've started my own company! 7 Minute Security, LLC gives me an outlet to do all my favorite infosec stuff, such as: Lees meer
Network assessments
Vulnerability scanning
Penetration testing
Training
Public speaking
I welcome you to check out 7MinSec.com for more information. Or 7MinuteSecurity.com or SevenMinuteSecurity.com. Collect 'em all!
What does this mean for the podcast?
Nada - I'll keep cranking it out. Maybe we'll cover a few more business related topics (people have asked about how to get an LLC off the ground, so I might do an episode or two on that), but otherwise everything's the same!
What about the Patreon project?
Because I've been blessed with this opportunity - which will in turn help me keep the 7MS lights on - the Patreon campaign will close down soon. For you lovely Patreons, I've sent you a message (via Patreon site and via email) with more details.
-
7MS #286: The Quest for Critical Security Controls - Part 3
16 november 2017 · 9 min
We're continuing to hammer on the CSCs again this week. Here's some rad resources that can get your CSC efforts in the right direction: Lees meer
CIS Implementation Guide for SMEs
CIS Cybersecurity quarterly newsletters
Netdisco lets you locate machines by MAC or IP, show the corresponding switch port, and disable it if necessary.
Defensive Security Handbook isn't specifically mapped to CSCs but offers great advice to tie into them.
Open-Audit tells you what's on your network, how it's configured, and when it changes.
-
7MS #285: The Quest for Critical Security Controls - Part 2
9 november 2017 · 13 min
Nothing to do with security, but I've heard this song way too much this week. Lees meer
I love the CIS Controls but it seems like there isn't a real good hands-on implementation guide out there. Hrmm...maybe it's time to create one? Speaking of that, check out the MacMon project and chat with us about it via Slack.
After hearing rave reviews about Fingbox (not a sponsor), I picked one up (~$120) and wow, I'm impressed! It's got a lot of neat features that home users and SMBs would like as it related to mapping to CSC #1:
Ability to map network devices to users to create an inventory
Email alerts for new devices that pop up on the network
Block unwanted users from the app, even when not directly connected to the LAN
Nice set of troubleshooting tools, such as wifi throughput test, Internet speed test, and port scanning of LAN/WAN devices
More on today's show...
-
7MS #284: The Quest for Critical Security Controls
2 november 2017 · 12 min
For a long time I've been electronically in love with the Critical Security Controls. Not familiar with 'em? The CIS site describes them as: Lees meer
The CIS Controls are a prioritized set of actions that protect your critical systems and data from the most pervasive cyber attacks. They embody the critical first steps in securing the integrity, mission, and reputation of your organization.
Cool, right? Yeah. And here are the top (first) 5 that many organizations start to tackle:
Inventory of Authorized and Unauthorized Devices
Inventory of Authorized and Unauthorized Software
Secure Configurations for Hardware and Software
Continuous Vulnerability Assessment and Remediation
Controlled Use of Administrative Privileges
Google searches will show you that you can definitely buy expensive hardware/software to help you map to the CSCs, but I'm passionate about helping small businesses (and even home networks!) be more secure, so I'm on a quest to find implementable (if that's a word?) ways to put these controls in place.
I'm focusing on control #1 to start, and I've heard great things about using Fingbox (not a sponsor) to get the job done, but I'm also exploring other free options, such as nmap + some scripting magic.
More on today's episode...
-
7MS #283: OFF-TOPIC - I Love Cops and COPS
27 oktober 2017 · 19 min
My plans for this week's podcast went hush-hush, kablooie, bye-bye, see ya, adios. Lees meer
So, I'm pinch-hitting and going off-topic and talking about...of all things...cops. Now wait! Wait wait! Don't run away. I'm not going all political on you or anything like that. Just wanna share some anecdotes and perspectives on the following:
What it was like growing up with a dad who was a cop
Losing a cousin in the line of duty
Getting a call from my local police department this week claiming I was a danger to a school bus full of kids. Whaaaaa?
Oh, and I sing a little bit on this episode too.
-
7MS #282: A Peek into the 7MS Mail Bag
19 oktober 2017 · 12 min
I'm gonna level with you: it's been a heck of a week. So I thought I'd try something a little different (and desperate?) and use this episode to answer some FAQs that come in via email and Twitter DM. Today's burning questions include: Lees meer
Q: Do I think it's dangerous to podcast and drive?
A: Not really, especially now that I got one of these babies.
Q: What is the eJPT cert all about?
A: It looks like a pentest training/cert path that sits somewhere (difficulty wise) between CEH and OSCP. It's favorably reviewed and will set you back a few hundred dollars.
Have you taken this cert? I'd love your feedback and, if possible, to do a mini Skype interview with you for the show. Drop me a note and lets chat.
Q: What's a good place to practice Web hacking skills online?
A: I've been a long time fan of Juice Shop, and up next in my queue is HackTheBox.
Q: Any more Vulnhub.com VMs in the works?
A: Kinda. Listen to today's episode :-)
-
7MS #281: Baby's First Banking Infosec Conference
11 oktober 2017 · 15 min
I went to my first ever banking-focused infosec conference a few weeks ago (WBA's Secure-IT) and learned a ton. Lees meer
I met some really great people and had many productive conversations around security. The main takeaways from the conference that I talk about in today's episode:
Standing all day and talking about security is exhausting!
You can thwart "swag whores" (sorry mom, but I learned that that's what they're called!) by pushing your merch table deep into the booth so it's touching the rear curtain. That way people have to go through your "people perimeter" and engage in conversation with you in order to be granted access to the swag!
From the conversations I had with the staff at these small banks, they're definitely wanting to slurp up as much helpful info from the sessions as possible. Specifically, finding ways to better improve security posture using free/cheap tools is ideal!
I attended a few sessions that got my blood boiling. The outline of these talks went something like this (slight exaggeration added, but not much):
Hackers are way smarter and more physically attractive than you, and they can get by all your defenses with ease
You're helpless, hopeless, and not physically attractive
Luckily we (Vendor X) are here and we offer our patented Super Solution Y that will thwart the APTs 100% of the time, no question, guaranteed
People don't appreciate being talked down to, nor do they want to be shamed, blamed or scared into making security better.
More on today's episode...
-
7MS #280: How to Become a Packtpub Author
5 oktober 2017 · 12 min
I'm excited to announce I'm going to be a PacktPub author! I'm going to work with them to create a course on network/vulnerability scanning. I'm pumped, but kinda nervous, so when I had the initial conversations with PacktPub staff, I made sure I hit them with my burning questions: Lees meer
Q: Are you going to ask me to create a sweet course and then pay me pennies for every digital copy sold?
A: No. Authors get paid a lump sum up front and then share in profits for digital copies sold.
Q: Who's gonna dictate the project outline - as well as timeline for recording it?
A: It's a joint effort. The author dreams up the timeline, fine-tunes it with PacktPub, and then hammers out a mutually agreeable project timeline.
Q: Do I have to buy some expensive software/hardware to make these videos?
A: Not really. PacktPub did recommend I buy a better microphone (so I got a Snowball), and then they license authors a copy of Panopto to record the videos.
More Qs and As covered on today's episode!
-
7MS #279: Patching Solutions Bake-Off - Part 4
28 september 2017 · 15 min
Intro Lees meer
The patching solutions review concludes this week with Ivanti's patch solution, as well as PDQ Deploy/Inventory.
As a quick reminder, here's where our bake-off currently sits:
Ninite (covered in 7MS #275)
ManageEngine (covered in 7MS #277)
Quick reminder: none of these solutions are bribing me with fat wads of cash to plug their products. Some day I hope to have such problems, but today is not that day.
Ivanti
You might know Ivanti as Shavlik - that's the product name I'm more familiar with anyways. Back in February, Shavlik became Ivanti.
Pros
Pretty easy to install and manage - even without a deep background in IT (in today's episode I tell a story that can back this claim based on my experience)
Does a solid job of applying patching Windows OS and third party
Cons
Pricing is a little steep - last figures I saw were ~$80 per server, per year and ~$40 per workstation, per year.
ITScripts library (that allows for GPO-style policy enforcement) is a little slim when compared to similar functionality offered from other solutions
PDQ Deploy/Inventory
Pros
Lets you crazy with building custom packages you can deploy to granular groups
Awesome online help resources, including a YouTube video library that's got a video for just about everything
Quick response to support tickets
Cons
A bit more complicated to get comfortable with than the other solutions
A little confusing on the Windows patching side - not quite as "point and patch" as some of the other solutions
Agentless system - machines have to be able to "see" the PDQ
-
7MS #278: Interview with Rob Sell
21 september 2017 · 56 min
Intro Lees meer
We're breaking ground with this episode, folks! For the first time in 7MS history, we've got a guest on the show (finally, right?!).
Rob Sell is an IT manager who has been working in IT for many years, with a focus on information security specifically for the last 4 years. He recently came home from Defcon 25 with a third place in the SE CTF.
Rob sat down with me to discuss the CTF, how to make an outstanding CTF audition video, OSINT tools/tips/techniques, the value of tech/security certifications, career advice, and more!
Interview notes and links
Here's Rob's Defcon CTF audition video
EchoSec helps you see a geographical area at a certain point in time. According to the Web site, EchoSec is "the most comprehensive social sentiment tool on the market" - hmmmm, seems like a great SE tool!
X-Ray is "a tool for recon, mapping and OSINT gathering from public networks."
Michael Bazzell's Web site has online training, free tools and other goodies. Michael also has some books.
Christopher Hadnagy has a podcast that's strictly focused on SE. He's also got some books.
ArcGIS isn't necessarily labeled as an SE tool, but can certainly be used for SE efforts.
-
7MS #277: Patching Solutions Bake-Off - Part 3
14 september 2017 · 13 min
ManageEngine Desktop Central Lees meer
Overall, I have to bluntly say that I really enjoyed playing with ManageEngine's solution. It's got a crap-ton of features built into it - above and beyond patching - that I think IT/security folks will really appreciate.
Pros
Agent or agentless management of systems
MDM (didn't play with it but it certainly looks feature-rich)
Application white/blacklisting
Ability to push out configurations for things you'd normally use GPOs for - i.e. setting a login banner, enforcing screen locks, setting IE homepage and search engine, etc.
Patch management is full-featured - it's easy to setup a simple "scan systems, download and deploy missing patches." Or just a "scan to identify missing patches" kind of thing. It's easy to run a variety of reports to find out which systems are most vulnerable, which patches are missing across the enterprise, etc.
Software deployment engine - there's a big package library where you can easily search and deploy things like Dropbox, Adobe Reader, etc. It also includes a self-service portal where users can simply select certain packages and have them installed automagically!
Inventory - ability to have detailed hardware/software level details on each machine. Ability to block software by path and/or hash. You can also give people a warning saying "We're gonna nuke dropbox in 2 days if you keep it on here!"
Agent-based install gives you ability to chat with users, remote control systems, send announcements, drop to a command line at a target machine, etc.
Reports - you can create a report for just about anything under the sun like AD group changes, user logon reports, users that are disabled/expired, and on and on...
Email alerts - I think you can trigger an email alert for just about ANYTHING that happens in the environment.
...more on today's episode!
-
7MS #276: The CryptoLocker song
6 september 2017 · 12 min
This is it! The worldwide Internet debut of an original infosec-themed song called CryptoLocker'd, and as the name implies, it's about a CryptoLocker incident. Here's the quick back story: Lees meer
A few years ago a worked on an incident response where a user got phished with a promise of a free burrito from Chipotle but instead got a free order of CryptoLocker! And rather than tell IT or sound the alarms, the user just left for the day! The next day they came back and the company was digitally on fire, and they played ignorant to what was going on.
I found the user's handling of the situation humorous (read: not the CryptoLocker infection itself!), so I was inspired to write a song about it. Today's episode has the audio, and I welcome you to follow along with the lyrics below (head to 7ms.us to see the full lyrics as they are included in a GitHub gist)
-
7MS #275: Patching Solutions Bake-Off - Part 2
30 augustus 2017 · 12 min
This episode continues our series on comparing popular patching solutions, such as: Lees meer
Ninite
ManageEngine
Ivanti
PDQ
Ninite
This week I focused on Ninite, and here's the TLDR version:
Pros
Does one thing (third party patching) and does it really well
Extremely affordable
User interface is clean, simple and really easy to use/learn
Cons
No "agentless" option - it's an agent or nothin'
I'm not sure if Ninite has the brand name recognition and reputation to be accepted/respected by large companies
I need to do more homework on how they pull down their packages...are they ripping apart packages and repackaging them at all? That could be a big avenue for side-loading icky stuff.
-
7MS #274: Speaking at ILTACON - Part 4
24 augustus 2017 · 15 min
I'm back from Vegas! My talk went really well and I'm excited to tell you about it in today's episode. First, some conference/trip highlights: Lees meer
During the ILTACON conference I attended a great talk by Don McMillan about how to infuse humor into your work environment. Really enlightening, and you know those things you hear about how humor lowers blood pressure, increases satisfaction and just overall makes you a more pleasant person to be around? Turns out it's true!
On the day before my presentation I got my first experience touring around the Vegas strip, and the people watching did not disappoint. I also saw the Muhammad Ali and Van Gogh exhibits, which were awesome.
When it came to the actual talk, everything went really well. The audio/visual stuff all worked perfect, and I felt the content delivery went over well too. People asked a lot of questions and even hung out afterwards to discuss security topics further.
There were two big surprises I wasn't expecting, though:
A podcast listener was at the conference, and shared with me that after listening to lots of 7MS episodes, he always figured I looked like Jared from Subway. :-(
There were super talented artists from a company called Filament did a comic-book style retelling of my talk live as I was doing it. I love crazy-talented people like this, so I was totally geeking out. I reposted the renderings (with their permission) at my personal portfolio site if you wanna check 'em out.
-
7MS #273: Speaking at ILTACON - Part 3
17 augustus 2017 · 9 min
I ran out of time in episode #272 to tell you about why preparing to be a speaker for ILTACON was way more stressful that preparing for Secure360 a few months ago. The main points of difference/stress were: Lees meer
ILTA wanted to see PowerPoint deck progress weekly, whereas with Secure360 it was pretty much "Your talk is accepted - see you at the conference!"
ILTA is going to show a "speaker slide" with bio a few minutes before the sessions starts. That way the session is focused on content (and probably avoids people who like to talk about themselves too much :-)
ILTA requested my PowerPoint and handouts a few weeks before the session so they could put on their Web site for attendees to see. Although that put some pressure on me to get content done early, I think it's great because presumably some people at the talk will have screened the content and therefore be more tuned in.
-
7MS #272: Speaking at ILTACON - Part 2
17 augustus 2017 · 11 min
This is part 2 of a series focusing on public speaking - specifically for the ILTACON conference happening in Vegas this week. Lees meer
In this episode I share a high-level walkthrough of my talk and the 10 "Blue Team on a Budget" tips that the talk will focus on. These tips include:
Turning up Windows auditing and PowerShell logging
Installing Sysmon
Installing Security Onion
Don't put too much faith in endpoint protection
Keep an eye on Active Directory
Install RITA
Deploy a Canary
Use strong passwords
Install LAPS
Scan and patch all your things
-
7MS #271: Patching Solutions Bake-Off - Part 1
10 augustus 2017 · 10 min
Seems like every business I meet with needs some sort of help in the patching department. Maybe they've got the Microsoft OS side of the house under control, but the third-party stuff is lacking. Or vice-versa. Either way, the team I work with is excited to kick the tires of some popular patching solutions over the next few weeks, and we'll audibly barf up what we learn into this mini-series! Lees meer
Solutions we'll poke around with include:
Ninite
ManageEngine
PDQ Deploy
PS: None of these solutions are sponsoring 7MS. They're just popular patching solutions we're trying out to learn more about 'em and give you the pros/cons we discover!
In today's episode I dive a bit into...
Ninite
Pros
Cheap
Does one thing, and does it well
Been around for a long time
Cloud-based - doesn't rely on LAN-side server
Cons
Only cloud-based...no LAN-side option
Requires an agent
Agent's only purpose is patching - no extra bells/whistles like remote control or inventorying capability
-
7MS #270: IDS on a Budget - Part 4
3 augustus 2017 · 12 min
I spent a bunch of time with Security Onion the last couple week's and have been lovin' it! I ran the install, took all the defaults, ran the updates, and pretty much just let it burn in on my prod (home) environment. Lees meer
After a few days, I went back to check the Security Onion dashboard to check the alerts. There was a bunch of benign stuff (computers pinging each other, Dropbox broadcasting to the network) but also a couple interesting finds - SO caught one of my VMs downloading (intentionally) Invoke-Mimikatz. The dashboard allows you to see transcripts of file downloads like this, as well as a tool called Network Miner to extract a copy of the downloaded file for further analysis.
One thing the SO didn't pick up on was the DNS-based C2 tunnel I setup on a test victim client. However, it turns out RITA works great for exactly this type of analysis - it reported the huge number of DNS requests from my victim client to the C2 server. Very helpful info for an incident response situation!
-
7MS #269: Documentation
27 juli 2017 · 13 min
Documentation is super boring, right? Yet it's critical to getting your client/audience excited about making their security better! Lees meer
In this episode I talk about my mixed feelings towards the "big" standards like ISO/NIST/etc. and how a more tactical, down-to-earth documentation approach might be more effective in some cases. And I think we need our documentation to be much more focused on consultation/remediation and not just "Hey, your security sucks...and these next 100+ pages will tell you exactly why!" We can do better!
Yes, this episode is like 18 minutes because, well, I guess I'm really passionate about documentation. :-)
-
7MS #268: IDS on a Budget - Part 3
19 juli 2017 · 12 min
Been having a blast working with the beta branch of the Sweet Security project and it anxious to try the latest fixes of the beta branch. Give it a look! Lees meer
I also spent a lot of time the last few nights playing with Security Onion and love it. After zipping through the install wizard and hitting reboot a few times you're pretty much good to go. A few recommendations I'd make after those initial reboots though:
Run the soup command to update Security Onion with all the latest packages
Use ufw to adjust the internal firewall to allow management from ports other than SSH (which is already preconfigured)
On a side note, I think you might have to have your vnic in VMWare set to promiscuous mode in order to allow proper network sniffing.
Do a wget http://testmyids.com to ensure Security Onion alerts are coming in the squil dashboard security alerts are pouring in.
Also, check out this article for some handy tips on threat hunting with Bro.
Next up on my "test this out list" is to setup DNS tunneling to a Digital Ocean droplet I setup, and see if the onion picks up on that, or if I can at least get warned somehow about a high amount of DNS traffic.
-
7MS #267: Backup Disasters
19 juli 2017 · 12 min
Today's episode is a horror story about how I recently lost 5+ years of CrashPlan backups due to what I'm calling a...small clerical error. Lees meer
Yes, this oopsie was 100% my fault, but I think backup providers can do a better job of warning us (via text or automated call rather than just email) before blowing away our life's work.
-
7MS #266: IDS on a Budget - Part 2
13 juli 2017 · 11 min
This week I've continued to play with the awesome Sweet Security IDS solution you can throw on a Raspberry Pi 3. A big update to share is that there is a beta branch which has some cool new features, such as the ability to break the Bro + ELK stack across multiple machines. Lees meer
I also lost a lot of sleep these last few days playing with Security Onion and will do a future episode focusing only on that!
-
7MS 265: IDS on a Budget - Part 1
5 juli 2017 · 11 min
I've been wanting to get a Bro IDS installed for a long time now - and for several reasons: Lees meer
It looks fun!
My customers have expressed interest
It will be part of my upcoming ILTACON session.
So this weekend I started getting the hardware portion ready, which includes:
Ubiquiti Edge Router X (~$99)
TP-Link TL-SG105E (~$35)
CanaKit Raspberry Pi 3 Complete Starter Kit (~$70)
If you need additional information such as screenshots/configs etc to get the VLANs passing properly from the Edge Router X to TP-LINK switch, let me know. Otherwise for now I'm just focusing on crafting content for part 2, where we'll dive into actually turning the Pi into a Bro sensor using Sweet Security.
-
7MS #264: Hacking Wordpress
29 juni 2017 · 12 min
I was pleasantly surprised to see a Wordpress site fall into a pentest scope this past week. One helpful tool to get familiar with when attacking Wordpress sites is wpscan, which is built right into Kali - or you can grab it from GitHub. Get familiar with the command line flags as they can help you conduct a more gentle scan that recovers from site errors/disconnections more easily. Specifically, read up on these options: Lees meer
--throttle - for example, I've been using --throttle 1000 in order to be a bit less intense on my target site
--request-timeout and --connect-timeout help your scan recover smoothly from site errors/timeouts
Also, if you find yourself in a situation where you're testing a production Wordpress sight (not recommended), consider setting up a free up/downtime alert via a free service like Uptime Robot so you can get emails if the site ever poops out. That certainly beats hitting F5 in Firefox every 10 seconds :-)
-
7MS #263: Make Nessus Reporting Fun Again!
26 juni 2017 · 14 min
Tell me I can't be the only one who regularly wants to combine a bunch of small Nessus scans files into a big fat Nessus scan file, and then make pretty pictures/graphs/summaries that the customer can easily understand? Lees meer
Over the last few weeks I must've tried every Powershell and Python script I could get my hands on, yet still didn't find the magic bullet solution. That is, until I found this little beauty of a tool: NamicSoft. It's a $65 tool for Windows that will not only combine multiple Nessus files into one huge file, but it offers a ton of export/reporting features to make the Nessus data more valuable. Oh, and it can also digest Burp and Nexpose data as well!
More on today's episode...
-
7MS #262: Speaking at ILTACON
15 juni 2017 · 10 min
Through kind of a weird series of events, I have an opportunity to speak at ILTACON this summer in Vegas (baby!). I'll be talking about some things you can do if you suspect your perimeter is breached, as well as low-hanging fruit you can implement to better defend against breaches. I'm pumped. And I've done the most important part and chosen a PowerPoint theme: A Few Good Men :-) Lees meer
I've spoken with some of you in the past and know a few of you spend your days and sleepless nights hunting threats. If so I'd love to talk to you to get some creative ideas as it relates to crafting the session content.
-
7MS #261: Blind Network Security Assessments
8 juni 2017 · 11 min
This week I had the fun opportunity to do a "blind" network security assessment - where basically we had to step into a network we'd never seen before and make some security posture recommendations. I've found that the following software/hardware is quite helpful for this type of assessment: Lees meer
The PwnPulse helps a ton in scanning wired and wireless networks...and even Bluetooth! I've covered the Pulse in past episodes - check out part 1 and part 2.
Network Detective will do a ton of helpful Active Directory enumeration and point out potential red flags, such as:
Accounts that haven't been logged into for a long time
Accounts with passwords that haven't been refreshed in a long time
Privileged groups that need review (Domain Admins, Enterprise Admins, etc.)
AD policy issues (*warning: by default Network Detective only pulls back a few policies by default. Check out scripts such as my Environment Check to grab a dump of all GPOs.
Thycotic Privileged Account Discovery is a free tool that can crawl AD workstations and enumerate the local administrator accounts on each machine. It makes a good case for implementing LAPS.
-
7MS #260: PwnPro 101 - Part 2
3 juni 2017 · 12 min
I'm continuing to love the our PwnPro and had a chance to use it on a customer assessment this week. For the most part the setup/install was a breeze. Just had a few hiccups that the Pwnie support team straightened me out on right away. Lees meer
In the episode I mention some command line tools and syntax that helped me work with the Pulse. One was using fping to sweep large subnets and accurately find live hosts:
fping -a -g 10.0.5.0/16 > blah.txt
Then, to setup the reverse shell, I just forwarded port 22 from my Ubiquiti gear to my internal Kali host, and then ran this to make the reverse connection:
ssh pwnie@localhost -p 3333
Lastly, to setup the reverse shell so you can proxy Web traffic to an alternate host/port, such as the Nessus port, setup your shell like so:
ssh pwnie@localhost -p 3333 -ND 8080
Then leave that window open and setup your Web browser so that you do a SOCKS5 proxy to localhost:8080. Finally, visit http://ip.of.your.host:XXXX. So if your Pulse was 1.2.3.4 and had Nessus running, you'd visit https://1.2.3.4:8834.
Enjoy!
-
7MS #259: OFF-TOPIC - Home Robbery Attribution
25 mei 2017 · 10 min
Warning! Warning! This is an off-topic episode! Lees meer
I try really hard to create valuable weekly content about IT/security. However, sometimes a virtual grenade goes off in my life and prevents me from having the necessary time/resources to get my act together. This has been one of those weeks. :-)
So today I'm going off-topic and talking about an alleged burglary of some electronics at my home. And once we identified the culprit, wow...nobody was more surprised than me.
-
7MS #258: Speaking at Secure360 - Part 2
18 mei 2017 · 15 min
Intro Lees meer
I mentioned last week that I was speaking at the Secure360 conference here in the Twin Cities, and at that time I was preparing a talk called Pentesting 101: No Hoodie Required. I was so nervous that I've basically spent the last week breathing heavily into paper bags and wishing I was on sedatives.
But I have good news to report in today's episode, friends! The talk was very well received and the attendees didn't get out torches and pitchforks! #winning! So today's episode (audio below) talks more about the public speaking experiences and highlights some lessons learned:
Things I'd do again next time
I'd not tempt the demo gods and still pre-record my hacking movies ahead of time. I saw some people do live demos of very technical things and it did not go well for a few of them :-(
I would still spend way too many hours cutting together my movies in iMovie so that they followed a good tempo when presented live
I would still have a copy of my presentation on two different laptops, 3 USB thumb drives, a cloud copy, and a copy sent to the Secure 360 folks just in case. Backups, backups, backups - am I right?
What I'd do differently next time
I'd hopefully have the preso done a few days (weeks, even!) ahead of time and practice it in front of colleagues to get some feedback.
I'd still have a theme to the presentation, but rather than something specific like Terminator 2, maybe I'd go even more general and pick a movie/character that could appeal even more to the masses.
I wouldn't worry so much about having a presentation that "nails it" for everybody. That's just not possible! We're all coming from different backgrounds and skillsets. It's not gonna be a home run for everybody.
-
7MS #257: Speaking at Secure360
11 mei 2017 · 11 min
The nervous butterflies are chewing up my organs this week. Why? Because I'm speaking at Secure360 next Tuesday and Wednesday. Lees meer
I'm trying to build a presentation that:
Appeals to both techie nerds like me, as well as regular human people
Strikes a healthy balance between fun and informative
So, my outline is roughly as follows:
Intros
Lets talk about pentesting vs. vulnerability scans
Build your own hackin' lab for $500!
Good/bad training (CEH vs. OSCP)
Lets hack some stuff following a methodology!
Tune in today's episode for more...
-
7MS #256: AlienVault Certified System Engineer - Part 2
4 mei 2017 · 11 min
So a few weeks ago I did an episode about the AlienVault Certified Security Engineer certification, and last Friday I took a stab at the test. Lees meer
I failed. It kicked my butt.
Today I'm here to both rant about the unfairness of the test and offer you some study tips so you don't suffer a similar fate.
P.S. - you should definitely check out this blog as it's one of the few valuable study guides I could find out there on the Interwebs.
-
7MS #255: PwnPro 101
27 april 2017 · 11 min
I'm kicking the tires on the PwnPro which is an all-in-one wired, wireless and Bluetooth assessment and pentesting tool. Lees meer
Upon getting plugged into a network, it peers with a cloud portal and lets you assess and pentest from the comfort of your jammies back at your house! Oh, and did I mention it runs Kali on the back end? Delicious.
Today's episode dives into some of what I've been learning about the PwnPro as I run it through its paces at work and warm it up for our first customer assessment...
-
7MS #254: Bash Bunny
20 april 2017 · 10 min
I've been working with the Bash Bunny for the past few weeks in preparation for a presentation/demo I'm doing in a few weeks. Today I want to talk about what the Bunny is, the cool things it can do, and some of my favorite payloads. Lees meer
Also, I started thinking about what conversation topics spawn from a demo of the Bunny. Specifically, I want to know how people would defend against the Bunny using AD policies, peripheral controls, etc. Check out the Hak5 thread I started about this, as it has got some great ideas.
-
7MS #253: Desperately Seeking Service Accounts
13 april 2017 · 9 min
Find the show notes here!
-
7MS #252: LAPS - Local Administrator Password Solution
6 april 2017 · 9 min
Show notes are here.
-
7MS #251: Blackholing Malvertising with Pi-Hole
30 maart 2017 · 10 min
Show notes are here
-
7MS #250: The PBS Telethon Episode!
23 maart 2017 · 10 min
Show notes for today's episode can be found here!
-
7MS #249: AlienVault Certified Security Engineer - Part 1
16 maart 2017 · 10 min
Show notes are here.
-
7MS #248: How to Hack the 10 O'clock News
9 maart 2017 · 11 min
Show notes are here.
-
7MS #247: Webapp Pentest Tool Bake-Off - Part 4
2 maart 2017 · 10 min
Show notes are here.
-
7MS #246: Webapp Pentest Tool Bake-Off - Part 3
23 februari 2017 · 11 min
Site notes are here. Enjoy.