« May 2006 | Main | July 2006 »

June 30, 2006

PaulDotCom Security Weekly - Episode 34 - June 29, 2006

Live from the PaulDotCom Security Weekly Studio....

This episode was also broadcast over SkypeCast, so look for us each week when we record. It will also be announced in our IRC chatroom #pauldotcom on Freenode (irc.freenode.net).

Hosts: Larry Pesce, Paul Asadoorian
Email: psw@pauldotcom.com

Direct Audio Download
No Video This Week, we are working on the next episode, hoping for a July release.

(Bandwidth provided by OSHEAN)

Audio Feeds:

June 29, 2006

Podcast day!

Today is the day. We are all back in the studio, and we will be resuming our Skype cast.


We should be starting about 6:00 PM EST. Want to listen live? Go to http://skypecasts.skype.com and search for "PaulDotCom" (without the quotes). It may not show up untill we start, so check back in at the time listed above.


Hope to see you all there!

- Larry

Does Wi-Fi security matter?

So this may be the first time that I don't agree with Bruce Schneier (although I'm sure that it will not be the last).  In an article for ZDnet UK, Bruce states, that ""I have a completely open Wi-Fi network, Firstly, I don't care if my neighbours are using my network. Secondly, I've protected my computers. Thirdly, it's polite. When people come over they can use it."

Now, I've got an open wireless network at home too - is is separate from the rest of my network, because it is polite and cool for all of my geek friends to get access while at my house.  The part I don't agree with is: "I've protected my computers."  What happened to defense in depth?  Sure, personal firewalls, IDS/IPS, Antivirus, and all that good stuff is good, but what about those risks that you don't know about?  I'm just not comfortable with putting machines that I do not control/have responsibility for on my network.  A separate, appropriately firewalled and secured, sure.

- L

Does Wi-Fi security matter?

[UPDATE] - Bruce Schneier Just updated his blog on this issue. I'm sure he is using really good security, including "unsavory men with bitey dogs." I wish I could deploy that kind! I think that the whole article might be a misqoute - either way, we intend it to get you to think!

Sudo For Windows, (Fri, Jun 23rd)

The good folks over at the ISC turned me on to something that I wished I'd known about a long time ago.  Now, I'm familliar with sudo for *nix, but I was never aware of sudo for Windows.  This definatley is a more elegant solution than Microsoft's DromMyPantsRights.  DropMyPantsRights allows an administrative user on a windows pc to run a program as a user with lower rights (such as IE) - which you need to specify individually.  What a mess!

Sudo for windows works just like sudo for *nix.  Configured properly, you run as a regular (non-admin) user, and when you want to so something that requires administrative rights, you use your own password to authenticate - a much better model.

Please go check out the post at the ISC below, and get your windows users out of the admin groups!

- L 

Sudo For Windows

June 28, 2006

Wi-Fi driver vulnerabilitites

Researchers David Maynor and Jon Ellch have discovered a way to compromise computers via some flaws in the device drivers for the wireless cards using LORCON - you don't even have to be using the card - the radio just needs to be active.  The are fairly tight lipped about the methods, as they will demonstrating the attack at Black Hat USA 2006.

Remember Simple Nomad's presentation about hacking the friendly skies at Shmoocon this year?  More wireless problems, which are left exposed by just having your wireless turned on - you don't even have to be using it.

A few words to the wise:

- Don't use the wireless at Black Hat (for this and many other reasons), or any other convention, or any untrusted hotel network unless you intend to wipe your drive and reinstall - especially at security/hacker/phreaker conferences.

- Don't store any personal information, or any other information that you don't want freely available on your mobile device that you use at above conferences.

- Shut off your wireless card when not in use

- Practice defense in depth, just in case. 

- L

Researchers hack Wi-Fi driver to breach laptop

Freenode Network Hijacked

So, as most of our faithful listeners know my now PaulDotCom maintains a channel at freenode (#pauldotcom), and we do converse with many of our listeners there.

Unfortunatley, at some point over the weekend, someone malicious took over the freenode network, and may have, for a time impersonated NickServ. As a result, it was related that about 25 individuals had their passwords potentially compromised.

It is sad to see that it has happened, and I'd highly suggest that all of our listeners that visit our channel (or any of the FiT channels, or freenode in general) immediatley change their password if you use that password anywhere else (which we know you don't 'cause you are good security doobies).

- L

P.S. You will now notice me posting here much more often, as I'll be posting both here and at haxorthematrix.

Freenode Network Hijacked

June 26, 2006

Feed "bug"

Well, I'd like to call it a bug, but it was just my stupidity.

Apparently the XML feed never referenced the enclosure for episode 33, but it pointed to episode 32 instead. I don't know how I missed it, but I did. Never the less, the feed has been updated.

Hopefully this won't screw up iTunes too badly.

My sincere apologies.

- Larry

[UPDATE] - I just checked my iTunes, and it downloaded the correct podcast. Now I have two entries for episode 33.

June 24, 2006

PaulDotCom Security Weekly - Episode 33 - June 22, 2006

Live via Skype from the Casa del Pesce....

This episode was unfortunatley not broadcast over SkypeCast. Paul is off on his honeymoon this week...so the audio is not the greatest, but not all that bad. Do look for us next week in our IRC chatroom #pauldotcom on Freenode (irc.freenode.net).

Hosts: Larry Pesce, "Twitchy", Kevin Devin
Email: psw@pauldotcom.com

Direct Audio Download

(Bandwidth provided by OSHEAN They are smooth, like peanut butter.

Audio Feeds:

June 15, 2006

PaulDotCom Security Weekly - Episode 32 - June 14, 2006

Live via Skype from the PaulDotCom Security Weekly Studio and Casa del Pesce....

This episode was unfortunatley not broadcast over SkypeCast. Craziness this week With Paul's wedding and all! However, do look for us in our IRC chatroom #pauldotcom on Freenode (irc.freenode.net).

Hosts: Larry Pesce, Paul Asadoorian
Email: psw@pauldotcom.com

Direct Audio Download

(Bandwidth provided by OSHEAN

Audio Feeds:

June 13, 2006

PaulDotCom - Version 2.0 and beyond

Before I depart for a much needed vacation I would like to communicate our mission, goals, and intentions to all of the loyal PaulDotCom fans/listeners/subscribers.

The original idea for this podcast was based on a monthly presentation I used to do which covered the month's security vulnerabilities, research, news, how topics, etc... When that died on the vine, I felt this void, like I needed a vehicle to carry my message. I spend a great deal of time keeping up with events in the security world and take great pleasure in sharing it with anyone who will listen. Then I heard about podcasting and thought, "Hey, that sounds like a great medium for the content that I have, and it could be great fun!". Yes, podcasting is a buzz term, but in looking at the underlying technologies, it just made sense. Record a show each week that covers security news, then people can listen to it anytime (I think that on the commute to work is the most popular).

So we set off to SANS LA to record our first podcast. Through some magic and stroke of luck, we also managed a very timely interview with Marty Roesch. I flew home on the plane loaded with raw Audacity files for episode 1 and the interview, and nothing else. No real blog, no RSS feed, no wiki, no recording equipment, no headphones (I had ear buds), zero audio engineering knowledge, and only the beginnings of a team (not certain if Larry had even made the commitment at that point yet).

Fast forward to today, and we have a very successful blog, wiki to hold show notes, interviews with some of the best and brightest in the field, 30+ shows under our belt, a full recording studio, a TV show, a frappr map with globe listeners, and a full team of people who make this all possible (Thanks to Larry, Nick, Andy, Mason, Dave, Jennifer, Snort/Sourcefire, OSHEAN, Syngress, Core, and all the FiT members, especially George). We've also gone through a lot of changes, very fast (okay lightening speed). We've tried numerous show formats, had our bad shows, and our good shows. The one thing that we have kept constant throughout is that we are true to ourselves and don't pretend to be anything else. Other than that, we never really thought people would listen, and never took a step back and thought about what we want to accomplish.

So here we are today, a show that features security professionals hanging out, drinking beer, talking shop, and having fun. We have found our niche being the entertaining and informative podcast. We've pushed the envelope with hacking stories, burping, farting, porn references, nipple shows, and all sorts of stuff that just wouldn't fly in a professional environment. If you asked any of us why, you'd get the same response as you would when as asking a mountain climber why they chose to climb the mountain, because it was there. For us, its because, well, we could. From this point on, it stops, and we get back down to business.

The new PaulDotCom will be more professional. We will continue to be entertaining, but not grotesque. Its easy to be entertaining when there are no rules, unfortunately this leads to offensive material. We want to reach a larger audience and serve more if the community. In order to do that we're turning down the raunchy from 11 to 3. Our new challenge will be to maintain a funny and entertaining podcast while upholding a higher standard of professionalism. This means that we will need to put more thought and effort into our show, which we believe is a worth while effort. We are not selling out, but merely looking to better ourselves and our show as a whole. So, we would now like to announce the official PaulDotCom Security Weekly mission statement:

"PaulDotCom Security weekly's mission is to provide free content within the subject matter of IT security news, vulnerabilities, and research. We strive to use new technologies to reach a wider audience across the globe. The mixture of technical content and entertainment will continue to set a new standard for podcasting and Internet TV."

In closing, I would like to thank the most important people of all, YOU, the listeners! Without you we'd just be a bunch geeks drinkin' beer (yes, we will still drink beer) and geekin' out. Thank you for listening.

Look for even better things to come....

PaulDotCom Security Weekly Crew

Paul.com, Larry, "Twitchy", & "The Mason"

June 09, 2006

PaulDotCom Security Weekly - Episode 31 - June 8, 2006

Live from the PaulDotCom Security Weekly Studio....

This episode was also broadcast over SkypeCast, so look for us each week when we record. It will also be announced in our IRC chatroom #pauldotcom on Freenode (irc.freenode.net).

Hosts: Larry Pesce, Paul Asadoorian, "Twitchy"
Email: psw@pauldotcom.com

Direct Audio Download

(Bandwidth provided by OSHEAN

Audio Feeds:

PaulDotCom Security Weekly - Episode 30 - June 1, 2006

Live from the PaulDotCom Security Weekly Studio....

This episode was also broadcast over SkypeCast, so look for us each week when we record. It will also be announced in our IRC chatroom #pauldotcom on Freenode (irc.freenode.net).

Hosts: Larry Pesce, Paul Asadoorian, "Twitchy"
Email: psw@pauldotcom.com

Direct Audio Download

(Bandwidth provided by OSHEAN

Audio Feeds: