Archive for the ‘5-info’ category

Ubergeek Your Laptop For SANS Labs

September 17th, 2009

This morning I’m in San Diego giving a talk on how to work more effectively at the Window’s command line. Here’s a PDF version of the presentation for anyone that is interested:

uber-geek-laptop-R3.pdf

SANS 502 VMware VMX file

September 16th, 2009

This post is just for the folks out in San Diego taking my SANS 502 Perimeter course. I just created a new DVD for the class, and inadvertently missed a file. Here is the VMware loader file I promised as well as instructions for use:

  1. You need a copy of VMware Player
  2. Grab 502-vmware-loader.zip and unzip it into an empty directory on your system
  3. Copy 502-course-dvd.iso (1.2 GB) from the course DVD into this directory as well
  4. Double click 502-vmware-loader.vmx

Note that you are welcome to run a VMware version of the course DVD in the labs, with the following exceptions:

  • VMware is known to change IP ID increments, so you should not use it during the idle scan lab
  • VMware does not provide a true Ethernet bus, so you should not use it during any lab that involves session hijacking

Why anti-virus is dead – live

August 18th, 2009

The keynote I did at the Proactive Cyber Defense Seminar seems to have been well received. I’m going to be doing an abridged version of the talk as a Webinar on August 27th. If you feel like you are fighting a losing battle with Malware, you may find the talk insightful. Sign up is free and more info can be found on the Live page.

If you can read this, you don’t work for SANS – part 2

August 5th, 2009

This issue appears to have been resolved. Kind of funny actually. I had been dealing with the Host Monster ticket system and it was taking 24 hours to get a reply. This morning I made a post to Matt Heaton’s blog (CEO of Blue Host) about the problem. It was resolved within hours and I’ve already received 3 follow ups from support.

Host Monster support states that the problem was D-Shield put themselves (and I assume Cisco as well) on their own ban list. I spoke with Johannes at D-Shield. I’ve known him for 10 years and he’s a real straight shooter. He had no clue what they are talking about and had not heard of this problem with anyone else. Sounds a little funny to me, because if they were actually using D-Shield to generate a ban list they would have known they were the good guys last Thursday when I first contacted support.

In any event it appears that all of the previously mentioned blocks have been cleared. Who says security and day time soap operas have nothing in common. ;)

The ideal scientific test for finding a compatible geek match

July 18th, 2009

While mundanes may think we geeks are happy with a significant other that simply has a pulse, we the initiated understand that it takes a truly unique spirit to be compatible with our life style choice. Dating is hard; and while there are certainly good dating sites out there for common folks, none really address the needs of the true geek. They rely on psycho-babble questioneers to check for imaginary attributes like “cognitive mode” and “relationship skills”. As a geek I don’t need a service that will check 29 dimensions for my perfect match. I’m only interested in a significant other that occupies this specific space/time.

So what we geeks need is a pure scientific test that will validate to within a satisfactory margin of error, say +/-0x0A%, our perfect compatibility mate. Preferably the testing will include sparks and cool technology, because we are geeks after all.

In order to define a proper testing methodology, we first need to delineate the criterion our test would be attempting to validate. I humbly suggest these test items should include:

  1. Subject has a pulse
  2. Subject has a neutral personality to deal with our obsessive behavior
  3. Subject plays well with IC’s and other ESD sensitive equipment
  4. Subject assumes we are smart and will trust us even when their common sense tells them otherwise
  5. Subject is capable of generating an ion stream from their fingers for those “sexy” times

It is this author’s opinion that the only scientific device capable of properly testing all of these attributes is a Van de Graaff generator. Luckily, a typical home model in the 350,000 to 400,000 volts range should be perfectly sufficient. If your generator is currently unavailable because you are leveraging Tesla’s wireless energy transmissions, borrow one from a close friend. If neither you nor your close circle of friends owns a Van de Graaff generator, well, you’re not really a true geek and this post will not apply to you anyway.

A Van de Graaff generator perfectly suited for home use

A Van de Graaff generator perfectly suited for home use

One of the benefits of this method of testing is that it does not require a single or double blind testing methodology. Just smoothly drop into the conversation “So would you like to touch my Van De Graaff?”. Even if the subject suspects that you are testing them for compatibility, it will have no impact on the final results (assuming they have not mastered the Zen art of changing their salinity ratio).

What you will need:

Testing is relatively straightforward. Simply have the test subject stand on the platform and place one hand on the Van de Graaff generator. Now turn on the power and BACK AWAY VERY QUICKLY. At this point the test subject has already passed test item #4. Their common sense must be screaming that this is a bad idea. We are off to a good start.

Now, wait exactly 31.4159×10-1 seconds and observe/measure the angle of inclination of their hair strands. The ideal candidate will show a deflection rate of no more than NCC-17.01 degrees. A deflection rate of NCC-17.01A and certainly NCC-17.01B is NOT acceptable. Figure 2 shows a common example of a failed testing condition.  Note the expression indicates the test subject probably already realizes they have failed our test.

This test subject clearly fails the first part of our Van de Graaff testing

This test subject clearly fails the first part of our Van de Graaff testing

If the subject passes the first test, we have validated test item #2. They clearly have a well grounded personality to put up with this type of activity. It is now time to move on to the next part of our testing.

Have the test subject remove their hand from the Van de Graaff and then power it down. Place the 42 Rice Krispie pieces in their other hand. Note the subjects hand must be dry for this portion of the testing. This can be difficult to achieve as its not uncommon for test subjects to heavily perspire from their palms when in the presents of a true geek. Enact level 1 containment and clean up procedures. If the problem persists complete the testing from behind a one way observation screen. If the problem still persists hang up a copy of the Periodic Table and point out the elements you feel are the most attractive.

With Rice Krispies in hand, have the test subject stand on the platform and place their other hand on the Van de Graaff. You did remember to discharge the Van de Graaff after the last test…right? If not the test subject will receive a relatively harmless 300,000 volt shock but it will probably be sufficient for them to mandate the conclusion of testing.

If you did remember to discharge the device, wait the appropriate 31.14159×10-1 seconds and have them extend their hand as shown in Figure 3. Note the test subject in Figure 3 easily passes the first testing. Now we simply need to determine how many Rice Krispies fly out of their hand in a projectile fashion. A maximum of two Rice Krispies travelling a distance of no more than .5 meters is considered acceptable. This will validate test item #3. Passing this test indicates the test subject exhibits a high resistance to channelling an electrostatic discharge.

Subject passes initial testing. A final Rice Krispie count must be taken for final validation.

Subject passes initial testing. A final Rice Krispie count must be taken for final validation.

If the subject has passed all of the previous testing, its now time to move on to the final, and arguable the most important test, test item #5. The importance of the test subject being able to generate an ion stream during “sexy” time can not be over stressed. Luckily this is also one of the easiest tests to perform. While touching the Van de Graaff generator, simply have the test subject point at the center of your body. If this produces a tingling sensation in that area, then a sufficient ion stream has been generated and the test can be deemed a success.

Please note that this author has received reports from other geeks that the application of a wedding ring appears to interfere with a test subjects ability to generate the ion stream. Experts in the field are currently investigating a resolution to the problem, but it appears that the installation of a wedding band causes the ion stream to be dispersed. Sonic signatures from this discharge may resemble the song You Lost That Lovin’ Feeling. Its also not uncommon for test subjects to exhibit chronic headaches. If you install a wedding ring on the test subject the above testing becomes void and you do so at your own risk!

I hope you have found this testing procedure helpful.

Invisible security bug spray

July 11th, 2009

Figured it would only be a matter of time before someone asked about the “Invisible security bug spray” comment at the top of each page. Didn’t think it would take less than one day. ;)

Here’s the scoop. Its a play on a quote from one of my all time favorite ISP responses to letting them know that one of the IPs within their network is hostile.  Here’s some quotes from their response:

Snip #1:
Hackers are like ants, chasing one away from the picnic table will not protect you from the thousands and thousands in the local ant hill that are still hungry. As soon as you rid yourself of one, you will still have an infinite risk available to you to get scanned or probed again.

Snip #2:
The point of the above statements are, as soon as you’ve had one hacker prosecuted and/or addressed, you’ve only swatted one gnat on a hot & humid summer afternoon. A few seconds to a min later, you will start feeling itchy again because there’s another one biting you.

Granted there is some Zen truth to their commentary (malicious IPs always make me itchy), but what an interesting choice of words. The response then went on to say:

Snip #3:
Firewall logs such as yours will often show the paper trail of the framed computer rather than the hacker itself. The real hacker hasn’t been and normally cannot be detected during those circumstances. We’re looking into the situation but we get dozens, if not hundreds of these a week.

Snip #4:
What you should focus on is not trying to kill every gnat, but rather wear invisible bug spray so that no matter how many of them there are, they cannot find you therefore there is no war. You cannot win the war, all you can do is stay out of it.  The better the firewall you use, the more likely you will remain invisible.

We apologize for any inconvenience but just bear in mind the broader perspective to this.

So there you have it, invisible security bug spray. :D

New site intro

July 10th, 2009

Greets all,

I’ve run this site for a number of years now by granting access to specific sections for only a limited number of people. While I will continue to do this for certain clients, I’ve decided its time to open up a large portion of it to public access. I also want to try my hand at integrating much of the advice I give via e-mail and private lists here as well. Figure that way the greatest number of folks will be able to benefit.

If you are used to having access to something and you don’t anymore, I apologize in advance. Please be patient as I try and integrate everything into WordPress. The system is very cool, but its also very different than what I was using in the past. Please give me time to cut the curve.

Yours in bits,

Chris