327 reputation
110
bio website bsidesorlando.org
location Climing in yo windows
age
visits member for 2 years, 2 months
seen Sep 4 at 13:47

Formerly worked for a security firm from home doing PCI ASV/PCI QSA work. Decided I hated working from home and that company, now I do vulnerability management for a corporate entity. I mostly still work in PCI, but I'm on the other end of the stick (the side that gets hit with the stick) Most of my time is spent spanking system owners when they don't patch properly, the rest is dedicated to reviewing and writing policy to help build up our VM program.

I used to know a whole lot of technical stuff, but then I got wrapped up for 2 years in PCI and lost all my skills by getting rusty and complacent. I spend a lot of time on /r/netsec.

I also created #DC407 and I'm an organizer of BsidesOrlando


Sep
3
comment DDoS - Impossible to stop?
@user2173629 ISPs do block addresses, or even, which is worse, can blackhole the customer. (Going at this from a datacenter/client POV) We've had issues in the past where another client in our DC is getting DDoS'd and kills the circuit at the DC until the DC company blackholes the client. ISPs can operate in the same fashion as well, block the customer upstream or block the IPs. If you choose to block the IPs, then you run into another potential DoS condition where the resources on the security device can't keep up with all the IPs coming in. There are services that help (Prolexic, Cloudflare)
Jun
28
comment If windows already has all admin rights, wouldn't a malicious program just need to pretend to be windows?
+1 There are various methods where you can inject into a process and then migrate to SYSTEM. A large portion of how Meterpreter from Metasploit works. It gets harder to do as we move into Windows 8 and 2008 R2 world, but you'll see advisories that support development in this space is really active. Here is a fresh privilege escalation from May seclists.org/fulldisclosure/2013/May/91
Jun
28
comment How do INFOSEC competitions deal with social engineering?
Yeah, they don't really handle SE in that regard, they'll handle it as answered by Terry below. They don't have users in the environment that will click on stuff. I have seen some CTFs (especially oCTF at Defcon) that will award points by doing things like sneaking into the organizer area and grabbing a flag there, or spying on the other teams. There are no SET-like challenges, since it mostly requires an uneducated user.
Jun
3
comment Criteria for Selecting an HSM
"Logical security model - can malicious entities on the >network abuse your HSM? Malicious processes on the host PC? " To add to that, how your HSM handles these events. My org's HSM will turtle up completely when it detects an event and doesn't log a lot of things (nature of the beast, PCI, etc). We have redundant HSMs with failover. We had an issue where a single ARP was bringing them down, staggered throughout the day. We ran around for a week trying to figure it out.
May
21
comment How to make a site vulnerable to SQLi?
@JacobKudria For XSS
Mar
19
comment Why does layer 2 IDS seem underdeveloped compared to layer 3 IDS, for wireless network?
It has nothing to do with PCI-DSS, what are you even talking about? FCC regulations make it so you cannot sell equipment that has the ability to jam radio signals. It is illegal to do so, unless you get some sort of authorization and even then your target audience is government anyway. fcc.gov/encyclopedia/jammer-enforcement
Mar
18
comment Why does layer 2 IDS seem underdeveloped compared to layer 3 IDS, for wireless network?
There are commercial layer 3 IDS's, but I honestly don't have much faith in them. Aruba's AP controller will have a rogue AP detector, as Cisco's does as well IIRC. There was a time where IPS was built in, but that violates FCC code on signal blocking.
Mar
12
comment Windows 2003 Enterprise infected by Conficker; post-infection problems continue
Conficker loves to spread like wildfire, so I also suggest doing a full scan of your network with nmap sans.org/security-resources/idfaq/detecting-conficker-nmap.php When my org got infected, I made a toolkit to help facilitate removal, but it's long gone. There should be plenty of resources available online to help. IIRC there are some scheduled tasks that need to be deleted, as well as registry entries.
Feb
21
comment Actual issue? Phone switches from 3G to router makes session switch from https to http
So the connection to the router is not using SSL to encrypt, but the connection to the site still utilizes SSL? Question is a bit unclear. If that is the scenario, the traffic to the website, as long as it's https, would still be encrypted.(provided no MiTM is going on) You may want to clarify your question a bit more.
Feb
20
comment Are we obliged to provide a complete log should auditors ask for it?
^+1 It really depends on the audit. If I was an QSA working on your SAQ, I would question your intentions.
Feb
14
comment Detect Bitcoin Mining
IF you don't have firewall logs, capture packets. There is a Wireshark dissector for bitcoin.
Feb
14
comment Blacklisting during a penetration test?
I think he's referring to the client's ISP.
Feb
14
comment What do I need to be aware of to select a transfer method for digital forensic data?
Can you expand on why you have those 3 options? Are you imaging machines at the user's desk, or are you taking it to your forensics room so you can properly handle chain of custody? Personally, what I've done in the past is confiscate the computer (or have it already confiscated, did forensics for LEO) and bring it to the forensics lab, which was locked and I was the only one with the code so proper chain of custody can be maintained. What is the purpose of your forensics program? Pursue legal action? If so, you'll need to consider the above.
Feb
6
comment Retreive header from SMS iphone
If you could figure out the sender's information. There is something as a User Data Header that's attached to SMS (en.wikipedia.org/wiki/User_Data_Header), but the Google results for UDH SMS iPhone really only give you results for a vulnerability in iOS that was disclosed a while ago. Your carrier might be able to assist.
Feb
6
comment Retreive header from SMS iphone
I believe there are also Android apps that will SMS bomb someone for you from your phone/tablet.
Jan
29
comment How to satisfy requirement 10.6 of PCI DSS?
You would have a procedure document that outlines the responsibilities of the person who is reviewing the document. Call out specific systems that need to be reviewed daily. Some ways to get around this costing time, is to use a SIEM, or on the cheap, set up daily alerts for each important service.
Jan
23
comment Vulnerability scan scheduling approach on demand versus change?
Sounds like this is more of a policy problem than a vulnerability management problem.
Jan
22
comment What techniques do advanced firewalls use to protect againt DoS/DDoS?
While firewalls/IPS offer good defense against DoS/DDoS based off of exploit, a powerful flood will still flood your pipe even if you have a really good robust firewall rule in place. Sadly, the only way to prevent this sort of thing from happening is to partner with a mitigation vendor. (or appliance, there is one out there that claims to stop DDoS, but I've yet to actually see it in use, just in demos) My org is in the middle of a mitigation partnership.
Jan
14
comment How is Tor secure?
Check out the latest 2600 for a way to use OpenVPN over TOR to secure both your transactions and identity. It needs some significant testing, but it's a great idea.
Jan
10
comment How is Tor secure?
Oh I know, I was making a joke. I understand that OSS is better reviewed, which is why I downplayed on that. All OSS has the downfall of the source being available to review by malicious agents, but it also gets fixes a lot faster. If closing your source was the solution, we wouldn't have all these 0days popping up around us.