BrakeSec Education Podcast

Sharing information between people and organizations can be a sensitive issue, especially if the information being shared is of mutual importance.  This week, we break down PGP and it's open source cousin GPG.  We discuss how last week's podcast about hashing, encoding, and encryption are all bundled up neatly with PGP, and give you some examples of software you can use on Mac, Windows, and Linux.   GPG4Win - http://www.gpg4win.org/ GPG Suite (Mac OS) - https://gpgtools.org/ public PGP key server - pgp.mit.edu NoStarch Press book: http://www.nostarch.com/pgp.htm gpg commandline tutorial - http://irtfweb.ifa.hawaii.edu/~lockhart/gpg/gpg-cs.html   Icon courtesy of NoStarch Press Intro "Private Eye", and Outro "Honeybee" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/

Ever heard someone mention AES Encoding, or MD5 Encryption?   Many people in IT, Infosec, and Software development get confused about what Hashing, Encrypting, and Encoding.  We hack through the definition forest, looking for that Sequoia of understanding. We also talk about Symantec's remarks that 'Antivirus is dead' and 'not a moneymaker', and what that means to the industy as a whole.   "Enkrypto" is the program I mentioned in the podcast.  It would appear that either s/he fixed it.  Still shouldn't be using an 'encoding' method to store SMS if they are of a sensitive nature... The screen shots still clearly show a Base64 encoded SMS, and still show it as a 'secured' message. :( plus, with a the option to allow an encrypted PIN with 4 characters, it would be trivial to crack even an AES encrypted message Do not buy this app... https://play.google.com/store/apps/details?id=org.enkrypto.sms     icon courtesy of http://www.differencebetween.info Intro "Private Eye", and Outro "Honeybee" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/  

This week, we find ways to increase security when browsing the EWW (Evil Wide Web). We give a shout-out to WhiteHatSec's Aviator browser as a way for everyone to have an eleveated security posture with very little configuration required. And Mr. Boettcher and I talk about some of the plugins we use to make ourselves more secure. And Mr. Boettcher surprises me with his proclivities toward farmyard animals.   Aviator Browser: https://www.whitehatsec.com/aviator/ Sandboxie: http://www.sandboxie.com/ Browser plugins: Firefox --- Request Policy: https://addons.mozilla.org/en-US/firefox/addon/requestpolicy/ Google --- Notscript: http://www.dedoimedo.com/computers/google-chrome-notscript.html     Intro "Private Eye", transition "Mining by Moonlight", and Outro "Honeybee" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/

Mandiant put out their 2014 Threat Report, and we got into all the meaty goodness.  From the Syrian Electronic Army, Iran, and China's APT1 and APT12. Find out if the bad guys are getting smarter, or if we are just making it easier for them? Have a listen and find out.     Mandiant 2014 report (registration required):  http://connect.mandiant.com/m-trends_2014       Intro "Private Eye", transition "Mining by Moonlight", and Outro "Honeybee" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/

Since 2006, Verizon has put out their yearly PCI report.  We break it down, and discuss the merits of the report.   2014 Verizon Report: www.verizonenterprise.com/resources/reports/rp_pci-report-2014_en_xg.pdf           Intro "Private Eye", transition "Mining by Moonlight", and Outro "Honeybee" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/

This is Part 2 of our interview with Phil Beyer.  We asked him about the difference between mentoring and coaching, and we end the podcast talking about influence, the types of influence and ways to gain influence.             Intro "Private Eye", transition "Mining by Moonlight", and Outro "Honeybee" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/

Whois for heartbleed was registered 5 April 2014 by Marko Laasko:   Whois Server Version 2.0 Domain names in the .com and .net domains can now be registered with many different competing registrars. Go to http://www.internic.net for detailed information. Domain Name: HEARTBLEED.COMRegistry Domain ID: 1853534635_DOMAIN_COM-VRSNRegistrar WHOIS Server: whois.godaddy.comRegistrar URL: http://www.godaddy.comUpdate Date: 2014-04-05 15:13:33Creation Date: 2014-04-05 15:13:33Registrar Registration Expiration Date: 2015-04-05 15:13:33Registrar: GoDaddy.com, LLCRegistrar IANA ID: 146Registrar Abuse Contact Email: @godaddy.comRegistrar Abuse Contact Phone: +1.480-624-2505Domain Status: clientTransferProhibitedDomain Status: clientUpdateProhibitedDomain Status: clientRenewProhibitedDomain Status: clientDeleteProhibitedRegistry Registrant ID: Registrant Name: Marko LaaksoRegistrant Organization: Codenomicon OyRegistrant Street: Tutkijantie 4ERegistrant City: OuluRegistrant State/Province: OuluRegistrant Postal Code: 90590Registrant Country: FinlandRegistrant Phone: +358.451302656Registrant Phone Ext: Registrant Fax: +358.3588340141Registrant Fax Ext: Registrant Email: @codenomicon.comRegistry Admin ID: Admin Name: Marko LaaksoAdmin Organization: Codenomicon OyAdmin Street: Tutkijantie 4EAdmin City: OuluAdmin State/Province: OuluAdmin Postal Code: 90590Admin Country: FinlandAdmin Phone: +358.451302656Admin Phone Ext: Admin Fax: +358.3588340141Admin Fax Ext: Admin Email: @codenomicon.comRegistry Tech ID: Tech Name: Marko LaaksoTech Organization: Codenomicon OyTech Street: Tutkijantie 4ETech City: OuluTech State/Province: OuluTech Postal Code: 90590Tech Country: FinlandTech Phone: +358.451302656Tech Phone Ext: Tech Fax: +358.3588340141Tech Fax Ext: Tech Email: @codenomicon.comName Server: NS-697.AWSDNS-23.NETName Server: NS-1338.AWSDNS-39.ORGName Server: NS-1621.AWSDNS-10.CO.UKName Server: NS-473.AWSDNS-59.COMDNSSEC: unsignedURL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/Last update of WHOIS database: 2014-04-13T12:00:00Z NSA exploting HeartBleed for years:  http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-used-heartbleed-bug-exposing-consumers.html RFC6520 - TLS Heartbeat (co-authored by the the guy Robin Seggelmann) https://tools.ietf.org/html/rfc6520   Slashdot article: http://it.slashdot.org/story/14/04/10/2235225/heartbleed-coder-bug-in-openssl-was-an-honest-mistake   OpenBSD's Theo De Raadt having a rant about OpenSSL: http://it.slashdot.org/story/14/04/10/1343236/theo-de-raadts-small-rant-on-openssl   OpenSSL's malloc issues: http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse and http://www.tedunangst.com/flak/post/heartbleed-vs-mallocconf Custom Snort rules to detect HeartBleed: http://blog.snort.org/2014/04/sourcefire-vrt-certified-snort-rules_10.html     Intro/Outro Music: "All This" Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0 http://creativecommons.org/licenses/by/3.0/  

This week, we're leaving the Infosec track a bit, but this interview may be more important to being a person's development as a good Infosec person. We interviewed Mr. Phil Beyer, Director of Information Security for the Advisory Board Company.  In addition to being a past president of the Capitol of Texas ISSA Chapter, he co-founded the Texas CISO Council, a regional steering committee composed of security leaders from private industry and the public sector. He recently gave a talk at Bsides Austin about leadership, and how anyone can be a leader of men. It was very inspiring and something Mr. Boettcher and I thought would be interesting for people in any line of work, not just infosec would benefit from.  If you would like to hear his Bsides Austin talk, we have an exclusive audio copy of the talk, which you can find with his slideshare link here: Brakeingsecurity.com Please leave feedback if you like this, or please feel free to re-tweet/share this elsewhere.     Intro "Private Eye", transition "Mining by Moonlight", and Outro "Honeybee" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/

I take a few minutes to explain a quick mass renaming shortcut using sed I use when I have multiple files that I need to rename.  I used the example of spaces in filenames, but you can use this to append a name to multiple files. Another way to easily change files is to use the 'tr' command. You can change a filename from all lowercase to all uppercase letters, or even remove non-printable characters from filenames.   Take a look, please leave feedback.  I know there are other ways using awk, perl, and others.  This is just another way to do it.

We are pleased to be the only podcast to have audio of the talk Phil Beyer gave at Bsides Austin!  It is a very informative talk about leadership, not just in Information Security, but how to be a leader in any field you do.   Breaking Down Security will also carry a 2 part interview with Phil. The first will post on the 6th of April, and the 2nd part will be on the 13th of April. Phil uploaded the slides of this presentation at Bsides Austin at http://www.slideshare.net/pjbeyer/choose-to-lead. Brakeing Down Security would like to thank Phil Beyer for his time and generosity.