When my spirits are down nothing quite perks me up like a neat new tool. And today *sniffle* I needed the boost granted me by Dnscat. Ron, I owe you a beer and a chest bump *tap tap*. -Pk
When my spirits are down nothing quite perks me up like a neat new tool. And today *sniffle* I needed the boost granted me by Dnscat. Ron, I owe you a beer and a chest bump *tap tap*. -Pk
02/23/2010 at 22:25 in Security | Permalink | Comments (1) | TrackBack (0)
Bill Brenner of CSO Magazine started a thread at LinkedIn asking what the community felt the most worthless security technologies (not ideas) were and why. The one early answer is based on difficultly and time to implementation (e.g. NAC and PKI). While that's one perspective I'd like to look at the bad ideas in general regardless of deployment logistics. Three technologies come to mind immediately:
That's the short and snarky. I'll write something more proper for LinkedIn and update here. -Pk
02/20/2010 at 16:06 in Security | Permalink | Comments (0) | TrackBack (0)
In yesterday's post I introduced a basic long-standing trend that continues to eat at our collective souls. We stick with what we know or our chosen path of enlightenment. Customers enable us for their own comfort level in a hope not to feel stupid. That's my story and I'm sticking to it!!
I'm not going to waste time trying to figure out why we deceive ourselves and continue to sabotage our potential for success. We could have an Security Twelve-steps program nationwide and still not figure that one out. What I'd like to ramble on about is communicating the needs of Security to our customers. Specifically some tactics I've successfully used to ensure the customer keeps coming back to ~ask~ for my input as opposed to just annual planning.
And I just realized I'm a huge fan of bulleted lists.
Is that enough to think about? I'm coming off as very preachy and condescending myself but I sincerely think we all need to think like this more. And it is all related to my things you didn't learn post. -Pk
[ I'm going to scrub some data and post PDFs on some ways I've presented the first two bullets. -Pk ]
[ NOTE TO SELF: You didn't re-read this before posting so don't forget to do that later. -Pk ]
02/17/2010 at 21:00 in Security | Permalink | Comments (0) | TrackBack (0)
A trend I've noticed growing in security is what I like to call the CYA Syndrome... Cover Your Arse and Choose Your own Adventure. It can be described as the inability of an organization to look beyond what they know or what they want to know in choosing and deploying security solutions. For example, if an organization is stacked with former network engineers as their security staff then network-centric solutions will get the most attention and budget. Or if an organization has a few folks that want to become investigators and move elsewhere then solutions and budget lean toward non-technical forensic tools (anything but badware Bub!). This failure of vision and planning is due to poor leadership to be sure but it's also something I find enabled by the customer base. Customers like simple point solutions and want to believe in consistency in solutions and evolutions in known models. Does that make sense?
And this practice really does fulfill both CYAs.. if something fails you can blame somebody else because you've implemented the system you know best for what is was meant to do. All of the sudden you don't remember pitching it as a panacea. And you also get to play with the toys of your choice regardless.
More on this tomorrow.... -Pk
02/16/2010 at 23:59 in Security | Permalink | Comments (0) | TrackBack (0)
[ UPDATE 02112010: OOMPH! I didn't see it getting quite that ugly. -Pk ]
With respect to my last post I thought I should get together a collection of papers on risk modeling across a variety of industries. Some of the papers are hardcore actual modeling, some are talking about the use of models, some are talking about the effectiveness of models retrospectively. I've come to two high-level conclusions about risk modeling:
For the sake of relevancy and to reduce annoyance I'm going to skip over Credit/Finance risk modeling. It was by far the most consistent and dry reading. And as some people have noted the credit models may have failed us or have been completely ignored as evidenced by the past few years of global financial turmoil. For the record I subscribe to the later, these models were bloody mature but people blatantly ignored them in the industry and in politics.
My feelings expressed in the below post remain the same. It's senseless to propagate more FUD or absolutism when we should be taking cues from other industries and working to refine our risk models. And for the academics to do that they need the practitioners to play nice. For the practitioners to play nice the academics need to stop standing behind pomp-and-circumstance. (I don't know if that even makes sense but I really wanted to say pomp-and-circumstance.)
However, I have to say after reading the material above, Dr. Wright is going to get throttled in any honest challenge. Which is unfortunate because I really think it's tantamount that the community help him as opposed to vilify him. I know, I know, he didn't help his own cause in his responses after being clobbered with Mjolnir but can't we all just get along? -Pk
02/10/2010 at 23:09 in Security | Permalink | Comments (0) | TrackBack (0)
[ UPDATE 02112010: OOMPH! I didn't see it getting quite that ugly. -Pk ]
So Dr. Risk (Dr. Dooms distant cousin), a Meteorologist, Dan Kaminski, and Ayatollah Basmati walk into a (juice) bar. You already know this isn't true because Kaminski would never goto just a juice bar. I'm waiting for the flag on the play? Anyone? Anyone?
By now you've probably read "Thor vs Clown" over at Tao... and it may be easy to just laugh off Dr. Craig Wright. Based on the comments it sure seems like throwing insults, calling names, and basing the prospect of risk calculations on your inability to stop bad things from happening is the medicine of the day.
The challenge issued by Dr. Wright wreaks of equal amount of virility and disgust BUT I sure hope to see a major panel come out of this. I hesitate to say Thor is wrong because, well, Thor... and Dr. Wright clearly needs some humility lessons too.
Here is my problem with this debate, in this fashion, at this time.. YOU'RE SQUANDERING YET ANOTHER OPPORTUNITY TO ACTUALLY PRODUCE PEER REVIEWED METHODOLOGY WITH DATA THAT WILL HELP LEGITIMIZE OUR INDUSTRY. Face it, if you think information security has reached mature legitimacy alongside other comp.sci areas of practice then I have a stick that will find water, gold, and wine for you.
Let me put it to you another way...
People like me, the fairly unimportant practitioners, can afford to look childish and foolish on occasion. Directors, Doctorates, and highly respected researchers that are closely watched and trusted cannot.
I propose a new rule when mailing list and blog debates get hostile. The Dr. Daniel Geer rule... no ridiculous monetary challenges, no contracts to be drawn up, no cursing, insults, or otherwise foolish behavior reserved for me. You all book a flight to the same campus setting, with huge whiteboards and projectors, and you start sensible discourse and set aside your struck nerves and egos. And phrases like "you're wrong", "you're a charlatan", etc. are penalized with timeouts wearing a Homer Simpson mask. If both sides continue to hurl insults and speak in only absolute terms you resign your current positions and both go work for Dr. Geer until you grow up.
[ I don't know why I chose Dr. Geer really, I think it's the cool facial hair. -Pk ]
And don't give me that garbage about having the brains and real-world results to backup your behavior. That's leftover locker-room sh*t so get over it.
Pot, kettle, black.. err. -Pk
[ UPDATE 02102010: The point is that people who are far more important decision makers than Bejtlich, Thor, and Wright probably listen to just one or two of these InfoSec Rock Stars. If you ostracize any of them you'll likely lose part of your important audience that you NEED to understand you. So get together and come to at least an amicable and polite disagreement so people will continue to take you seriously. And let the research continue. ]
02/10/2010 at 11:55 in Security | Permalink | Comments (0) | TrackBack (0)
Every few weeks I check BOINC hoping to see some really intriguing project that solves impossible problems... like women, the perfect salsa, or pitching for the Red Sox. And I continuously try new projects only to end up back on SETI.
So I'd like to call out to SourceForge, Fortify | Ounce | Coverity, and the community to develop a distributed software assurance system for Open Source software. The idea would be that checked-in code would automatically be queued up and distributed in functional units to participants. All the same Distributed.net concepts with teams and some monetary award from sponsors could apply. The vendors who participated would also get valuable testing feedback and earn karma points with the community that would carry into the closed workplaces.
Add on top of the basic functionality the opportunity for education! Throw all the automated findings in a public queue for registered SourceForge users to review and generate patches or identify false-positives. Let users rate solutions up and down and you've got a treasure-trove of information for the comp.sci crowd.
Screw this.... I want in! Who came up with this idea? Are they looking for contributors? When did I start dash-ing everything? -Pk
02/06/2010 at 20:55 in Security | Permalink | Comments (0) | TrackBack (0)
A former colleague asked me to recommend some reading material for incident response during active attacks. I'm sorry to say I can't possibly be happy with this post because I know him, his environment, and his unique challenges. And if I drop specifics I might end up in a Legal tussle with a Rhino.
With that said let me throw a few things out there...
I'm sorry to say I can't really narrow it down more than that... there isn't just a short list that jumps out at me as comprehensive or even reasonable per given event *shrug*. Cheers, -Pk
02/04/2010 at 22:49 in Security | Permalink | Comments (0) | TrackBack (0)
My my, it has been only fifteen years... err.. it's been fifteen years already?
Sometimes it seems like something that happened before I was born but nevertheless, Mitnick was the defining hacker identity for quite a few years. Like it or not.
So I think BlackHat, DEFCON, ShmooCon, CanSec, etc. should all have Sweet 16 reviews of the industry with Mitnick as host. Get some other, pardon the expression, old-timers up on stage too..... I'd love to see Zimmerman, Ranum, and some semi-retired characters up on the stage. Mitnick should have to wear a Disney princess costume for at least part of it though. -Pk
02/04/2010 at 15:00 in Security | Permalink | Comments (0) | TrackBack (0)
Every major industry goes through various phases of maturation. Once fairly mature they repeat cycles of next best biggest thing. To get to that point all industries go through a phase I call "deity" worship. I was reminded of this last night when trying to help a friend in the UK who repeatedly insisted everything should be fine because he was following Richard Bejtlich's suggested practices. While Bejtlich is clearly an accomplished and wonderful mind to have in the Security realm he is hardly a one-stop source for everything. He himself wouldn't ever claim to be... so why do we do this to ourselves and our industry?
I know it's tempting to take explicit direction from HD Moore, Halvar Flake, Dan Kaminsky, etc. etc. but is it really necessary to setup a Church or altar to them? It's not a coincidence we finally have a name for our Satan, APT/APA, and now the lines are being drawn for the holy security warriors behind their chosen Gods.
I hate this step in the life-cycle of industry but at least we've finally reached it and after eighteen months or so I expect it to be forgotten. Think C++ or Java... RISC or CISC.. these were all states in their sectors until multi-paradigm evolutions of each were the result. So hold on a bit longer, try not to worship too much, and get ready for the eventual amalgam of practices and beliefs.
The best part is, in the end, it'll be like a Presidential election... nobody will actually claim that they ever rooted for anyone. -Pk
02/02/2010 at 14:16 in Security | Permalink | Comments (0) | TrackBack (0)
I've often been asked by interns and recent graduates what they still needed to learn after they have their degree, certificates, and a few CONs under their belt. I felt like sharing with all two of you today.
This is just a high-level generic list. If you don't understand something I've said above feel free to grab my contact information from the About page. If you've got all of the above covered I've got ninety three others for you too. Seriously, I'm blogging here and not writing comprehensively but I don't mind sharing interactively.
And I'm too tired to proofread my scratch. -Pk
[ Man I can come off as a pompous pious BoFH. Ping me via IM or email if you actually want more pointers. I'm not trying to infer you're a neophyte. Except you over there. Yeah, you. -Pk ]
[ UPDATE 01292010: A former intern reminded me I insisted they learn more about side-channel attacks. Indeed, that should be in the Top 7. -Pk ]
[ UPDATE 01302010: Thanks for the feedback via Twitter. @Barkybree reminded me that communication skills aren't a high-point for ITSec professionals. He used the term "madman" which is fairly accurate. We do have a tendency to be fatalistic about everything. And communication includes learning about metrics and data presentation. @Crabbyolbastard talked about managing your manager which is a varied art. If your manager is an immovable object, say like a Rhino, then go with at least a .416 Rigby. See, both readers responded. -Pk ]
01/29/2010 at 21:44 in Security | Permalink | Comments (0) | TrackBack (0)
Today has been a bizarre day but I did come across and start futzing with Groundspeed. It's a Firefox add-on for webapp penetration testing. Take a gander..
On a related note, take a look at the right-hand column and you'll see a Bitty Browser to Security Database Tools Watch. Sometimes I wish everything was on freshmeat.net but alas it doesn't work that way.
Anyhow, update your Tor/Vidalia installation and get on Groundspeed. Cheers, -Pk
01/28/2010 at 21:36 in Security | Permalink | Comments (0) | TrackBack (0)
[ BWAHAHA! might be (tm) @Jedimercer. -Pk ]
Dr. Ross Anderson is the closest equivalent to Dr. Richard Feynman that I've seen in the Security space. I don't say that lightly as Feynman is a regular hero in many Physics and Engineering departments. Feynman's lectures and work on the Challenger disaster are required study for being a human being.
Dr. Anderson already wrote one on the best tomes in Security space. And his department at Cambridge also has a fantastic blog that should be bookmarked. Twice.
His latest published collaboration is on the 3D Secure system used by Visa and MasterCard SSO authentication for online transactions. The paper, alternately titled How Not to Design Authentication, is like reading about kicking puppies. It's just painfully wrong and you wonder how such a thing could happen.
I'm pretty sure I stole kicking puppies from @Barkybree. Hrmm. I'm in a linking and phrase thieving mood. -Pk
[ UPDATE 01292010: The authors have a follow-up blog post on the topic. -Pk ]
01/27/2010 at 20:34 in Security | Permalink | Comments (0) | TrackBack (0)
While the 'I'm kind of a big deal' crowd and antimalware companies define, redefine, and take credit for APT (Advanced Persistent TALK), there is also a movement underway to demonstrate there is conflicting evidence China took part or takes part in cyberespionage. Herein lies the bigger problem with defining APT. APT is not an entity either.. APT is not China or Russia or the USA.
APT is a classification encompassing a generation of tactics, economics, metrics, mindsets, geopolitics, and partnerships.
I'm throwing this concept out there to be ripped apart but in my tired mind that's a good view of what APT means. APT is everywhere people, get use to it. It has been around for a few years now, welcome to the party.
I've met APT, and you my friend are no APT. -Pk
[ UPDATE 03032010: APT as an acronym or anything meaningful is dead. It's now purely marketing jargon with "automated" and "accurate" tools for isolating and defending against APT. If it's automated and accurate then there is no A left in APT. And beyond that the number of variants, bitching about Cleared personnel ignoring Uncleared personnel (TRUE!), etc... it's just, *sigh*, a dead issue. I am now at the point where if APT ever had a meaning I don't even know what it is anymore. I hear those three letters and I cringe. Ugh. -Pk ]
01/26/2010 at 21:24 in Security | Permalink | Comments (0) | TrackBack (0)
Today we salute you Tcpreplay!
Armed with a pcap file you daringly split traffic into client and server until every last packet is accounted for.
DDoS, fuzzing, or hijacked Postscript.. you handle it all and replay it over-and-over to within a heartbeat of insanity.
Sure, nobody puts you in their top three tools list but nobody is a nobody and doesn't matter anyway.
So crack open a capture of this mornings SQL injection, because somebody has to do it, and rest easy knowing you're providing only the best in modern day network playback.
We salute you Tcpreplay!
...
In all seriousness, unlike the Bud Light ((tm) or something?) commercials, I'm not making fun here. Tcpreplay has figured me out some problems many times! Slainthe! -Pk
01/25/2010 at 03:01 in Security | Permalink | Comments (0) | TrackBack (0)
I wish TrackingTheThreat.com was more current and had some equivalent sites maintained for APT and other cybercharacters and cybertheatres. There are some private offerings that provide good cyberintelligence but are in serious need of visualization tools.
I think Paterva and FMS need to get busy and produce some offspring. Beer might help. -Pk
01/24/2010 at 21:47 in Security | Permalink | Comments (0) | TrackBack (0)
When reading the coverage of the Google/China dispute I was surprised that one of the biggest questions was still how did China know who to target? Going so far as insinuating it must be an inside job. Does anybody beside UN*X sysadmins remember finger? Remember for umpteen years we've been turning it off? Well, you can't turn it off now.
Between LinkedIn, Facebook, StumbleUpon, JetBytes, Twitter, TripIt, instant messaging, MMORPGs, Xfire, Filebox, Torrents, YouTube, VideoJug, any number of mailing lists, PassiveRecon, Maltego, MemeStreams, Google, Factiva, Data.gov, US Patent Office, and tens of other social networking and data sources it's impossible ~not~ to know who to target. You'd have to be a complete jester not to have done your homework to maintain cover, improve signal-to-noise, and keep your handlers/customers happy. [ Links intentionally excluded. -Pk ]
Your most valuable people are awarded, named in Patents, give talks, attend conferences, then they network with their peers, respond in mailing lists, etc. and all quite publicly. I do it, it's easy as sin to figure out how best to reach me or catch my eye. People get calls all the time claiming they've been suggested by so-and-so that they met here-or-there. Organizations are all too eager to educate their users about these risks during financial closings or mergers and acquisitions. This awareness has to become a permanent fixture with risks labeled and decisions based on data.
End-user education is a baseline but I'm strongly suggesting companies take their Competitive Intelligence departments and train that OSInt bend straight into their Human Resources departments too. Help HR help their customers (employees) know when their at higher risk and why. This is not a call to end all networking and Internet posting so don't start scrutinizing your employees personal lives. That's silly, I know from experience, .. this is about enabling your intellectual property workers with the same OSInt you give the Board.
Organizations also need to stop trying to hide who their most valuable employees are from their peers and competitors. We all already know who they are, get over it. Share this information during security cooperatives and cross-organization incidents. If they hit your Uber-widget Engineers then they'll go after your partners and peers same Uber-widget personnel. Knowing what they're after during a given frame is important. They might rotate attacks on clusters of similar organizations. Either way it's important to start sharing data while the patterns are simple (NOW!) so you can be prepared as attack patterns increase in complexity.
I'm half-asleep and I don't remember what triggered this rant *shrug*. -Pk
[ UPDATE 03032010: And with the recent news that the US Military is encouraging and allowing more social networking and even blogging from the front-lines this is more important to consider. DoD contractors and other shops that use the DoD and NSA as examples for restrictive policies are going to succumb to their end-users sooner rather than later. So start building those personnel intelligence programs and change end-user education modules. -Pk ]
01/24/2010 at 14:44 in Security | Permalink | Comments (0) | TrackBack (0)
