Skip to main content

AtlSecCon - 2017 Findings Pt. 2

This is part 2 (day 2) of my review of Atlantic Security Conference (AtlSecCon) 2017. Click here for Part 1. A few items that I have been mentioned, and worth investigating ZAP, OSQuery, Komand and ThreatStack.

Opening Speaker on Day 2:
This was an interesting speech, it was titled "Move Fast and Fix Things" by Jen Andre. But basically the long and short of it was her explanation of how she was previously an entrepreneur and has assisted in startups previously, and how to start a proper security startup. The biggest takeaways are:
- Search for a scalable business model
- Start with a problem, not a technology
- Make it minimalistic and viable
- Know that your solution, and possibly your problem will evolve.
- Don't boil the ocean.
- Early Adopters are awesome, as they provide a crucial role in development.
- Startups != the only path to innovate in Security.

Speech 1:
This was a speech outlining some of the Security and Cryptography laws within EU/Canada/US. This was provided as non-legal advice, so take the rest explained here as the same:
- UK has the Snooper's Charter.
- US has the Burr-Feinstein Bill
- EU has the General Data Protection Regulation (GDRP)
- Canada has the PIPEDA Act and ISPs cannot collect users data without Lawful Access request. Bill C-13 known as the revenge bill is simply put that you cannot distribute unauthorized photos on internet and also with that definition of Data has changed from something that can be understood by PC and/or other devices. Also included, if you have a decryption key, you may be forced to give it.
- Discussion also came up with what happens if you forget your "Decryption key"
- Indirect access, such as US going into CDN, or CDN into US, if you do not agree with Border Crossing, they can explicitly deny you access.

Speech 2:
Websockets are going to change the Pentesting Community & HTTP/2 was the second speech of the day. Basically outlining how Websockets work, and how the are exploitable, and go under the radar of most of the UTM devices; It also has a lack of tools today that can be used for WebSocket testing. HTTP/2 was also covered where it is a new HTTP standard, with built in encryption and bi-directional & full duplex communication. QUIC was also mentioned.

Speech 3:
Barbarian's at the Gate(ways) was an interesting discussion around tools and items that was used against Akamai and similar cloud/CDN services, discussing LOIC/HOIC, Brobot, Mirai's hack and Boosters/Stressors. Also suggested reports such as State of the Internet Report (released by Akamai) to view new/interesting threats that may be coming out.

Speech 4:
This screenshot. That is all.



Speech 5:
How I stopped worrying and loved the cloud - This was a great speech outline some of the self-healing and containerization that can occur with Docker and similar container applications.

Closing Keynote:
Scam School's Brian Brushwood did the closing Keynote which sent the rest of the session over the top, explaining some Social Engineering tricks and recommending some books, "Psychology Influence of Persuasion". Social Engineering takeaways:
- 3 Keys:
 - Liking
 - Reciprocation
 - Authority
- Whomever is asking the questions, controls the conversation.
- Social Proof is the simple concept that if someone believes that it is good, then the mass will also believe. (Fake Book, hits Apple's Top 10 eBooks.)

...Until next year.

Comments

Popular posts from this blog

How to setup a Host-Check for Fortigate SSL VPN

This document outlines how to setup a host-check for a Fortigate SSL VPN (Web only): config vpn ssl web portal edit "portalname" set web-mode enable set host-check custom set host-check-policy "Microsoft-Windows-Firewall" set os-check-enable set ip-pools "PoolName" set split-tunneling disable set page-layout double-column set theme orange config os-check-list "windows-7" set action check-up-to-date set latest-patch-level 1 end  config vpn ssl web host-check-software edit "Microsoft-Windows-Firewall" config check-item-list edit 1 set target "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile:EnableFirewall==1" set type registry next edit 2 set target "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\PublicProfile:EnableFirewall==1" set type registry next edit 3 set target "HKLM\\SYSTEM\\CurrentControlSet\\S...

Implementing 802.1X - Windows 2012R2 + Cisco 4500 Switches

Implementing 802.1X Using Windows Server 2012R2 & Cisco 4500 Series Switches Overview: This document is to outline how the configuration between Windows Server 2012 R2’s NPS Services and Cisco 4500 Series switches has been implemented. High Level Diagram:   Requirements: Windows Server 2012 R2 with NPS Server installed Windows Server 2012 R2 with CA Services Windows AD Environment Cisco 4500 Series Switches Windows 7-10 Clients to connect NPS Configuration: 1. This assumes the above requirement that the NPS Service has already been installed on Windows Server 2012 R2 2. Disable all existing Policies under Connection Request Policies and Network Policies as you will be making your own, except one that states “Catch All” with the below parameters: 3. You will then need to add in a new Radius Client to have Policies built around. Friendly Name will be used going forward for the Policies for referencing the document. 4. Once completed...

OVA/OVF Templates and Older Versions of VMware ESXI

Recently ran into this issue which I feel is something that I should document, as it provides some additional details onto how to configure or modify an existing .ova or .ovf file which is the standard deployment template for ESXI/VMware. Here was the issue: - ESXI 5.5 - OVA required hardware type 8. Gave an error of  " Unsupported hardware version - vmx-8" when testing. Based on everything I was reading, it isn't supported. So using the ovftool which can be found on VMware's Website ( here ) you can basically extract out the ova/ovf file into a directory, and then use it to modify the VMX file and then put it all back together. Steps: 1. Download the application and install it. 2. Go to the directory where the ovftool is stored via cmd line (Typically C:\Programs Files\Vmware\ect..) 3. Issue the following command: ovftool 4. Then modify the .vmx file so that it contains now the hardware ID of 7 (or whatever you need set for your release). 5. Then issu...