Elamb Cybersecurity

Category: hacking

  • Want to outwit hackers? Hire an ethical one

    Some of my colleagues in the information security profession think that hacking is evil.  They strongly rebuke any information security professionals for condoning hacking. 

    I think that is a ridiculous position to take.  How can we be any good at our job (particulary the more technical information security professionals) if we ignore the skills that malicious hackers use to exploit the very systems we protect?  Why would we bind our own hands from finding vulnerabilities before our enemys? 

    Not knowing the darker side of security is like a Drug Enforcement Agent who can't recognize drugs because he or she has never had any exposure to controlled substances.  It is not my position that cops should rob a bank or abuse crack to REALLY know the criminal mind.  I'm just saying that security is not just about implementing secuirty practice, it is about knowing the exploits, vulnerabilities and threats and knowing them well.

    Hacking is cool.  It is not all evil or criminal.  Sometimes I have to hack my system after locking myself out.  I've attempted to hack my own network to find vulnerabilities. 

    I think hacking is about mastering systems, finding easier ways to do things in life, being clever.  The dangerous thing about hacking is that sometimes individuals are smarter than the systems that they interface with (or control them).  It is the mutant strain that changes everything, the revolution that forces change, the rebel refuses to submit and any of those can be very good or very bad.

    Unfortunately, it is easier to destroy than to create, so some weak, ignorant, sociopaths give in to the darkside.  This is true of any method, skill, talent, profession ect.  It is a part of human nature to have users and abusers in our ranks.  You may even have some in your family!  It is my personal belief that what you reap is what you sow (karma); those who do bad will get theirs.  I choose to hack ethically lest I incur the wrath of the universe.

    The first ethical-hacking course was started six years ago. Today, there are some half-dozen organizations offering similar instruction around the world

    read more | digg story

  • Web Application Security

    Joel Helgeson created a short video clip demonstrating how easily security
    can be circumvented at the application layer resulting in compromise of
    sensitive data. It is short and suitable for management.

    http://www.appiant.net/exploit.wmv

    Joel also provides an abbreviated Microsoft SQL hardening presentation:

    http://www.appiant.net/sql_security.wmv

    Full commentary can be found at:

    http://www.appiant.net

  • China preparing information warfare army

    The Chinese People's Liberation Army (PLA) is developing information warfare reserve and militia units. Also, China is developing the ability to launch pre-emptive attacks against enemy computer networks in a crisis, according to the document, “Annual Report to Congress: Military Power of the People's Republic of China 2006.”

    I wonder if this is a response to the US release of information about that Elite Hacker Unit last year.  I guess the threats are turning Cyber.

    read more | digg story

  • Certified Ethical Hacker Cert and Certified Pen Testing Expert

    I'm going to go for the Certified Ethical Hacker Cert and eventually the Certified Pen Testing Expert Certification.  That is the direction that I'd like to go with my Information Security Career. 

    As of right now, I have a CISSP.  I do a lot of Security Testing Evaluations and Authorization Agreement, Security Policy type work.  It pays well but I think Pen Testing would be more fun.  After getting the CISSP, I seriously considered going after the ISSEP, Information System Security Engineering Professional cert, which I heard was harder than the CISSP… I don't see how that is possible.

    The CEH is a 125 question test that I've heard mixed reviews about.  I've taken the bootcamp and I love the material.  Its all hardcore hacking.  Not simply how to use Cane & Abel or NMap but how to code malware with notepad, methods of SQL injection, and firewall attacks.  I learned a lot.  It also scared the piss out of me.  If your already a hacker or hardcore pent tester than the class would be nothing more than a refresher.  Intermediates with pentesting will have a real treat.  Beginers will be decapitated.

    I guess CPTE, Certified Pen Testing Expert is the lastest one.  From what I've read, it looks like it is a step up from the CEH.  Here is some more info on the CPTE.  From what I've read the CPTE is INSANE.  It looks like a practical exam completed in the presents of a pentesting expert.  It includes SQL injections, gathering data, compiling hacker applications, and FRICKING Lockpicking… I AM NOT READY. 

  • Password Hacking Programs: EBCD

    One of my favorite Password hacking programs is the EBCD.  EBCD stands for Emergency Boot disk.  Since it operates on Linux, many people have a hard time using it.  Anytime, that I've had friends that have locked themselves out of their own system or some co-workers who forgot their login to the corporate laptop and I give them a copy of the EBCD they are at a loss on how to use it because to command line Linux.

    So here is something I've been wanting to do for a while.  This is a simple walkthrough on how to use the EBCD.  I'm still working on it.  As with my in entire “hacked” series it is a work in progress.

    The EBCD was created by Mikhail Kupchik.  Give him donation if you like his work.  One of these days I hope to have the coding skills necessary to bring to life tools as usefull as this.  These days I'm more into web applications and learning PHP.  Cools stuff.

  • Child Hackers

    “Forget viruses, 419 email fraudsters and server meltdowns. The biggest potential threat to your online security could come from the growing menace of 'click' kiddies, a leading security firm warns.”

    Basic security features should stop most script kiddies.  They are not real hackers.  The deadly threat on the Internet are the guys that write the code the script and “click” kiddies use.

    read more | digg story

  • suntzu – Hacking and the Security Professional

    suntzu

    suntzu,
    originally uploaded by elamb_blog.
    I've been hacked a few times (that I know of). As a security professional, it is my belief that being hacked (or hacking… ethically) is the best way to learn about phishing, social engineering, buffer overflows, denial of service attacks, malware etc.

    Unfortunately, a lot of “information security professionals” don't know anything about what hacking is or what hackers are all about. The term “hacker” is not always a criminal activity. Information Security professionals should have exposure to hacking like cops have exposure to drugs.

    Of course, some information security professionals don't have anything to do with hacking or anything technical (as Martin McKeay has pointed out to me). My point is that all Security Professionals (including cops, investigators, even Infantry) should know their enemies and their enemies tactics.

    Like a detective knowing the criminal mind.

    It was Sun Tzu, ancient Chinese warrior, author of The Art of War, that said that you must “know your enemy” before going into battle. If “you know your enemy and know yourself,” he wrote, “you need not fear the result of a hundred battles.” Sun Tzu went on to say, “If you know yourself but not the enemy, every victory gained you will also suffer a defeat.”

    And that is why I love going to Defcon. There is every spectrum of computer security aficionado.

    http://elamb.blogharbor.com/hacked/igothacked.htm

  • Yet another university hacked for personal records

    College networks are always getting owned.  Why is that?  You'd think that these haven for some of the greatest developing minds in the country would be like digital fortresses with a battalion of young Internet hardened GEEKS patroling the college data 24/7.

    This is a sign that even though security awareness has risen people still are not taking it seriously. 

    POMONA – Computer hackers added Cal Poly Pomona to a growing list of schools from which personal information has been accessed illegally. Notification went out to 31,077 people Thursday that their records might have been stolen after Cal Poly Pomona discovered two computer servers were compromised in late June…

    read more | digg story

  • Mitnick on Hiring Criminal Hackers; elam on hiring crackheads

    I basically look at it as… if the guy hacked into
    Citibank and stole millions of dollars, would I hire him to secure my
    bank? Maybe not!

    Kevin Mitnick

    I agree, Kevin. 

    Hiring a crimial hacker who has stolen millions from banks to guard
    your bank is like hiring a crack head to guard your CRACK.
    –Rob Elamb.


    Rufus Griffin.

  • My Honeypot server: Message from system to alert spam

    I plugged an unpatched Windows 2000 system on the Internet with no
    firewall, antivirus or even pop up blockers to sniff out the raw filth
    being pumped to the world. 

    What I was immediately spammed with was “Message from System to Alert messages” from various “security software” sites.   Here are the results:

    “Message from System to Alert” Pop ups

    These messages claimed to be from Microsoft or from my system or from
    System32 saying my registry was corrupt and a bunch of other lies.