Skip to main content

AtlSecCon - 2017 Findings Pt. 1

This document outlines information gathered at the most recent AtlSecCon, on 4/27-28/2017 and some interesting findings and presentations performed by the speakers there:

Day 1:
Keynote Talk - The biggest take away that I received from this was two fold: Educate your employees/non-technical folk in a method that they understand and rather than just tell them you have to do X, tell them why your doing X and how by not doing X, that Y/Z will occur in plain terms. And that security starts and ends with your users, so if your not doing the first portion right, you can place all of the fanciest UTM and latest and greatest white/black boxes in front/in your infrastructure and it will simply not matter.

Cracking Locks like your on CSI: Cyber - This was interesting but was very much a if you have physical security, then it all goes out the window anyways talk. Concept was that using smart-locks, such as those with keypads could be easily circumvented from the outside either to fail open or to literally work like one of the locks off CSI Cyber where he plugs in a device and it magically unlocks. Not totally up my field, but cool none the less.

Murder by Vehicle - This was quite an eye opener, basically came to the formulation that smart cars can be hacked. Now, with that said, I've seen on Youtube where a buddy opens up his PC with looks to be a Serial Cable connected to the CAN and is able to make it slow down/accelerate/ect, but the crazy piece in all this is the amount of details that the presenter went into within reason explaining all of the items that can now be controller across this un-secure CAN table within car. (Think of the CAN as a literal network bus, where anyone can talk to anything on it.) As more cars and more modules get digitalized instead of being a physical controller then we run into the issue that it can be controlled. Examples that was brought up was E-Breaks, Acceleration and Cruise Control just to name a few.

Malware Research using OSINT and Open Source Tools - This was a presentation by my personally favorite malware researcher Raul Alvarez, he was explaining some of the common tools that are available for researching Malware and finding out what and how things work. Some of the products mentioned was Virtualbox, Cuckoo, OllyDbg, x64 OllyDbg and Immunity Dbg. He performed a presentation of using Cuckoo, Ubuntu and Virtualbox with an example of Petra showing how Cuckoo will take screenshots and break down the file changes/ect.

Vaccinating the IoT - This presentation was interesting as it outlined where everything is now connected to the internet, and its never actually properly secured, who is liable when things break. This goes kinda in-tie with Murder by Vehicle, but basically runs into the problem of as IoT devices get made, and security flaws are found out, they are never actually patched.

Closing Keynote - This ending keynote outlined the importance and ease of deployment of containers and their use in development, along with performing an additional secure environment where applications and items can run/work out of.

 Will follow up with Pt 2 sometime today.


Comments

Popular posts from this blog

How to setup a Host-Check for Fortigate SSL VPN

This document outlines how to setup a host-check for a Fortigate SSL VPN (Web only): config vpn ssl web portal edit "portalname" set web-mode enable set host-check custom set host-check-policy "Microsoft-Windows-Firewall" set os-check-enable set ip-pools "PoolName" set split-tunneling disable set page-layout double-column set theme orange config os-check-list "windows-7" set action check-up-to-date set latest-patch-level 1 end  config vpn ssl web host-check-software edit "Microsoft-Windows-Firewall" config check-item-list edit 1 set target "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile:EnableFirewall==1" set type registry next edit 2 set target "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\PublicProfile:EnableFirewall==1" set type registry next edit 3 set target "HKLM\\SYSTEM\\CurrentControlSet\\S...

Implementing 802.1X - Windows 2012R2 + Cisco 4500 Switches

Implementing 802.1X Using Windows Server 2012R2 & Cisco 4500 Series Switches Overview: This document is to outline how the configuration between Windows Server 2012 R2’s NPS Services and Cisco 4500 Series switches has been implemented. High Level Diagram:   Requirements: Windows Server 2012 R2 with NPS Server installed Windows Server 2012 R2 with CA Services Windows AD Environment Cisco 4500 Series Switches Windows 7-10 Clients to connect NPS Configuration: 1. This assumes the above requirement that the NPS Service has already been installed on Windows Server 2012 R2 2. Disable all existing Policies under Connection Request Policies and Network Policies as you will be making your own, except one that states “Catch All” with the below parameters: 3. You will then need to add in a new Radius Client to have Policies built around. Friendly Name will be used going forward for the Policies for referencing the document. 4. Once completed...

OVA/OVF Templates and Older Versions of VMware ESXI

Recently ran into this issue which I feel is something that I should document, as it provides some additional details onto how to configure or modify an existing .ova or .ovf file which is the standard deployment template for ESXI/VMware. Here was the issue: - ESXI 5.5 - OVA required hardware type 8. Gave an error of  " Unsupported hardware version - vmx-8" when testing. Based on everything I was reading, it isn't supported. So using the ovftool which can be found on VMware's Website ( here ) you can basically extract out the ova/ovf file into a directory, and then use it to modify the VMX file and then put it all back together. Steps: 1. Download the application and install it. 2. Go to the directory where the ovftool is stored via cmd line (Typically C:\Programs Files\Vmware\ect..) 3. Issue the following command: ovftool 4. Then modify the .vmx file so that it contains now the hardware ID of 7 (or whatever you need set for your release). 5. Then issu...