327 reputation
110
bio website bsidesorlando.org
location Climing in yo windows
age
visits member for 2 years, 3 months
seen Sep 4 at 13:47

Formerly worked for a security firm from home doing PCI ASV/PCI QSA work. Decided I hated working from home and that company, now I do vulnerability management for a corporate entity. I mostly still work in PCI, but I'm on the other end of the stick (the side that gets hit with the stick) Most of my time is spent spanking system owners when they don't patch properly, the rest is dedicated to reviewing and writing policy to help build up our VM program.

I used to know a whole lot of technical stuff, but then I got wrapped up for 2 years in PCI and lost all my skills by getting rusty and complacent. I spend a lot of time on /r/netsec.

I also created #DC407 and I'm an organizer of BsidesOrlando


Sep
24
awarded  Autobiographer
Jun
4
awarded  Popular Question
Jan
13
answered How can a Facebook page be hacked?
Sep
24
awarded  Yearling
Sep
3
comment DDoS - Impossible to stop?
@user2173629 ISPs do block addresses, or even, which is worse, can blackhole the customer. (Going at this from a datacenter/client POV) We've had issues in the past where another client in our DC is getting DDoS'd and kills the circuit at the DC until the DC company blackholes the client. ISPs can operate in the same fashion as well, block the customer upstream or block the IPs. If you choose to block the IPs, then you run into another potential DoS condition where the resources on the security device can't keep up with all the IPs coming in. There are services that help (Prolexic, Cloudflare)
Jun
28
comment If windows already has all admin rights, wouldn't a malicious program just need to pretend to be windows?
+1 There are various methods where you can inject into a process and then migrate to SYSTEM. A large portion of how Meterpreter from Metasploit works. It gets harder to do as we move into Windows 8 and 2008 R2 world, but you'll see advisories that support development in this space is really active. Here is a fresh privilege escalation from May seclists.org/fulldisclosure/2013/May/91
Jun
28
comment How do INFOSEC competitions deal with social engineering?
Yeah, they don't really handle SE in that regard, they'll handle it as answered by Terry below. They don't have users in the environment that will click on stuff. I have seen some CTFs (especially oCTF at Defcon) that will award points by doing things like sneaking into the organizer area and grabbing a flag there, or spying on the other teams. There are no SET-like challenges, since it mostly requires an uneducated user.
Jun
3
comment Criteria for Selecting an HSM
"Logical security model - can malicious entities on the >network abuse your HSM? Malicious processes on the host PC? " To add to that, how your HSM handles these events. My org's HSM will turtle up completely when it detects an event and doesn't log a lot of things (nature of the beast, PCI, etc). We have redundant HSMs with failover. We had an issue where a single ARP was bringing them down, staggered throughout the day. We ran around for a week trying to figure it out.
May
21
comment How to make a site vulnerable to SQLi?
@JacobKudria For XSS
May
14
answered How secure are iPhone/Android/Windows 8 “PIN”/Pattern Lock features?
May
6
answered Random connections to meterpreter reverse tcp listener
Mar
19
comment Why does layer 2 IDS seem underdeveloped compared to layer 3 IDS, for wireless network?
It has nothing to do with PCI-DSS, what are you even talking about? FCC regulations make it so you cannot sell equipment that has the ability to jam radio signals. It is illegal to do so, unless you get some sort of authorization and even then your target audience is government anyway. fcc.gov/encyclopedia/jammer-enforcement
Mar
18
comment Why does layer 2 IDS seem underdeveloped compared to layer 3 IDS, for wireless network?
There are commercial layer 3 IDS's, but I honestly don't have much faith in them. Aruba's AP controller will have a rogue AP detector, as Cisco's does as well IIRC. There was a time where IPS was built in, but that violates FCC code on signal blocking.
Mar
12
comment Windows 2003 Enterprise infected by Conficker; post-infection problems continue
Conficker loves to spread like wildfire, so I also suggest doing a full scan of your network with nmap sans.org/security-resources/idfaq/detecting-conficker-nmap.php When my org got infected, I made a toolkit to help facilitate removal, but it's long gone. There should be plenty of resources available online to help. IIRC there are some scheduled tasks that need to be deleted, as well as registry entries.
Feb
22
awarded  Critic
Feb
21
comment Actual issue? Phone switches from 3G to router makes session switch from https to http
So the connection to the router is not using SSL to encrypt, but the connection to the site still utilizes SSL? Question is a bit unclear. If that is the scenario, the traffic to the website, as long as it's https, would still be encrypted.(provided no MiTM is going on) You may want to clarify your question a bit more.
Feb
20
comment Are we obliged to provide a complete log should auditors ask for it?
^+1 It really depends on the audit. If I was an QSA working on your SAQ, I would question your intentions.
Feb
14
awarded  Citizen Patrol
Feb
14
comment Detect Bitcoin Mining
IF you don't have firewall logs, capture packets. There is a Wireshark dissector for bitcoin.
Feb
14
comment Blacklisting during a penetration test?
I think he's referring to the client's ISP.