Feeling the Burn

It used to be that I could sit down and write a new blog post whenever I felt like it, I just had so much to say! Today I sat down with the intention of writing a new blog post and I came up with absolutely nothing. I am literally five drafts on multiple topics ranging from toys that I want to buy, to the business of big data analytics all the way to how to integrate an intelligence process…at the the end, they were all crap. All of them. I recognize this isn’t because I have nothing to say, but rather because I am totally burnt out.

I don’t think that I am the only one suffering under these conditions however, I think many of us are probably struggling today. Frankly there is too much work to be done and too few of us to actually do it. Worst yet, is the influx of less experienced, less passionate, and less talented security professionals stepping onto the scene attempting to dominate. In a way this is more exhausting than anything because it not only fails to decrease workloads but also creates a difficult environment for ensuring quality of security delivery.

Furthermore, for many, including myself, much of our workload now is less security related than it has ever been. This is especially true for the travelers whose work/life balance consists of trying to integrate 20 hours of travel every week. The point is it is rough out there right now. I leave you with this one piece of advice I look in the mirror and tell myself every morning…hang in there.

Defcon Survival Guide 2010

Rules to Live By

1. Do not use the ATM’s at or in the close vicinity of the Riveria

2. Secure cellphones as best as possible

a. Do not connect it the wireless network

b. Bluetooth and other non-essential communications mechanisms should be off

c. Not physically visible during the conference

d. Store phones in a secure location where it will not fall out and possibly fall into the possession of someone else. In fact do this for any personal item of value.

3. Do not use any credentials on websites without encryption throughout the entire conference (see sidejacking)

a. Dynamic port forward all your traffic through a properly configured SSH tunnel

b. Use a VPN tunnel for all traffic

4. Do not take unauthorized DefCon pictures in the contest area or in the CTF area

5. Do not give away valuable information (utilize constant vigilance)

6. Do not attach a work machine or a machine with valuable information to the DefCon network

7. Do not accept ?Free? devices to attach to a machine (e.g. a free USB key from another attendee)

8. Do not antagonize anyone with a ?Goon? or higher-level attendee badge

9. Shower. Seriously, please shower. I’ve said it once, I’ll say it again, poor hygene does not make anyone a better hacker.

10 In fact please read and adhere to the do’s and don’ts of personal presentation at conferences written by Shyama, who is a well-known, knowledgeable, intelligent security professional.

---

Read more >>

What is RaffCon??? (A Mock Conspiracy Investigation)

With the security community fully engulfed in Operation Aurora, BlackHat DC, and ShmooCon, it would be easy to overlook a conspiracy. Thankfully the vigilance of SecAnalysis has uncovered an underground brewing storm, known only as ?RaffCon.? As of currently, details of RaffCon are sparse at best. However what is known, is that on 7 February 2009 some of the security communities most well-known if not notorious figures met to discuss various topics. We now are aware that the codename for that meeting was in fact, RaffCon.

The Players

In attempting to unravel the tightly knit conspiracy plot that is RaffCon, SecAnalysis scoured the hacker underground for information. At great personal risk, a SecAnalysis turned asset was able to leak the photo below. What this photo reveals is that things are worst than previously suspected.

In this photo it is clear that highly notable and dangerous personas such as Adam Ely, well known for his reporting at Information Week as well as security leadership at Tivo, Rafal Los, known for his evangelization of web application security, Michelle Schaffer, one of the most powerful Public Relations professionals in the security industry, and Caleb Sima, a well known hacker, X-Force alumni and founder of SPI Dynamics were all in attendance. In addition John Terril currently a consultant and yet another SPI alumni known for his short temperment and lethal capabilities as well as Raffy Marty, former Splunk CTO, known for entrancing even the most focused security professionals with dazzling visualizations were also in attendance. Finally, there are several sleepers who may or may not have various special assignments.

It should be noted that Caleb was an asset of SecAnalysis functioning as a double agent. The last time Caleb called over to the SecAnalysis team, was 14 December 2009. The SecAnalysis team went to San Francisco to meet with Sima. However, upon arrival the SecAnalysis team was immediately headed off by RaffCon conspirators Adam Ely and John Terril who brought back up in the form of possible Raffcon sleepers Vincent Liu, managing partner of Stach and Liu and S. Rose, a well known security persona and Security Associate at Stach and Liu. It should also be noted that during the SecAnalysis visitation, it rained uncharacteristically in San Francisco for three full days. Has Ely and the RaffCon conspirators created some type of weather control machine? The SecAnalysis team can only speculate.

What is known is that the communication between Sima and SecAnalysis nearly ended Sima. Shortly after the SecAnalysis team arrival, Sima vanished. He was later found with enough of the chemical CH3CH2OH in his blood system to kill a small elephant. Fortunately, Sima has spent a lifetime building up a resistance to that very agent.

SecAnalysis Takes Action

With no other information SecAnalysis conducted indepth if not torturous interrogations of known players in an attempt to uncover the nefarious activities of codename ?RaffCon.? First up was Rafal Los himself. Below are the details of that interrogation….

?Hello Raf, I want to keep this cordial, please tell me what RaffCon is.?

?Interesting, but what is RaffCon??

SecAnalysis team leaves the room and returns after a half hour. ?Raf, we spoke with Caleb, he told us everything, would you like to tell us of your involvement? It could save you a lot of trouble.?

?Alright Raf, we tried to do this the nice way.? After four hours of waterboarding.

We were then forced to release Rafal Los because of of Geneva conventions. Attempts to question other players including Michelle Schafer yielded similar results.

At this point the SecAnalysis team had no other choice but to burn asset Caleb Sima. At great personal risk, Caleb got into contact with SecAnalysis directly. At first Caleb was not willing to give up information, however, after he was notified that a speculative blog post would be made public regardless of a lack of real information he divulged a highly sensitive piece of information…

The conversation was immediately cut short–the SecAnalysis team has not heard from him since. It seems as though the trail ends here, We encourage our readers to keep asking questions…questions like:

Where is Caleb?

What is so secretive that a public relations rockstar could be silenced?

Are Rose and Liu RaffCon sleepers?

Do Terril and Ely have some type of weather control machine?

What is going down at Source Boston?

WHAT…is RaffCon?

ShmooCon Wrap-Up

Over the past three years I have attended rougly 25 security conferences and events. In each of those, I believe I may have been searching for ShmooCon 2010. In spite of multiple adverse conditions, ShmooCon was quite simply the best run, most worthwhile (from a learning perspective) event that I have attended to date. If for no other reason, ShmooCon 2010 was a rare celebration of computer security expertise and passion that is often lost in the overcrowded, diluted conferences that seem to have taken hold of the security industry.

The awesome qualities of ShmooCon could not be out done by the 20 inches of snow that covered the Wahsington DC metro area where ShmooCon was held. Despite the unforgiving weather, to my knowledge all the speakers, with the exception of Josh Coremann who telecommuted, were able to attend the event. Furthermore, despite canceled flights, train arrivals, and bus trips, only 100 attendees were unable to make it into the DC area. These figures are incredible when one considers the severity of the weather situation which the media has laughingly labeled ?Snowpocalypse.?

Smooth sailing in spite of adversity is not however what made ShmooCon an incredible conference. What made ShmooCon an incredible conference was the attendees. The ShmooCon attendees mirrored what I have always pictured DefCon attendees to be. This is not to say that the level of expertise of DefCon attendees is not superb, but rather to say that the elite are diluted by the indifferent. ShmooCon on the other hand seemed to house a higher potency of the passionate than the indifferent and more of the knowledgeable than the curious. Granted, ShmooCon 2010 hosted roughly 1,500 attendees compared to DefCon 17?s nearly 10,000.

The significantly lower attendance of ShmooCon was not due to demand however, but rather more due to exclusion. ShmooCon does ticket sales a little bit different than most other conferences. Specifically tickets are limited and while ShmooCon could have brought in more money by allowing more attendees, they kept the figures down to 1,500. This meant that, with few exceptions, only people particularly driven to attend were able to get tickets. In fact, in each round of ShmooCon ticket sales sold out in minutes.

As a direct result of the relatively exclusive nature of the event, the level of conversation seemed higher and the ratio of vendor marketing to security practitioners seemed just about right. Finally the content of the talks was fantastic, although I still think my tracking and profiling talk shouldn?t have been an alternate (I?m just saying). ?Granted the content was probably not on par with the likes of BlackHat DC, however, that is also a $200 ticket versus a $1,095 conference pass comparison. All things considered ShmooCon was fantastic, so kudos to the Shmoo Group, I?ve been a fan since Rouge Squadron J keep up the good work!

A Few Highlights

The highlighted presentations may still be purchased on DVD or some may still be available on http://www.ustream.tv/recorded/4538594

• Hacking Sleep Cycles
• Social Zombies II: Your Friends Need More Brains
• Learning By Breaking: A New Project For Insecure Web Applications
• Jsunpack-Network Edition Release: Javascript Decoding and Intrusion Detection
• 0wn the Con
• Just walking around talking to people

Forget the Spoon there is No Solution

Perhaps it’s all the talk about Advanced Persistent Threats (APT’s) or the arguements over sophistication, heck maybe it’s just because it’s after the holidays and I have some kind of security industry seasonal depression–but I can’t deny that my disenchantment with the security community is at an all-time high at the moment. In fact the realization is setting in that the career of a security professional is one that will be defined by the minor victories in our overall defeat. Security professionals are Michael Spinx and we’re in the ring with Tyson. The only difference is that we’re not going to get put out of our misery in one round…it’s going to be a long affair. That is of course unless we actually learn something from organized attacks like Titan Ra–errr I mean organized attacks like Operation Aurora.

To be clear I’m not talking about learning lessons from a technical or internal process perspective, rather I’m talking about learning how, as a community, we can work to better handle these types of scenarios. My own personal perspective is that the community as a whole has lost sight of what the overall goal is and how we must ALL function together to accomplish that goal. This view is exacerbated by the multiple questions that have been left in my mind by incidents such as Operation Aurora. Again let me stress that I’m not talking about anything from a technical or internal process perspective but rather pointing out the multiple questions that continue to go unanswered by the community as a whole. Questions such as: isn’t this the exact type of real-world event that drills such as Cyberstorm were supposed to prepare us for? Why, with our multiple upon multiple information sharing venues does it seem like everyone is running so frantic and misinformed? and most important in my mind, as a community are we trying to market security or are we trying to ensure it?

The truth is, that I don’t have a definitive answer to these questions. What I do know is that when most of the community is looking to vendors like McAfee and Symantec for answers it doesn’t help when one vendor calls the event a “Watershed Moment In Cybersecurity” and the other rates the risk as very low. In my personal opinion, which is supported by researching multiple responses to the event and conducting a source code analysis on the IE 0day exploit, I would personally say it’s somewhere in between, at a medium. On the one hand it is certainly not a “Watershed Moment In Cybersecurity” the details of the event that make it distinct are extremely similar to the Titan Rain incident of 2003. The only real difference between the distinct details of the two events is that Titan Rain really only targeted US government and defense contractor infrastructures, while Operation Aurora has targeted multiple industrial segments. Put simply, Operation Aurora makes for a better marketing message. On the other hand, the attack used an evolving IE 0day exploit and leveraged three pieces of malware working in concert together. The risk is not “very low”.

The bottom line is this, security events such as Operation Aurora can be detected early if not ototally prevented but the security community as a whole needs to make major changes. Vendors need to stop selling snake oil and vaporware, while security teams need to do a better job of information sharing. The only problem is that no one seems to know how to do this, so at the end of the day the problem is not the attackers, it’s the defenders and unfortunately there is no solution in sight.

ShmooCon Picks

Nothing gets me more excited professionally than the opportunity to go to a good conference. If nothing else, I relish the opportunity to surround myself with others who are as passionate for information security as I am. Unfortunately, while I have experienced a number of conferences in my six years as an information security professional, I have no as of yet experienced a ShmooCon. This year I decided to change that trend.

I will be spending three full days at the Marriott Wardman Park soaking in all the infosec information I can find with the other ShmooCon attendees who successfully battled for tickets. Find me for some cool swag and be sure to attend the Fire Talks, I might be speaking (I’m the first alternate).

Friday

1600: GPU vs CPU Supercomputing Security Shootout

1700: Economics Of Cybercrime

1800: Learning By Breaking: A New Project For Insecure Web Applications

18:30 Guest Stealing…the VMware Way

Saturday

1000: Jsunpack-Network Edition Release: Javascript Decoding and Intrusion Detection

1100: Social Zombies II: Your Friends Need More Brains

1600 BaS04: A Dynamic Dataflow Tool For Auditing and Reversing

Sunday

1000: PCI an Extistential Threat To Security As We Know It

1200: 0wn the Con

An Underlying Message from Operation Aurora

Looking past the hype surrounding the IE 0-day that was utilized in Operation Aurora, is it all that different from other attacks in the past? Not at all. In fact if?one were to look a little closer at what is actually delivered to the victim, it is blatantly obvious that this is an attack. From the large unescape variable that is clearly percent encoded hexidecimal values (and probably shellcode) to the padding in the form of the repeated 0c 0d. These are characteristics of exploits that the security community has been dealing with for the past four years and not of a sophisticated new threat!?In fact, existing IPS signatures were capable of triggering alerts on the attack itself. For example, ISS Proventia IPS devices would have raised at least six alarms should this IE 0-day have crossed a sensor. Why then does the security community find these attacks so frightening?

My own personal perspective is it is because the attackers showed an advanced level of sophistication beyond what most security professionals will ev er achieve in their careers. The security community today is saturated with professionals who may have never even witnessed a computer compromise, let alone truly understood one.?For the most part security professionals do not know how to hack and to a large extent do not know how to code. While they might understand the basics of a buffer overflow or SQL injection from a theoretical level, in a real world situation the average security professional would not have the slightest idea how to actually infiltrate an application or network. Thus, when security professionals are enlightened to the level of sophistication held by their opponents it is frightening. Even more so when jazzy labels like, Advanced Persistent Threat (APT) or “Operation” are applied to an incident. Terms such as these insinuate battle and make people feel threatened by something they do not truly understand and like so many other things, what people do not understand, scares them.

So while I do encourage decision makers to allocate more budget towards the products and services that will better protect them from attacks like Operation Aurora, I also encourage them to recognize the need for better understanding. Particularly, I encourage them to realize that ten people with certifications may not be worth a single person who understands the COND field of a microword, or rather someone with a deeper level of knowledge. For the rest of the security community, I would encourage them to recognize that with the saturation of what qualifies as a security professional, the endless pursuit for knowledge in this field is invaluable. If a cyberwar does truly exist, then it is not a battle of what was hacked and what was secured, but rather an intellectual competition the likes of which have not been seen since the space race. And for those frightened by the events that took place in Operation Aurora, I offer for comfort the fact that in this intellectual race, the good guys are not behind, just saturated. | An Underlying Message From Operation Aurora