Why do Smartphones make great Spy Devices?

There has been extensive, emotional political debate over the use of shadow IT and misuse of mobile phones in sensitive areas by former US Secretaries of State Colin Powell and Hillary Clinton. There is a much needed and very complex discussion we must have about executive security awareness and buy-in, but due to extensive misinformation I wanted to briefly tackle the issue of bringing smartphones into sensitive areas and conversations (and why that’s something that is our responsibility to educate our leadership to stop doing).

This should not be a partisan issue. It underscores a pervasive security issue in business and government: if employees perceive security controls inexplicably inconvenient, they will try to find a way to circumvent them, and if they are high enough level, their actions may go unquestioned. This can happen regardless of party or organization, and in the interest of security, information security professionals must try to discuss these cases in a non-partisan way to try to prevent them from reoccurring.

That being said, let’s talk briefly about why carrying smartphones into any sensitive business or government conversations matters, and is a particularly bad habit that needs to be broken.

There are two things to remember about hackers. The first is that we’re as lazy (efficient?) as any other humans, and we will take the path of least resistance to breach and move across a network. Instead of uploading and configuring our own tools on a network to move laterally and exfiltrate data, we will reach for the scripting and integrated tools already available on the network. In doing so, smart hackers accomplish a second and much more critical objective of limiting the number of detectable malicious tools in an environment. Every piece of malware removed from an infiltration operation is one less potential antivirus or intrusion detection system fire, and one less layer of defense in depth that is effective against hackers. An intrusion conducted using trusted and expected  administrative tools and protocols is very hard to detect.

These same principles can apply to more traditional audio and video surveillance. In the past, covert surveillance devices had to be brought into a target facility via human intervention (for instance, brought in by an operative, a bribe, or covertly planted on a person or delivery). The decades of history (we know) about bugs is fascinating – they had to be engineered to pass through intensive security measures and remain in target facilities without notice. In the pre-transistor and the early era of microelectronics, this was a complex engineering feat indeed.

Personal communication devices, and to a greater extent smartphones, are a game changer. Every function that a cold war -era industrial or military spy could want of a bug is a standard feature of the smartphones that billions of people carry everywhere. Most have excellent front and rear facing cameras. They have microphones capable of working at conference phone range. They have storage capable of holding hours of recording, multiple radio transmitters, and integrated GPS. James Bond’s dream.

More importantly than any of this, smartphones tend to be one of three major operating systems, which are commercially available globally and excruciatingly studied for exploits by every sort of hacker. Some of these exploits are offered to the highest bidder on the black market. Although the vulnerability of smartphone operating systems varies by age and phone manufacturer, each is also  vulnerable to social engineering and phishing through watering hole attacks, email, text message, or malicious apps.

Why expend the effort and risk to get a bug into a facility and conceal it when an authorized person brings such a fantastic, exploitable surveillance device in knowingly and hides it themselves? If the right person in the right position is targeted, they may not even be searched or reprimanded if caught.

There’s been a lot of discussion about countermeasures against compromised smartphones. Unfortunately, even operating inside a Faraday cage that blocks all communication is not effective because eventually, the phone leaves. A traditional covert device may not. As with the USB devices used to deploy Stuxnet, this trusted air gap is broken the moment an untrusted device can pass across it. A compromised phone can simply be instructed to begin recording audio when it’s cellular signal is lost, and upload the recording as soon as that connection is restored. Turning off the devices is also not particularly effective in the era of smartphones with irremovable batteries.

Yes, of course it’s still possible to put a listening device in a remote control or a light fixture. Surreptitious hacking tools used to compromise networks on site can still function this way. But why expend the substantial effort and risk in installing, communicating to, and removing them if there’s an easier way?

This is not to say it’s time to put on our tin foil hats and throw out our phones. Most people are probably not individual targets of espionage, and using smartphones with current updates and good security settings is decent protection against malware. However, there are people all over the world who are viable targets for industrial or nation-state espionage, either for their own position or for their access to sensitive people, information, or places. If you are informed by a credible authority that you may be targeted and should not bring your smartphone into a particular area, please take this advice seriously and consider that your device(s) could be compromised. If you suspect that there is another valid reason that you could be targeted by industrial or nation state espionage, leave your phone outside. It is generally far simpler to compromise your smartphone than it would have been to break into your office and install a listening device.

 

 

Starting an InfoSec Career – The Megamix – Chapter 7

 

Chapter 7: Landing the Job

So, we’ve come this far in your infosec journey. You’ve studied hard, attended conferences, played a CTF or two, updated your resume, and networked a bit within the information security community. Great work!

Let’s prepare for your very first information security interview.

 


=== What to Say ===

There have been nigh infinite pieces written on the subject of interviewing, but I’d like to briefly share some basic interview skills that have really served me and my candidates well:

  • Make sure spend at least 30 minutes researching the organization you will be interviewing at. What are their strategic goals or products? Where do they have offices? What’s their corporate culture like? Consider what interests you about their mission, and how you feel you could benefit them as a security professional.
  • Always bring several printed copies of your resume and references to your interview, formatted the way you intended. HR systems will often remove formatting and line breaks before routing your resume to a hiring manager, and your copy may be more pleasant to read. You will also want a copy to reference, yourself.
  • Bring note taking materials to your interview, and make sure you’ve written down a few relevant questions to ask your interviewers about the position and the organization.
  • Arrive 15 minutes early for your interview, and be polite to everybody you meet. You never know if the person you make eye contact with and say “good morning” to in the hall will be interviewing you, later.
  • Make eye contact, and pay attention during the interview. Most of us are introverts, and this can be a challenge. Make the effort to be personable and show that you are listening to your interviewers.
  • Put your phone away and on silent. I shouldn’t have to say this.
  • Answer questions honestly. Most of my colleagues and I would very much prefer, “I’m not sure”, to an evasive answer or an outright lie, particularly on technical questions. Often, knowing where you would look something up is an okay answer to a technical question. When we ask you questions about where you could improve, there should be a real response that verifies you are a human. Everybody has some area they can improve in, and we will never believe you’re utterly perfect.
  • The initial interview is not normally the appropriate place to ask about compensation. Yes, infosec is an understaffed and in demand field. You have better chances than most at landing the job. No, your Masters in Information Security does not guarantee you the position immediately in lieu of a technical interview.
  • Do talk about your (legal) infosec-related hobbies and activities! We want to hear about the security lab you built in your house, the book you read, the CTF that you participated in, or the security related talks and projects you’re participating in. They show you are an interested and involved candidate, and a good fit for our teams.

 

 


=== What to Know ===

The previous chapters in this blog series suggested ways to build your foundational skills in the key areas of networking, systems administration, and security, so I won’t dwell too much on the necessity of knowing the fundamentals of these things such as common ports and protocols, malware types, and operating system functionality in an entry level infosec interview. Suffice to say, this is where the free educational resources, formal training, and your home lab really come into play.

You should ensure, before going to an interview, that you are up to date on the basics of current threats and security news. What you learned at your university is almost certainly not current enough for most interviews. There are a lot of great resources that provide information on ongoing threat activity. For instance, I really like the exploit kit status dashboard at (ProofPoint) EmergingThreats. SANS ISC posts botnet and scanner activity from publicly submitted data, and Sophos posts a nice free malware dashboard that shows their overview of currently detected malware. Threat trackers, coupled with the blogs, news services, and educational resources we’ve previously discussed, should enable you to go to your interview ready to answer general questions about the top threats that are currently plaguing organizations.

 


=== What Not to Say ===

 

 

In May, I surveyed a broad swath of security professionals to share the statements they hear from interview candidates that are the most indicative that the person is inexperienced in professional information security work. I’d like to share a few of the most popular, and why they carry that connotation. Keep in mind, the selected statements by candidates aren’t necessarily technically wrong; they more often tend to oversimplify or ignore administrative and business-related problems in security. It would be wise to choose your words diplomatically before saying any of the following things:

“Antivirus is obsolete, and a waste of money! Get rid of it.”

We can’t all be Netflix, dramatic headlines or not. It’s true that antimalware programs have a lot of problems to contend with in the 2010s. Between a cat and mouse game with well-funded malware authors, and polymorphism and regular botnet updates, simply maintaining a library of static signatures is indeed not effective anymore. Most decent antivirus vendors recognize this, and have implemented new tactics like heuristic engines and HIPS functionality to catch new variants and unknown threats. Antivirus is one component of a solid ‘defense in depth’ solution. It has a reasonable potential to mitigate a percentage of things that slip past network IPS, firewalls, web filters, attachment sandboxes, and other enterprise security solutions.

“Why are you wasting money on $x commercial product? I can do the same thing with this open source project on GitHub”

We love the philosophy and price tag on open source projects, and it’s great that commercial vendors have open source competition that drives them to improve and enhance their products. This doesn’t mean that free tools are always a viable replacement for commercial tools in an enterprise environment. There are intangible things which usually come with the purchase of a good quality commercial security product: support, regular updates, scalability, certifications, and product warranties. Those intangible things can have a tangible cost for an enterprise implementing an open source product in their stead. For instance, the organization may have to hire a full time developer to maintain and tweak the tool to their needs and scale. They may also be solely legally liable if a vulnerability in free open source software is exploited in a breach – a risk many organizations’ legal teams will simply not accept.

“They deserved to get breached because they didn’t remove Java / Flash / USB functionality / Obsolete Software…”

Most organizations exist to provide a product or service, and that’s usually not “security”. As security professionals, we’re just one small part of our organizations and their mission, and we never function in a vacuum. Oversimplified assertions like this are a dead giveaway that a candidate is not used to compromising and negotiating inside a business environment. Yes, in an ideal security world, we would use hardened operating systems with limited administrative rights and no insecure applications. Few of us actually operate in that ideal world, and many of us work at an operational scale alone that renders this unfeasible. We do what we can; navigating the political risk management game where we must to provide the most secure environment we are capable of.

“Just block China/Russia/x… IPs.”

Once again, this indicates a candidate is thinking only as a security person (and a biased security person) and not as a member of a business. Unfortunately, it also shows a lack of technical knowledge, as many attackers use large, global networks of compromised hosts to launch attacks.

“Security Awareness is a waste of money. Users will always be stupid.”

This is an appalling lack of confidence in your own ‘team’. Yes, some end users will probably always click / ignore / fail to report. (Most security people will also click when properly socially engineered.) The point of security awareness is not to create a perfect environment where nobody ever clicks on a phishing message or ignores an alert window – if your management has made that their measure of success, they’re doing security wrong. The point of security awareness is to improve awareness of threats, encourage some employees to report potential threats so you can respond, and decrease day to day problems so you can focus on the more severe ones.

“[Fortune 100] should have already have gotten rid of $OS and gone to $OTHEROS, because it’s more secure / real security people use $OTHEROS.”

This is dogmatic elitism without real business or technical foundation. Any up-to-date operating system can have a valid use case in business and in security work. A good red team or blue team security professional should be able to secure, compromise, and use tools on OSX, Linux, and Windows effectively (and indeed, there are valuable tools unique to each). It’s okay to have an operating system preference and to intelligently discuss the merits of $OperatingSystem for your specific use case. Don’t assume everybody else’s use case is the same.

“Hack them back / have the attackers arrested…”

We all crave the movie ending where the black hat hackers get their comeuppance and are thrown in jail. Unfortunately, unless we work for a LEO, the military, or a huge global telco, we’re rarely likely to get it. “Hacking back” of any sort is usually wildly illegal (especially because attacks are almost always launched from compromised hosts that belong to law-abiding people). Arrests happen when time-consuming coordinated efforts between security firms, global law enforcement, and lawyers are successful. Even the terrifying financial spearphish to your CFO is likely to not be chased down by law enforcement for some time. When permitted, absolutely do share your threat intelligence with law enforcement and working groups to aid in these important efforts. Expect any response received will take significant time.

“Don’t you monitor every brute force attempt against your perimeter? I count the dictionary attacks against my honeypot every night!”

No, monitoring this would be a waste of time in most large organizations. Behavioral trends and specific sequences of events that could indicate a compromise are more valuable to monitor. Time is money.

Any statement beginning with, “Why don’t you just…?” or “It’s simple…”

It pretty much never is that simple, so don’t personally insult your interviewer by assuming it is
.

 


***

This concludes the InfoSec Career Megamix! I hope you’ve enjoyed this blog series and that it has been helpful to you in furthering your own security career. Many thanks to everybody who has commented on my blogs or provided input and suggestions. Please do check out the links to other peoples’ wonderful work on the subject which I have included throughout the blogs.

[You can find the previous chapters in this blog series here:

The Fundamentals

> Education & Certifications

> Fields and Niches

Blue Team Careers in Depth

Red Team Careers in Depth

Self-Study Options]

InfoSec tickets for Veterans & Twitter Feed!

Hello all,

For the past year, I have reached out to twitter-folk for their spare and unwanted infosec con tickets they wished to donate to military veterans and military members interested in the field. I have made the decision today to formalize this into a website and twitter account, .

Why do I do this?

There is a collective misunderstanding in our society about military members. Although we may consider them to be heroes, valiant, and tough, the vast majority of charities and educational programs available to them after serving also presume them all to fit into specific blue collar professions after their enlistment or commission.

This is simply not the case. The military staffs almost every job seen in the civilian world, from cooks to network engineers. There are even infosec professionals, just like us, using similar tools and attending the same certification programs. The difference is, they are doing it on the military payscale and within military lifestyle restrictions, to benefit a larger cause.

To a junior enlisted military member working in IT or recently discharged from the military, with industry certifications and years of experience, a couple hundred dollars we might consider trivial can be an impossible roadblock to attending conferences and networking. We all know how absolutely critical attending these events can be to progressing in our careers. So why keep qualified people out over a trifling sum of money?

This Twitter account is made to reduce the isolation veterans may feel upon trying to enter the information security field. I will endeavor to RT and tweet programs beneficial to veterans and currently enlisted people,  as well as provide an informal operator service to connect people with spare infosec con tickets with veterans who want to attend the conferences.

This service will be best effort and a work in progress until I find others willing to volunteer time and effort to it. However, I believe this service fills a serious void between military and civilian IT security.

If you wish to donate a spare ticket or sponsor an attendee, please DM the account and I will relay this opportunity is available. If somebody requests the ticket, I will connect you to arrange transfer of ownership. I hold no liability for the transfer so please exercise caution and common sense.

If you are a veteran or military member who would like a ticket to a conference, please stay tuned to this twitter account and DM if you see a ticket that interests you (first come, first serve).

This service is on the honor system and I will only be spot checking military service. I can only ask for your honesty to maintain the account.

This account will not be accepting advertisement or promotional offers; corporate sponsorship for individuals is okay within reason.

[Off Topic] On Dealing with Completely Impossible Situations

dos

Just some non-infosec-specific thoughts regarding things I’ve learned about dealing with burnout, and the really bad days:

  • Steve, Diane, Kay, Erica, Bryan, and Anna taught me that sometimes you just find family when it’s needed. (Say yes to seeing your friends, even when you’re indescribably exhausted.)
  • Jack taught me to have a breakdown plan.
  • Col E. taught me that it’s not weakness to ask for help when you really need it.
  • Rance taught me that sometimes you have to put on the chicken hat and dance besides it all.
  • D.T. taught me that you can be lying there missing a leg in the hospital, then marry your nurse.
  • Johnny taught me that even on a really crappy day, a lightsaber battle is still okay.
  • Selena taught me that writing about the worst situations can help you face them (and help other people, too).
  • Reggie taught me that however messed up things are, it’s not too late to reconcile with people you fought with honorably, like a true samurai.
  • 60 hackers confirmed that our community is real, and if you’re not a dreadful person both the “black hat” and “white hat” people in it might send cards and books to a person across the planet who needs them, without prompting or asking questions.
  • Jodi taught me be unapologetically your own self, and keep fighting and screaming at what’s wrong in the world, even when the world is beating you down.
  • Two ER visits and permanent health damage have taught me that there are repercussions for not taking care of yourself under continual and intense stress.
  • Completely impossible situations taught me that you never really know what you’re capable of dealing with until you’re faced with one. Overcoming those obstacles are the memories you keep.

I hope someday when you are going through an impossible time, you can come back to this post and find some help and hope.

 

The Worst InfoSec Resume, Ever

I do quite a bit of InfoSec résumé reviewing and critiquing, both personally and professionally, so I’m repeatedly asked for tips on common problems. In order to ensure that these problems were not exclusive to me, I recently had a lengthy discussion  with a number of InfoSec professionals involved in hiring (thank you!). We discussed our “top 10” pet peeves when reading candidates’ résumés.

So without further ado, here is an illustrated example of some common problems we see on many résumés, and some suggestions about how to fix them.

(If these images are hard to view on your phone or at a specific resolution, you may click them to view them full screen.)

file-page1

file-page2

The Top 9 Ways I Found Your ‘Secret’ Dating Profile

  1. You reused a cute username (or email address).

Aliases and usernames have become a big part of our personal online presence, and we often feel tied to them when we register for new sites and services. This can be a great was to build an online identity, but it can also make it trivial to tie our activity on various services together.

Even if your registered username isn’t immediately visible in a dating profile, it’s often visible in the URL of your profile, your profile photo filenames, or during communication with other users.

There are plenty of free and paid services which search and monitor social media and email accounts by username. Pipl is a great example. It will rapidly scan popular sites and services for email addresses, usernames, names, and phone numbers to build a comprehensive profile of a person.image002

Namechk.com performs a broader sweep of services for usernames only, immediately flagging services where a particular username has been registered. This is an easy way for someone with malicious intent to draw connections between a dating site profile username and your ‘real’ life, even if your profiles are correctly private or hidden.

image004

The very simplest, a Google search will often turn up social media profiles, forum posts, and blog comments tied to a particular username. If you’re concerned about dating site matches finding your online presence, or people online finding your dating profile, just don’t reuse usernames or email addresses!


 

  1. You reused profile pictures.

A few years ago, image recognition on a large scale was restricted to law enforcement and corporate security. This isn’t true anymore. Free services like Tineye and Google Images will search billions of indexed images on the internet for identical or similar pictures. This isn’t necessarily traditional hash or metadata specific – cropping or resizing an image is not a foolproof way to defeat this (as I show in the screenshot below, where Tineye and Google correctly identified my profile selfie which is substantially cropped on social media). The photos are visually similar enough that the search engines’ algorithms can draw a connection.

image006image008

Ultimately, this means that if you are interested in privacy, you should never reuse a photo or set of photos that you’ve used elsewhere on the internet (at any time) on your dating profile. Choose where to use your glamour shots, wisely!


 

  1. You forgot to check and sanitize your pictures.

Reuse isn’t the only situation in which photos can compromise your privacy. There are two sets of clues that can give away important personal information in your photos. The first are old-fashioned visual clues. Consider: is there a window in your photos, and are there identifiable buildings or landmarks outside of it? Were your photos taken in an apartment building or dorm that can be easily identified in other people’s photos? I highly recommend reading this eye-opening blog on the subject by IOActive. Give some thought to what people can see in your photos’ backgrounds before posting them to your private dating profile.

The second way your photos can betray your privacy is a bit more technical, but still terribly important to recognize. It has to do with hidden information, or ‘metadata’, which is tacked onto most pictures by phones, photo editing software, and digital cameras. You can’t see EXIF metadata without using special tools, but it may contain startling amounts of information about where the photo was taken, by whom, and when. This exists primarily to help out professional photographers and photo storage tools.

image010

I took this pretty photo at Disney World. Let’s look at some of the data hidden inside of it:

Create Date                     : 2016:02:20 20:01:04
Make                              : Samsung
Orientation                     : Horizontal (normal)
Flash                               : No Flash
Focal Length                   : 4.3 mm
GPS Position                   : 28 deg 21′ 27.100″ N, 81 deg 33′ 29.71″ W

Even with location geotagging disabled in your camera settings, metadata still provides a tremendous amount of detail about you and your devices, and can even uniquely identify photos taken with your camera. (The use of photo editing tools also becomes blatantly obvious, which can be a cause for some embarrassment.) Ensure you remove identifying metadata from photos before posting them onto your dating profile.


 

  1. You forgot that the internet is forever.

If I were forced to pick only one error which causes dating site members the most personal embarrassment over the long term, it’s forgetting this. A single mistake made months earlier can haunt you. Let’s imagine that before reading this article you uploaded your professional headshot to your dating site profile. You realized a few days later that it was too much of a privacy give-away, and made the wise choice to switch to a new photo. You might not be out of the woods.

Search engines and archive sites are continually indexing as much content as they can from the internet. These sites retain cached copies of images and pages long after they are changed or erased at the original source.

Somebody with malicious intent may use this to their advantage when trying to correlate your dating profile to other web content. He or she will very likely check search engine caches for old pictures or bios that are easier to identify or contain embarrassing details. If that professional headshot is still in a cache associated with your dating profile, he or she can use Tineye to match it to your corporate bio that shares the same photograph. If you’ve changed your username, he or she may be able to find the previous version.

Unfortunately, this isn’t an easy thing to fix after the damage is done. The bottom line is: assume that anything posted to the internet is perpetual, and usually cannot be removed (even through legal action). If you post data which compromises your privacy or reputation to your profile, remove it immediately and consider starting fresh with an entirely new profile. If needed, pursue sites and search engines to remove what they can and will, and disassociate your online identity as much as possible from the content.


 

  1. Minor details tell a larger story about you.

This is open source intelligence 101. The individual facts and conversations you post on dating sites might not give away your identity, but as a collective whole, they may. Give some consideration to how much information you’re giving other users over time and as a whole. Did you post that you live in Milwaukee, tell a user that you live in an apartment with a pool, and tell another that you live next to an airport? These pieces of information put together say a lot more about your location than they do individually.

image012

Pay attention to details. How much information have you posted on your profile over time as you’ve updated it? How much information are you providing in private conversations with other users?


 

  1. Your social media profiles aren’t private enough.

The number one open source intelligence source that people with evil intent will try to use against you, or to identify you, is your social media profiles. You make a malicious person’s life significantly more difficult by simply locking down your social media profiles so that nobody except people you know personally can view them, or that the data that is publicly visible is not enough to provide the attacker an advantage.


 

  1. You joined your social media profile to your dating site account.

We’ve previously discussed the privacy risk posed by sharing photos, usernames, and email addresses between your private dating profile and the rest of your online presence. Linking your social media accounts may be a simple and timesaving way to create an account on many dating sites and apps, but these sites frequently import most of the data we’ve discussed above directly into your dating profile and account. Given all the points we’ve discussed previously, this is obviously not a wise choice.

I highly recommend using an entirely new and separate email account to sign up for a private dating profile. If the site in question absolutely requires linking a social media account, start a new one without unnecessary personal details.


 

  1. You forgot that social engineering (and catfishing) happen, and can happen to you.

No matter who you are, which gender you are, what you do for a living, or how much money you make, you can be a target for fraud or social engineering. Somebody who wants to manipulate or identify you on a dating site may attempt to gain your trust before drawing you into a trap. If something doesn’t feel right, it probably isn’t. If something seems too good to be true, it probably is. Be very cognizant of members leading you into revealing unusual personal details, compromising photos, or financial information. Dating sites are fair game to cyber-criminals.


 

  1. You weren’t aware that you were accepting risk.

Dating online, like the rest of our lives, carries some inherent risk. The level of risk associated with joining a dating site and interacting with others on that site varies by each individual’s situation. For example, this risk may be to your reputation if your profile (or behavior with other users) were publicized, or to your personal safety if your location or identity were compromised.

Online dating is a great option for many people and many healthy relationships exist today because of it. You must simply consider what level of risk you’re willing to accept before doing it. Even if you are meticulous in protecting your online presence, there will always be circumstances outside your control. What would the consequences be if the site were breached, and your identity and interactions were posted online or sent to your employer or family? If somebody successfully identified you, how easy would it be to find your street address or place of business? Like any other activity that carries some significant risk, you must consider these types of questions and make your own informed decision.

Starting an InfoSec Career – The Megamix – Chapter 6

[You can find the previous chapters in this continuing blog series here:
Starting an InfoSec Career – The Megamix – Chapters 1-3
Starting an InfoSec Career – The Megamix – Chapters 4-5]

Chapter 6: Self-Study Options

In the previous chapters, I’ve discussed potential career paths, education and certification options, and the fundamental knowledge needed to become a successful InfoSec professional. Unfortunately, college degrees and certification courses aren’t financially or logistically an option for everyone, nor do they provide all of the skills and practical experience needed to become a desirable candidate for an entry level position. Without further ado, let’s delve into some options for improving InfoSec knowledge individually.

==== Home Labs ====

Building a home practice lab is an integral part of improving skill at any area of blue team or red team information security. Since most of us (hopefully) don’t want to break the law and get arrested while learning how to hack, conduct forensic investigations, or reverse engineer systems, we’re obliged to create our own self-contained network environments to practice and learn within. This will also improve network and systems administration skills, which as I noted in Chapter 1 are absolutely fundamental for being a well-rounded InfoSec professional.

A decade ago, a home lab looked significantly different. It almost certainly included multiple computers, and likely a network rack complete with switches, power supplies, KVM, and cabling. While this is still a great option, a rack of computer equipment is noisy, hot, and power consuming. Today, we have the tremendous luxury of virtualization. A single reasonably spec’ed ESXi host server can act as most of our practice environment. While we might still opt for some physical network hardware, we have virtualized network lab environments available for use, as well. I really prefer the virtualized option because as we exploit, infect, and otherwise destroy our hosts, we can simply revert them to an earlier snapshot and start over.

Regarding purchasing the physical equipment or host machine(s), we can get as creative as our budget requires. A great way to purchase server grade computer hardware is via federal and state government auctions. These auctions are fairly underutilized next to commercial sites like eBay, and can offer some great deals during regular equipment replacement schedules. Remember that local businesses, hospitals, and municipal services often replace their hardware and sell the older equipment for a fraction of the original price. For virtualization, we’ll want a decent server grade processor, a lot of memory, and enough disk space for all the operating systems we are interested in using to grow as expected. Everything else is fairly negotiable. Many folks buy a few old servers of the same model, pull all of the memory, NICs, and hard drives out, and put them into one chassis.

The hosts we install in our lab environment shall vary quite a bit based upon our area of interest and what we’re currently trying to accomplish. For instance, in my forensics lab, I selected SIFT and Windows 8 hosts which I use to conduct analysis, and an array of primarily client OSes which I conduct analysis upon. My network monitoring and incident response environment is very different, because network services, network IPS, and firewalls are in play in a more realistic network environment. A penetration testing environment will look different still. Before you purchase equipment or begin the lengthy process of building your lab, consider what you want to learn, and what hosts and services you will need to accomplish this goal.

I’m not going to delve much further into the technical details of building out a lab, as a lot of people have done great writing on this subject already. I recommend looking at Carlos Perez, Matt Barrett, and Adrian Crenshaw’s informative blogs.

==== Self-Study Materials ====

Every person has a different learning style. Some of us are more comfortable learning new skills by watching a video; others need hands on practice or reading materials to understand new concepts best. Fortunately, at this point people who wish to learn InfoSec skills have a plethora of freely available options to fit any learning styles.

For the Visual Learner:

Years of talks at information security conferences have been recorded and are freely available on YouTube. I’d avoid watching Joe from ACME computer shop explaining how to use Kali, but there are more hours of recorded talks on from reputable conferences than anyone will ever have time to watch. Archive.org hosts an immense number of conference talks. Adrian Crenshaw has recorded talks at conferences for years, and has a prolific archive of these videos on his channel. SecurityTube is also a great resource, (although some of their materials are paywalled by PenTester Academy, which may or may not be in your budget).

For the Auditory Learner:

Check out the amazing range of InfoSec podcasts available for free. There are so many more great podcasts than I could discuss in a blog of their own, but some highlights are PaulDotCom, Southern Fried Security Podcast, Security Now, ISC Stormcast, Defensive Security, Liquidmatrix, and Braeking Down.

For the Reading Learner:

There are two major resources you should investigate – textbooks, and blogs. This will, of course, vary quite a bit based your area of interest. My personal ‘essential reading list’ for Information Security professionals would include the following:

There are an immense number of amazing security blogs out there, but a very short list of my favorites includes Dark Reading,  Krebs on Security,  McGrew Security, Graham Cluley, Naked Security, Lenny Zeltser, Troy HuntAndrew Hay,  Threatpost,  and Andy Ellis.

For the Kinesthetic Learner:

As we previously discussed, a home lab is a great option, followed by Capture the Flag exercises and Challenges, which I discuss in the next section.

==== Capture the Flag and Challenges ====

Once you feel ready to leave the safety of your own home lab and delve into another network, a great option is Capture the Flag events, and similar challenges. A large percentage of hacking conferences provide some kind of CTF event, which will pit your skills against challenges they’ve designed as well as other participants, in a structured, legal environment. The challenges usually vary from simple to extremely difficult, and points are awarded to participants as they find or reach ‘flags’ hidden in the challenges. Don’t be daunted; most CTF events are rarely restricted by skill level, and they’re a great way to test what you’ve learned. You’re competing against yourself as much as other teams or participants.

CTFs and challenges are not restricted to red team penetration testers. There are plenty of open and paid practice challenges in many areas available now, both in person and online. DFIR challenges test investigation and forensics skills, while malware challenges test participants’ ability to reverse and analyze malicious code. Check out the great list of online challenges at captf.com.

==== Conferences ====

There are no substitutes for in-person networking or training events. I strongly recommend attending InfoSec / hacking conferences, but I also encourage you to choose the right ones for you. Regrettably, the events with the biggest budgets often get the most hype. That does not translate to them being the best environments to learn in. Cost is often a factor that bears consideration, as well. Tickets to InfoSec conferences range from free (or nearly free) to thousands of dollars. Hotel and airfare costs vary by venue. All these factors should weigh into your decisions, but there’s a conference for everybody.

Hacking conference size and content vary a lot, but there are some commonalities. There are normally one or more tracks of speaker talks, selected by the organizers from outside call-for-paper submissions. Capture the Flag type events are fairly ubiquitous. It’s also not uncommon to see an option for longer, hands-on training classes for an additional fee. You’re likely to see some vendors, as well as hobbyist groups such as locksport organizations or makerspaces sharing their expertise. Evening parties sponsored by the conferences or vendors can provide an opportunity to network and have fun.

Let’s discuss a few popular conferences. A couple caveats. Firstly, I’m quite certain I am going to offend one conference or another by not listing them here – for this list I selected some better known representative examples and it is by no means comprehensive. Secondly, I’m based in the US, so my examples are primarily in North America. Hacking/InfoSec conferences are a global phenomenon, and the types of conferences I list have equivalents in Asia, Europe, Africa, and South America. Please feel free to ask me for assistance in finding ones in other locations as needed.

DEF CON – Las Vegas, NV, USA

One of the oldest, most famous, and largest hacking conventions in the world, DEF CON is held in August on the Las Vegas strip. The attendees are a mix of everybody from the most dubious black hats to corporate security professionals, from journalists to Generals, from researchers to federal agents. Events and talks run the full gambit in every sense of the word. The parties are wild and so are the attendees. DEF CON tickets current cost $230, (cash only!).

>> Pros: This is where you’ll see some of the most cutting edge research released, and meet many top notch pros. Everybody should DEF CON at least once, for the sheer experience.

>> Cons: Over-the-top parties, crowds, and hangovers can overwhelm actual learning and networking. If this is your first hacking conference, or you’re not reasonably cautious, you may be targeted for pranks (or worse).

BLACK HAT– Las Vegas, NV, USA

Black Hat (USA) occurs the week prior to DEF CON, and offers more structured training opportunities on a variety of topics. There’s a heavy vendor presence. Black Hat is more targeted towards security professionals and executives, and offers organized networking events and a bevy of courses and high profile speakers. The talks are well vetted. This doesn’t come cheap; regular tickets are currently $2195. Training courses cost significantly more. If money is a factor, I certainly wouldn’t recommend paying your own way to Black Hat unless there is a course you desperately want to take that isn’t offered anywhere else. Wait for a scholarship or corporate sponsor.

DERBYCON – Louisville, KY, USA

DerbyCon is a relatively new but very popular conference, and acts a bit like a more community and family-friendly alternative to DEF CON. It occurs in September in the heart of downtown Louisville. While it’s not as big of a conference, DerbyCon offers five simultaneous talk tracks, as well as hosting a few special interest working groups and CTF. DerbyCon tickets are $175, and given the reasonable cost of living in Lousiville, this can be a pretty economical conference, without quite as much of the shock value. Although there are bad apples at any hacking conference and basic precautions should always be taken by attendees, DerbyCon is policed pretty well and is a very safe bet for a first con.

SHMOOCON – Washington DC, USA

Shmoocon was founded by a husband and wife team to become a relatively small, friendly, community and education focused conference. It occurs in January, and costs $150, making it the most affordable of the ‘big name con’ admissions. Due to its location and educational reputation, it’s popular with federal government, military, and federal contractors, and the networking, vendors, and talks can reflect this a bit. The downside is that Shmoocon has grown much more popular than its size allows, and tickets sell out quickly – very quickly – a matter of seconds, making attendance a bit of a lottery. If you plan to attend Shmoocon, (I do recommend it), read up on the ticket purchase process well ahead of time.

RSA CONFERENCE – San Francisco, CA, USA

If you missed that RSA occurs in February, you’re not tuned into information security news. I can draw a lot of parallels between RSA Conf and BlackHat, but personally favor Black Hat as an event. They’re both targeted at executives and professionals, throw star-studded vendor parties, come with a hefty price tag (standard RSA tickets are currently $2,295), and get plenty of press. They have the biggest vendor expos, and often boast high profile speakers. I don’t recommend RSA to entry level infosec folks, even if the price tag is in your budget. For the money, I’d attend a course at Black Hat or REcon. The glitz and glamour do not make this the best environment to learn fundamentals or network, and despite some very good speakers, in my opinion RSA Conf continually commits public security faux pas to the ire of hackers and security professionals.

RECON – Montreal, QB, Canada

If reverse engineering malware, hardware, or software is your cup of tea, there’s no better conference to learn more than REcon, which focuses exclusively on sophisticated reversing. Ticket prices for RECon increase through the year leading up to the event, currently starting at 700 CAD and culminating in 1200 CAD in June. Student tickets are discounted. The ticket price is hefty, but includes snacks and lunches. The available hands-on training courses will run you around 2000 – 5000 CAD, so once again, you may want to wait until you’re eligible for some sort of sponsorship for this one. I have not had the pleasure of attending this conference myself, but I’ve heard nothing but glowing reviews from my colleagues in this space.

CIRCLE CITY CON – Indianapolis, IN, USA

Circle City Con is newer than Shmoocon and DerbyCon, but fills the same educational / community friendly conference niche. Circle City Con occurs in June, near the Indianapolis Convention Center. Tickets are currently $150 and include optional training classes, aside from any required materials. Circle City Con is another safe bet for a first conference, and for family participation.

HOPE – NYC, NY, USA

Hackers On Planet Earth is still a bit of a ‘hidden gem’. Although it’s one of the oldest annual hacking cons, it remains reasonably small and attended by industry greats. HOPE occurs in July, and tickets are currently $150. HOPE offers some of the most unique and varied events of any conference outside DEF CON, and boasts film festivals, art, and robotics along with the usual offerings. It’s a bit more eclectic and nuanced than other conferences. HOPE is worth serious consideration, especially for East Coast folks.

GRRCON – Grand Rapids, MI, USA

GrrCON specifically states their goal of avoiding elitism, and as a result they’ve earned a reputation as a positive and friendly environment which is heavily geared towards great networking and security education. GrrCON occurs in October and regular tickets are currently $150. Another location with very reasonable room and board, it would be a great choice for a first con. GrrCON also offers opportunities for family participation.

BSIDES EVENTS (Global)

Perhaps you looked at this long list of conferences, and balked at the locations, travel costs, and ticket prices. All is not lost. Seek out your local BSides event, which occur in many metropolitan areas. BSides events tend to be organized by local hacker groups, and most are one or occasionally two days. BSides also tend to be smaller and less expensive, with tickets usually ranging from $0-50. There’s rarely a good excuse to miss your local BSides – it’s a great opportunity to network with security folks in your area for a nominal fee. BSides events also make a great excuse to travel to cities on your bucket list across the world, learn about hacking, network with people, while enjoying the local culture, sights, and cuisine.

I’d be remiss if I did not briefly discuss hacking conference safety and preparedness. As I’ve mentioned above, the level of ‘threat’ at conferences varies and exists everywhere, but regardless of the event you should take common sense precautions. (All of these precautions should translate into everyday life, because bad gals and bad guys are everywhere!)

  • Consider whether it is necessary for you to even bring a laptop to the conference if you’re not attending a course that requires one. Given insecure networks full of hackers, safely using a laptop adds an extra layer of preparation required and gives you another bulky, expensive item to carry and keep track of.
  • If you must bring a laptop, I highly recommend using a new hard drive with a clean OS image, full disk encryption, and as little personal data as possible that you only use for the conference(s). Ensure you have a standard array of vetted security tools if you plan to connect to any network, including VPN. Ensure wireless and Bluetooth are fully disabled when not in use. Use common sense about what you log into.
  •  It’s hard to function today without a smartphone, but consider ways to make your phone more secure. Burner phones or faraday bags are popular options. At the very least, ensure wireless and Bluetooth are off, and that the phone itself is encrypted. VPN if possible. Do not connect to WIFI. Do not borrow phone chargers.
  • Bring cash for as many purchases as possible. Bring as few credit/debit cards as absolutely necessary, and ensure they’re in a vetted RFID safe wallet (but certainly don’t expect those to be foolproof). Don’t bring unnecessary stuff in your wallet or purse such as your work ID, social security card, or passport. Do not use an ATM within an easy walk of the event. I have rarely been to a conference where the hotel ATM wasn’t obviously and amusingly hacked by the end of the first day.
  • Don’t leave valuables unattended at the bar or in your hotel room, in a hotel full of hackers who can trivially open (any) hotel doors. Double lock your room when you’re inside.
  • Know who you can contact and how to reach them if there’s a security or medical issue at the conference – most hacking cons have a staff of security ‘goons’ who are always present and reachable. Any large event can have its share of bad apples, rowdiness, alcohol overuse, and drugs, and they’re there to keep things from getting out of hand. That being said, hacking conferences should not be treated like Mos Eisley cantina. Look out for the safety and well being of your friends and the people around you, and get them help if needed.

==== Local Hacking Meet-ups ====

Aside from organized conferences, many metropolitan and regional areas have formed hacking meet-ups of varying structure and activeness. I recommend finding your local group as soon as possible and participating as much as you can, as it’s a really important way to network with local hiring managers and security teams. Name recognition in this community is absolutely invaluable when applying for jobs.

There were ways that hackers met two decades ago that still work, but they’ve been  impacted by Web 2.0 and social media as much as anything else. So, I’ll both discuss the more traditional ways to find your local hacker and InfoSec folk, as well as newer options.

The Old Ways

  • DEF CON local groups: They’re named by area code, globally. Unfortunately, in my experience, some are now defunct or inactive. (Check and make sure before showing up.)
  •  2600 : 2600 meetings occur in public spaces to be inclusive to everybody, but be cognizant that they are more ‘hacker’ meetings than ‘information security’ meetings. Their active group list is maintained pretty well.
  • CitySec meetups: A more ‘security professional’ focused set of informal meetings in many global metropolitan areas.

The New Ways

  • Meetup.com: I’ve seen quite a few various information security organizations start posting their meetings through this site over the last few years. It’s always worth a look.
  • ISSA: A formal professional organization with chapters around the world.
  • Twitter – Plenty of these organizations post their scheduled events.
  • LinkedIn – Plenty of these organizations are listed as LinkedIn Groups.

 

 

Hair Dryers, Hacking, and Us

In case you’ve been living under a rock for the past several days, IBM posted, then ultimately removed a video promoting STEM fields for women via “hacking hairdryers”, to a great deal of public outcry from STEM professionals. The unhappiness stemmed not only from perceived sexism, but also tremendously poor timing as the ad was released close to the anniversary of the École Polytechnique massacre of 1989.

I will apologize from momentarily veering away from my usual structured technical guides. However, I’d likely to briefly state my own experience and thoughts on the matter, because I feel there are a couple things that still need to be said.

Before I continue, I’d like to make it clear that I see no purpose in badmouthing IBM further regarding their campaign. I genuinely believe they meant well, and I have many exceptional friends (both male and female) employed in STEM fields there. I’m not offended by their campaign; I merely feel disappointment. The ad (probably generated by an unrelated advertising team) was symptomatic of what I perceive as a systemic misconception about how to interest girls and women (and in a larger sense, minorities) in STEM fields.

I’m fairly straightforward about my interests and experience on social media and my blog. I hope I have properly expressed over the years that I truly have keen interest and skill in an array of tech, without compromise. Tech isn’t merely a career for me – it’s something I live. I also publicly enjoy a fair number of things that are often traditionally categorized as ‘feminine’. I own a gratuitous amount of makeup. I enjoy subversively playing with the ‘sparkly’ and ‘pink’ tropes. I will admit that it took time for me to reconcile these things as a young adult. These things are not mutually exclusive, nor are they particularly interrelated apart from my persona.

I’m not a girl hacker – I’m a hacker. I am not a hacker because somebody taught me to hack on a pink keyboard. I learned to hack, code, and solder the same way most everyone else did. I don’t personally know any female hackers or technical professionals who state that they owe particular success or interest to being approached with anything pink, sparkly, or remotely associated with Barbie. Your mileage may vary.

I owe my skill at tech not to campaigns targeted at me as a girl, but to the fact that by the time that people told me that I could not do things because I was female I was already confident in my ability to do them. By the time my sixth grade science teacher reminded me to, “Remember what happened to Joan of Arc”, I had coded my first text based RPG and soldered circuit boards, and I had found that it was something I enjoyed.

My parents never gave me any presumption of advantage or disadvantage in life to being female. It had no bearing. There was an expectation that I would learn to play a musical instrument and appreciate fine arts, but also help fix the car or TV when they broke and have a solid fundamental understanding of science. My parents both firmly held the assumption these were things an informed human being should do. If I showed an interest in something beneficial, they encouraged it.

Outside of my immediate family, who I firmly believe were instrumental in me freely pursuing an interest in a variety of fields, I also can point directly to youth organizations like the Girl Scouts. Although I can absolutely name cases where I’ve seen them stoop to the same fallacy, even in the 80’s and 90’s, their youth programs still offered a wide array of science and tech teaching that was presented in a great, unbiased, non-condescending way. Our telescopes never needed to be sparkly. We just had to know that we were looking at Saturn through the eyepiece in a cramped observatory on a chilly night, and that was enough.

In my experience it’s absolutely an unfortunate reality that women and girls often do face negative pressures, preconceptions, and lack of encouragement from many sources when they demonstrate any real interest in science, technology, engineering, or mathematics. Trying to advertise these fields through gross gender stereotypes is probably not the way to fix this problem. The ability to excel comes from being told it’s OK to pursue almost any interest by the formative people in a child’s life. This includes family, teachers, mentors, and the community. It comes from being provided exposure to varied interests at a young age. We have to counter the societal negative pressures with positive encouragement for everybody.

Give the kids and young adults in your life the exposure and support to explore and pursue things they wish to.

Get involved with the many great organizations like Hak4Kids and DefCon Kids that provide so much education and motivation to youths.

If you’re able, mentor and sponsor people in your community who don’t have support to grow and learn in tech fields.