So I have been looking to rent a new place as I moved back to the DC metro area. What I have found is an exuberant amount of people that are asking for a ridiculous amount of personal information. They are asking for SSN, checks which would obviously include account and routing information, and I even had one person asking to set up the ability for them to auto charge my account for the monthly rent and yet another asking for a photocopy of 2 picture IDs and my SSN card!
I have probably found myself looking for this stuff more and more lately but I find this outrageous. My general question is; Am I being over paranoid or is it correct of me to deny them these things? It’s bad enough that I need to keep thieves from gaining access to this via my personal space, but now I need to put reliance on these people, which most are arguably ignorant about computer and general security, from getting hacked and exposing my information.
What ways are there to get around this? Obviously I see their side of wanting this information, but they should understand this side as well. Explaining this to them is quite difficult though unless they have been a victim of such a crime. I thought about running the credit checks myself and scrubbing the information and just denying the existence of a personal checking account. Any other suggestions?
Monday, August 24, 2009
Tuesday, August 18, 2009
SANS 560 anyone?
I was extended an invitation to become a SANS mentor. This means I will be running some classes real soon. I will be starting with offering the 560. This is the class you would take to obtain your GPEN certification. Time and place to be announced soon. If you are interested, drop me a line and let me know. I'll get you on the list. Here is the link of the course and what is included:
SANS 560
SANS 560
I Can't hear you now! :(
You read that correctly. I was unable to get a good test with the bluetooth hacking this weekend. The reason? It appears that when you pass your bluetooth through to a virtual machine on your Mac, you loose a lot of the needed functionality. Yes, yes I know. You are thinking why didn't you just get carwhisperer to work on the Mac or try the Windows route, or boot your Dell into Backtrack?
The truth is that I wanted to see it work this way. I really like the idea of having one laptop that can do everything I need to do with the use of VMWare. Alas, this is not the case yet; at least not without getting external wifi and bluetooth dongles. I will attempt again this weekend with the Dell and Backtrack.
I did find something else interesting though....the PS3 has bluetooth. My goal may be to see what kind of cool stuff I can do there as well.
The truth is that I wanted to see it work this way. I really like the idea of having one laptop that can do everything I need to do with the use of VMWare. Alas, this is not the case yet; at least not without getting external wifi and bluetooth dongles. I will attempt again this weekend with the Dell and Backtrack.
I did find something else interesting though....the PS3 has bluetooth. My goal may be to see what kind of cool stuff I can do there as well.
Friday, August 14, 2009
Can you hear me now?
OK, OK my posting has been a bit spotty. I'm trying :) So anyway why I am posting today.... Can you hear me now? Reminds you of a Verizon commercial. Well, this post has to do with...well cell phones, and bluetooth headsets. You may have all been reading how vulnerable bluetooth is. Do you know just have vulnerable? Check out the following video by Josh Wright:
I Can I hear you now!
So how scary is that? Bet you will think twice about wearing one of those bad boys now :). That got me thinking, those of you that know me you know how that goes! If we can eavesdrop/inject on bluetooth headsets then I bet we can eavesdrop/inject on car bluetooth systems. Well...I hope to test this tomorrow and see. I'm traveling back from PA in the AM and will have a few hours at my disposal. If by some reason I am too tired, it will be done this weekend and I will post my results here. This can have a very scary outcome. Lets hope more thought was put into the car bluetooth setup though...yeah right!
I Can I hear you now!
So how scary is that? Bet you will think twice about wearing one of those bad boys now :). That got me thinking, those of you that know me you know how that goes! If we can eavesdrop/inject on bluetooth headsets then I bet we can eavesdrop/inject on car bluetooth systems. Well...I hope to test this tomorrow and see. I'm traveling back from PA in the AM and will have a few hours at my disposal. If by some reason I am too tired, it will be done this weekend and I will post my results here. This can have a very scary outcome. Lets hope more thought was put into the car bluetooth setup though...yeah right!
Monday, July 20, 2009
Passed the GPEN!
Just wanted to share that I passed the GPEN exam! Got a 90%. It was one of those exams that showed you your progress. This was a blessing and curse. It was nice to know I passed after getting 105 questions correct, but since I knew I passed at that time, it was easy to slack off toward the end and I missed a number of questions because of it.
I put in my application for my GPEN gold. The paper title is: "Identifying Load Balancers in Penetration Testing". The application was approved. I will begin work on the paper starting around the 10th of next month. It is a 6 month process so more to come on that. I have a lot of work ahead of me.
In the mean time, still being on track with my certification goals, I began studying for the CISSP yesterday. I hope to have it done before the years end. (If anyone else is studying for this one as well and would like to get together online or in person to study, let me know) That was the goal I set forth. Then in the beginning of next year I will be finishing my GPEN gold paper and starting to get ready for the GSEC towards my GSE.
I put in my application for my GPEN gold. The paper title is: "Identifying Load Balancers in Penetration Testing". The application was approved. I will begin work on the paper starting around the 10th of next month. It is a 6 month process so more to come on that. I have a lot of work ahead of me.
In the mean time, still being on track with my certification goals, I began studying for the CISSP yesterday. I hope to have it done before the years end. (If anyone else is studying for this one as well and would like to get together online or in person to study, let me know) That was the goal I set forth. Then in the beginning of next year I will be finishing my GPEN gold paper and starting to get ready for the GSEC towards my GSE.
Friday, July 10, 2009
XSS?
Where have you been Curt? Well as some of you may know I'm getting real close to taking the GPEN certification exam. Next week in fact! So I have been trying to study hard and keeping focused. I did want to give you guys a new post though to ensure you that I'm still here and still plan on keeping up on my musings.
Have you heard of XSRF? You might have heard it called cross site request forgery. This is a dangerous attack vector that people can used to do all sorts of nasty things. Take for example, this cool picture of cookie monster:
What picture of cookie monster you might ask? You may see nothing above or you may see a little white box with a red x in it or a box with a ripped file inside. You see what just happened is I executed a bit of code for your system to run. What code? Well if you had a bank account with my bank, I would have just transferred $13000 from your account to mine :) Thanks! There are something things that would need to be in place for this to happen though.
What I would need to do is have you look at this blog posting while you were logged into your online banking. This isn't that difficult as a lot of people multi task. You may say "but I don't normally browse when I bank". That is fine too. I can also use this code to have you execute a command of my choosing to any site you may be logged into at the moment. i.e. How about changing your Facebook, Myspace, or ebay password so I can highjack it for example?
Why would the other page accept this junk? The short answer is that it does this because I use your cookie (or session) to tell it what to do. Since you authenticated to that site, it thinks you are requesting this information so it subserviently obliges.
Why all of the bad news? Well I want you all to be aware of the things that can happen very simply on the Internet. The good news to this is that websites such as your bank, ebay and others are doing all they can to help stop this. It is an uphill battle though so don't expect it to end completely. As long as there is crime in the world there will be people coming up with new ways to steal your information.
How can we protect against this Curt? Again, this is difficult to say because the dynamic changes all of the time. One thing that would help here is to turn on, or off, the setting in your browser to not allow third party images. In Firefox there is a setting you can disable called Load images automatically. IE 8 actually has a nice new feature that allows you to block third party images from a website, much like how I ran the code above. This may cause issue with your page displaying properly. I guess it's about how far you want to go. Alternately you can choose the option to clear cache, cookies and offline content every time you close your browser. This does mean you will have to log in every time you vist those types of sites that require it. You can also close your browser and reopen it after doing online transactions and logging out of those pages. It does seem that more and more pages of this sort are providing you with that request when you log off already, which is a good thing. That clears the session and if you are clearing your cookies and such on exit then it takes the option away from the attacker.
Be safe on the Internet. It's not a land of milk and honey! It's a warzone where many unsuspecting people get caught in crossfires and direct attacks. You can enjoy the convienance and productivity that it brings, just be cautious. As always, if you have any further questions, let me know!
Have you heard of XSRF? You might have heard it called cross site request forgery. This is a dangerous attack vector that people can used to do all sorts of nasty things. Take for example, this cool picture of cookie monster:
What picture of cookie monster you might ask? You may see nothing above or you may see a little white box with a red x in it or a box with a ripped file inside. You see what just happened is I executed a bit of code for your system to run. What code? Well if you had a bank account with my bank, I would have just transferred $13000 from your account to mine :) Thanks! There are something things that would need to be in place for this to happen though.
What I would need to do is have you look at this blog posting while you were logged into your online banking. This isn't that difficult as a lot of people multi task. You may say "but I don't normally browse when I bank". That is fine too. I can also use this code to have you execute a command of my choosing to any site you may be logged into at the moment. i.e. How about changing your Facebook, Myspace, or ebay password so I can highjack it for example?
Why would the other page accept this junk? The short answer is that it does this because I use your cookie (or session) to tell it what to do. Since you authenticated to that site, it thinks you are requesting this information so it subserviently obliges.
Why all of the bad news? Well I want you all to be aware of the things that can happen very simply on the Internet. The good news to this is that websites such as your bank, ebay and others are doing all they can to help stop this. It is an uphill battle though so don't expect it to end completely. As long as there is crime in the world there will be people coming up with new ways to steal your information.
How can we protect against this Curt? Again, this is difficult to say because the dynamic changes all of the time. One thing that would help here is to turn on, or off, the setting in your browser to not allow third party images. In Firefox there is a setting you can disable called Load images automatically. IE 8 actually has a nice new feature that allows you to block third party images from a website, much like how I ran the code above. This may cause issue with your page displaying properly. I guess it's about how far you want to go. Alternately you can choose the option to clear cache, cookies and offline content every time you close your browser. This does mean you will have to log in every time you vist those types of sites that require it. You can also close your browser and reopen it after doing online transactions and logging out of those pages. It does seem that more and more pages of this sort are providing you with that request when you log off already, which is a good thing. That clears the session and if you are clearing your cookies and such on exit then it takes the option away from the attacker.
Be safe on the Internet. It's not a land of milk and honey! It's a warzone where many unsuspecting people get caught in crossfires and direct attacks. You can enjoy the convienance and productivity that it brings, just be cautious. As always, if you have any further questions, let me know!
Wednesday, June 17, 2009
Mentioned on another blog
Some of you may know, but then some of you may not. Yesterday I was mentioned on the CommandLine kung fu blog. Now it was no big deal, like new spolit found or new rockin code, but it's nice to be mentioned and associated with individuals such as Ed Skoudis and the other folks that maintain the blog. I submitted a question/suggestion for them to discuss command output redirection. They did an excellent job in covering the material and I hope a lot of people learned as much from it as I did! Thanks guys!
I did not get to testing the new l0phtcrack this weekend. I ended up playing with my Mac the whole time :) I'm just about completey over to it now. I'm giving Entourage a try over Outlook. So far it's not that bad. The only issue I have remaining is that the SANS @home sessions will not play on my Mac. I have a ticket open with them to try to fix this. It's not a show stopper though as I have VMWare fusion installed and running Windows 7 which runs the sessions fine. So long story short, I hope to get to testing soon. I'm tied up at work all weekend this weekend but maybe during my downtime I can see what I can do. I'm also trying to go through the SANS 560 and 561 class materials one last time before taking the GPEN test. My hope is to take it in the middle of next month so I can get started on my CISSP.
More later, hopefully a full review of l0pht vs. some of the other free password crackers out there!
I did not get to testing the new l0phtcrack this weekend. I ended up playing with my Mac the whole time :) I'm just about completey over to it now. I'm giving Entourage a try over Outlook. So far it's not that bad. The only issue I have remaining is that the SANS @home sessions will not play on my Mac. I have a ticket open with them to try to fix this. It's not a show stopper though as I have VMWare fusion installed and running Windows 7 which runs the sessions fine. So long story short, I hope to get to testing soon. I'm tied up at work all weekend this weekend but maybe during my downtime I can see what I can do. I'm also trying to go through the SANS 560 and 561 class materials one last time before taking the GPEN test. My hope is to take it in the middle of next month so I can get started on my CISSP.
More later, hopefully a full review of l0pht vs. some of the other free password crackers out there!
Subscribe to:
Posts (Atom)
