I'm reading a book I recently purchased, called Professional Penetration Testing. I'm using this as a first try at using the tools available for Amazon Associates on Blogspot. Feel free to hover over the image/link, and click for more information on the book. I believe I only generate some sort of commission, when there is a sale.
I pledge to my readers never to offer products that I don't own myself. I hope to give meaningful reviews of these products as well.
So far, my experience with Professional Penetration Testing is a positive one. While I admit that the price tag is a little steep, you should understand that it comes with a DVD that contains not only instructional video, but also some system images to be used in training. These images are suitable for loading into VMWare for example.
Another thing about the book that put it onto my "buy it now" list, is that in addition to covering the technical aspects of Penetration Testing, it also covers ethics as well as "the business" of Penetration Testing.
I hope you all don't get sick of this advertisement, but I'll keep posting it while I'm going through this book. I know there is an awful lot of information that is redundant for me, personally. That happens when you are at the stage of your career that I am in (I think they call it getting old). There aren't many books I can pick up and not have to go through some amount of information that I'm already familiar with. But this is as much a part of Cyber-Jutsu as anything else. One needs to learn to dig through the proverbial weeds, in order to find the gems that will be useful.
Another really good reason for me to pick up this book, is that I expect that CyberCede, my company, will be hiring within the year. I think this might be a great tool for my new recruits. If you are in college and looking for a co-op position or if you recently graduated and desire a position as a entry/junior level information security analyst, drop me an email and/or shoot me your resume. If you are eager to get started on this path - you might want to purchase this book (and keep your receipt).
Thursday, September 2, 2010
The State Of The Current SNAFU vs. The Good Old Days
I sit and write this post, which is long overdue, and slightly off topic, while I watch my HP Pavilion dv9000 "running" Windows Vista Ultimate "welcome" me forever. It is just sitting there with its very stylish shining circle spinning like its grandfather, the hourglass used to do. I'll be honest. It is still spinning - and spinning, and I'm getting the sinking feeling that this system isn't going to come back up without a hard boot. Luckily, I'm barefoot right now.
While I enjoy the many terabytes of storage that store movies, pictures, and other data of all kinds in my home and home office, there is a part of me that longs for "the good old days". Which good old days might those be? How about a time when, if I had a problem with my operating system disk, I reached over and grabbed one the the other copies that I had in a pile of 5.25" floppy disks.
That was the way my first IBM clone worked. It didn't come with a hard drive, it didn't even have a pre-established space to mount one. I had the deluxe model, it had not one, but two five and a quarter inch floppy drives. This allowed me to boot the computer off of the MS DOS disk, and leave it in the drive while I put my application floppy disk in the second drive.
Others, who didn't have this deluxe model would have to, from time to time, pull out their application disk, and re-insert their Operating System disk for a required file. One of my most-used applications in those days was a word processor called "Word Star", another was dBase, a database I taught myself to use (it may have been dBase II). Ah, the time I saved by having that second floppy drive was well worth the price. :)
I purchased that first IBM clone while I was in the US Air Force, and stationed in Japan (1987-1989). It was a Commodore PC10. The "10" stood for the speed. It ran at an amazing 10Mhz. This was a vast improvement over the actual IBM PC computers I had the opportunity to use in the Artificial Intelligence lab at the on-base satellite-campus for the University of Maryland. Those beasts were running around 4.77 Mhz as I recall, and the speed difference while running the expert system I had written in Prolog was significant. I recall my first reaction to seeing the IBM logo on those systems. I was ecstatic. "Oh man," I had said, "real IBMs!" My instructor asked me if I had a computer back in my dorm, and I told him what I had. "You will want to use that when you can," he advised; and, he was right.
While I was very skeptical at first, tinkering (or hacking) with the computer hardware started almost immediately. I had a friend who was disgusted by the notion that I was only using two floppy drives to run my system; and he helped me upgrade my IBM clone to include a hard drive. It was the first time I had ever taken the cover off of a computer. I was shocked and appalled when my friend pulled a drill out of his bag. "This is a computer," I said, as if he was not aware of that obvious fact. "It is a delicate piece of electronics," I continued as he moved closer to the system and plugged the drill in. He spun the drill's motor up and grinned at me. "I don't think this is the way it should be done," I pleaded. He was mildly amused at first, but quickly annoyed. I was perhaps 18 or 19 years old, and my friend was probably in his mid to late 30s. He was perfectly content not to use the drill. But he advised me, if we didn't, he couldn't help me install the hard drive I had just purchased with his help.
I bought the hard drive at the same location I bought the PC. There was an electronics shop on base that had all of the wonders of the world, most of which would not be seen in the Continental United States for about four years. Most Americans aren't aware of the consumer technology lag between Japan and the United States which is still around four years. I think that is an effect produced by the unquestionable pseudo-truth that all Americans grow up with; namely, that the United States is the best country in every way. But I digress.
My friend had suggested that I purchase the 10, or 20 Megabyte hard drive. "You will probably only ever use ten megabytes," he advised. "You might use ten, you probably won't ever even need more than ten," he continued as I held the forty megabyte box in my hands. "You will never in your life use forty megabytes. You are wasting your money," he urged. I bought the 40MB hard drive, and never looked back.
Having been pushed up against the cliff of not getting that monster hard drive installed if I refused to allow my evil computer-doctor friend to use his barbaric drilling instrument, I gave the go-ahead. He did an outstanding job. That hard drive, a Seagate, is still mounted securely in that 8088 system to this day - and the last time I spun it up, it was still working.
While I've been typing away - my HP laptop did finally boot, and I was able to log into my desktop. However, Internet Explorer refuses to run. Only God knows what the system was doing for all the time it took it to boot. I'm attempting to remove Windows Live Once Care (which was a really good Microsoft offering that is no longer supported). It refuses to be removed in Safe-Mode, and everything is just hanging (or taking unbelievable lengths of time to complete).
There were updates that seem to have failed to load - but kept trying each time I shut down. I've been round and round with this system now for longer than I care to admit. Is it a virus? Perhaps. An intermittent drive failure? Perhaps. A heat issue? Perhaps. Is it a pain in the arse? Definitely. Can I easily swap out some parts to troubleshoot? Definitely not. :(
Until next time,
Metajunkie
While I enjoy the many terabytes of storage that store movies, pictures, and other data of all kinds in my home and home office, there is a part of me that longs for "the good old days". Which good old days might those be? How about a time when, if I had a problem with my operating system disk, I reached over and grabbed one the the other copies that I had in a pile of 5.25" floppy disks.
That was the way my first IBM clone worked. It didn't come with a hard drive, it didn't even have a pre-established space to mount one. I had the deluxe model, it had not one, but two five and a quarter inch floppy drives. This allowed me to boot the computer off of the MS DOS disk, and leave it in the drive while I put my application floppy disk in the second drive.
Others, who didn't have this deluxe model would have to, from time to time, pull out their application disk, and re-insert their Operating System disk for a required file. One of my most-used applications in those days was a word processor called "Word Star", another was dBase, a database I taught myself to use (it may have been dBase II). Ah, the time I saved by having that second floppy drive was well worth the price. :)
I purchased that first IBM clone while I was in the US Air Force, and stationed in Japan (1987-1989). It was a Commodore PC10. The "10" stood for the speed. It ran at an amazing 10Mhz. This was a vast improvement over the actual IBM PC computers I had the opportunity to use in the Artificial Intelligence lab at the on-base satellite-campus for the University of Maryland. Those beasts were running around 4.77 Mhz as I recall, and the speed difference while running the expert system I had written in Prolog was significant. I recall my first reaction to seeing the IBM logo on those systems. I was ecstatic. "Oh man," I had said, "real IBMs!" My instructor asked me if I had a computer back in my dorm, and I told him what I had. "You will want to use that when you can," he advised; and, he was right.
While I was very skeptical at first, tinkering (or hacking) with the computer hardware started almost immediately. I had a friend who was disgusted by the notion that I was only using two floppy drives to run my system; and he helped me upgrade my IBM clone to include a hard drive. It was the first time I had ever taken the cover off of a computer. I was shocked and appalled when my friend pulled a drill out of his bag. "This is a computer," I said, as if he was not aware of that obvious fact. "It is a delicate piece of electronics," I continued as he moved closer to the system and plugged the drill in. He spun the drill's motor up and grinned at me. "I don't think this is the way it should be done," I pleaded. He was mildly amused at first, but quickly annoyed. I was perhaps 18 or 19 years old, and my friend was probably in his mid to late 30s. He was perfectly content not to use the drill. But he advised me, if we didn't, he couldn't help me install the hard drive I had just purchased with his help.
I bought the hard drive at the same location I bought the PC. There was an electronics shop on base that had all of the wonders of the world, most of which would not be seen in the Continental United States for about four years. Most Americans aren't aware of the consumer technology lag between Japan and the United States which is still around four years. I think that is an effect produced by the unquestionable pseudo-truth that all Americans grow up with; namely, that the United States is the best country in every way. But I digress.
My friend had suggested that I purchase the 10, or 20 Megabyte hard drive. "You will probably only ever use ten megabytes," he advised. "You might use ten, you probably won't ever even need more than ten," he continued as I held the forty megabyte box in my hands. "You will never in your life use forty megabytes. You are wasting your money," he urged. I bought the 40MB hard drive, and never looked back.
Having been pushed up against the cliff of not getting that monster hard drive installed if I refused to allow my evil computer-doctor friend to use his barbaric drilling instrument, I gave the go-ahead. He did an outstanding job. That hard drive, a Seagate, is still mounted securely in that 8088 system to this day - and the last time I spun it up, it was still working.
While I've been typing away - my HP laptop did finally boot, and I was able to log into my desktop. However, Internet Explorer refuses to run. Only God knows what the system was doing for all the time it took it to boot. I'm attempting to remove Windows Live Once Care (which was a really good Microsoft offering that is no longer supported). It refuses to be removed in Safe-Mode, and everything is just hanging (or taking unbelievable lengths of time to complete).
There were updates that seem to have failed to load - but kept trying each time I shut down. I've been round and round with this system now for longer than I care to admit. Is it a virus? Perhaps. An intermittent drive failure? Perhaps. A heat issue? Perhaps. Is it a pain in the arse? Definitely. Can I easily swap out some parts to troubleshoot? Definitely not. :(
Until next time,
Metajunkie
Tuesday, March 2, 2010
Accumulated Permissions
One thing that every company should look at is the effect called "Accumulated Permissions". This is often caused by individuals within a company moving from one department to another. The knowledge worker has permissions to do job A, and when they are promoted, or transferred into a new role (job B), the permissions to create, read, update, and/or delete information concerning job A might not be removed.
If a person works for an organization long enough, they can accumulate quite a large quantity of technically unnecessary permissions. This obviously creates a potential for abuse from such accumulated permissions, if they belong to a disgruntled, malicious, or unscrupulous employee. Even when under the control of the most loyal and trustworthy employee, such accumulation of permissions are still a danger to the organization because of accidental use of permissions no longer expected to be active, or in the event of an account compromise by someone who means the organization harm.
A yearly, or quarterly, manual review of all roles within an organization, and the actual permissions associated with each account is the only fool-proof way of handling Accumulated Permissions. Such a review requires a joint effort between managers, data owners, data custodians, and information security professionals.
Information Security Companies such as CyberCede Corporation, can assist an organization with internal permission reviews.
If a person works for an organization long enough, they can accumulate quite a large quantity of technically unnecessary permissions. This obviously creates a potential for abuse from such accumulated permissions, if they belong to a disgruntled, malicious, or unscrupulous employee. Even when under the control of the most loyal and trustworthy employee, such accumulation of permissions are still a danger to the organization because of accidental use of permissions no longer expected to be active, or in the event of an account compromise by someone who means the organization harm.
A yearly, or quarterly, manual review of all roles within an organization, and the actual permissions associated with each account is the only fool-proof way of handling Accumulated Permissions. Such a review requires a joint effort between managers, data owners, data custodians, and information security professionals.
Information Security Companies such as CyberCede Corporation, can assist an organization with internal permission reviews.
Wednesday, January 27, 2010
Another new device from Apple: iPad
Apple has done it again. They have released details of a new device called the iPad at an Apple Keynote in San Francisco, CA. There have been mounting rumors and expectations for a while, about an Apple Tablet device. It is finally here - and to use a Steve Jobs phrase, it looks "insanely great".
You can get an excellent video overview of it on apple's website for the iPad.
There isn't anything that I can say about it here that you won't be able to learn about it from that video linked above.
Enjoy!
Sensei Metajunkie
Tuesday, January 26, 2010
Google Wave Invitations Available
I have some invitations for the Preview of Google Wave available.
Let me know if you are interested.
Sensei Metajunkie
Monday, January 25, 2010
Sharing with the TaoSecurity Blog
I recently posted a comment which I'd like my readers and students to take a look at on Richard Bejtlich's TaoSecurity Blog.
You will find several of Richard's books on our reading list. He is, in my opinion, a thought leader in the field of Information Security. This is especially true of his ideas concerning Network Security Monitoring (NSM).
I encourage you all to take a look at the whole threaded conversation, but below is a copy and paste of my comment:
Richard,
I'm not sure I'm really following you on this one. Are you suggesting that the 'point in time' doesn't matter?
I generally find your 'out of the box' thinking refreshing (and often inspiring); but, I think I'm missing your point. Or, perhaps I'm just not agreeing with you.
I can agree that we are facing 'on-going' campaigns of cyber-threats in many arenas, and that we need to plan with the big picture in mind. But even in a physical campaign of war; while we must have high level strategy that leads battlefield level tactics, we must win the individual 'point in time' conflicts (at least the key ones) in order to win the war. Wouldn't you agree?
How does IT Security, or if you will allow the term cyber-warfare, differ? I have spent quite a bit of time converting Sun Tzu's The Art of War into IT Security wisdom. To me - his warfare consulting applies in cyberspace as well as physical terrain.
While Sun Tzu does advocate that the war is won or lost in the planning stage, before the enemy is even physically engaged; in the end, the best planning won't amount to a hill of beans if the boys in the trenches can't overcome their foes. That is IMHO the Zen aspect of IT Security - you have to be 'in the moment'.
From a Sun Tzu point of view, I believe that the lesson of his which most American companies that I've worked with are failing to heed is the "Know the Enemy, Know yourself." And of those two suggestions - it is actually the "know yourself" which is hurting the most. I could probably go on at the length of a book on that one... so I'll quit here ;)
Sensei Metajunkie
Governments and the Internet
A cyber-friend of mine mentioned that I was curiously quiet on this blog about the recent events between Google in China and and the evil hoard of malicious hackers seemingly putting political pressure via cyber-attacks.
The short story is that Google has been working with the Chinese government to censor google results which the Chinese Government doesn't want their citizens to see. In perhaps what was a moment of Liberty-Clarity, Google recently came out with a statement that they were going to stop censoring these results. To the best of my knowledge, they haven't actually implemented this change in policy - but they said they were going to.
After releasing their statement, they came under cyber-attack.
In other news, a law-firm that is representing an American company that is suing the state of China also came under cyber-attack.
Within the last few evenings, I saw Secretary of State, Hillary Clinton giving a long speech about "Internet Freedom".
Of all of the events noted above, listening to Secretary Clinton talk about the importance of a Free Internet caused me the most concern. I have a hard time believing that she has had a change in what I perceive to be her core beliefs. In order to understand why this of all things concerns me the most, you should probably do a google search on clinton, gore, PMRC, and the v-chip. ((if you don't get any interesting results - none of this will matter any more. ;) ))
My memory lumps all of these things together in a time when: Phil Zimmerman was being put on trial by the US Government for making his free encryption program (PGP) available on servers that were connected to the Internet, the Clinton Administration was ensuring that the v-chip would be put into every television in America, and Tipper Gore and Hillary Clinton were dabbling in their own game of PMRC censorship, while I was the sysop (system operator) of the CIA (Central Information Agency) BBS trying to raise awareness about the decline of Liberty in America.
My judgement is that our Secretary of State is just fine with censorship, as long as she is in a position of decision. I further judge that she is no friend to true Internet Freedom; and, prefers the perception of freedom to the real thing. I am willing to be wrong about this, and I'd love to hear your thoughts on the subject.
I'm waiting to see all of the legislation that will follow, to ensure the "Freedom (R)" of the Internet.
Sensei Metajunkie
More Internet Explorer Woes
This is just a quick heads up - if not a tad late...
Internet Exploder... errr "Explorer" has more serious security flaws in it. The last I heard, Microsoft was still trying to come up with a patch.
Have you looked into using an alternative web browser yet?
Firefox is FREE.
There is also a free email client called Thunderbird.
While we are at it... You should already be familiar with OpenOffice.org. It is a free suit of programs for word processing, spread-sheets, presentations, etc. I'm amazed how many people I run into who are using old pirated versions of Microsoft Office. Live and let live; but, for the small business this is a really poor choice of roads to travel. Why not adopt the open-source and completely free to use for personal and business uses alternative? OpenOffice has been around for a long time now. Unless you have all sorts of custom-coded MS Office VBA Applications and/or a serious Access Database, there really isn't a good reason not to switch to Open Office. And if you are one of the few companies that are truly leveraging the power of MS Office, good for you - now pay the piper. ;)
Surf safe,
Sensei Metajunkie
Wednesday, January 13, 2010
Cyber-Jutsu Style: Free Music is Nice!
All work, and no play can make your cyber-jutsu rigid like the dance steps of a less than articulate automaton. Free Internet Music is a sure-fire way to keep you in the rhythm of things.
I recommend all cyber-jutsu practitioners check out Pandora internet radio at www.pandora.com.
Pandora is free to use through your browser, though they have also released a fee-based version which strips out the advertisements and provides a native windows and/or Macintosh application. The paid service cost $36/year. Some simple math shows us that their premium music service would only end up costing $3/month. There are a bunch of other reasons to purchase the premium membership - but I'll leave that up to them to convince you with.
In any case - I just created my own radio station based upon Generation X to listen to. This is pretty neat stuff! :)
Enjoy!
Sensei Metajunkie
Wednesday, January 6, 2010
Anti-Virus software companies statistically evaluated
"Established in 2004, The Shadowserver Foundation gathers intelligence on the darker side of the internet. We are comprised of volunteer security professionals from around the world. Our mission is to understand and help put a stop to high stakes cybercrime in the information age."What was most striking, regarding the AV information I reviewed, was the surprisingly low identification rate for AV products that I had previously held in high regard. I'm not sure if this data is proof that some of the more mature AV companies are sitting back on their laurels, or if it is indicative of a malware epidemic growing out of control. It is probably a bit of both.
I recommend all cyber-jutsu practitioners check out Shadow Server.
Subscribe to:
Posts (Atom)