SecuraBit

Before It Bytes!

SecuraBit Episode 72: Take risks, get owned!

SecuraBit  Episode 72:  Take risks, get owned!
Recorded on December 29, 2010

Hosts:
Anthony Gartner – @anthonygartner http://anthonygartner.com
Chris Gerling  – @chrisgerling
Christopher Mills – @thechrisam
Jason Mueller – @securabit_jay
Andrew Borel –  @andrew_secbit

Guests:
Jack Jones discusses Risk Assessment and the FAIR method http://riskmanagementinsight.com/

General topics:

Risk Management, Small biz vs Enterprise
Monte Carlo?
How to Measure Anything: Finding the Value of Intangibles in Business by Douglas W. Hubbard
http://www.amazon.com/How-Measure-Anything-Intangibles-Business/dp/0470539399/ref=tmm_hrd_title_0

OnePassword – http://agilewebsolutions.com/onepassword
KeePass – http://keepass.info/
LastPass – http://lastpass.com/

Upcoming events
#BSidesMSP (7 Jan 2011)
ShmooCon (28-31 Jan 2011)
RSA Conference 2011 (14 -18 Feb 2011)
#BSidesSanFrancisco (14-15 Feb 2011)
#BSidesAustin (11-12 March 2011) http://www.keepsecurityweird.org/

Links:
http://securabit.com
Chat with us on IRC at irc.freenode.net #securabit
iTunes Podcast – http://itunes.apple.com/us/podcast/securabit/id280048405
iPhone App Now Available – http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8

SecuraBit Episode 70: Following the wh1t3Rabbit, Hat-tricks with a wh1t3Rabbit

SecuraBit  Episode 70: Following the wh1t3Rabbit, Hat-tricks with a wh1t3Rabbit
December 1, 2010Hosts:
Anthony Gartner – @anthonygartner http://anthonygartner.com
Christopher Mills – @thechrisam
Chris Gerling  – @chrisgerling
Andrew Borel –  @andrew_secbit

Guests:
HP’s Rafal Los – @wh1t3Rabbit
Subscribe to his blog at http://hp.com/go/white-rabbit

General topics:
Shmoocon tickets, who’s got them?

Hat-trick http://en.wikipedia.org/wiki/Hat-trick

Password security, does it really matter?

Application security to detect and prevent malicious code.

Diaspora https://joindiaspora.com/

Security Metrics

Story time with Rafal

RSnake shutting down his blog after 5 years and 1000 posts http://ha.ckers.org/

FTC Staff Issues Privacy Report Offers Framework for Consumers, Businesses, and Policymakers: Endorses “Do Not Track” to Facilitate Consumer Choice About Online Tracking
http://www.ftc.gov/opa/2010/12/privacyreport.shtm

Upcoming events
Sunbelt Quarterly Briefing December 8th, 2010 at 9am and 2pm
DojoCon December 11-12, 2010
#BSidesBerlin December 28-30, 2010
ShmooCon January 28-31, 2011

Links:
http://securabit.com
Chat with us on IRC at irc.freenode.net #securabit
iTunes Podcast – http://itunes.apple.com/us/podcast/securabit/id280048405
iPhone App Now Available – http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8


SecuraBit Episode 69: Picking Locks and Messing up Podcasts, Welcome to Gringo Village!

SecuraBit Episode 69: Picking Locks and Messing up Podcasts, Welcome to Gringo Village!
November 3, 2010

Hosts:
Christopher Mills – @thechrisam
Andrew Borel –  @andrew_secbit
Anthony Gartner – @anthonygartner http://anthonygartner.com
Jason Mueller – @securabit_jay
Rob Fuller – @mubix
Tim Krabec – @tkrabec http://www.SMBMinute.com

Guests:
Deviant Ollam – http://deviating.net/ – Author of Syngress Practical Lock Picking
General topics:
Practical Lock Picking By Deviant Ollam http://www.syngress.com/hacking-and-penetration-testing/Practical-Lock-Picking/

Review submitted by a coworker:
Practical Lock Picking by Deviant Ollam was an enjoyable read. The author does a good job of covering the art and science of picking locks. He chose two of the most common types of locks for the bulk of his material which helps keep the focus of the book tight. He leads the reader from the basic operational principles of the locks, to flaws in the design & manufacture and finally how to pick the locks. The coverage of pick types and other tools of the trade round out the readers knowledge of the subject. His down to earth style and simple language help the reader understand the material and develop the skills to pick these types of locks. His logical progression of starting with one pin and working your way up to all the pins in the lock will help the reader build confidence in their skills. The final sections on bypassing the door reminds the reader that locks are part of a system and sometimes the way to defeat a system is not the direct approach. Overall I would give this book 4 out of 4 stars.

Shmoocon Tickets??

The Open Organization Of Lockpickers http://toool.us/
Lock Picking Videos – http://www.youtube.com/deviantollam
General Information http://deviating.net/lockpicking/

IE Zero Day
Microsoft Security Advisory (2458511)
Vulnerability in Internet Explorer Could Allow Remote Code Execution
http://www.microsoft.com/technet/security/advisory/2458511.mspx

Enhanced Mitigation Experience Toolkit v2.0
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=c6f0a6ee-05ac-4eb6-acd0-362559fd2f04

SpyEye v. ZeuS Rivalry Ends in Quiet Merger
http://krebsonsecurity.com/2010/10/spyeye-v-zeus-rivalry-ends-in-quiet-merger/

Upcoming events
#BSidesDFW November 6, 2010
#BSidesDE November 6, 2010
AppSec DC 2010 November 8-12, 2010
#BSidesOttawa November 12-13, 2010
RUXCON 2010 December 4-5, 2010
DojoCon December 11-12, 2010
#BSidesBerlin December 28-30, 2010
ShmooCon January 28-31, 2010

Links:
http://securabit.com
Chat with us on IRC at irc.freenode.net #securabit
iTunes Podcast – http://itunes.apple.com/us/podcast/securabit/id280048405
iPhone App Now Available – http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8

SecuraBit Episode 63: Walking to the Waffle House with Andy Willingham

SecuraBit Episode 63: Walking to the Waffle House with Andy Willingham
August 11, 2010
Hosts:
Anthony Gartner – @anthonygartner http://anthonygartner.com
Chris Gerling – @chrisgerling
Christopher Mills – @thechrisam
Jason Mueller – @securabit_jay
Andrew Borel –  @andrew_secbitGuests:
Andy Willingham (Southern Fried Security Podcast) – @andywillingham http://www.andyitguy.com/blog/

General topics:
DEFCON/BLACKHAT/BSides Recap
–Chris – experience this year, and a review of the medical facilities in Las Vegas
–General entertaining banter

Shiny Old VxWorks Vulnerabilities
http://blog.metasploit.com/2010/08/vxworks-vulnerabilities.html

Facebook name extraction based on email/wrong password
http://seclists.org/fulldisclosure/2010/Aug/130

Apple Fixes PDF Vunerability that allowed webbased Jail Break.
iOS 4.0.2 Software Update http://support.apple.com/kb/DL1061

Interview with Andy Willingham
ShmooCon 2011 Dates Announced
http://tinyurl.com/29nzc46

Microsoft drops the patch bomb
http://www.securabit.com/2010/08/10/microsoft-drops-the-patch-bomb/Andriod Malware and Unexpected Features
http://crave.cnet.co.uk/mobiles/android-gets-its-first-texting-malware-50000303/

Free Android antivirus clocks up 2.5m downloads
http://www.theregister.co.uk/2010/08/11/free_android_security_app/

A Review of Verizon and Google’s Net Neutrality Proposal
http://www.eff.org/deeplinks/2010/08/google-verizon-netneutrality

Upcoming events
South Florida ISSA’s Hack the flag and chili cook-off  Saturday August 14, 2010 from 12:00pm – 5:00pm
http://sfissa.org/index.php/sfissa-mm-events/htf-main/85-hack-the-flag-2010
Hacker Halted http://www.hackerhalted.com/ Tim Is speaking October 14th
Louisivlle Infosec 10/7. http://www.louisvilleinfosec.com/
Atlanta B-Sides 10/8. http://www.securitybsides.com/BSidesAtlanta
HacKid – http://www.hackid.org/ 10/9-10/10
Phreaknic 10/15. http://www.phreaknic.info/pn14/

Links:

http://www.securabit.com
Chat with us on IRC at irc.freenode.net #securabit
iTunes Podcast – http://itunes.apple.com/us/podcast/securabit/id280048405
iPhone App Now Available – http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8

SecuraBit Episode 62: Visualizing Data with NetWitness

SecuraBit  Episode 62: Visualizing Data with NetWitness

Hosts:
Anthony Gartner  @anthonygartner http://anthonygartner.com
Chris Gerling @chrisgerling
Christopher Mills @thechrisam
Andrew Borel @andrew_secbit

Guests:
Eddie Schwartz – @eddieschwartz

General topics:
BSidesLV http://www.securitybsides.com/BSidesLasVegas
BlackHat https://www.blackhat.com/html/bh-us-10/bh-us-10-home.html
Defcon https://www.defcon.org/html/defcon-18/dc-18-schedule.html

Shmoocon Woot Video http://www.youtube.com/watch?v=HJ0ypgZU_D0
NetWitness Visualize http://visualize.netwitness.com/

Brief panel on certifications.

iPhone App Now Available. http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8

http://itunes.apple.com/us/podcast/securabit/id280048405

Upcoming events
South Florida ISSA’s Hack the flag and chili cook-off  Saturday August 14, 2010 from 12:00pm – 5:00pm
http://sfissa.org/index.php/sfissa-mm-events/htf-main/85-hack-the-flag-2010
Hacker Halted http://www.hackerhalted.com/ Tim Is speaking October 14th

Links:
http://securabit.com
Chat with us on IRC at irc.freenode.net #securabit
iTunes Podcast – http://itunes.apple.com/us/podcast/securabit/id280048405
iPhone App Now Available – http://itunes.apple.com/us/app/securabit-mobile/id382484512?mt=8

SecuraBit Episode 50: Interview with Rob Lee!

SecuraBit Episode 50: Interview with Rob Lee!

  • What is SANS vLive?
  • Forensics
  • DOD Cyber Crime
  • How the forensics classes are structured.
  • 508 course and how it’s changed. Divided up into essentials and then follow on courses. 6 total courses for all of the info.
  • APT – Advanced Persistant Threat
  • Q & A from the IRC

If you havent taken the Security 508 course yet we have an excellent opportunity for you!  Rob will be teaching the SEC508 (Forensics) course  via the SANS vLive! platform beginning 3/23/2010. Classes will occur  every Tuesday and Thursday until 4/29/2010 from 7-10PM EDT.

Chat with us on IRC at  irc.freenode.net #securabit

Hosts:
Anthony Gartner – @anthonygartner
Christopher Mills – @thechrisam
Chris Gerling – @chrisgerling
Jason Mueller – @securabit_jay
Andrew Borel – @andrew_secbit

Guests:
Rob Lee – @robtlee

Links:
http://phishme.com/
http://phishtank.com/

SecuraBit Episode 49: ConFoo.ca!

SecuraBit Episode 49:  ConFoo.ca!

Podcasters Meetup – http://www.podcastersmeetup.com/
ShmooCon – Saturday Evening @ 8PM

SANS Discount Code SB508 – Free GCFA attempt when using this link.

Philippe Gamache:
Day job is focused on secure programing, developer training and code audit.
About ConFoo.ca:
-New conference about web technology
-PHP Quebec Conference offshoot
-Get all the user groups in the Monteral area together to share information
-8 Separate tracks at the time

ShmooCon FireTalks

Escaping the clutches of The GOOG - http://www.securabit.com/2010/01/21/escaping-the-clutches-of-the-goog/

Hosts:
Anthony Gartner  @anthonygartner
Christopher Mills @thechrisam
Chris Gerling  @chrisgerling
Nicholas Berthaume – @aricon
Andrew Borel @andrew_secbit

Guests:
Philippe Gamache – ConFoo.ca – @SecureSymfony

Chat with us on IRC at irc.freenode.net #securabit

Links:
ConFoo.ca – http://www.confoo.ca/en

SecuraBit Episode 48: Shmoocon (The Big Cheese) and PhoneFactor!

Hosts:
Anthony Gartner  @anthonygartner
Christopher Mills @thechrisam
Jason Mueller – @securabit_jay
Chris Gerling  @chrisgerling

Guests:
Bruce Potter – Shmoocon – @gdead
Steve Dispensa – CTO and Co-founder of PhoneFactor - http://www.phonefactor.com/about/management-team/steve-dispensa/ @dispensa
Marsh Ray – PhoneFactor – @marshray

Recent goings on:
If you are going to DC3 CyberCrime Conference contact Jason Mueller (@securabit_jay) to meet up!
Sean Hausauer and David Shpritz join the crew!  Check out their blog postings!

First Guest – Bruce Potter – Shmoocon – @gdead

Logistics of putting on a conference.
New events!
Ticket sales process is constantly evolving.

Wardman Park in 1920’s:  http://www.shorpy.com/files/images/29398u.jpg
ShmooCon 2010 FireTalks:  http://www.novainfosecportal.com/2010/01/06/shmoocon-2010-firetalks/
Podcasters Meetup:  http://www.podcastersmeetup.com/

PhoneFactor:
How to fix SSL/TLS in software
The process of working with vendors to get a solution implemented.
Project Mogul

End:
Join us on January 27, 2010 when we speak with Phillipe Gaumeche about the ConFoo.Ca conference.
Chat with us on IRC at irc.freenode.net #securabit

Links:
Shmoocon – http://www.shmoocon.org/
PhoneFactor –http://www.phonefactor.com/

Not on the air:
Andrew Borel @andrew_secbit

SecuraBit Episode 45: More on DOJOCon

SecuraBit Episode 45  More on DOJOCON

Marcus J Carey discusses MetaSponse tool to be released in mid-December. This uses the MetaSploit Framework for Incident Response.

Metasploit Framework 3.3  Released!
http://blog.metasploit.com/2009/11/metasploit-framework-33-released.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+metasploit%2Fblog+%28Metasploit+Blog%29

Join us in IRC at irc.freenode.net #securabit

Hosts:
Anthony Gartner – @anthonygartner
Chris Gerling  – @chrisgerling
Christopher Mills – @thechrisam
Jason Mueller – @securabit_jay
Andrew Borel – @andrew_secbit

Guest:
Marcus Carey – @marcusjcarey

Links:

DojoCon – http://www.dojocon.org/
Hackers for Charity – http://www.hackersforcharity.org/
hak5 – http://www.hak5.org/

NoVA Hackers – http://groups.google.com/group/novahackers

dojosec @ USTREAM http://www.ustream.tv/dojosec
White Wolf Security – http://www.whitewolfsecurity.com/
ShmooCon 2010 – http://www.shmoocon.org/
Netwars Competition – http://www.sans.org/netwars/
International Spy Museum – http://www.spymuseum.org/
Cyber Forensics: Digital CSI – http://spymuseum.org/programs/calendar_pages/2009/q4/2009_12_01_prog.php
http://hashtags.org/tag/roachesmustdie