Alle afleveringen
746 afleveringen, van nieuw naar oud
-
7MS #345: Interview with Amber Boone
16 januari 2019 · 22 min
Coming up on Tuesday, January 22 I'll be doing a Webinar with Netwrix called 4 Ways Your Organization Can Be Hacked. It features a Billy Madison theme and pits evil Eric Gordon against sysadmin Billy Madison. Hope you'll join us - it'll be fun! Lees meer
Today I'm pleased to welcome Amber Boone to the program! She is an awareness builder for a cybersecurity vendor (insert dramatic music!), and Amber was gracious enough to help me pilot a new style of interview called 7 Minute Interviews with 7MS.
I basically asked Amber a "serious" question about security, then a goofy one, then another serious, then another goofy...and so on and so forth until the 7 minutes was up.
Amber answered important questions such as:
Would she rather fight 100 duck-sized horses, or 1 horse-sized ducks?
What basic security effort could orgs address without investing a huge amount of dollars and effort?
Would she rather be a giant hamster or a tiny rhinoceros?
If you'd like to check out what Amber's doing online, check out her LinkedIn, her side project YourLegacies.com or follow Amber on Twitter.
Interested in doing a 7 minute interview with 7MS? Head here.
-
7MS #344: Announcing the 7MS User Group
9 januari 2019 · 11 min
I'd like to coordially invite you to the first-ever 7MS User Group meeting, coming up Monday, January 14th at 6 p.m.! You can attend physically, virtually or both! All the info you need is in today's podcast, as well as here. See you there!
-
7MS #343: Interview with Dan DeCloss
2 januari 2019 · 1 uur 1 min
Psssst! Wanna come to the first ever 7MS User Group meeting? It's coming up on January 14th. You can join in person or virtually! Head here for more information! Lees meer
Dan DeCloss (a.k.a. wh33lhouse on Slack and @PlexTracFTW aon Twitter) joined me virtually in the studio to talk about his passion project, PlexTrac. Dan also shared his insight on all sorts of great topics, including:
How to bleed "purple" and get comfortable playing on both the attacking and defending side of the house
What areas are we failing in defending our networks - and what kind of things can we do make our networks more resilient?!
What's the biggest challenge you see on both the blue and red team side (spoiler alert: communication is super important!)?
How do you break into a cyber security position that requires X years of experience when you have zero experience (Dan offers a great tip: don't be intimidated by requirements on job postings...they're often excessive/unreasonable)
Ways to show security aptitude on your resume without necessarily having a bunch of experience:
Build a home lab
Create a blog
Bug bounties
Make a podcast
Get certs (or at least get enrolled in them)
Some history on PlexTrac and what inspired Dan to create it
-
7MS #342: Interview with Matt McCullough
27 december 2018 · 1 uur 46 min
Matt McCullough (a.k.a. Matty McFly on Slack) joined me in the studio to talk about his wild and crazy path to security. He started literally with no technical experience, but through a lot of hard work, aggressive networking and taking advantage of educational and career opportunities, Matt now rocks a SOC job. Matt and I sat down to talk about a lot of good stuff: Lees meer
How to start an IT career as "the family IT guy"
Leveraging a higher education (at places like Lake Superior College to meet people of influence and start networking like a beast
Entry level sysadmin and helpdesk jobs are fun - great opportunities to make the most of the position, build your skills and stretch yourself outside your comfort zone
MSPs (Managed Service Providers) are another great way to see different clients/verticals/systems and the various requirements that go into supporting them. From there, look for opportunities to start securing those organizations, as many MSPs don't dabble heavily into the security realm.
If you're going to school for cybersecurity training, look for ways to leverage your status to get discounts on security training, such as with SANS
Competitions like CCDC are awesome. You're given a handful of servers that are full of vulnerabilities, and you essentially are tasked with defending a network against a professional group of pentesters/redteamers. You even have to deal with real-life "injections" (other random emergencies and mock customers to deal with) while you're in the thick of the battle!
Join local cyber clubs (or start your own)! Looking for a fun CTF to get started in a group setting? Try hacking the OWASP Juice Shop
Attend security conferences(or start your own)!
...more notes at 7MS.us!
-
7MS #341: How to Fix Unquoted Service Paths
19 december 2018 · 17 min
Today's episode is brought to you by my friends at safepass.me. Safepass.me is the most efficient and cost-effective solution to prevent Active Directory users from setting a weak or compromised password. It's in compliance with the latest NIST password guidelines, and is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount! Lees meer
In today's episode we talk about how to identify - and resolve - unquoted service paths. Maybe you've seen this pop up in your vulnerability scanner and aren't quite sure what the risk is or how to fix it - and maybe more importantly, how to fix it at scale if need be. That's the technical conundrum I faced this week, so I talk about some resources to help you identify this risk and get it out of your environment!
And here's a gist I wrote that walks you through everything step by step:
-
7MS #340: Forensics 101 Reloaded and The CryptoLocker Music Video
13 december 2018 · 23 min
Last week I had the fun privilege of speaking twice at the Minnesota Goverment IT Symposium on the following topics: Lees meer
Forensics 101: This was a "reloaded" talk that I started earlier this year (and covered in episode 299 and 300). At a high level, the talk covered:
Hunting malware with Sysinternals
Creating system images with FTKImager
Dumping memory with Volatility and ripping icky stuff out of memory images with their 1-2-3 punch article
Seeking out DNS tunneling/exfil using Security Onion
Pecha Kucha: this talk, which is in a 20x20 format is part PSA about how to not click bad links, part cautionary tale (and music video!) about how the promise of a free burrito can ruin your business! Check out the video here, and special thanks to Joe Klein for providing the awesome pics to go along with the storyboard - you're a champ.
Also, check out the Digital Forensics Survival Podcast which is awesome for learning more about forensics and IR.
-
7MS #339: A Pulse-Pounding Impromptu Physical Pentest
6 december 2018 · 19 min
On a recent security assessment I was thrown for a loop and given the opportunity to do a two-part physical pentest/SE exercise - with about 5 minutes notice(!). Yes, it had me pooping my pants, but in retrospect it was an amazing experience. This is the mission I was given: Lees meer
See if you can get the front desk staff to plug in a USB drive - I posed as John Strand and armed myself with a fake resume. And as I approached the front desk I suddenly panicked and thought, "What if the front desk person is a BHIS fan?!?!?"
Break into a door with weak security and steal equipment - I was given a plastic shiv and asked to try and get into a secure area in the middle of a busy office morning. No pressure, right?
Was I successful? Was I arrested? Find out in today's episode!
-
7MS #338: SIEMple Tests for Your SIEM Solution
28 november 2018 · 17 min
Today's episode talks about some SIEMple tests you can run on your SIEM (OMg see what I did there? I took the word simple and made it SIEMple. Genius stuff, right? And there's no extra charge for it!). And if you're just now starting to shop around for a SIEM, this episode also has an extensive questionnaire you can use to put your vendors' feet to the fire and see what they're made of! Along with today's episode, I'm releasing a companion gist that contains: Lees meer
Questionnaire - a series of questions you can ask SIEM vendors to gather as many data points about their products and services as possible
SIEM tests - a few tests you can conduct on your internal/external network to see if your SIEM solution indeed coughs up alerts
Enjoy!
-
7MS #337: Happy Secure Thanksgiving
21 november 2018 · 27 min
Happy Thanksgiving! In this episode I: Lees meer
Share some things I'm thankful for - like you!
Talk about a fun episode I'm working on that has some SIEMple tests you can use to test your SIEM (omg see what I did there? So clever)
Announce the 7MS user's group that will start meeting in the south metro area of Minnesota in January of 2019!
Tell you a story about a kid that peed his pants in front of me (you're welcome in advance)
Hope you can take some time off and enjoy your friends/family this week and weekend. Have a blessed Thanksgiving!
-
7MS #336: How to Succeed in Business Without Really Crying - Part 6
14 november 2018 · 24 min
Welcome to part 6 of our miniseries all about the ups, downs, trials and tribulations of being a small, one-person security start up. In this episode I detail out all the software/services I use to run 7 Minute Security, LLC in hopes it might help you run your company as well! I started a new gist to complement this episode, which you can get by clicking here. Enjoy! Lees meer
-
7MS #335: Cool Stuff I Just Learned From Red Teamers
8 november 2018 · 13 min
Today I'm excited to brain-dump a bunch of cool stuff I learned at a red team conference called ArcticCon this week. Although this conference observes the Chatham house rule I'm just going to talk about a few things from a general, high level. Specifically, I asked several heavy-hitting red teams these burning questions: Lees meer
When you red team an org, do you usually assume compromise (i.e. plug a Kali box into the network and go from there) or are you crafting email payloads from scratch, trying to get a reverse shell past various email/firewall filtering efforts?
Does your management seem to "get it" when it comes to the true value of having a red team? Or do they put limits on your efforts - like "Wait a sec, don't phish my boss!" Or "OMG hold on, don't pwn those systems!"
-
7MS #334: IT Security Horrors That Keep You Up at Night
1 november 2018 · 23 min
This week I got to celebrate Halloween with my friends at Netwrix by co-hosting a Webinar called IT Security Horrors That Keep You Up at Night. The content was a modified version of the Blue Team on a Budget talk I've been doing the past year or so, and essentially focuses on things organizations can do to better defend their networks without draining their budgets. Lees meer
The presentation had a Child's Play theme and showed Chucky trying to hack Andy's company via:
Phishing
Abusing bad domain passwords
Abusing bad local admin passwords
Responder attack
Lack of SMB signing
Each attack was also followed up my some advice for how to stop it (or at least slow down its effectiveness).
The presentation itself was a blast and I learned some good public speaking lessons as a result:
Get your slides done early! - when co-presenting, it makes sense that they want to see your slides sooner than the day of! :-)
Don't freak out about an audience of "none" - I always think Webinars are weird because you can't see people's faces or interpret their body language to get a feel for whether they appreciate your humor or understand the points you're trying to make. I learned you just gotta keep pushing forward "blind" whether you like it or not.
Setup a redundant presentation system - ok so file this one with the irrational fears dept, but I actually had a second laptop ready with my presentation loaded, and the laptop was connected to a cell hotspot I setup on a tablet. That way if my machine BSOD'd or Internet went out in my house, I could quickly rejoin the presentation and pick up where I left off. Safe or psycho? You decide!
Happy belated Halloween!
-
7MS #333: Pentesting Potatoes
26 oktober 2018 · 13 min
This week I was in lovely Boise, Idaho doing some security assessment work. While I was there I got to hang out with Paul Wilch and some of the Project7 crew and picked up a lot of cool tools and tips I share in today's episode: Lees meer
The Badger Infosec group did a cool Rubber Ducky demo.
Dan from DDSec did a demo of PlexTrac which is "the last cybersecurity reporting tool you will ever need." I'm actually going to use PlexTrac for my next few assessments and am working to line up a future interview with Dan to learn even more.
Paul gave a demo of Parrot which is cool and Kali-like. However, when Paul and I did a side-by-side test with Kali, we noticed that Parrot kind of barfed when it set out to do an Eyewitness report.
After meeting Paul's son, Simon, I'm optimistic about the future IT/security leaders in this country. There are some wicked-smart youth out there!
Paul gave me a hotel keycard lockpick/shiv (his own creation!) and staged a few doors for me to try and bypass. He made it interesting when he promised to throat-punch me if I failed! Thankfully, I got off without any throat punches!
-
7MS #332: Low Hanging Hacker Fruit
17 oktober 2018 · 8 min
In this episode I'm releasing a new document aimed to help organizations eliminate low hanging hacker fruit from the environment. The document contains (relatively) cheap and (relatively) easy things to implement. And my hope is it can be a living/breathing document that will bulk up over time. Got things to add to this list? Then please comment on the gist below! Lees meer
-
7MS #331: How to Become a Packtpub Author - Part 3
10 oktober 2018 · 8 min
It's done! It's done!! It's DONE!!! Lees meer
That's right mom, my PacktPub course called Mastering Kali Linux Network Scanning is done!
In today's episode I:
Recap the course authoring experience
Explain my super anal retentive editing process that takes 4 hours for every 10 minutes of produced video
Admit some last minute mistakes that about made me quit the whole project
With the holidays coming up, this course is a perfect gift for that IT or security person in your life :-). Buy them a copy - or 10!
Psst! I will soon be getting a handful of vouchers to the course that I can give away to podcast listeners. Interested in one? Ping me and I'll draw names from a virtual hat in a few weeks!
-
7MS #330: Interview with Nathan Hunstad of Code42
3 oktober 2018 · 53 min
In today's episode, I'm excited to be joined in the studio by Nathan Hunstad, Director of Security at Code42. Nathan and I had a great chat about Code42's new security offering called Code42 Forensic File Search, which helps IT and security teams figure out where files are located across their enterprise - even if the endpoints are offline. This functionality lends itself to a number of interesting use cases and helps answer questions such as: Lees meer
"Does known malware have, or has it ever had, a foothold in our environment?"
"Has a particular crypto-mining agent been installed on our employees' computers? Who has it now?"
"What endpoints have or had copies of our company's most sensitive files?"
"What files did an employee download or delete in the months before resigning?"
"What non-sanctioned collaboration applications are present in our environment?"
After today's podcast, be sure to check out this great video of Nathan demonstrating the power of Code42 Forensic File Search live!
Also talked about in today's episode:
Implementing host-based firewalls - here's a great blog and video on it
I want to thank Code42 for their support of the 7 Minute Security podcast. It's a pleasure to work together with them to help companies be more secure!
-
7MS #329: Active Directory Security 101
27 september 2018 · 22 min
Today's episode is brought to you by my friends at Netwrix. Their amazing Netwrix Auditor tool gives you visibility into what's happening both on your local network and cloud-based IT systems and tells you about critical changes, and when and where people have been accessing data. Give it a spin right in your browser here, and then try it in your environment free for 20 days! www.netwrix.com Lees meer
Welcome! Today I'm kicking off a new miniseries all about the fundamentals of Active Directory security. Rather than try to pile all the info into show notes, I'm going to start pumping everything into a living/breathing GitHub gist so we're all on the same page as this miniseries develops further. So, please feel free to check out that gist here.
-
7MS #328: How to Succeed in Business Without Really Crying - Part 5
19 september 2018 · 29 min
This episode is a cavalcade of fun! Why? Lees meer
First, I've got a big announcement: I've accepted a new position.
"What?!" exclaimed my mom. "I thought you were president of 7MS, what the what?"
No worries, it's business as usual, and my responsibilities at 7MS aren't changing. But I'm also going to start writing blogs, nurturing a Slack channel and producing a podcast for somebody else each week. Tune in to find out who!
Oh, and I also conclude this episode with a song from my band, Sweet Surrender. A few years ago we wrote a goofy song to start our shows called Sound Check, and in this episode, I wanted to debut the sequel to that song...called MANDATORY ENCORE. Enjoy.
-
7MS #327: Interview with John Strand
13 september 2018 · 47 min
Today's episode is brought to you by my friends at Netwrix. Their amazing Netwrix Auditor tool gives you visibility into what's happening both on your local network and cloud-based IT systems and tells you about critical changes, and when and where people have been accessing data. Give it a spin right in your browser here, and then try it in your environment free for 20 days! www.netwrix.com Lees meer
Well I'm geeking out big time because today I chatted with John Strand of Black Hills Information Security, SANS instructing, Security Weekly, Active Countermeasures, RITA and more. Some people think he looks like Wash from Serenity or Steve the Pirate from Dodgeball, and others get upset when they learn he's not John Strand the male model.
I've followed John and his team's work since I got started in security, and they've been a huge inspiration for what I do at 7MS. If you're not watching the BHIS Webcasts stop what you're doing and subscribe now! They're all full of practical, hands-on security advice - often complemented by tools that are totally free!
Anyway, enjoy today's interview where John and I talk about how to make pentesters' jobs harder, and why he'd rather be a security advisor to Katy Perry than Donald Trump.
-
7MS #326: Interview with Ryan Manship and Dave Dobrotka
6 september 2018 · 1 uur 34 min
Today's episode is brought to you by my friends at Dashlane, a fantastic password manager for you, your family and your business! Head to www.dashlane.com/7ms and use the code 7MS for 10% off a year of Dashlane Premium! Lees meer
Today I'm super pumped to be joined by Ryan Manship of RedTeam Security and Dave Dobrotka of United HealthGroup. Both these guys lead red teams for a living and had a lot of great insight to share as it relates to:
The definition of "red teaming" and where it overlaps, if at all, with pentesting
Successfully running red team campaigns
Defending against a red team campaign
How to climb unclimbable walls
Is antivirus any good at stopping attackers?
The importance of 2FA and training your end-users
How to fool the "This email originated outside your organization" email banners
How to break into red teaming as a career
How to successfully break into a casino (or not)
Other links and things mentioned in today's show:
RedTeam Security's awesome YouTube video on breaking into the US power grid
If you're a red teamer and in the Twin Cities area (or willing to drive a bit), you definitely want to sign up for ArcticCon coming up on October 23-24 at the Optum World Headquarters. Head to the link and sign up - if there are seats left!
Once you listen to today's episode, please let me know if you'd like Ryan and Dave to come back for another interview. We were thinking it would be a blast to talk about the details of planning a red team engagement!
-
7MS #325: Integrating Pwned Passwords with Active Directory - Part 2
30 augustus 2018 · 19 min
Today's episode is a follow-up to #304 where we talked about how you can integrate over 500 million weak/breached/leaked passwords form Troy Hunt's Pwned Passwords into your Active Directory. Lees meer
To get started with this in your environment, grab Troy's updated passwords list here, and then you can check out my BPATTY site for step-by-step implementation instructions.
The big "gotchas" I discuss in today's episode are:
If users update their password to something on the Pwned Passwords list, they'll see the generic "Your password didn't meet policy requirements" message. In other words, the message they'll see is no different than when they pick a password that doesn't meet the default domain policy. So be careful! I'd recommend training the users ahead of pulling the trigger on Pwned Passwords.
If you want to take, for example, just the top 100 words off of Troy's list and start your implementation off with a small list with:
Get-Content ".\pwnedpasswords.txt" | select -First 100
As it relates to "hard coding" a machine to point to a specific domain controller, this site has the technique I used. Is there a better way?
-
7MS #324: How to Succeed in Business Without Really Crying - Part 4
23 augustus 2018 · 21 min
It's been a while so I thought I'd update you on how things are going on the business front. Here are the big updates I want to share with you in today's episode: Lees meer
A new 7MS hire that's going to hunt sales opportunities!
My approach to finding podcast sponsors (it seems to be working)
Some kick-butt interviews that are on the horizon (including the one and only JOHN STRAND!)
Lots of goodies to share today!
-
7MS #323: 7 Ways to Not Get Hacked
16 augustus 2018 · 18 min
I'm putting together a general security awareness session aimed at helping individuals and businesses not get hacked. To play off the lucky number 7, I'm trying to broil this list down to 7 key things to focus on. Here's my list thus far: Lees meer
Passwords
2FA/MFA
Wifi (put a good password on it, don't use WEP, don't use WPS
Sign up for HaveIBeenPwned
Update all the things
Block malware/mining with browser plugins
Security awareness training
What do you think? Anything I missed or should consider swapping with another topic? Contact me!
-
7MS #322: My First Live Radio Interview
9 augustus 2018 · 53 min
I had an exhilarating and terrifying experience this week doing my first ever live radio interview! Lees meer
As a quick bit of background, this interview was part of the 7MS radio marketing campaign that I've talked about my "How to Succeed in Business Without Really Crying" series (here's part 1, 2 and 3).
The interview was conducted by Lee Michaels, and though my heart was pounding for the first few minutes, it quickly became fun as Lee and I talked about picking good passwords, securing wifi, talking to your kids about safe online behaviors, and more.
-
7MS #321: Interview with Joe Klein - Part 2
1 augustus 2018 · 1 uur 47 min
Today's episode is brought to you by ITProTV. Visit itpro.tv/7ms and use code 7MS to get a FREE 7-day trial and 30% off a monthly membership for the lifetime of your active subscription. Lees meer
Today's episode is a follow-up interview with Joe Klein, who is my good pal, a former coworker, and a SOC analyst extraordinaire. You might remember Joe from things such as...this podcast - episode #290 to be exact.
When we last left Joe, he had just started an exciting new journey as a SOC analyst, and also picked up a new sweet gig teaching college-level security courses. So Joe and I sat down last week in the 7 Minute Security studios to talk with Joe about:
How to be an absolute beast at networking
Seizing new opportunities (even if it seems scary)
Good certs for security newbs (and not-so-newbs) to pursue
Life as a SOC analyst
How to learn security by teaching it!
This interview was an absolute blast to work on with Joe, and after it was over, neither of us could believe that the run time was nearly 2 hours! So in order to help you navigate the episode and have the best listening experience possible, we created the following "Choose Your Own Adventure" timeline with the high (and low?) discussion points of the interview. Enjoy!
(Interview timeline available on 7MS under episode #321)
-
7MS #320: Interview with Lane Roush of Arctic Wolf
25 juli 2018 · 1 uur 3 min
Today's episode is brought to you by ITProTV. Visit itpro.tv/7ms and use code 7MS to get a FREE 7-day trial and 30% off a monthly membership for the lifetime of your active subscription. Lees meer
This week I sat down with Lane Roush of Arctic Wolf to discuss the big hairy beast that is...(insert dramatic music here) logging and alerting! I work with a lot of clients (and you probably do too) who want answers to these questions:
What in the world is going on in my network?
How will I know if bad stuff is happening?
If I do identify the bad stuff and attempt to eradicate it, how will I know if I've exorcised all the demons?
So Lane and I sat down to discuss this conundrum, and explore answers to other burning questions like:
Why is it so hard to separate the signal from noise when trying to figure out what's happening in the bowels of your network?
Should logging/alerting be a full-time job for one or more people?
When does it make sense to outsource these responsibilities?
Check out today's interview to learn more, and also reach out to Arctic Wolf on their Twitter or LinkedIn for more information.
-
7MS #319: Sniper and Firewalls Full of FUD
20 juli 2018 · 18 min
Today's episode is brought to you by ITProTV. Visit itpro.tv/7ms and use code 7MS to get a FREE 7-day trial and 30% off a monthly membership for the lifetime of your active subscription. Lees meer
In today's episode, I talk about my fun experience using the Sn1per automated pentesting tool. It's really cool! It can scan your network, find vulnerabilities and exploit them - all in one swoop! It also does a nice one-two punch of OSINT+recon if you feed it a domain name.
And, I tell a painful story about how a single checkbox setting in a firewall cost me a lot of hours and tears. You can LOL at me, learn from my pain, and we'll all be better for it.
-
7MS #318: Interview with Bjorn Kimminich of OWASP Juice Shop
11 juli 2018 · 1 uur
Today's episode is brought to you by ITProTV. Visit itpro.tv/7ms and use code 7MS to get a FREE 7-day trial and 30% off a monthly membership for the lifetime of your active subscription. Lees meer
This week's show is another interview episode - this time with my pal Bjorn Kimminich of the OWASP Juice Shop.
If you've never heard of the Juice Shop before, it's the world's most secure (and I mean that sarcastically) online shopping experience. Actually, it's chock full of security issues, which makes it a fantastic learning tool for Web app pentesters, be they seasoned or total newbs. Bjorn and I sat down (over Skype) to discuss:
How the Juice Shop came to be
The current status of application security (is it getting any better?!)
Common vulnerabilities still found in today's Web apps
Juice Shop being featured in Google's Summer of Code
How dev teams can better bake security into their products
What's next for the Juice Shop (hint: stay tuned after the episode is over for a hint on one new "feature")
Bjorn has gone to great lengths to provide documentation about how to get up and running with a copy of the Juice Shop to begin your hacking. Personally I find it dead simple to follow Bjorn's instructions for spinning up a Docker container:
docker pull bkimminich/juice-shop docker run --rm -p 3000:3000 bkimminich/juice-shop
Should you find the Juice Shop to be a valuable tool, please be sure to ping Bjorn on Twitter to let him know.
Be sure to follow the Juice Shop on Twitter as well. Psst...this account sometimes tweets coupon codes which can help you unlock certain challenges!
-
7MS #317: Interview with Justin McCarthy of StrongDM
5 juli 2018 · 48 min
Today's interview features Justin McCarthy, CTO and cofounder of StrongDM, which offers both commercial and open source tools (like Comply) to help customers with SOC compliance. Lees meer
Justin schooled me (in a nice way) about a lot of things, including:
What SOC and the various SOC types are all about
What SOC compliance costs
What to look for in selecting a good auditor
Tools that can help companies make SOC compliance efforts go more smoothly
-
7MS #316: How to Succeed in Business Without Really Crying - Part 3
28 juni 2018 · 23 min
In this episode I wanted to give you some cool/fun updates as it relates to 7MS the business! Specifically: Lees meer
A new member of the 7MS team (kinda!)
The weird and varied projects I'm working on
Upcoming podcast sponsors (probably in July)
7MS has a "real" office coming soon to the southern metro of MN (hopefully!)
-
7MS #315: Creating a Personal DR Plan - Part 2
21 juni 2018 · 11 min
As a continuation of last week's episode I'm now making a bit of progress in finding a good backup solution that protects USB backups both at rest and when pumped up to the cloud. Lees meer
I mentioned I've been using BackBlaze for backups (not a sponsor), and they allow you to backup USB drives as long as they're connected at least once every 30 days. That's cool. However, many of my USB drives are not encrypted, and I want to protect myself in the off chance that someone breaks in and steals all my stuff while those unencrypted drives are connected.
My BackBlaze backup PC is just a little dinky box running Windows 10 Home, so I don't have access to BitLocker. I was gonna drop the ~$100 for the Windows 10 Pro upgrade, but I coincidentally was doing an endpoint security product evaluation at the same time, and so I grabbed a copy of ESET's DESLock (also not a sponsor) because it was on sale. Where I'm stuck now is that the USB drives are unlocked, and yet for some reason BB can't properly back them up. I've got a ticket into their support folks, and will update you once we get to part 3 of this miniseries.
-
7MS #314: Creating a Personal DR Plan
14 juni 2018 · 16 min
You probably create DR plans for your business (or help other companies build them), but have you thought about creating one for yourself? Yeah, I know it's grim to think about "What will my loved ones do to get into my accounts, backups, photos, social media accounts..." but it's probably not a bad idea to prepare for that (spoiler alert: we all die at some point). Lees meer
Today I talk about how I'm beginning to build such a plan so my wife can take over for my/our online accounts. This plan includes:
A "here's how I run all our technology" Google doc with domains I have registered, their expiration date, what their function is, etc.
A how-to guide on restoring data from our online backup solution
Implementation of a password manager
-
7MS #313: Push-Button Domain Admin Access
8 juni 2018 · 19 min
As I was preparing for my Secure 360 talk a month or so ago, I stumbled upon this awesome article which details a method for getting Domain Admin access in just a few minutes - without cracking passwords or doing anything else "loud." The tools you'll need are: Lees meer
PowerShell Empire
DeathStar
Responder
Ntlmrelayx
I've written up all the steps in a gist that you can grab here. Enjoy!
-
7MS #312: OFF-TOPIC - Boxing a Cat
30 mei 2018 · 18 min
It has been a heck of a week (in a good way), and I'm taking a break from security so you can help me untangle a mystery that's been wrapped around my brain for years. I need you to help me figure out what this dude meant when he said that something was as frustrating "as boxing a cat." Lees meer
P.S. if you hate off-topic episodes no worries! We'll be back to our regularly scheduled security program next week!
-
7MS #311: How to Build a Cuckoo Sandbox
24 mei 2018 · 16 min
This week I dove into building a Cuckoo Sandbox for malware analysis. There are certainly a ton of posts and videos out there about it, but this entry called Painless Cuckoo Sandbox Installation caught my eye as a good starting point. Lees meer
This article got me about 80% of the way there, and the last 20% proved to be problematic. I got some additional answers from the Cuckoo documentation but still left some answers to be desired.
Through a lot of Googling, banging my head against the wall and looking at the GitHub issues list, I finally got everything working.
I've taken my entire build process and included it as a gist here. Enjoy!
-
7MS #310: Secure the Radio Commercials
18 mei 2018 · 13 min
Last week I was in the recording studio to record three 7MS commercials aimed at churches. The goal was to educate them on some security topics and close with a "hook" to contact 7MS for help securing your church. Lees meer
The commercials themselves are embedded in this episode so please have a listen and let me know what you think! I'll also let you know (via the podcast) when these commercials hit the air. It's likely the station won't air in your area, but you can catch it on the interwebs if you so desire (thanks again for your support, mom).
-
7MS #309: Password Cracking in the Cloud - Part 2
9 mei 2018 · 13 min
Cracking passwords in the cloud is super fun (listen to last week's episode to learn how to build your own cracking box on the cheap at Paperspace)! Lees meer
In the last couple weeks, customers have asked me about doing a password strength assessment on their Active Directory environment. I asked around and read a bunch of blogs and found a method that I think:
Extracts the hashes safely
Parses down the dump to contain only the hashes (so that if somebody popped my Paperspace cloud-crackin' box, they'd have just a list of half-cracked hashes and that's it)
Does the work pretty automagically
I talk about this in more detail in today's podcast, and here's the gist you can follow with all the necessary commands to get AD crackin'!
-
7MS #308: Password Cracking in the Cloud
2 mei 2018 · 11 min
I had an absolute ball this week trying to figure out how to crack passwords effectively, and on the cheap, and in the cloud. Today's episode goes into much more detail, and embedded below is the Gist of my approach thus far. If you've got things to add/suggest to this document, let me know! Lees meer
P.S. if you don't see the gist because you're reading this in a podcast-catching app, head to https://7ms.us and look up today's episode and you'll see the gist in all its gisty glory!
-
7MS #307: Writing Security-Focused Radio Commercials
25 april 2018 · 13 min
Hey, so this week I am without my main machine - thus no jingle or "jungle boogie" intro music. Feels weird. Feels real weird. Lees meer
Anyway, ya know how I teased last week that 7MS could possibly be coming to a radio station near you? Well I think it's more of a probability than a possibility at this point!
I met with a radio exec a few weeks ago and we talked about:
Lots of people still listen to the radio (who knew?)
Creating a "security minute" spot that would lead to a commercial about 7MS
How to write a good commercial "hook"
It's difficult to write a 60-second commercial!
Targeted advertising at churches, which is an under-served market when it comes to infosec
Writing a new (shortened) 7MS jingle
More on this today on 7MS!
-
7MS #306: A Peek into the 7MS Mail Bag - Part 2
19 april 2018 · 19 min
We've dug into some pretty technical topics the last few weeks so we're gonna take it easy today. Below are some FAQs and updates I'll cover on today's show: Lees meer
FAQs
What security certs should a sales person get?
What lav mic should I get for podcasting?
How do I know if I'm ready to take the OSCP?
When are you gonna do some more YouTube videos?
When will the PacktPub project be done?
Updates
Don't forget to check out these new and/or updated pages on BPATTY:
Caldera
LAPS
PwnedPasswords
Speaking engagements
I learned that the Cryptolocker song was played as muzak for a security conference. That makes me LOL ;-)
Those of you in Minneapolis/St. Paul are invited to join me for Blue Team on a Budget lunch and learn at Manny's - it's on May 3 and hosted by OneIdentity.
I'll be at Secure360 on May 16 to give my Blue Team on a Budget talk at 9:30 a.m., and I'll also be hosting our pal Bjorn for his Twin Cities vs. OWASP Juice Shop workshop on May 17. Gonna be awesome - hope you can come to either event (or both!).
-
7MS #305: Evaluating Endpoint Protection Solutions - Part 2
12 april 2018 · 12 min
Today is part two of evaluating endpoint solutions, where I primarily focus on Caldera which is an adversary simulation system that's really awesome! You can essentially setup a virtual attacker and cut it loose on some test machines, which is what I did as part of an endpoint protection evaluation project. Lees meer
The attacks simulated are from Adversarial Tactics, Techniques & Common Knowledge (ATT&CK) project. So the big question is...did any of these endpoint solutions catch some of the simulated ATT&CKs? Check out today's podcast to find out!
Oh, and I wrote up my quick install guide for Caldera here.
-
7MS #304: Integrating Pwned Passwords with Active Directory
5 april 2018 · 17 min
I've been super pumped about Troy Hunt's Pwned Passwords project ever since it came out - especially when I saw a tweet about using it in Active Directory so that enterprises could essentially stop people from picking previously pwned passwords! That led me to explore the following two solutions: Lees meer
Pwned Passwords DLL
This blog entry has everything you need to get started with this GitHub project. If you've got some coding skillz you can probably give everything a quick read and have the DLL installed and running in no time. If you're like me and have little to zero Visual Studio experience, head to my BPATTY site page about Pwned Passwords where I've laid everything out step-by-step!
Bottom line is this is a FREE way to check AD passwords against Troy's list of 500M+ previously pwned passwords. Awesome dude!
SafePass.me
I gave this commercial solution a demo and it worked fine as well. It's about $700 USD and comes packaged in an .MSI file that you simply double-click to install, then reboot the domain controller(s). It looks to do the exact same thing as Pwned Passwords DLL but without having to build a DLL or install it manually.
-
7MS #303: Evaluating Endpoint Protection Solutions
29 maart 2018 · 15 min
I'm working on a fun project right now where I'm evaluating endpoint protection solutions for a client. They're faced with a choice of either refreshing endpoints to the latest gen of their current product, or doing a rip and replace with something else. Lees meer
I've spun up a standalone AD environment with ~5 Win 10 VMs and nothing on 'em except a current set of patches. The idea is I can assign each workstation VM an install of INSERT_NAME_OF_POPULAR_AV_VENDOR_HERE and have somewhat of a "bake off."
Now what I'm finding is there are great sites like [AV Test](AV Test) or AV-Comparatives do a nice job of breaking down what kind of performance, features, and management offerings a given vendor has. But what I haven't found is some structured testing for "act like a bad guy" actions. I'm thinking things like:
Mimikatz tomfoolery
Lateral attacks with Metasploit shells
Egress port scanning (to find an acceptable outbound port for C2 or data exfil)
Jacking around with various PowerShell scripts and commands
However, thanks to some awesome friends on Slack they pointed me to what looks to be a nice set of scripts/tests - many of which could be used to see what kind of behaviors the endpoint protection will catch. So coming up in part #2 of this series, I'll do a deeper dive into:
RTA
Atomic Red Team
-
7MS #302: Bunnies and Bloodhounds
22 maart 2018 · 17 min
I've had a fun week with a mixed bag of security related stuff happening, so I thought I'd throw it all in a big stew and cook it up for today's episode. Here are the highlights: Lees meer
Bash bunny preso
I had a fun opportunity this week to speak to some property managers about the threats the Bash Bunny poses to an environment. Specifically I showed the one-two punch of:
How BB can steal your wireless network pre-shared keys that are saved to your PC
How BB can go into "Responder mode" to capture credentials
From the comfort of my mom's basement I can steal all this stuff, have it emailed to me, then drive up to your parking lot and join your wifi network with valid network creds! Sneaky bunnies FTW!
Bloodhound
I got to run this on a big AD environment this week and the results were super interesting. I'm working on a down and dirty Bloodhound quick start guide for BPATTY (coming soon).
Brian's botched wireless
Lesson learned this week: doing large Nessus scans from your home network can crush your ERX so scan with care (specifically, go into your Nessus policy and don't scan as many hosts simultaneously - I cranked mine down from like 100 hosts at a time to 5).
-
7MS #301: CredDefense
15 maart 2018 · 15 min
Intro Lees meer
CredDefense is a freakin' sweet tool from the fine folks at Black Hills Information Security that does some really nifty things:
Password filter
Lets say you use the out-of-the-box password policy that comes with Active Directory, and you want to change your password to Winter2017! - AD is gonna say "Yeah dude/dudette, go for it...it fits the bill!" But from an attacker's perspective we know this is bad - people love to pick bad seasonal passwords like Winter2017, Summer2019, etc.
With CredDefense's password filter in the mix, any new password gets checked against an additional word list, and if there's a match found within, BAM!! - password rejected.
Password audit
Ok, so now are you curious who in your AD environment is already using crappy passwords like Winter2017? Load up the password audit feature, feed it a big wordlist like rockyou, and you'll be good to go in no time.
ResponderGuard
This is a nifty PowerShell tool that can jack with pentesters/attackers in your environment who are running the popular cred-stealing Responder tool. And what I especially appreciate from a blue team perspective is that if ResponderGuard catches Responder in use in the environment, it can stamp a log in the event log, which can then in turn generate an email if you're using something like WEFFLES (which we talked about recently) and the nifty WEFFLES email script my pal hackern0v1c3 put together here.
-
7MS #300: Windows System Forensics 101 - Part 2
9 maart 2018 · 16 min
In today's continuation of last week's episode I'm continuing a discussion on using free tools to triage Windows systems - be they infected or just acting suspicious. Specifically, those tools include: Lees meer
FTK Imager - does a dandy job of creating memory dumps and/or full disk backups of a live system. You can also make a portable version by installing FTK Imager on a machine, then copying the C:\Program Files\wherever\FTK Imager\lives to a USB drive. FTK on the go!
Redline grabs a full forensics pack of data from a machine and helps you pick apart memory strings, network connections, event logs, URL history, etc. The tool helps you dig deep into the timeline of a machine and figure out "What the heck has this machine been doing from time X to Y?"
DumpIt does quick n' dirty memory dumps of machines.
Volatility allow you to, in a relatively low number of commands, determine if a machine has been up to no good. One of my favorite features is extracting malware right out of the memory image and analyzing it on a separate Linux VM with something like ClamAV.
-
7MS #299: Windows System Forensics 101
1 maart 2018 · 11 min
I had the privilege of creating a Windows System Forensics 101 course/presentation for a customer. The good/bad news is there is so much good information out there, it's hard to boil things down to just an hour. Lees meer
For the first part of the presentation, I focused on Mark Russinovich's technique of using Sysinternals as the primary surgical tool. This approach includes things like:
Use Process Explorer to find processes with no signature and/or description.
Put any suspicious processes to sleep before killing them (it's more humane! :-)
Use autoruns to find registry entries, scheduled tasks, etc. that might be hooked to malicious executables that run on startup.
Rinse and repeat.
In part 2 (coming up soon!), I'll continue the forensics fight and talk about tools like Redline, Volatility and FTK Imager! Stay tuned.
-
7MS #298: How to Succeed in Business Without Really Crying - Part 2
15 februari 2018 · 17 min
Last week I talked about how business has been going with the LLC. Today I answer some additional questions that I didn't have time to address: Lees meer
How I'm finding leads/projects to work on (TLDR: I'm NOT sending 1TB of PDFs to people, spamming them, calling them endlessly or LinkedIn'ing everybody and their mom)
The interesting conversations I'm having with customers who seem a little tired of the traditional pentest/assessment song and dance (spoiler alert: they're looking for people with solutions and who will actually help remediate the stuff in the report!)
The training services I'm offering are getting a lot more interest than I expected - and I think that's due to some of the sessions being more technical, yet not as intense as, say, a SANS course or the OSCP.
More on today's show!
-
7MS #297: How to Succeed in Business Without Really Crying
8 februari 2018 · 17 min
Intro Lees meer
Here's some of the "juice" that has helped 7MS have a successful start:
Support system
Ok so I think if you're going to have a successful business, you need an awesome support system. Mine consists of some of these things:
Faith - I'm a Christian and pray about this business constantly. In fact I learned really quickly how easy it is to brag about your rock-solid faith when everything is going fine. And then when suddenly the rug is pulled out from under you, you find what your faith is really made of!
My wife - she's my biggest supporter and cheerleader.
Financial advisor - we have a great "money guy" who helped us plan for moments like these, where income might be slower as I drum up business.
Trusted advisors - I'm blessed to have a partner called InteProIQ that has been a sounding board for a zillion and one questions. Everything from helping me quote projects and set hourly rates to marketing plans and connecting me with other business owners and contacts.
General "get your business started" stuff
Form your LLC - I just Googled how to do it, and found a bunch of articles with good info. Basically I found my state's Web site hierarchy and within that was a place to register the LLC and grab an EIN for tax purposes.
Bank accounts - I visited my local banker and setup work checking/savings/etc.
Tech tools to help you get the job done
Quickbooks - I use this to keep track of expenses, send out quotes, reconcile invoices, etc.
Expensify - I use it to track receipts and mileage. They even give you an email address where you can forward receipts to and it'll work it's awesome OCR magic to automatically extract the vendor, charge and date. Awesome!
Toggl - a free Web interface (and app) to track time for projects (if the client doesn't already have something they want me to use)
....more on 7MS.us!
-
7MS #296: WEFFLES - Windows Event Logging Forensic Logging Enhancement Services
1 februari 2018 · 15 min
WEFFLES are delicious! Lees meer
WEFFLES stands for Windows Event Logging Forensic Logging Enhancement Services and is Microsoft's cool (and free!) console for responding to incidents and hunting threats. I had a chance to play with it in the lab this week and for the most part, the install of WEFFLES went well, but I had one minor issue that was cleared up easily.
As I went through the MS TechNet article, I wrote a full install write-up on my BPATTY site.
So go gobble up some WEFFLES and let me know how it goes!