g3k

327 reputation

bio	website	bsidesorlando.org
	location	Climing in yo windows
	age
visits	member for	7 months
	seen	May 16 at 18:52
stats	profile views	15

Formerly worked for a security firm from home doing PCI ASV/PCI QSA work. Decided I hated working from home and that company, now I do vulnerability management for a corporate entity. I mostly still work in PCI, but I'm on the other end of the stick (the side that gets hit with the stick) Most of my time is spent spanking system owners when they don't patch properly, the rest is dedicated to reviewing and writing policy to help build up our VM program.

I used to know a whole lot of technical stuff, but then I got wrapped up for 2 years in PCI and lost all my skills by getting rusty and complacent. I spend a lot of time on /r/netsec.

I also created #DC407 and I'm an organizer of BsidesOrlando

	327 reputation	bio	website	bsidesorlando.org	visits	member for	7 months
8 badges		location	Climing in yo windows		seen	May 16 at 18:52

summary answers questions tags badges favorites bounties reputation activity

25 Comments

suggestions reviews revisions comments badges posts accepts all

Mar 19	comment	Why does layer 2 IDS seem underdeveloped compared to layer 3 IDS, for wireless network? It has nothing to do with PCI-DSS, what are you even talking about? FCC regulations make it so you cannot sell equipment that has the ability to jam radio signals. It is illegal to do so, unless you get some sort of authorization and even then your target audience is government anyway. fcc.gov/encyclopedia/jammer-enforcement
Mar 18	comment	Why does layer 2 IDS seem underdeveloped compared to layer 3 IDS, for wireless network? There are commercial layer 3 IDS's, but I honestly don't have much faith in them. Aruba's AP controller will have a rogue AP detector, as Cisco's does as well IIRC. There was a time where IPS was built in, but that violates FCC code on signal blocking.
Mar 12	comment	Windows 2003 Enterprise infected by Conficker; post-infection problems continue Conficker loves to spread like wildfire, so I also suggest doing a full scan of your network with nmap sans.org/security-resources/idfaq/detecting-conficker-nmap.php When my org got infected, I made a toolkit to help facilitate removal, but it's long gone. There should be plenty of resources available online to help. IIRC there are some scheduled tasks that need to be deleted, as well as registry entries.
Feb 21	comment	Actual issue? Phone switches from 3G to router makes session switch from https to http So the connection to the router is not using SSL to encrypt, but the connection to the site still utilizes SSL? Question is a bit unclear. If that is the scenario, the traffic to the website, as long as it's https, would still be encrypted.(provided no MiTM is going on) You may want to clarify your question a bit more.
Feb 20	comment	Are we obliged to provide a complete log should auditors ask for it? ^+1 It really depends on the audit. If I was an QSA working on your SAQ, I would question your intentions.
Feb 14	comment	Detect Bitcoin Mining IF you don't have firewall logs, capture packets. There is a Wireshark dissector for bitcoin.
Feb 14	comment	Blacklisting during a penetration test? I think he's referring to the client's ISP.
Feb 14	comment	What do I need to be aware of to select a transfer method for digital forensic data? Can you expand on why you have those 3 options? Are you imaging machines at the user's desk, or are you taking it to your forensics room so you can properly handle chain of custody? Personally, what I've done in the past is confiscate the computer (or have it already confiscated, did forensics for LEO) and bring it to the forensics lab, which was locked and I was the only one with the code so proper chain of custody can be maintained. What is the purpose of your forensics program? Pursue legal action? If so, you'll need to consider the above.
Feb 13	comment	How Twitter got hacked and preventing They alluded to the recent Java 0day being an issue in the attack (blog.twitter.com/2013/02/keeping-our-users-secure.html) If this is true, then it was an internal breach on a machine that had DB access. While it's cute you're coming up with solutions to fix Twitter's problems, I don't think any of the issues described above are part of the problem they encountered.
Feb 6	comment	Retreive header from SMS iphone If you could figure out the sender's information. There is something as a User Data Header that's attached to SMS (en.wikipedia.org/wiki/User_Data_Header), but the Google results for UDH SMS iPhone really only give you results for a vulnerability in iOS that was disclosed a while ago. Your carrier might be able to assist.
Feb 6	comment	Retreive header from SMS iphone I believe there are also Android apps that will SMS bomb someone for you from your phone/tablet.
Jan 29	comment	How to satisfy requirement 10.6 of PCI DSS? You would have a procedure document that outlines the responsibilities of the person who is reviewing the document. Call out specific systems that need to be reviewed daily. Some ways to get around this costing time, is to use a SIEM, or on the cheap, set up daily alerts for each important service.
Jan 23	comment	Vulnerability scan scheduling approach on demand versus change? Sounds like this is more of a policy problem than a vulnerability management problem.
Jan 22	comment	What techniques do advanced firewalls use to protect againt DoS/DDoS? While firewalls/IPS offer good defense against DoS/DDoS based off of exploit, a powerful flood will still flood your pipe even if you have a really good robust firewall rule in place. Sadly, the only way to prevent this sort of thing from happening is to partner with a mitigation vendor. (or appliance, there is one out there that claims to stop DDoS, but I've yet to actually see it in use, just in demos) My org is in the middle of a mitigation partnership.
Jan 14	comment	How is Tor secure? Check out the latest 2600 for a way to use OpenVPN over TOR to secure both your transactions and identity. It needs some significant testing, but it's a great idea.
Jan 10	comment	How is Tor secure? Oh I know, I was making a joke. I understand that OSS is better reviewed, which is why I downplayed on that. All OSS has the downfall of the source being available to review by malicious agents, but it also gets fixes a lot faster. If closing your source was the solution, we wouldn't have all these 0days popping up around us.
Jan 9	comment	Email Compromised due to Yahoo Mail Exploit While it's good that you changed your password and we all need to do that more often than we should, but the exploit isn't a Yahoo Mail systems exploit. The exploit in question is XSS that needs to be pointed at a target and the PoC is not public last I checked. That being said, knowing it's there may lead to other people to discovering the exploit.
Jan 4	comment	Macbook pro, rootkithunter Format the drive and start with a fresh installation of OSX.
Jan 3	comment	Building a Security Training Simulation environment GiT has a great lab, I remember reading a lot of articles on it when it came out: Here is a whitepaper on it (unknown date, sorry. Also, PDF Warning): csc.gatech.edu/~copeland/6612/netseclab/… csc.gatech.edu/netseclab.html Description of lab and their methodology for grading
Jan 2	comment	Cons of disabling live CD in bios On laptops, it can be easy as pie, or it could depend on the alignment of the moon with the fifth order of Mars. I've run into Lenovos that are extremely difficult to reset the bios.