Due to an unexpected business trip, the podcast will be recorded and released the night of Monday, April 15 assuming all goes according to plan.
Jerry
Due to an unexpected business trip, the podcast will be recorded and released the night of Monday, April 15 assuming all goes according to plan.
Jerry
Podcast: Play in new window | Download | Embed
Subscribe: RSS
The Internet destroying ddos attack that wasn’t
http://krebsonsecurity.com/2013/03/missouri-court-rules-against-440000-cyberheist-victim/
http://hothardware.com/News/Huge-Spike-In-Mobile-Data-Traffic-Drives-IEEE-400-Gigabit-Ethernet-Standard/
http://adamcaudill.com/2013/04/04/security-done-wrong-leaky-ftp-server/
http://nakedsecurity.sophos.com/2013/04/05/ransomware-child-buse/
http://blog.trendmicro.com/trendlabs-security-intelligence/three-lessons-from-the-south-korea-mbr-wiper-attacks/
Podcast: Play in new window | Download | Embed
Subscribe: RSS
Subscribe in iTunes | Podcast RSS Feed | Twitter | Email
http://www.informationweek.com/security/vulnerabilities/cisco-password-fumble-hardware-security/240151244
Etsy’s solution for running java: http://codeascraft.etsy.com/2013/03/18/java-not-even-once/
http://www.infosecurity-magazine.com/view/31372/seoul-cautious-in-blaming-north-korea-for-massive-cyberattack-
http://blogs.mcafee.com/mcafee-labs/south-korean-banks-media-companies-targeted-by-destructive-malware
http://arstechnica.com/security/2013/03/your-hard-drive-will-self-destruct-at-2pm-inside-the-south-korean-cyber-attack/
https://isc.sans.edu/diary/Wipe+the+drive+Stealthy+Malware+Persistence+Mechanism+-+Part+1/15394
https://isc.sans.edu/diary/Wipe+the+drive+Stealthy+Malware+Persistence+-+Part+2/15406
https://isc.sans.edu/diary/Wipe+the+drive!++Stealthy+Malware+Persistence+-+Part+3/15448
https://isc.sans.edu/diary/Wipe+the+drive%21++Stealthy+Malware+Persistence+-+Part+4/15460
Bruce Schneier recently wrote a blog post about the value of security training on Dark Reading that is a bit provocative. Similar to the comments Dave Aitel made last year, Bruce asserts that money spent on education is more useful if spent elsewhere on improving security.
I both strongly agree and disagree with this position. Before you assume I am copping out of taking a stance, let me explain. It’s my experience that there are some things worth teaching and others that have little value:
Choosing a strong password – little value
Understanding that AntiVirus can’t protect against many threats – pretty valuable
And so it goes.
I’ve found that it is nearly useless to try to train people on password etiquette for a number of reasons. They don’t care; they don’t believe that it really matters; they are prompted to choose a password at a very inopportune time; they really believe that Password1 is strong. This is an area where it is far better to focus efforts on improving the technical control than spending a bunch of money on more training. Set the minimum password length to 20 characters and give everyone a password manager – oh and make sure that they can’t pick abcdefghijklmnopqrs as their password.
But in other areas, we are forced to rely on trying to hone the imperfect mind. Recognizing phishing emails and understanding that AV is not perfect are important, because we can’t enable a setting to make people safe. I suspect we all wish the world would invest in writing more secure software, and despite appearances, we are trying but the tactics for finding weaknesses grow ever more ingenious. I can’t envision a future where we have solved the problem, despite diverting all training spending on better development practices. So we are left trying to find innovative ways to get people to change their behavior, even if slightly.
I can’t count the number of times employees have expressed surprise and frustration that potentially malicious files might end up in their email inboxes. “How is it possible that a virus can get to my inbox if we are using AV?”
To me, it seems like the trick is figuring out which aspects of security to focus training on, and which can and should be addressed with technology.
On a related topic, I have been working on some security education and have been thinking about how to make it more engaging. I recently flew Delta from Atlanta to Las Vegas and noticed that the airline had remade their safety videos. I have flown hundreds of times and find those videos a bit of a bore, but I was captivated. Delta worked in some very humorous elements into the safety video – from a man using a typewriter on a tray table and needing to stow it, to a man in a neck brace unable to look behind him for the nearest exit, to a posted placard that prohibits comb-overs. I couldn’t stop watching and listening to catch the subtle humor that was being presented. On the return flight, I found that the video was mostly different, and so I needed to pay close attention again to get the new jokes. Brilliant move by Delta, in my opinion. I would love to come up with a way to do something similar in my security education programs.
There is a really interesting blog post by @ossij called “Hacking the a tag in 100 characters“.
I suspect the nefarious utility of this is going to be pretty extensive. We often tell our constituents in security awareness training to look at the address of a link before clicking on it. This strategy certainly has the ability to undermine that guidance, particularly if this JavaScript works in HTML emails. And I expect that it will work in HTML emails. One more reason that viewing email in plain text is a good idea.
I can envision some new crafty targeted watering hole attacks with this method. Rather than including a noisy iframe that gets presented to everyone, links on the page are redirected to a malicious site after clicking, but only for the intended victim – the page looks and works normally for everyone else.
Stay safe,
Jerry
In episode 11, I made some comments about wiping a compromised system rather than trying to clean it. I saw in my twitter feed a bit ago that the 2013 Shmoocon videos were posted. I looked through and one talk stuck out and I wanted to share here, given my comments: Wipe The Drive – Techniques for malware persistence..
Basically, the presenters show why it’s such a bad idea to simply clean a computer after a virus infection. I like to think this is common knowledge, but I meet people daily who so not understand the reasons behind taking this draconian approach.
Podcast: Play in new window | Download | Embed
Subscribe: RSS
Subscribe in iTunes | Podcast RSS Feed | Twitter | Email
Krebs Swatted: http://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/
China: http://www.slate.com/articles/technology/future_tense/2013/03/the_u_s_response_to_chinese_cyberespionage_will_backfire.html
http://www.crn.com/news/security/240150929/new-exploit-evades-all-antivirus-products-for-almost-a-day.htm
http://www.net-security.org/malware_news.php?id=2441
http://m.threatpost.com/en_us/blogs/ramnit-malware-back-and-better-avoiding-detection-031513
http://www.honeynet.org/node/1031
http://arstechnica.com/security/2013/03/national-vulnerability-database-taken-down-by-vulnerability-exploiting-hack/
Mandiant report: http://www.mandiant.com/library/M-Trends_2013.pdf
Solutionary report: http://www.solutionary.com/dms/solutionary/Files/SERT/2013GTIR.pdf
Podcast: Play in new window | Download | Embed
Subscribe: RSS
Feedback/comments – info@defensivesecurity.org
@defensivesec
Interesting Writeup by ESET on sink holing the zortob.b botnet http://www.welivesecurity.com/2013/03/08/sinkholing-trojan-downloader-zortob-b-reveals-fast-growing-malware-threat/
– common phishing emails emanating from it at the rate of 80m per hour Continue reading Defensive Security Podcast Episode 10
Podcast: Play in new window | Download | Embed
Subscribe: RSS
Episode 9 – From Las Vegas
Comments/questions/hate mail to info@defensivesecurity.org
Follow podcast on twitter @defensivesec
DDOS attack on Bank of the West masked a $900,000 theft from the account of Ascent Builders. http://krebsonsecurity.com/2013/02/ddos-attack-on-bank-hid-900000-cyberheist/
Bible.org- https://isc.sans.edu/diary/When+web+sites+go+bad%3A+bible+.+org+compromise/15250
Site compromised – serving malware, had rudimentary defense against automated analysis
Bit9 update: https://blog.bit9.com/2013/02/25/bit9-security-incident-update/
– kudos to bit9 for transparency and disclosure – hopefully works in their favor
Podcast: Play in new window | Download | Embed
Subscribe: RSS
News:
Burger King & Jeep twitter accounts hacked
Microsoft and Apple hacked with same exploit that hit Facebook
NBC.com’s site is hacked, injecting an iframe directing visitors to a site that served an exploit kit and installed the Citadel trojan. Continue reading Defensive Security Podcast Episode 8