Archive for January, 2008

The Unified Threat Management Wireless Security Project

Thursday, January 31st, 2008

While listening to Pauldotcom’s Podcast Episode 97, they mentioned a project that they had connections to which seems to be as it was put, “a fun weekend project” with some definite security benefits. It is called the PacketProtector which is a Linux distribution for wireless routers, built on top of OpenWrt.

The goal of this project is to transform the router into a unified threat management device.

Here’s what you get-

  • a stateful firewall (iptables)
  • WPA/WPA2 Enterprise wireless (802.1X and PEAP with FreeRADIUS)
  • intrusion prevention (Snort-inline)
  • remote access VPN (OpenVPN)
  • content filtering/parental controls (DansGuardian)
  • web antivirus (DG + ClamAV)
  • a local certificate authority (OpenSSL)
  • secure management interfaces (SSH and HTTPS)
  • advanced firewall scripts for blocking IM and P2P apps
  • IP spoofing prevention (Linux rp_filter)
  • basic protocol anomaly detection (ipt_unclean)

I have not tested only because I am currently lack the hardware, but if can find a Linksys WRTSL54GS or ASUS WL-500g (Deluxe or Premium) router, and a USB 2.0 drive with 100MB of free space for the right price, I will definitely being testing this one out.

If you have tried this out, please leave some feedback.

Matthew “The Security Zealot” Becker

Maltego - Passive Information Gathering Tool

Wednesday, January 30th, 2008

I ran across this tool by Paterva called Maltego which seems to be a fairly useful tool for high-level Passive Information Gathering, as well as verifying your companies Internet Footprint.

As defined by Paterva,

” Maltego is a program that can be used to determine the relationships and real world links between:

  • People
  • Groups of people (social networks)
  • Companies
  • Organizations
  • Web sites
  • Internet infrastructure such as:
    • Domains
    • DNS names
    • Netblocks
    • IP addresses
  • Phrases
  • Affiliations
  • Documents and files”

Although it seems that only the Classic Web Version is available, it still seems to be a useful tool. There is also a downloadable GUI interface.

For more information checkout Paterva’s Maltego.

Matthew “The Security Zealot” Becker

2008 North Carolina Area Information Security Conferences

Friday, January 25th, 2008

I have starting to put together a list of the Information Security related conferences that I have found in and around North Carolina.

February 15 -17 ShmooCon Washington D.C
February 18- 21 Black Hat DC Briefings Washington D.C.
March 3-6 Techno Training Bootcamp 2008 - Charlotte, NC
March 25 2008 Security Summit - Charlotte, NC
March 28-29 Carolinacon Regional Technology Conference - Chapel Hill, NC
April 3 Raleigh Tech-Security Conference Raleigh, NC
June 1 -4 TechnoSecurity - Myrtle Beach, SC
October 16 Fourth Annual Triangle InfoSeCon Raleigh, NC
October UNC Charlotte Fall 2008 Cyber Security Symposium, Charlotte, NC
October Metro Atlanta Information Security Conference Atlanta, GA
October 27-29 Techno Forensics Conference - Gaithersburg, MD

If you know of any other conferences, please add it to the post.

SZ

An In Depth Discussion with Mile2’s CEO - Raymond Friedman

Thursday, January 24th, 2008

The CISA exam has come and gone as I am patiently awaiting the results.

In the mean time, I have been taking a few weeks to regroup and take a hard look at the possible paths that I could continue down to maintain skill levels. My first path I have decided to assess is how my current and future certifications align with my career goals and my interests.

To put this into perspective, I have a very strong belief that in order to be a strong Information Security Professional, you must maintain a balance of technical, audit and management skills in order to fully understand the full breathe of Information Security. Secondly, I personally have a strong fascination as well as respect for the intelligence and technical skills that is required to assess and harden infrastructure and it’s vulnerabilities. As a result, I began to take a particular hard look at my Certified Pen Testing Specialist (CPTS) certification from Mile2.

A Brief History

I took the Mile2’s CPTS one week course back in December 2006 and found it to be a highly comprehensive course that detailed the basic methodology of Pen Testing as well as several most commonly used tools and techniques in the field. Later, I passed the exam in March 2007 on the second attempt and have held the certification for close to a year.

After obtaining this certification, I began to notice that there has not been much change on the Mile2’s Website, nor have I encountered many other CPTS in the industry. I did some Googling for Mile2 and its certifications and it seemed the only sources I could find were either on Ethical Hacking forums or links that were off the Mile2 site. This raised several questions and concerns that I believe needed to be answered.

So I e-mailed Mile2 with the following questions:

Can you provide me with the number of CPTS’s and CPTE’s (Certified Pen Testing Experts) whom are globally certified?

Has there been an increase or decrease in the market?

What is the future Road Map of Mile2?

Is Mile2 still trying to remain “elite” against its competitor?

Why is it that the majority of the publicity that I can scour about the CPTS/CPTE certification is directly from Mile2?

Expecting to receive a call from “Joe the Sales Guy”, I was completely surprised when I received a phone call from Raymond Friedman, the CEO of Mile2 and M2IA.

Through an hour long conversation, Mr. Friedman revealed several interesting new events that Mile2 is embarking. First and foremost, Mr. Friedman’s organization Millennium Squared Information Assurance (M2IA) has recently acquired Mile2 UK, LLC and has become the central site for providing training for Mile2. As a result of the new acquisition, there has been a newly appointed management team in the United Kingdom, an established presence in Tampa, Florida, as well as the opening of a third office in Europe.

Since the acquisition, M2IA have been revising their existing course ware and developing new courses that are being finalized in the beginning of 2008.

Some of the changes include:

CPTS - Certified Penetration Testing Specialist v. 7.2 Revision (Focus on BackTrack Distro)

CPTS - Financial Sector

CPTE - Certified Penetration Testing Expert (including a hands-on live network penetration)

CWAS - Certified Wireless Assessment Specialist

CWPTS - Certified Web Penetration Testing Specialist

CSCS- Certified Secure Coding Specialist

CSCS- Certified Secure Coding Specialist – Java

CWPTS-Certified Web Penetration Testing Specialist

CISSO-Certified Information Systems Security Officer

CLSS - Certified Linux Security Specialist

CDFEC - Certified Digital Forensics Examiner

CRCA - Certified Reverse Coding Analysis

With such an emphasis on new certifications, I questioned Mr. Friedman about the pass/failure rates of the CPTS and CPTE certifications. He stated that on an average, there are 50 candidates who take the CPTS each month with a 25% Pass Rate. As for the CPTE, he stated that pass rate is only at 7%. This is obviously quite a tremendous difference pass rate then Mile2’s competition.

M2IA is also retooling a new company website, which should debut this month, and is adding several features including an online shopping security store. This store will offer Penetration Testing Gear and tools, training kits, various forensics software as well as security equipped computers for customers. Additionally for Mile2 students and members there will be access to invaluable security info; software downloads, as well as exclusive white papers written by the Mile2 experts. A Career Academy and Staffing Resources will be added for students and Mile2 members to post resumes and search security job positions globally.

Apart from the company website, M2IA is contributing to the Securipedia.com website, which will be an independent search engine built to sponsor the Information Security Culture and provide an information location for the member of the security field. Mr. Friedman states that Securipedia.com is, “”Bigger than all of us… and will grow without us”; meaning that although Mile2 and M2IA have helped incubate this search engine it will earn its own place on the Internet.

.He continued to list other added benefits that Mile2 is deploying to include:

· Pro Services - (2007) Penetration Testing and Forensics consulting which within the last year, Mile2 has landed large contracts in both Holland and Canada as well as other several other contract worldwide.

· CBT and Virtual On line training- (2007) mile2 is offering live on line training as well as CBTs (Computer Based Training) to our new courses. CPTS, Wireless, Forensics, Social Engineering

· Advertising campaign with Hakin9 Magazine.

With all of this activity surrounding Mile2 and M2IA and the customer oriented dedication that Mr. Friedman portrayed to me, I have since regained my confidence in the time and effort I have spent with my certification. Our conversation even sparked an interest in the possibility of pursuing the CPTE certification.

SZ

A Sad Note for Information Security this New Year

Wednesday, January 9th, 2008

Happy New Year to all. I hope everyone’s holidays were all what they dreamed they could be.

It seems that the TV show Tiger Team is no more. There is no listing on TruTV and

I would state that late night on Christmas Day was probably not the best premier a new series and expect it launch. By this time most people had full bellies of food and eggnog while their ears rang from screaming kids and outlandish stories from there in-laws. The last thing most people would want to see is how all of their Christmas “Bootie” could be gone tomorrow.

I echo the words of Mr. Bejtlich in saying, “That is a real shame — I hope TruTV reconsiders.”

SZ