CyberGuardians

After reading a very spirited, informative discussion on this topic over at SecurityFocus I decided to throw my own hat into the ring. I want to expand on several relevant topics. 1 - Certifications are a joke - A certification alone, without experience is typically not worth that much in the real world. It proves that the candidate can pass a test, often with having the questions in advance( see Testking/ActualTests). All it really guarantees, is that the candidate has some basic knowledge of the subject. Even the certs with experience requirements are pitiful, due to the fact that they do not audit every candidate. And if they did, there's always a chance they lied, like most people do on their resume. 2 - Certifcations are necessary - until the HR machine is overhauled, you cannot afford to not have certifications. Unless you have a good contact in the company, most non-certified individuals will be screened out by the non-technical HR employee, who basically knows keywords. ...

As ridiculous as that sounds, startup Robot Genius aims to do just that. Talk about an ambitious project. Not only do they want to scour the entire internet, they also want to analyze the binaries present on the websites for malicious characteristics. Such a product is sure to be in high demand, given that web-based malware has taken the reigns from email-based malware as the vector of choice. This biggest gap I see, is how quickly they can do this. Its very common for malware authors to change IPs on a daily or weekly basis to stay ahead of the whitehats. With such a dynamic environment as the internet, surely they will not be able to keep uptodate with the daily changes. More realistically monthly changes would be feasible. Still, I see the value of the service as a more accurate blacklist then has been delivered in the past. I think this will serve to raise the bar for other AV/Security vendors to improve their products as well. And if that doesn't work, some behemoth like Syman...

So I'm still undecided on whether or not Mondo Armando and Müstaschio are for real. All the news reporters seem to think so, but I think it could also be just another April fools joke. Either way, if they actually produce some Myspace exploits, that would be awesome. Myspace has such a history of slow response to security issues, that I'm not feeling sorry for them in any way. And given that it hosts millions of peoples personal information and they tend to be mostly computer illiterate and lack security knowledge, it looks like a good target for hackers. I also really like the approach these guys are taking, by making fun of the other Month of Whatever projects. HD Moore's original Month of Browser Bugs was awesome, but the ones that followed seemed to get less and less important. So in the end, I guess we will just have to wait and see whether this is just another publicity stunt or if these guys have something to offer other then humour. Stay tuned. Read the Story HERE

Brian Krebs has written a few articles recently focusing on how bad identitiy theft and credit card fraud really is. There are 2 facts that I find really hard to ignore, which are also really infuriating. The first is that according to Symantec, the majority of the Credit Card trafficking is being done on servers located inside the USA. So what happened to that Patriot act? Why are these criminals allowed to continue doing this, when clearly the FBI has the power to stop it. I know the logic they are using is that they are going after the kingpins and not the small fish, which makes sense. Except that tens of thousands of US citizens are getting thier lives destroyed in the process. And even though they may take down a kingpin one day, another one pops up the next. So eitherway, US citizens are getting screwed. The second problem I have is that we are infact subsidizing our own credit cards getting stolen. The Credit Card industry on a whole acknowledges fraud as an acceptable loss an...

1 - Windows - - Unable to delete registry key? - Use the at command to schedule an interactive registry edit with SYSTEM rights ex. c:\> at 16:00 /interactive regedt32.exe - - Netstat Foo - - C:\> netstat -na 1 | find "[Scan_Host_IP_Addr]" -- Watches for connections/scans - - C:\> netstat -nao 1 | find "[Dest_IP_Addr]" -- Finds the PID generating the traffic - - C:\> netstat -na 1 | find "4444" | find "ESTABLISHED" -- Reports when someone connects - - Get Your Netbios Name Codes http://www.cotse.com/nbcodes.htm - - PSTools Foo - - Remote Shutdown > psexec \\RemotePC -u UserName -p Password shutdown -r -t 1 - - Remote Service Disabling - sc \\ config start= disabled - - MISC - - LM Empty Hash AAD3B435B51404EEAAD3B435B51404EE - - NTLM Empty Hash 31D6CFE0D16AE931B73C59D7E0C089C0 - - Find Resultant Set of Group Policy, rsop.msc - - C:\> write notepad.exe:STR -- allows you to see ADS - - Ping Sweeper - - for /L %i in (1,1,255) do @...

Map of Windows Memory Addresses openRCE

SANS Track 4 Notes, Comments Day 1 – Incident Handling Sample Incident forms are available @ http://www.sans.org/incidentforms/ Giac Practicals are available @ http://www.giac.org/GCIH.php and contain good working examples Protect Evidence – get the user away from the machine ASAP to keep the machine unchanged until you can image the drive. Keep the original stored in a safe place and maintain a chain of evidence. Verify backup integrity to insure you are not restoring a compromised image. Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned Keep up to date on privacy laws, European laws are radically different from US laws IDS, depending on the vendor, maybe able to monitor encrypted VPN traffic Always strive to raise security awareness with management Honeynet – for training purposes it maybe useful to set up a vulnerable system to intentionally let it be compromised to develop the teams investigative skills. Nice Trojan Port list http://www.dark-e.co...