An Information Security Place Podcast

Link to MP3

The long-awaited episode 20 is finally here. Sorry for the crazy long wait!

InfoSec News Update –

• Data Breach Suit Targets Auditor – Link Here
• Exobox data leak detection coming out – Link Here
• "CloudBurst" allows attackers to break VM guest OS and attack Host – Link Here
• Obama creates the office of Cyber Czar – Link Here
• Twitter and Iran – Link Here
• IOSCAT talk from SANS – Link Here
• Tmobile Breached….Maybe? – Link 1 / Link 2
• Wireless Keyboard sniffing just got alot easier – Link Here
• LC6 is Officially Released – Link Here
• Trojan Attack on ATMs – Link Here
• Patch Your Blackberry Servers – Link Here

Discussion Topic -Whats the difference between an Auditor and a Assessor?

Consultant’s Corner - To Scope or Not to Scope

Music Notes:

• Intro/Outro – Digital Breaks – "Therapy"
• Segway 1 – PawnShop Diamonds – "High Road Low Down"
• Segway 2 – Woodfish – "Melody"
• Segway 3 – The WaterMarks – "Shut Down"

Link to MP3

So, we officially have our first lost episode. I recorded episode 18 a while back with Michael Santarcangelo, but we had some crazy technical problems. When I tried to get everything edited together to make it work, I started having some major problems. Without getting into all the details, the recording was not salvageable. Sorry to Michael for this since I know he took his valuable time to record with me.

So know we have episode 19. I guess we could have just said this one was episode 18 and went on, but we are honest people over here at An Information Security Place Podcast. And as far as episode 19 goes, Jim and I have been balls-to-the-wall busy lately, and I have had a crazy schedule for over a month. Jim got a break in his schedule (probably more like forced a break) and coerced Kirk Greene to help him out in my place. And then Jim had some technical problems as well and ended up recording the last 15 minutes by himself (or Kirk pissed him off – not sure which). Yes, it has been a crazy time for us. But we are back, and hopefully we will get back on a regular schedule.

Now, here are the show notes for episode 19:

InfoSec News Update –

• Warm Fuzzy Story – Many Users say they’d sell company info for the right price! – Link Here
• Another Twitter Admin Account Compromised – Link Here
• New Tools Emerge To Ease Enterprise Fear Of Firewall Swapping – Link Here
• Acrobat with Yet Another 0-day – Link Here
• Feb Bank Worker charged with Data Theft – Link Here
• More Federal Reg ‘a’ Coming for Power companies – Link Here
• Thats gonna leave a mark! – Multiple Vulns found on Mcaffee’s website – Link Here
• Hacker’s demand: $10M for Virginia prescriptions database – Link Here
• Economy Note – Security Suffers Cuts but fares better than most – Link Here

Geek Toys -

• Interceptor – Hak5 Episode – DigiNinja’s Page
• Acer Aspire One 10.1 Netbook
• Wifi Card of Choice – Alfa Network AWUS036H
• Need a second NIC on a laptop? – Apple USB Ethernet is rather inexpensive and works with Windows / Linux / and OSX (duh). / Windows Driver
• NAS From Heaven – QNAP TS-809

Consultants Corner - DIY Security Testing Lab

Music Notes:

• Intro/Outro – Digital Breaks – “Therapy”
• Segway 1 – Dave Stanley Band – “Lights Out”
• Segway 2 – John Taglieri – ” Make A Mistake With Me”
• Segway 3 – Junior – “What Was I Thinking?”

Link to MP3

Here is Episode 17. Sorry for the delay in getting it out. Last week was extremely rough for Jim and I, but we are back at full strength now. Well, maybe 85% strength anyway

In this show Jim and I relate the latest news as always, then we have some discussion about layoffs and how that is causing a lot of orphaned hardware and software. Then we discuss some challenges for the consultant in walking the mind field of politics at client companies.

Also, we had some listener feedback from Geir. He was busting on us a bit about our saying you need to patch your stuff when we were talking about 0day. Thanks for keeping us straight Geir. If you want to send feedback, you can send it to podcast-at-infosecplace.com.

Here are the show notes:

InfoSec News Update:

• Follow up – Another Payment Processor Has Been Hacked – Visa says JUST KIDDING! – Link Here – This Just In – A new timeline of the Unnamed Processor – Link Here
• Gartner – Nearly 8 Percent of U.S. Adults Lost Money To Financial Fraud in ‘08 – Link Here
• Federal cybersecurity director quits, complains of NSA role – Link Here
• Health Records Show Up in Yard – Link Here
• Study: Antivirus Software Catches About Half Of Malware – Link Here
• MS Finally killing off AutoRun – Link Here
• Marine One data leak – Link Here
• The Return of L0phtCrack!! – Link Here
• WarVox Released – Link Here
• Theives Steal the Show at Cebit – Link Here
• Checklist for complying with PCI security standard – Link Here / Link To Checklist

Discussion - Orphaned hardware and Software – Link Here

Consultant’s Corner - Dealing with political landscapes at your client’s company

Music Notes:

• Intro/Outro – Digital Breaks – “Therapy”
• Segway 1 – Beth Thornley – “Mr. Lovely”
• Segway 2 – Munk – “DirtyWork”
• Segway 3 – By The Wayside – “Do You Ever Notice”

Link to MP3

Episode 16 is up and running.  Jim and I cover a lot of news again in this episode.  Also, Jim goes a little crazy with the geek toys, but it is all really cool stuff and good info.  We get into some PCI futures, playing off of Rich Mogull’s ideas on the subject.  And we have a good cert discussion as well.

Show notes:

InfoSec News Update:

• Another Payment Processor Has Been Hacked

• Follow Up from last podcast – Chris Pagets ShmooCon session video is up

• Reported raids on federal computer data soar

• Backtrack 4 Beta Released

• FaceBook Privacy Changes

• Acrobat 0-Day running Wild

• XSS Stealing Data without a trace -”Our goal was to retrieve Web content anonymously,” says Matthew Flick, principal with FYRM Associates, who, along with fellow researcher Jeff Yestrumskas, demonstrated the XSS Anonymous Browser (XAB) framework at Black Hat DC yesterday. “We [said], ‘Why don’t we volunteer people for our network?’…Cross-site scripting can make people do things we want.

• Weaponizing Cyberspace

• Threats the Smart Phones Increase

• Intel’s new Bios Gets Slapped

• Researcher demonstrates SSL attack

• GNU Radio Kit – Universal Software Radio Peripheral
• Netbooks A Plenty – MSI Wind and Lenovo S Series
• Tmobile @home Service

Consultants Corner: Top three security certifications (uhhh, yeah…)

Music Notes:

• Intro/Outro – Digital Breaks – “Therapy”
• Segway 1 – Electric Touch – “Sounds From the Underground”
• Segway 2 – Junkyard Groove – “Thank You”
• Segway 3 – InnerLogics – “Bam’s GirlFriend”

Link to MP3

Here is episode 15. There was a lot to cover in this episode.  Jim and I were in discussion mode, so be prepared to sit down for a while longer than normal this time.  Jim and I were also in a joking mood and consequently cracked ourselves up on this episode, so enjoy the laughter and comedy at a fellow human’s expense.

BTW, I am a milestone guy, and any time a “0″ or a “5″ is at the end of the episode number, I think it is cool. So 15 is a cool number to me. On to the show notes.

Show notes:

InfoSec News Update: whole lot of crap!

• FAA Security Breach Exposes 45K Employees
• AV makers Hacked – BitDefender and Kaspersky, More: Full Info on hackers Blog
• Electronics Firm Faces FTC Lawsuit Following Multiple Hacks – “The complaint alleges that until at least December 2007, Compgeeks (geeks.com) routinely stored this sensitive information in unencrypted text on its corporate computer network, among other security failures. The complaint also charges that the respondents did not adequately assess whether its Web application and network were vulnerable to commonly known or reasonably foreseeable attacks, such as SQL injection.”
• Identity thieves beat Obama to stimulus package punch
• Obama’s new CyberSec Chief Named
• Federal Workers Warned Of Potential Data Compromise At SRA
• Jailed SF network admin files $3M claim – Looks like the S.F. Mayor has some l33t admin skills because “Childs, formerly a network administrator with the city’s Telecommunications and Information Services (DTIS), had argued that the department’s staff was incompetent and that the mayor was the only person qualified to handle the passwords.”
• Heartland Breach Follow up – 157 institutions claiming issues – includes Bermuda, Canada, and Guam
• War cloning, the “new hacker sport”
• The latest MS Patches – One is for MS SQL, and there is exploit code out there

Discussion: File Under DUH! Unauthorized Web Use On The Rise

Consultants Corner: How does “Compliant” equal Owned?

Music Notes:

• Intro/Outro – Digital Breaks – “Therapy”
• Segway 1 – Munk – “DirtyWork”
• Segway 2 – Patent Pending – “Cheer up Emo Kid”
• Segway 3 – Fabienne Delson – “I’m Gonna Catch Me a Rat”

Link to MP3

Episode 14 is here. First off, let me thank everyone that is listening to Jim and me spout off about everything. Fourteen shows does not seem like a big number, but it involves a lot of work getting this going (especially on Jim’s part – thanks Jim) and keeping it going, and Jim and I appreciate everyone sticking in there with us.

Second, we have made some changes with my setup, so there might be a sound difference and some issues with this episode. Forgive us as we get some new kinks worked out.

Third, this episode includes an interview with Mike Rothman from eIQnetworks. You might know him better as that guy from Security Incite that has a yankee accent and tells everyone what he is thinking. Either way, Mike is a great guy and a great friend, and I was honored to interview him. I think you will enjoy that portion of the show.

And lastly, there is a programming note. The geek toys segment that is brought to you by Jim every show is now going to be made more of a quarterly thing. The reason is because Jim has to find something to talk about every time, and it is getting a little more difficult to find something for every show.

Here’s the breakdown of the show.

Show Notes:

InfoSec News Update: there’s been a lot happening the last two weeks

• Largest CC breach Ever !! Yes, I am talking about Heartland. 100 million + credit cards and the accusation that they attempted to hide behind the inauguration
• Heartland Followup – Law Enforcement Closing in on Perp – Looks like they are outside the US (thanks for narrowing that down)
• Monster.com Hacked … Again!
• Using Twitter for Info/Data Mining – Lenny Zeltser
• Conficker Worm Takes down a Hospital
• Follow up – Same worm variant is also attacking the UK MOD – Michael at mcwresearch.com
• Shavlik apologies for hyped MS patch Analysis – Eric Shultze: “So here’s my official apology for crying wolf on this issue when I should have done my due diligence and read all three Microsoft locations before offering my opinion on this issue”
• New Report from US Dept of Health and Human Services (HHS) – Task force recommends that government spearhead medical identity theft awareness and prevention initiatives (link is a PDF). I get a tad cynical here. Hey, it involves government.

Discussion – New president declares his plan for US Cyber Security (more cynicism from Michael)

Vendor Interview – Michael interviews Mike Rothman from eIQnetworks

Consultants Corner -Combining compliance initiatives and what that means for security practices

Music Notes:

• Intro/Outro – Digital Breaks – “Therapy”
• Segway 1 – Eric Kauschen – “Speed of Light”
• Segway 2 – GK & TheRenegades – “Enemies”

Link to MP3

An Information Security Place Podcast Lucky Episode 13 is here! Sorry for the delay between podcasts. Jim and I usually try to maintain the every-2-weeks schedule, but since we had Accuvant’s annual meeting coming up, we decided to push it out so we could do it there (”there” was Sedona, AZ – a beautiful place). This is the first time Jim and I have been in the same room recording the podcast, which was different (Jim kinda smells a bit). We had fun with it.

In addition, I wanted to take advantage of having some vendors close by (we have a vendor fair every year) for some interviews. I only got one, but it was a good one with Bluecoat. Thanks to Greg Buchan and Thomas Lee for spending some time with me.

So without further ado, here are the show notes:

Show Notes:

InfoSec News Update:

• South Korean woman defeats Japan’s airport Biometric systems
• Some Nokia Phones vulnerable to DoS attacks due to SMS
• The Academy Home Launched
• McAfee’s Virtual Criminology Report
• MS doesn’t release a patch for Windows 7 Beta
• Twitter Security Problems

Discussion – Security Predictions for 2009 from Computer World

Geek Toys – MiniStack v3 Review

Consultants Corner – Choosing the right travel plans for yourself

Vendor Interview – Michael interviews Bluecoat

Music Notes:

* Intro/Outro – Digital Breaks – “Therapy”
* Segway1 - SatelliteState – “ClockWorks”
* Segway2 – Naked Gun – “A.D.D.”

Link to MP3

MERRY CHRISTMAS and welcome to Episode 12! I have been sick all week, and it hit me hard yesterday and today. So Jim and Kirk saved the day and recorded the podcast without me. I am a little bummed that I was not on the last podcast of the year, but you would not have wanted to listen to me sounding all nasally.

So thanks to Jim and Kirk. Here are the…

Show Notes:

InfoSec News Update:

• Oh the Wonders of the Black Berry –
• More Phone Fun – Follow up from Episode #4
• Netscreens of the Dead – Great Preso
• New Checkpoint Vulnerabilities
• Amex has XSS issues
• Report – 1/3 of all Impersonation Attack Victims located in US or Russia
• Transit Authority Working With Hackers – Follow Up from Episode #8

Discussion - Using Local resources for Social Engineering

Geek Toys – Last Minute Geek Gift Ideas

• Asus EEEPC
• Nice ToolKit
• Noise Cancelling Headphones
• Some Quiet Time with the Family
• Lock Pick Set
• Portable Power Strip
• Podcaster on the Go
• Portable Bluetooth Speakerphone

Consultant’s Corner - 2008 Year in Review – the Consultant’s Perspective

Music Notes:

• Intro – TheHipCola – “Sleigh Ride”
• Segway 1 – Wiser Time – “Blue Christmas”
• Segway 2 – Bill Kahler – “Christmas Eve In The Trailer Park”
• Outro – TheHipCola – “Winter Wonderland”

Link to MP3

Show Notes:

Segment 1: InfoSec News Update (Michael gets to do a little talkin’ here – and he promptly screws it up):

• New Security Awareness video on YouTube – kinda cheesey, but a pretty good production
• Digittrade HD Encryption Broken- “in our test, unscrewing the housing took longer than cracking its encryption mechanism.”
• Lenovo’s new Facial recognition software defeated by printed photo
• Massachusetts new law – 201 CRM 17.00 – “Every person that owns, licenses, stores or maintains personal information about a resident of the Commonwealth shall develop, implement, maintain and monitor a comprehensive, written information security program applicable to any records containing such personal information” – a civil penalty of $5,000 may be awarded for each violation of 93H. In addition, under the portion of 93H concerning data disposal, businesses can be subject to a fine of up to $50,000 for each instance of improper disposal. Requires – Regular Monitoring, Documenting responsive actions taken during breach, and reasonable monitors of systems.
• File Under DUH! – Symantec Discovers Cybercrime makes money – estimates value around $1.7Bil
• Really simple PCI FAQ that you should be aware of
• Apple and the AntiVirus Debate – In a written statement sent to security news site Securityfocus.com, Apple explained their decision to pull the document: “We have removed the KnowledgeBase article because it was old and inaccurate,” Apple said in a statement sent to SecurityFocus. “The Mac is designed with built-in technologies that provide protection against malicious software and security threats right out of the box. However, since no system can be 100 percent immune from every threat, running antivirus software may offer additional protection.”

Discussion: BLATANT FUD – Patching at the Enterprise level – Securina “virtually every Windows PC is at risk” – 98% of Windows computers are missing patches – 46% were missing more than 11 patches

• Follow on – make sure you reboot!!

Segment 2: Geek Toys and Consultants Corner

• Geek Toys – Kensington Portable Power outlet – AS SEEN ON REGIS AND KELLY!!!!
• Consultants Corner – Helping client dealing with a breach (specifically as how it relates to compliance issues)

Music Notes: NEW – CHECK OUT THE LINKS TO THE BANDS ON PODSHOW.COM

• Intro/Outro – Digital Breaks – “Therapy”
• Segway 1 – Portal – “The Simple Things”
• Segway 2 – Shovel 13 – “Show Me Affection”

Link to MP3

Show Notes:

Episode 10! We are in double digits! W00T! Thanks to Jim for all the hard work on getting these podcasts produced, for picking the music, for doing most of the talking, for… errr, what do I do around here anyway??

Segment 1: InfoSec News Update and some discussion about pinko commies

• Ted Demopoulos’ has set up a website with comments on the state of some security certs
• Metasploit 3.2 is released. Always good stuff coming from a fellow Texan
• Sendmail has Yet Another DOS vuln. Of course, that’s not a security vulnerability, so I am not sure why we are talking about it here. Yea, right…
• Pinko Commie China Targets US Computers for Espionage – US-China Economic and Security Review Commision Report – Report File (pdf)
• Discussion – Are Sharepoint Sites the Weakest link? – Survey Q from Cnet

Segment 2:

• Geek Toys – Jim has pretty much given up on trying to please Kirk because he is talking about non-security related toys AGAIN – a review of the Popcorn Hour A-110
• Consultants Corner- Staying diligent during holidays
• Further ranting – Jim says “LEAVE ME ALONE – I AM BUSY” to Q4 invitations to speak at conferences

Music Notes:

• Intro/Outro – Digital Breaks – “Therapy”
• Segway 1 – Naked Gun – “A.D.D.”
• Segway 2 – Kickstart – “Bouncey”