First time at RSA Conference? How to have the most fun. #RSAC



Tweet

I'm missing RSA this year. :( 

My rude advice to one of our less senior guys. I think this works for nearly everyone except the Sales guys. Sorry Sales guys.

I would pack your typical office clothes. Khaki/grey/black pants. Dress shirts (not white) or Polos are best. Definitely no ties.

There will be lots of guys in suits. Those guys are all Sales guys. Avoid them unless they are from something you use or you really want info about.  Unless, of course, they are handing out invites for after parties.  

You identify yourself as a potential customer (and get invites to parties and dinners) by not looking like another Sales guy. 

There will also be guys that look like they run the EFF and just left DefCon or CCC. You know what I mean.  Those guys will have either sandals with socks or Doc Martins. They either don't own a comb or don't care.  Embrace these guys and engage with them. They are usually the smartest guys there and have tons to tell you and killer stories. That said, Sales guys think they don't actually plan to buy anything, so they don't get invited to parties, except maybe to add some credibility to the company. You don't want to be identified as those guys either. 

If you connect with any wireless network check it out beforehand.  RSA typically provides one. It will be well advertised.  Don't get suckered in to using anything that you aren't sure about.  Right now, remove all of the default wireless networks (linksys, dlink, etc.) SSIDs from your phone and laptop. There are security "researchers" who will set up rouge networks and will snag all the Sales guys.  Who knows what they plan to do.  Not as bad a DefCon or CCC, but still…

Last advice.  Set up a Google Voice number and only hand that out when asked for it by Sales guys.  Don't plan to ever use that number again.  If you can, change the phone on your registration as well. You will get inundated with calls for years after the show if you give them your desk number.  All the companies buy the lists of attendees and contact everyone.  They are pretty adamant that they need to talk to you and demo their stuff.

Have fun!  Send me some pictures.

Google Mobile-Friendly Test



Tweet

This is very helpful.
https://www.google.com/webmasters/tools/mobile-friendly/

VA Secretary Robert McDonald apologizes for misstating military record - The Washington Post



Tweet

You can be outraged if you can state, without looking it up, the difference between Special Forces and Rangers. How many of us can do that?  Some Special Forces don't think this is that big of a deal either. 

From the article:

Wood quoted retired Army Col. Gary Bloomberg, a former Special Forces commander, calling McDonald's claim "a boneheaded statement." But Bloomberg said he and other former special ops officers did not consider it as egregious as some other misrepresentations.

"No one got really crazy about the whole thing, compared to some of what we've seen," he told the Huffington Post. "It's a lot different from guys running around faking their special forces credentials. … I can see [other former special forces soldiers] going, 'Hey, check out this boneheaded remark,' but I don't see the gravitas that I would with a guy wearing medals he didn't earn.'"

More:
http://www.washingtonpost.com/news/morning-mix/wp/2015/02/24/report-va-secretary-robert-mcdonald-apologizes-for-misstating-military-record/

What Good is Tor in 2014?



Tweet

Tor is not a privacy slam dunk. #NewAmCyber

It's probable, especially in the wake of the recent NSA revelations, that government agencies such as the NSA and CSIS sniff traffic on many exit nodes.


More:
http://resources.infosecinstitute.com/good-tor-2014/

Replacements - The Ledge Lyrics



Tweet

I have heard this song at least a thousand times, but I've never looked at the lyrics.

Wow. Strong and sad. I think I knew that kid.

I'm glad I was able to get tickets today.

See you guys in DC in May.

http://www.metrolyrics.com/the-ledge-lyrics-replacements.html

Jeb Bush just revealed the social security numbers of a bunch of former constituents



Tweet

Dear "eGovernor" Bush,

Privacy protection is an important part of the job. Who is your security officer? You have a security officer, right?

In a ham-handed effort at transparency, the likely 2016 Republican presidential candidate Jeb Bush just released a trove of emailsfrom his time as Florida's governor—but the emails included confidential messages, personal information and even social security numbers from thousands of people. What was he thinking?

The un-redacted email dump was first identified by the Verge, which found emails that, among other things, discussed the firings of public employees. In some emails, petitioners sent their social security numbers to Bush, who was famously responsive to email inquiries from his constituents.

More:
http://qz.com/342126/jeb-bush-is-apparently-not-the-cyber-security-candidate-for-us-president/

I was quoted in an FCW article on mobile device security.



Tweet

Striking a balance with mobile device security

Agencies face a delicate balancing act when it comes to providing mobile security.

On the one hand, IT departments seek to extend endpoint security to a growing population of mobile devices. It's easy to see why: Smartphones can go missing along with agency data, and mobile devices in general can introduce malware to enterprise networks. On the other hand, employees want the ease of use of consumer technology, and agency managers covet the potential productivity boost.

More:
http://fcw.com/articles/2014/12/08/striking-a-balance-with-mobile-device-security.aspx

Fitbit ChargeHR



Tweet

Best Alternatives to Tor: 12 Programs to Use Since NSA, Hackers Compromised Tor Project



Tweet

Here are a list of programs you can use now that Tor has been breached (Note that some of them like Disconnect and Peerblock are not full-scale replacements for Tor and Tails uses Tor):

More:
http://www.idigitaltimes.com/best-alternatives-tor-12-programs-use-nsa-hackers-compromised-tor-project-376976

New CISSP Domains



Tweet

CISSP Domains, Effective April 15, 2015

• Security and Risk Management (Security, Risk, Compliance, Law, Regulations, Business Continuity)
• Asset Security (Protecting Security of Assets)
• Security Engineering (Engineering and Management of Security)
• Communications and Network Security (Designing and Protecting Network Security)
• Identity and Access Management (Controlling Access and Managing Identity)
• Security Assessment and Testing (Designing, Performing, and Analyzing Security Testing)
• Security Operations (Foundational Concepts, Investigations, Incident Management, Disaster Recovery)
• Software Development Security (Understanding, Applying, and Enforcing Software Security) 

More info:
https://www.isc2.org/cissp-sscp-domains-faq/default.aspx

Crews maintaining 450 ICBMs had just one wrench with which to attach nuclear warheads



Tweet

Staff at bases in North Dakota, Wyoming and Montana had to send the toolkit to each other via FedEx, the review found. Mr Hagel said that problem had now been rectified.

Inspectors reportedly ignored the fact that ageing blast doors at nuclear silos would no longer seal shut.

On staffing, the reviews found that a culture of micromanagement and extreme exam-testing distracted from major problems with equipment and nuclear readiness.

More:
http://m.bbc.com/news/world-us-canada-30051468

Sony Kept Thousands of Passwords in a Folder Named "Password"



Tweet

I especially like ALL_SSL_Certs_2012.xlsx!

The second trove of data snuck out sometime yesterday, and it didn't take long for Buzzfeed to stumble upon the Facebook, MySpace (an ancient form of Facebook), YouTube, and Twitter "usernames and passwords for major motion picture social accounts." Likely due to the fact that they were saved in a huge file called "Password." Which contained even more passwords called things like "Facebook login password." So they would know that that was the password. Because who needs encryption or security or common sense or even the vaguest attempt at grade-school level online safety.

More:
http://gizmodo.com/sony-kept-thousands-of-passwords-in-a-document-marked-1666772286

Cheap Black Friday Android tablets: Security threats found



Tweet

"Bluebox Labs purchased over a dozen of these Black Friday 'bargain' Android tablets from big name retailers like Best Buy, Walmart, Target, Kmart, Kohl's and Staples, and reviewed each of them for security," the company wrote on its blog. "What we found was shocking: most of the devices ship with vulnerabilities and security misconfigurations; a few even include security backdoors. What seemed like great bargains turned out to be big security concerns. Unfortunately, unsuspecting consumers who purchase and use these devices will be putting their mobile data and passwords at risk."

More:
http://bgr.com/2014/11/26/cheap-black-friday-android-tablets/

New Attack Method Can Hit 95% Of iOS Devices



Tweet

FireEye recommends that organizations warn users to protect themselves three ways. One, users shouldn't install apps from third-party sources other than Apple's official store or an enterprise app store. Two, users shouldn't click on install buttons on a pop-up from third-party web pages. Three, if iOS shows an alert with an "Untrusted App Developer" warning, users should click "Don't Trust" and uninstall the app immediately.

More:
http://www.darkreading.com/new-attack-method-can-hit-95--of-ios-devices/d/d-id/1317359

IAF asks personnel not to use Xiaomi phones



Tweet

IAF personnel and their families have been asked to desist from Chinese 'using Xiaomi Redmi 1s' phones as these are believed to be transferring data to their servers in China and could be a security risk.

"F-secure, a leading security solution company, recently carried out a test of Xiaomi Redmi 1s, the company's budget smartphone, and found that the phone was forwarding carrier name, phone number, IMEI (the device identifier) plus numbers from address book and text messages back to Beijing," says an advisory issued by the IAF to its personnel.

The IAF note, issued some weeks back, has been prepared by the intelligence unit based on the inputs from Indian Computer Emergency Response Team (CERT-In), according to IAF sources.

More:
http://m.timesofindia.com/india/IAF-asks-personnel-not-to-use-Xiaomi-phones/articleshow/44926994.cms

New Fitbit activity tracker release, price, specs, new features



Tweet

Here we look at what to expect from the next Fitbit tracker, when it will be available, and what it will cost. We're basing our report on the latest rumours and leaks, historical data, rival trackers, and recent Fitbit trademark applications for a Fitbit Surge, Fitbit Charge and PurePulse. In what may be no coincidence, just weeks after the razzmatazz unveiling of the Apple Watch, first Gizmodo then The Verge suddenly get leaked information each on one of the new trackers.

New Fitbit Charge and Charge HR trackers: new features – Force replacement and heart-rate monitor

More:

http://mobile.pcadvisor.co.uk/features/gadget/3531709/new-2014-fitbit-surge-charge-activity-tracker-release-date-price-specs-features/

This POODLE bites: exploiting the SSL 3.0 fallback



Tweet

SSL 3.0 is nearly 18 years old, but support for it remains widespread. Most importantly, nearly all browsers support it and, in order to work around bugs in HTTPS servers, browsers will retry failed connections with older protocol versions, including SSL 3.0. Because a network attacker can cause connection failures, they can trigger the use of SSL 3.0 and then exploit this issue.

Disabling SSL 3.0 support, or CBC-mode ciphers with SSL 3.0, is sufficient to mitigate this issue, but presents significant compatibility problems, even today. Therefore our recommended response is to support TLS_FALLBACK_SCSV. This is a mechanism that solves the problems caused by retrying failed connections and thus prevents attackers from inducing browsers to use SSL 3.0. It also prevents downgrades from TLS 1.2 to 1.1 or 1.0 and so may help prevent future attacks.

More:
http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiting-ssl-30.html

Truly scary SSL 3.0 vuln to be revealed soon: sources



Tweet

Gird your loins, sysadmins: The Register has learned that news of yet another major security vulnerability - this time in SSL 3.0 - is probably imminent.

 

Maintainers have kept quiet about the vulnerability in the lead-up to a patch release expected in in the late European evening, or not far from high noon Pacific Time.

 

Details of the problem are under wraps due to the severity of the vulnerability.

 

To that end it is unknown what platforms were impacted, but as SSL is very widely used any flaw will require plenty of urgent attention ... and probably be unwelcome news to a tech community already reeling from the recent Shellshock vulnerability in Bash and the Heartbleed flaw.

 

The SSL flaw won't be the only thing keeping security bods and system administrators busy. A dangerous worm has been discovered exploiting a zero-day flaw (CVE 2014-4114) in all versions of Microsoft Windows and Server 2008 and 2012.

 

From:

http://www.theregister.co.uk/2014/10/14/nasty_ssl_30_vulnerability_to_drop_tomorrow/?mt=1413288787389

DEFCON Router Hacking Contest Reveals 15 Major Vulnerabilities



Tweet

According to the rules of the contest, an entry wasn't considered valid unless the contestant also showed proof of disclosure to the manufacturer. Here's a full list of routers in which 0-days were reported in Track 0, along with our current understanding of the fix in progress:

• ASUS AC66U; reported, but no response from the manufacturer.
• Netgear WNDR4700; reported, but no response from the manufacturer.
• D-LINK 865L; reported, and manufacturer confirms it is working on a fix, currently in beta.
• Belkin N900; reported, and manufacturer acknowledgedbut was unclear on providing a fix.
• TRENDnet TEW-812DRU; reported, and manufacturer claims all reported 0-days are fixed.
• Actiontec Q1000; reported, and manufacturer acknowledged the report.

For details please see the full contest results.

More:
https://www.eff.org/deeplinks/2014/08/def-con-router-hacking-contest-success-fun-learning-and-profit-many

OMB gives DHS new powers to scan some civilian agency networks for cyber threats



Tweet

OMB added this new requirement for DHS to scan civilian agency networks in the aftermath of the Heartbleed vulnerability. During that time, DHS had to get permission from agencies to scan their networks, which delayed its mitigation strategy by a few days.

DHS made it clear in May during a House hearing that it needed Congress to give it more authorities to scan agency networks.

Andy Ozment, the assistant secretary of the Office of Cybersecurity and Communications in DHS, told Federal News Radio in an interview before OMB issued the FISMA guidance that when DHS doesn't have the explicit authorities that it needs and Congress wants them to have, it makes everything harder.

More:

http://www.wtop.com/893/3715204/OMB-gives-DHS-new-powers-to-scan-some-civilian-agency-networks-for-cyber-threats