SecuraBit

Latest Episodes:

SecuraBit Episode 41 - Speaking of Cons, and forensics... Oct 06, 2009

Show notes

SecuraBit Episode 41 - Speaking of Cons, and forensics... Part 1: Marcus Carey Dojocon - http://www.dojocon.org/ - @dojocon November 6 & 7, 2009 Capitol College Maryland

Part 2: Scott Moulton

http://www.microforensics.com/pages/software-mercury.php (link below) blackberry stuff: bitpim Hosts: Chris Gerling – @chrisgerling Jason Mueller – @securabit_jay Andrew Borel – @andrew_secbit Anthony Gartner – AnthonyGartner.com - @anthonygartner Guest: Marcus Carey - http://www.dojocon.org/ - @dojocon Scott Moulton - http://www.myharddrivedied.com/ Links: Dojocon - http://www.dojocon.org/ - @dojocon Mercury - http://www.microforensics.com/pages/software-mercury.php BitPim - http://www.bitpim.org/

SecuraBit Episode 40 - Paul WHO???? Oct 03, 2009

Show notes

SecuraBit Episode 40 - Paul "Pauldotcom" Asadoorian Microsoft Security Bulletin MS09-048 - http://www.microsoft.com/technet/security/Bulletin/MS09-048.mspx Microsoft Security Bulletin MS07-063 - http://www.microsoft.com/technet/security/bulletin/MS07-063.mspx Renaud script to go from Nmap to Nessus Interview with Paul Asadoorian (PaulDotCom/Tenable/Nessus) Intro Questions:

Who are you, and what are you doing on THIS podcast?

Tell us about the PaulDotCom podcast (I've talked to SecuraBit listeners who have never heard of PDC)

How long have you been using Nessus?

When did you start working for Tenable?

What is your role at Tenable?

Nessus Questions:

What's new in this version of Nessus?

Are changes driven primarily by Tenable, or the community?

What does Nessus use for a scanning engine?

How does Nessus interact and work with Nmap?

Explain Nessus licensing and what an individual vs a corp is entitled to.

How much is a license?

Cost of proffesional feed = $1200.00/year

Home feed no longer a delay, no SCADA plugins

How does Nessus differ from OpenVAS?

Can you use the OpenVAS repo with Nessus?

Talk about the extensibility of Nessus. (Scripting, etc)

How does Nessus work with OVAL definitions? How does this help for FDCC compliance?

Does tenable have any dedicated appliances for enterprise scanning and monitoring based on nessus?

Implementation and Operation questions (How Paul Does Things):

Do you place scanning servers on each segment of the network, or do you scan through zone-to-zone firewalls? Why?

Is there a practical limit to the number of deices that can be scanned by one scanning server? Or is it just a time tradeoff?

How often do you scan (and re-scan) a network?

How do you handle the results (and avoid dropping a 300 page Nessus report on the server guys and saying FIX IT)

Are results parse-able and able to be fed into compliance and risk management tools?

Other Questions:

When is the next PaulDotCom episode?

What are the topics/guests?

What is your favorite beer?

Hosts: Anthony Gartner – AnthonyGartner.com @anthonygartner Christopher Mills – @thechrisam Andrew Borel – @andrew_secbit Ed Smiley - @edsmiley Guest: Paul Asadoorian - @pauldotcom - http://www.pauldotcom.com Links: Nessus - http://www.nessus.org/nessus/ Tenable Network Security Blog and Podcast - http://blog.tenablesecurity.com/

SecuraBit Episode 39 - Stealing candy from little kids everywhere!!! Sep 14, 2009

Show notes

SecuraBit Episode 39 – Stealing candy from little kids everywhere!!!

Jay brought up that some government web sites will be switching to an http://openid.org authentication

What Does DHS Know About You? - http://philosecurity.org/2009/09/07/what-does-dhs-know-about-you How to request your travel records - http://www.hasbrouck.org/blog/archives/001607.html

TwiGUARD - http://twiguard.com/index.html TweetDeck - http://tweetdeck.com/beta/

MS IIS FTPD DoS ZER0DAY - http://www.milw0rm.com/exploits/9587

Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D. - http://www.milw0rm.com/exploits/9594

Poison Ivy Remote Administration Tool - http://www.poisonivy-rat.com/

FRHACK: Pentesting Live DVD - http://pentestit.com/2009/09/09/frhack-pentesting-livedvd/

Upcoming Events: SANSFIRE 2009 - http://www.sans.org/sansfire09/ Baltimore, MD - June 13 - 22, 2009

Phreaknic 13 - http://www.phreaknic.info/pn13/Site_2/Welcome.html October 30 - November 1 2009

SANS Cyber Defense Initiative - http://www.sans.org/cyber-defense-initiative-2009 Washington, DC - December 11 - 18, 2009

ToorCon - http://www.toorcon.org/ San Diego Convention Center - October 23rd-25th, 2009

Join us in IRC at irc.freenode.net #securabit

Hosts: Anthony Gartner – http://www.anthonygartner.com – @anthonygartner Chris Gerling – http://www.chrisgerling.com – @hak5chris Christopher Mills – http://www.packetsense.net – @thechrisam Andrew Borel – @andrew_secbit Jason Mueller – @securabit_jay

SecuraBit Episode 38 – Classic Securabit, Lots of Rambling, Low Content Aug 30, 2009

Show notes

SecuraBit Episode 38 – Classic Securabit, Lots of Rambling, Low Content

Louisville Metro InfoSec Conference in Louisville, KY October 8, 2009 8am - 5pm Sponsored by the local ISSA Chapter Some of speakers at the event include:

John Strand
Lee Kushner
Scott Moulton
Adrian "IronGeek" Crenshaw

http://www.louisvilleinfosec.com/ Presentations are planed to be posted online afterwards.

If you wish to attend the conference you can use the discount code of "geek seat" to get $20 off registration

Round Table Topic: Who should be responsible for patching? Infrastructure or Security?

There is a conversation about the new Snow Leopard for Mac and Macs mail.

A brief discussion about Helix, Security Onion, and Splunk 4.

Join us in IRC at irc.freenode.net #securabit

Guest: Brian Blankenship - chair ( a ) louisvilleinfosec ( dot ) com

Links: Louisville Metro InfoSec Conference - http://www.louisvilleinfosec.com/ Security Onion - http://securityonion.blogspot.com/ Splunk 4 - http://www.splunk.com/view/splunk-4-features/SP-CAAAEVR

SecuraBit Episode 37 – Mapping Networks with Fyodor and NMAP Aug 25, 2009

Show notes

SecuraBit Episode 37 – Mapping Networks with Fyodor and NMAP NMAP 5 with Gordon "Fyodor" Lyon * How did Nmap start? * What's new in Nmap 5? * Whe kind of legal issues have you faced in regards to NMAP? * Where did the handle Fyodor start? * Will there be a second edition of Nmap book? (below) no second e yet or planned * Where is NMAP Going? * Where do you see Nmap Scripts (NSE) going, possibly doing a community repo? * Will scans for mobile devices in future releases? * Why lua vs. python or ruby or something else? Find the answers to these questions and more by listening to the show.

After our interview we cover DEFCON and the Podcasters meetup.

Join us in IRC at irc.freenode.net #securabit

Guest: Gordon "Fyodor" Lyon - http://insecure.org/fyodor/

Links: NMAP 5 - http://nmap.org/5/ Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning - http://www.amazon.com/Nmap-Network-Scanning-Official-Discovery/dp/0979958717/ref=sr_1_1?ie=UTF8&qid=1250122655&sr=8-1 New 'ping sweep' - http://carnal0wnage.attackresearch.com/node/373 The Programming Language Lua - http://www.lua.org/ WordPress 2.8.4 Security Release - http://wordpress.org/development/2009/08/2-8-4-security-release/

SecuraBit Episode 36 - The f0rb1dd3n Network Aug 07, 2009

Show notes

SecuraBit Episode 36 - The f0rb1dd3n Network

We are joined by Jayson Street to talk about his book, Disecting the Hack: The f0rb1dd3n

Network, that is due out soon. All Black Hat bags will have an excerpt from the book in them.

Additionally we get Jayson's input on the topic of the recent denial of service attacks not

coming from North Korea after all.

DJ Great Scott gives us an update on the social events at this years DEFCON.

Finally we cover media destruction policies. How do you decommission old hard disks? Do you

retain the ones from your copiers and fax machines? What about thumb drives?

Join us in IRC at irc.freenode.net #securabit

Hosts:

Anthony Gartner – http://www.anthonygartner.com – @anthonygartner Chris Gerling – http://www.chrisgerling.com – @hak5chris Christopher Mills – http://www.packetsense.net - @thechrisam Andrew Borel – @andrew_secbit Jason Mueller – @securabit_jay

Guest: Jayson E. Street – http://f0rb1dd3n.com/author.php

Links: http://f0rb1dd3n.com Computer attack may not have originated in North Korea after all -

http://blogs.usatoday.com/technologylive/2009/07/evidence-has-surfaced-that-the-denial-of-service-attacks-that-crippled-dozens-of-us-and-south-korean-web-sites-last-week-ma.html UK, not North Korea, source of DDOS attacks, researcher says -

http://www.pcworld.idg.com.au/article/311070/uk_north_korea_source_ddos_attacks_researcher_says DEFCON 17 - http://www.defcon.org/html/defcon-17/dc-17-index.html Podcasters Meetup - http://www.podcastersmeetup.com/

SecuraBit Episode 35 - Content, what content? Oh, THAT content!!! NSFW!!! Jul 13, 2009

Show notes

SecuraBit Episode 35 - Content, what content? Oh, THAT content!!! NSFW well some anyway!!!

Facebook privacy settings are getting simplified.Michal Jackson causes google to trip thinking they had a DOS attack in progress, followed by spam assaults, and all the joke emails.Slowloris DOS the show stream.We discuss OSSEC with Andrew Hay.

Join us in IRC at irc.freenode.net #securabit

Next live recording is July 15, 2009 at 8pm EDT.

Hosts:

Andrew Borel - @andrew_secbitAnthony Gartner – http://www.anthonygartner.com – @anthonygartnerChris Gerling - http://www.chrisgerling.com - @hak5chrisChristopher Mills - http://www.packetsense.net - @thechrisamRob Fuller - Mubix - http://room362.com - @Mubix

Guest(s):

Wesley McGrew - http://www.mcgrewsecurity.com/ - @mcgrewsecurityAndrew Hay - http://www.andrewhay.ca/ - @andrewsmhay

Links:

http://serverfault.com/questions/32361/how-to-best-defend-against-a-slowloris-dos-attack-against-an-apache-web-server http://www.ossec.net/OSSEC - http://www.ossec.net/Andrew Hay's Book - http://www.amazon.com/OSSEC-Host-Based-Intrusion-Detection-Guide/dp/159749240X

SecuraBit Episode 35 - Content, what content? Oh, THAT content!!! NSFW well some anyway!!!

Facebook privacy settings are getting simplified.

Michal Jackson causes google to trip thinking they had a DOS attack in progress, followed by spam assaults, and all the joke emails.

Slowloris DOS the show stream.

We discuss OSSEC with Andrew Hay.

Join us in IRC at irc.freenode.net #securabit and you can find our past episodes at http://www.securabit.com.

Next live recording is July 15, 2009 at 8pm EDT.

Hosts:

Chris Gerling - http://www.chrisgerling.com - @hak5chris

Christopher Mills - http://www.packetsense.net - @thechrisam

Anthony Gartner – http://www.anthonygartner.com – @anthonygartner

Andrew Borel - @andrew_secbit

Rob Fuller - Mubix - http://room362.com - @Mubix

Guest(s):

Wesley McGrew - http://www.mcgrewsecurity.com/ - @mcgrewsecurity

Andrew Hay - http://www.andrewhay.ca/ - @andrewsmhay

Links:

http://serverfault.com/questions/32361/how-to-best-defend-against-a-slowloris-dos-attack-against-an-apache-web-server

http://www.ossec.net/

OSSEC - http://www.ossec.net/

Andrew Hay's Book - http://www.amazon.com/OSSEC-Host-Based-Intrusion-Detection-Guide/dp/159749240X

SecuraBit Episode 34 RoundTable Well Virtually anyway!!! Jul 01, 2009

Show notes

SecuraBit Episode 34

This week we welcome Scott Fitzpatrick of Symantec to join our roundtable on the news items of the day.

News Items:StrongWebMail Fail - http://www.pcworld.com/businesscenter/article/166314/web_mail_company_to_pay_prize_after_ceo_hacked.html

TweetDeck still passes authentication in the clear

Google Apps criticized about their security

iPhone 3.0 Teathering Hack - http://www.jellysms.com/blog/enable-internet-tethering-with-your-iphone-in-2-minutes-on-o2-ireland-with-30-gm/

RSnake's SlowLoris (low bandwidth, greedy, poisonus HTTP client) - http://ha.ckers.org/slowloris/

Mubix presenting a six hour work shop "From Shell to Owning the Company" at ToorCamp

DefCon and the Podcasters Meetup- In Sky box 207 and 208 8pm or after the last talk on Saturday night.- Exotic Liability (http://www.exoticliability.com/) and Germaina Newbs (http://grmn00bs.blogspot.com/) will be join the line up.

PaulDot Com with Securabity Thursday July 2, 2009 at 7pm.

Join us in IRC at irc.freenode.net #securabit

Our Next live recording is July 1, 2009 at 8pm EDT.

Hosts:Chris Gerling - http://www.chrisgerling.com - @hak5chrisJason Mueller - @securabit_jayChristopher Mills - http://www.packetsense.net - @thechrisamRob Fuller - Mubix - http://room362.com - @MubixAndrew Borel - @andrew_secbit

Guests:Scott Fitzpatrick

Links:Symantec - http://www.symantec.com/Mubix - Couch to Career - http://www.room362.com/archives/564-couch-to-career-follow-up.html

SecuraBit Episode 33 - Bursting Clouds with Kostya Kortchinsky Jun 13, 2009

Show notes

In this episode we talk to Kostya about the process that is behind Cloud Burst. He speaks about breaking out of the existing Virtual Machine and into the host. Once you own the host you have the ability to own other Virtual Machines.

Quick Topics: OS X Security Update Palm Pre North Korea Cyberware Air France Flight 447

Hosts: Anthony Gartner - http://www.anthonygartner.com - @anthonygartner Chris Gerling - http://www.chrisgerling.com - @hak5chris Christopher Mills - http://www.packetsense.net - @thechrisam Jason Mueller - @securabit_jay

Guests: Kostya Kortchinsky - http://www.linkedin.com/pub/kostya-kortchinsky/4/211/a71 Tim Krabec - http://www.SMBMinute.com - @tkrabec

Links: Immunity Inc - http://www.immunitysec.com/ CLOUDBURST exploit video - http://www.immunityinc.com/documentation/cloudburst-vista.html CVE-2009-1244 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1244 53634 : VMware Multiple Products Display Function Host OS Arbitrary Code Execution - http://osvdb.org/53634 Microsoft Security Bulletin MS08-067 - http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx SyScan '09 Singapore July 2-3 - http://www.syscan.org/Sg/program.html The Cassandra Tool - https://cassandra.cerias.purdue.edu/main/index.html Apple Security Update 2009-002 / Mac OS X v10.5.7 - http://support.apple.com/kb/HT3549 Palm® Pre™ - http://www.palm.com/us/products/phones/pre/ North Korea Builds Up Cyber Warfare Unit - http://news.yahoo.com/s/afp/20090505/ts_afp/nkoreaitmilitary Air France Flight 447 - http://en.wikipedia.org/wiki/Air_France_Flight_447 DEFCON® Hacking Conference - http://www.defcon.org/ Immunity CANVAS - http://www.immunitysec.com/products-canvas.shtml

SecuraBit Episode 32 PDF Love! May 27, 2009

Show notes

SecuraBit Episode 32 PDF Love!

Dieter talks about how the ifilter will actually allow you to use a pdf to exploit the system because ifilter uses the windows indexing service. He also discusses some of the various methods of prevention including his tool called PDFiD.

Penetration Document Format http://www.flickr.com/photos/packetsense/3549486353/

Hosts: Anthony Gartner - http://www.anthonygartner.com - @anthonygartner Chris Gerling - http://www.chrisgerling.com - @hak5chris Christopher Mills - http://www.packetsense.net - @thechrisam

Guests: Didier Stevens - http://blog.didierstevens.com/

Links: PDFiD - http://blog.didierstevens.com/2009/03/31/pdfid/ PDF Tools - http://blog.didierstevens.com/programs/pdf-tools/ Security Justice - http://securityjustice.com/ Exotic Liability - http://exoticliability.ning.com/

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected