<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
    <title>PaulDotCom</title>
    <link rel="alternate" type="text/html" href="http://pauldotcom.com/" />
    <link rel="self" type="application/atom+xml" href="http://pauldotcom.com/atom.xml" />
    <id>tag:pauldotcom.com,2008-06-02://1</id>
    <updated>2009-07-02T17:08:57Z</updated>
    
    <generator uri="http://www.sixapart.com/movabletype/">Movable Type 4.24-en</generator>

<entry>
    <title>Podcast hijinks at 7 - SecuraBit, DECT, and Kon-bots, oh my!</title>
    <link rel="alternate" type="text/html" href="http://pauldotcom.com/2009/07/podcast-hijack-at-7---securabi.html" />
    <id>tag:pauldotcom.com,2009://1.698</id>

    <published>2009-07-02T15:06:31Z</published>
    <updated>2009-07-02T17:08:57Z</updated>

    <summary>The insanity stream should begin around 18:45 EDT (6:45 PM Eastern), Thursday, July 2nd. We should begin recording the live show around 19:00 EDT. Please keep in mind that these times are estimates. Our guests this Episode are the SecuraBit...</summary>
    <author>
        <name>Mike Perez</name>
        <uri>http://pauldotcom.com</uri>
    </author>
    
    
    <content type="html" xml:lang="en" xml:base="http://pauldotcom.com/">
        <![CDATA[<p>The <strike>insanity</strike> stream should begin around 18:45 EDT (6:45 PM Eastern), Thursday, July 2nd. We should begin recording the live show around 19:00 EDT. Please keep in mind that these times are estimates.  </p>

<p>Our guests this <a href="http://www.pauldotcom.com/wiki/index.php/Episode158"> Episode</a> are the <a href="http://securabit.com/"> SecuraBit</a> folks, who will discuss current security events alongside the PDC crew, with Technical Segments by Larry "sniff" Pesce on "Sniffing DECT for fun and Penetration Testing" and Mick "Hella" Douglas on "Kon-Boot".</p>

<div style="text-align:center;"><img src="http://pauldotcom.com//konhappy.gif" alt="konhappy.gif" border="0" width="148" height="110" /></div>
<br>

<p>Don't forget to join in on the IRC channel during the stream - we can take live comments and discussion from the channel!  Find us on IRC at irc.freenode.net #pauldotcom.</p>

<p>When active, the live stream(s) can be found at:</p>

<p>Ustream: <a href="http://www.ustream.tv/channel/pauldotcom-security-weekly-live-stream">PaulDotCom UStream Channel</a></p>

<p>Icecast: <a href="http://radio.pauldotcom.com:8000">PaulDotCom Radio</a></p>

<p>Please join us, enjoy the show live, and thanks for listening!</p>

<p>- Larry, Mick, John, & Carlos.</p>]]>
        
    </content>
</entry>

<entry>
    <title>Backtrack 4 Pre-Release with persistence on an SD card</title>
    <link rel="alternate" type="text/html" href="http://pauldotcom.com/2009/06/backtrack-4-pre-release-with-p.html" />
    <id>tag:pauldotcom.com,2009://1.697</id>

    <published>2009-06-30T20:00:47Z</published>
    <updated>2009-06-30T20:00:50Z</updated>

    <summary>How to create a persistent install for BackTrack 4 Pre-release (via the Informer) on an SD card (or USB thumb drive) I was excited to be able to use the new pre-release version of Backtrack 4, as I love to...</summary>
    <author>
        <name>Larry Pesce</name>
        <uri>http://pauldotcom.com</uri>
    </author>
    
        <category term="Security" scheme="http://www.sixapart.com/ns/types#category" />
    
    
    <content type="html" xml:lang="en" xml:base="http://pauldotcom.com/">
        <![CDATA[<p>How to create a persistent install for BackTrack 4 Pre-release (via the Informer) on an SD card (or USB thumb drive)</p>

<p>I was excited to be able to use the new pre-release version of Backtrack 4, as I love to use it on my Asus EEE 1000HA.  When it was released I was eager to make it work, booting off of an SD card in the EEE so that I would not have to mess with additional USB thumb drives (they stick out of the laptop, and the SD card is internal).  During the process, I was happy to discover that both the internal wireless and bluetooth adapters are now supported.  The wireless card even appears to support injection!</p>

<div style="text-align:center;"><img src="http://pauldotcom.com//backtrack-4-beta.png" alt="backtrack-4-beta.png" border="0"  height="100" /></div>

<p>I'll be tailoring this to use on an SD card, but the steps are exactly the same as a USB thumb drive.</p>

<p>Thank you to the Offensive Security folks who put together LINK this video, as this guide is based on it exactly.  I wanted to put it down in text as it isn't always that easy to print out video, or view when you don't have internet access (such as on a plane...), where I initially wanted to accomplish this.</p>

<p>Additionally, this is a signifiant departure from the previous methods for creating a persistent install.  This will not work for the BT4 beta versions.</p>

<p>Let's get started.</p>

<p>Two things that you will need:</p>

<p><img src="http://pauldotcom.com//4GB_SD_CARD.jpg" alt="4GB_SD_CARD.jpg" border="0" height="100" align="right" /><ul><li> The Backtrack 4 Pre-release ISO, booted on a machine with an SD card reader <br />
<li>An SD Card 4 gigs or larger (or USB thumb drive 4 gigs or larger) that we  can completely wipe.  This is a destructive method, as we need to create a few partitions.<br />
</ul></p>

<p>After Booting in to BT4, and insert your SD card.  Issue the command "dmesg".  At the very bottom of the output, we should be able to identify the plug in of our SD card, and the device to which it was assigned.  Mine happened to be /dev/sdc, so that's how the rest of the instructions will progress.  Replace /dev/sdc with your assignment from the output of dmesg.</p>

<p>Now, as root (the default user for BT4), we need to fdisk our SD Card.  BE CAREFUL, as selecting the wrong drive here can potentially hose your system.  That's why I like doing this from within a VM. Start fdisk with the appropriate drive:</p>

<pre>
# fdisk /dev/sdc
</pre>

<p>Within the fdisk utility, print the existing partition table with "p".  If there are existing partitions, delete them with "d", and select the appropriate partition, and repeat until they are all gone. You can reverify  by reprinting the partition table with "p".</p>

<p>We now need to create two new partitions with in fdisk.  For the first partition enter "n" for a new partition, "p" for primary partiton, "1" for first.  Use a size of "+1500M" for 1.5 Gig.  For the second partition, "n" for a new partition, "p" for primary partition, 2 for second.  You can accept the default for size, or at a minimum of 1.5 Gig with "+1500M"</p>

<p>Activate (set as bootable) the first partition with "a", and select partition 1.  Assign a type to partition 1 by issuing "t", select partition 1, and use the code of "b" to identify it as W95 FAT32</p>

<p>Verify the new partition table by issuing a "p" with in fdisk.  If all looks OK, write it to disk (and exit) with "w"</p>

<p>Ok, you can breathe again.  The dangerous part is done.</p>

<p>In order to use our new partitions, we need to format them.  The first partition (/dev/sdc1) will be vfat, and the second (/dev/sdc2) will be ext3.  We can format them with the following commands:</p>

<pre>
# mkfs.vfat -F 32 -n BT4 /dev/sdb1
# mkfs.ext3 -b 4096 -L casper-rw /dev/sdb2
</pre>

<p>The mkfs.ext3 command will take some time, so be patient.</p>

<p>Before we can begin copying over the files, we need to mount the forst partition after creating a directory to mount it to.  We accomplish that with:</p>

<pre>
# mkdir /mnt/sdc1
# mount /dev/sdc1 /mnt/sdc1
</pre>

<p>Copy away!  We're going to copy the contents of our current, booted BT4 enviroment to the new partition on the SD card:</p>

<pre>
# rsync -avh /media/cdrom/ /mnt/sdc1
</pre>

<p>Again, this one will take some time, so be patient.  Also, note that the extra "/" at the end of /media/cdrom/ is important.  If you use tab completion to add that directory to the command, it will not be included and the rsync copy will fail.</p>

<p>Let's install the grub bootloader so that the thumbdrive will actually boot, and know where to fund all of the appropriate files:</p>

<pre>
# grub-install --no-floppy --root-directory=/mnt/sdc1 /dev/sdc
</pre>

<p>Editing the startup items will make our experience that much better.  You can use your favorite text editor here (vi for example), but nano is included on the BT 4 install, so feel free to use that:</p>

<pre>
# nano /mnt/sdc1/boot/grub/menu.lst 
</pre>

<p>At the top of the file, change the default boot option to 5 to automatically use the persistent install at boot time if no user interaction is provided. the line should now read as:</p>

<pre>
default 5
</pre>

<p>Also, edit the block towards the end of the file with the title of "Start Persistent Live CD". You'll want the kernel line to be updated, and at the   at the end add 0x315.  This sets the default video mode for boot, and was the highest resolution available on my EEE.  For normal installations (such as on non-netbooks), use 0x317.  The updated line should be as follows:<br />
<img src="http://pauldotcom.com//the_force.gif" alt="the_force.gif" border="0" height="180" align="right" /></p>

<pre>
/boot/vmlinuz BOOT=casper boot=casper persistent rw quiet vga=0x315 
</pre>

<p>Exit nano and save the file to the default location (with ctrl x).</p>

<p>We are almost done! Just unmount the SD card ad reboot:</p>

<pre>
# umount /mnt/sdc1
# init 6
</pre>

<p>Enjoy your persistent Backtrack 4 installation on an SD card!</p>

<p>- Larry "haxorthematrix" Pesce</p>]]>
        
    </content>
</entry>

<entry>
    <title>PaulDotCom Security Weekly - Episode 157 - June 25 2009</title>
    <link rel="alternate" type="text/html" href="http://pauldotcom.com/2009/06/pauldotcom-security-weekly---e-15.html" />
    <id>tag:pauldotcom.com,2009://1.696</id>

    <published>2009-06-29T02:24:01Z</published>
    <updated>2009-06-29T02:24:03Z</updated>

    <summary>Special guest Valsmith comes to talk to us about Phishing, post exploitation, recon and al sorts of other evil goodies! Full Show Notes Direct Audio Download Hosts: Larry &quot;HaxorTheMatrix&quot; Pesce, Paul &quot;PaulDotCom&quot; Asadoorian, John Strand, Mick Douglas, Carlos &quot;Dark0perator&quot; Perez...</summary>
    <author>
        <name>Larry Pesce</name>
        <uri>http://pauldotcom.com</uri>
    </author>
    
        <category term="Security Weekly" scheme="http://www.sixapart.com/ns/types#category" />
    
    
    <content type="html" xml:lang="en" xml:base="http://pauldotcom.com/">
        <![CDATA[<p>Special guest <a href=http://carnal0wnage.attackresearch.com/>Valsmith</a> comes to talk to us about Phishing, post exploitation, recon and al sorts of other evil goodies!</p>

<div style="text-align:center;"><img src="http://pauldotcom.com//DontPanic_1024.jpg" alt="DontPanic_1024.jpg" border="0" width="300"  /></div>

<p><a href="http://pauldotcom.com/wiki/index.php/Episode157">Full Show Notes</a></p>

<p><a href="http://media.libsyn.com/media/pauldotcom/pauldotcom-SW-episode157.mp3">Direct Audio Download</a></p>

<p>Hosts: <a href="http://www.pauldotcom.com">Larry "HaxorTheMatrix" Pesce</a>, <a href="http://pauldotcom.com">Paul "PaulDotCom" Asadoorian</a>, <a href="http://www.pauldotcom.com">John Strand</a>, <a href="http://www.pauldotcom.com">Mick Douglas</a>, Carlos "Dark0perator" Perez</p>

<p>Audio Feeds: <a href="http://pauldotcom.com/podcast/psw.xml"><img src="http://pauldotcom.com/images/xml.png"></a>  <a href="http://www.odeo.com/channel/38062/view"><img src="http://pauldotcom.com/images/badge-channel-black.gif"></a><a href="http://phobos.apple.com/WebObjects/MZStore.woa/wa/viewPodcast?id=91472687"> <img src="http://pauldotcom.com/images/itunes.gif"></a></p>]]>
        
    </content>
</entry>

<entry>
    <title>PaulDotCom Security Weekly - Special Edition - PCI Round Table - June 24, 2009</title>
    <link rel="alternate" type="text/html" href="http://pauldotcom.com/2009/06/pauldotcom-security-weekly---s.html" />
    <id>tag:pauldotcom.com,2009://1.695</id>

    <published>2009-06-28T21:40:06Z</published>
    <updated>2009-06-28T21:40:14Z</updated>

    <summary>An all out, no holds barred PCI Round Table Featuring all types of industry luminaries, including Anton Chauvakin, Jericho and others. The gloves come off and the debate gets bloody! Direct Audio Download Hosts: Paul &quot;PaulDotCom&quot; Asadoorian, Carlos &quot;Dark0perator&quot; Perez...</summary>
    <author>
        <name>Larry Pesce</name>
        <uri>http://pauldotcom.com</uri>
    </author>
    
        <category term="Security Weekly" scheme="http://www.sixapart.com/ns/types#category" />
    
    
    <content type="html" xml:lang="en" xml:base="http://pauldotcom.com/">
        <![CDATA[<p>An all out, no holds barred PCI Round Table Featuring all types of industry luminaries, including Anton Chauvakin, Jericho and others.  The gloves come off and the debate gets bloody! <br />
<div style="text-align:center;"><img src="http://pauldotcom.com//ninjamobile.jpg" alt="ninjamobile.jpg" border="0" width="300" height="300" /></div></p>

<p><a href="http://media.libsyn.com/media/pauldotcom/pauldotcom-SE-pcirt2.mp3">Direct Audio Download</a></p>

<p>Hosts: <a href="http://pauldotcom.com">Paul "PaulDotCom" Asadoorian</a>, Carlos "Dark0perator" Perez</p>

<p>Audio Feeds: <a href="http://pauldotcom.com/podcast/psw.xml"><img src="http://pauldotcom.com/images/xml.png"></a>  <a href="http://www.odeo.com/channel/38062/view"><img src="http://pauldotcom.com/images/badge-channel-black.gif"></a><a href="http://phobos.apple.com/WebObjects/MZStore.woa/wa/viewPodcast?id=91472687"> <img src="http://pauldotcom.com/images/itunes.gif"></a></p>]]>
        
    </content>
</entry>

<entry>
    <title>I See Your Dirty Laundry And Its Okay</title>
    <link rel="alternate" type="text/html" href="http://pauldotcom.com/2009/06/i-see-your-dirty-laundry-and-i.html" />
    <id>tag:pauldotcom.com,2009://1.694</id>

    <published>2009-06-25T16:35:34Z</published>
    <updated>2009-06-25T16:35:36Z</updated>

    <summary>Some people get really worried if a complete stranger sees their dirty laundry. In order to hide their &quot;secrets&quot; they will air their dirty laundy in a dark basement. The problem is the laundry is still dirty, kids are sleeping...</summary>
    <author>
        <name>Paul Asadoorian</name>
        
    </author>
    
        <category term="Security" scheme="http://www.sixapart.com/ns/types#category" />
    
    
    <content type="html" xml:lang="en" xml:base="http://pauldotcom.com/">
        <![CDATA[<p>Some people get really worried if a complete stranger sees their dirty laundry.  In order to hide their "secrets" they will air their dirty laundy in a dark basement.  The problem is the laundry is still dirty, kids are sleeping in dirty sheets, all because you are ashamed.</p>

<div style="text-align:center;"><img src="http://pauldotcom.com//laundry.jpg" alt="laundry.jpg" border="0" width="300" height="199" /></div>

<p>An excuse some will use not to have a penetration test is, "Our data is too sensitive for you to ever have access to, so you just need to do an audit".  Even better, "Our systems cannot go down, so just do a portscan".  Wow, this is just an amazing security fail!  If you don't trust an outsider, and lets face it, some organizations just can't, then develop an internal pen test team and program.  This is not an excuse not to have a penetration test, its a reason to create your own team!  In addition to your own team, consider expanding the scope for external testers.  This is something that you've heard so many professional penetration testers saying, and its time to start listening and sleeping in clean sheets.</p>

<p>Paul Asadoorian<br />
PaulDotCom Enterprises</p>]]>
        
    </content>
</entry>

<entry>
    <title>Podcast tonight at 7:00 PM EDT - Episode 157 - Spearphishing &amp; BackTrack on SD</title>
    <link rel="alternate" type="text/html" href="http://pauldotcom.com/2009/06/podcast-notice-for-tomorrow-at.html" />
    <id>tag:pauldotcom.com,2009://1.693</id>

    <published>2009-06-24T20:08:08Z</published>
    <updated>2009-06-25T17:42:00Z</updated>

    <summary>The stream should be active around 18:45 EDT (6:45 PM Eastern), Thursday, June 25th. We should begin recording the live show around 19:00 EDT. Please keep in mind that these times are estimates. Our Technical Segment this episode is by...</summary>
    <author>
        <name>Mike Perez</name>
        <uri>http://pauldotcom.com</uri>
    </author>
    
        <category term="Security Weekly" scheme="http://www.sixapart.com/ns/types#category" />
    
    
    <content type="html" xml:lang="en" xml:base="http://pauldotcom.com/">
        <![CDATA[<p>The stream should be active around 18:45 EDT (6:45 PM Eastern), Thursday, June 25th. We should begin recording the live show around 19:00 EDT. Please keep in mind that these times are estimates.  </p>

<p>Our Technical Segment this <a href="http://www.pauldotcom.com/wiki/index.php/Episode157"> episode</a> is by Larry 'roll your p0wn' Pesce. Larry will discuss BackTrack3/4 on an SD Card.</p>

<p>Our guest this Episode is Val Smith, who will discuss SpearPhishing Automation and MetaSploit Phishing Frameworks.</p>

<div style="text-align:center;"><img src="http://pauldotcom.com//spear_monkey.jpeg" alt="spear_monkey.jpeg" border="0" width="305" height="219" /></div>
<br>

<p>Don't forget to join in on the IRC channel during the stream - we can take live comments and discussion from the channel!  Find us on IRC at irc.freenode.net #pauldotcom.</p>

<p>When active, the live stream(s) can be found at:</p>

<p>Ustream: <a href="http://www.ustream.tv/channel/pauldotcom-security-weekly-live-stream">PaulDotCom UStream Channel</a></p>

<p>Icecast: <a href="http://radio.pauldotcom.com:8000">PaulDotCom Radio</a></p>

<p>Please join us, enjoy the show live, and thanks for listening!</p>

<p>- Larry, Paul, Mick, John, & Carlos</p>]]>
        
    </content>
</entry>

<entry>
    <title>PaulDotCom Security Weekly - Web Application Interviews - June 2009</title>
    <link rel="alternate" type="text/html" href="http://pauldotcom.com/2009/06/pauldotcom-security-weekly---w.html" />
    <id>tag:pauldotcom.com,2009://1.692</id>

    <published>2009-06-24T15:08:00Z</published>
    <updated>2009-06-26T12:18:38Z</updated>

    <summary>We are very excited to release two interviews with some of the leaders in the field when it comes to web application testing and vulnerabilities. The first interview is with Andres Riancho, lead developer of w3af, one of the most...</summary>
    <author>
        <name>Paul Asadoorian</name>
        
    </author>
    
        <category term="Security Weekly" scheme="http://www.sixapart.com/ns/types#category" />
    
    
    <content type="html" xml:lang="en" xml:base="http://pauldotcom.com/">
        <![CDATA[<p>We are very excited to release two interviews with some of the leaders in the field when it comes to web application testing and vulnerabilities.</p>

<p><a href="http://w3af.sf.net/"><div style="text-align:center;"><img src="http://pauldotcom.com//w3af.jpg" alt="w3af.jpg" border="0" width="500" height="153" /></div></a></p>

<p>The first interview is with Andres Riancho, lead developer of <a href="http://w3af.sf.net/">w3af</a>, one of the most comprehensive open-source web application testing frameworks.  We talk with Andres about breaking up with girlfriends, the differences between <a href="http://w3af.sf.net/">w3af</a> and commercial web<br />
application testing packages and much more!</p>

<div style="text-align:center;"><img src="http://pauldotcom.com//wafw00f.png" alt="wafw00f.png" border="0" width="384" height="166" /></div>

<p>The second interview is with Sandro Gauci, founder of Enable Security and the co-author of <a href="http://tacticalwebappsec.blogspot.com/2009/06/waf-detection-with-wafw00f.html">WafW00f</a>, a suite of tools to test web application firewalls.  There is some serious security FAIL going on here, and we get all of the details.</p>

<p><a href="http://media.libsyn.com/media/pauldotcom/pauldotcom-SE-interviews1.mp3">Direct Audio Download</a></p>

<p>Hosts: <a href="http://www.pauldotcom.com">Larry "HaxorTheMatrix" Pesce</a>, <a href="http://pauldotcom.com">Paul "PaulDotCom" Asadoorian</a>, <a href="http://www.pauldotcom.com">Carlos "dark0perator" Perez</a></p>

<p>Audio Feeds: <a href="http://pauldotcom.com/podcast/psw.xml"><img src="http://pauldotcom.com/images/xml.png"></a>  <a href="http://www.odeo.com/channel/38062/view"><img src="http://pauldotcom.com/images/badge-channel-black.gif"></a><a href="http://phobos.apple.com/WebObjects/MZStore.woa/wa/viewPodcast?id=91472687"> <img src="http://pauldotcom.com/images/itunes.gif"></a></p>]]>
        
    </content>
</entry>

<entry>
    <title>PaulDotCom Maintenance Notification</title>
    <link rel="alternate" type="text/html" href="http://pauldotcom.com/2009/06/pauldotcom-patch-notification.html" />
    <id>tag:pauldotcom.com,2009://1.690</id>

    <published>2009-06-23T18:45:00Z</published>
    <updated>2009-06-23T20:12:46Z</updated>

    <summary>Tonight there may be brief outages of the PaulDotCom web site (and the items hosted on it -- the blogs, the wiki, the forums, etc) while we do some housekeeping. These outages and other noticeable things will happen around 10...</summary>
    <author>
        <name>Mick Douglas</name>
        <uri>http://pauldotcom.com</uri>
    </author>
    
        <category term="Upcoming Events" scheme="http://www.sixapart.com/ns/types#category" />
    
    
    <content type="html" xml:lang="en" xml:base="http://pauldotcom.com/">
        <![CDATA[<p>Tonight there may be brief outages of the PaulDotCom web site (and the items hosted on it -- the blogs, the wiki, the forums, etc) while we do some housekeeping.  These outages and other noticeable things will happen around 10 PM Eastern and should be over by 11 PM Eastern.  So if you have some strange error or a timeout -- no worries, it's all according to plan.</p>

<p>Thanks for understanding!</p>

<p>The PDC web goon squad<br />
- Mick & Byte_Bucket</p>]]>
        
    </content>
</entry>

<entry>
    <title>Webcast tomorrow June 24 at 14:00 EDT for LBCAV!</title>
    <link rel="alternate" type="text/html" href="http://pauldotcom.com/2009/06/webcast-tomorrow-june-24-at-14.html" />
    <id>tag:pauldotcom.com,2009://1.691</id>

    <published>2009-06-23T16:16:04Z</published>
    <updated>2009-06-24T11:19:28Z</updated>

    <summary> The June Late-Breaking Computer Attack Vectors webcast this month will be held on: Wednesday, June 24, 2009 2:00 pm EDT (GMT -04:00, New York) Register Here For This Webcast This month Dark0perator will discuss some of the latest attacks,...</summary>
    <author>
        <name>Mike Perez</name>
        <uri>http://pauldotcom.com</uri>
    </author>
    
        <category term="Upcoming Events" scheme="http://www.sixapart.com/ns/types#category" />
    
    
    <content type="html" xml:lang="en" xml:base="http://pauldotcom.com/">
        <![CDATA[<p><a href="https://whitehatworldevents.webex.com/ec0605l/eventcenter/enroll/join.do?siteurl=whitehatworldevents&confId=278196932"><div style="text-align:center;"><img src="http://pauldotcom.com//EMAIL.jpg" alt="EMAIL.jpg" border="0" width="325" height="202" /></div></a></p>

<p>The June Late-Breaking Computer Attack Vectors webcast this month will be held on:</p>

<p>Wednesday, June 24, 2009 2:00 pm EDT (GMT -04:00, New York)</p>

<p><a href="https://whitehatworldevents.webex.com/ec0605l/eventcenter/enroll/join.do?siteurl=whitehatworldevents&confId=278196932">Register Here For This Webcast</a></p>

<p>This month Dark0perator will discuss some of the latest attacks, including:</p>

<ul>
<li>Mobile Device Threats</li>
<li>Client Side Attacks and Defense</li>
<li>Major Virtualization Gotchas</li>
<li>P2P Data Leakage</li>
</ul>
<br>
<p>This webcast will run about one hour.
</p>

<p>- Carlos "Dak0perator" Perez and The PaulDotCom Crew</p>]]>
        
    </content>
</entry>

<entry>
    <title>PaulDotCom Security Weekly - Episode 156 - June 18, 2009</title>
    <link rel="alternate" type="text/html" href="http://pauldotcom.com/2009/06/pauldotcom-security-weekly---e-14.html" />
    <id>tag:pauldotcom.com,2009://1.689</id>

    <published>2009-06-22T00:05:12Z</published>
    <updated>2009-06-22T00:05:14Z</updated>

    <summary>Special guest speaker Rob talking about MiTM and virtualization, live from SANSFIRE! Full Show Notes Direct Audio Download Hosts: Larry &quot;HaxorTheMatrix&quot; Pesce, Paul &quot;PaulDotCom&quot; Asadoorian, John Strand, Mick Douglas Audio Feeds:...</summary>
    <author>
        <name>Paul Asadoorian</name>
        
    </author>
    
    
    <content type="html" xml:lang="en" xml:base="http://pauldotcom.com/">
        <![CDATA[<p>Special guest speaker Rob talking about MiTM and virtualization, live from SANSFIRE!</p>

<div style="text-align:center;"><img src="http://pauldotcom.com//larryhappycannon.png" alt="larryhappycannon.png" border="0" width="240" height="320" /></div>

<p><a href="http://pauldotcom.com/wiki/index.php/Episode156">Full Show Notes</a></p>

<p><a href="http://media.libsyn.com/media/pauldotcom/pauldotcom-SW-episode156.mp3">Direct Audio Download</a></p>

<p>Hosts: <a href="http://www.pauldotcom.com">Larry "HaxorTheMatrix" Pesce</a>, <a href="http://pauldotcom.com">Paul "PaulDotCom" Asadoorian</a>, <a href="http://www.pauldotcom.com">John Strand</a>, <a href="http://www.pauldotcom.com">Mick Douglas</a></p>

<p>Audio Feeds: <a href="http://pauldotcom.com/podcast/psw.xml"><img src="http://pauldotcom.com/images/xml.png"></a>  <a href="http://www.odeo.com/channel/38062/view"><img src="http://pauldotcom.com/images/badge-channel-black.gif"></a><a href="http://phobos.apple.com/WebObjects/MZStore.woa/wa/viewPodcast?id=91472687"> <img src="http://pauldotcom.com/images/itunes.gif"></a></p>]]>
        
    </content>
</entry>

<entry>
    <title>Podcast Tonight! - Episode 156</title>
    <link rel="alternate" type="text/html" href="http://pauldotcom.com/2009/06/june-18th-podcast-notice-for-e.html" />
    <id>tag:pauldotcom.com,2009://1.688</id>

    <published>2009-06-18T16:40:33Z</published>
    <updated>2009-06-18T19:18:03Z</updated>

    <summary>The stream should be active around 18:45 EDT (6:45 PM Eastern), Thursday, June 18th. We should begin recording the live show around 19:00 EDT. Please keep in mind that these times are estimates. We have a Guest Technical Segment this...</summary>
    <author>
        <name>Mike Perez</name>
        <uri>http://pauldotcom.com</uri>
    </author>
    
        <category term="Security Weekly" scheme="http://www.sixapart.com/ns/types#category" />
    
    
    <content type="html" xml:lang="en" xml:base="http://pauldotcom.com/">
        <![CDATA[<p>The stream should be active around 18:45 EDT (6:45 PM Eastern), Thursday, June 18th. We should begin recording the live show around 19:00 EDT. Please keep in mind that these times are estimates.  </p>

<p>We have a Guest Technical Segment this <a href="http://www.pauldotcom.com/wiki/index.php/Episode156"> episode</a> by <a href="http://www.linkedin.com/pub/rob-vandenbrink/5/5a7/961"> Rob VandenBrink</a>. Rob will present "Man in the Middle Attacks in a Virtual World'.</p>

<p>Don't forget to join in on the IRC channel during the stream - we can take live comments and discussion from the channel!  Find us on IRC at irc.freenode.net #pauldotcom.</p>

<p>When active, the live stream(s) can be found at:</p>

<p>Ustream: <a href="http://www.ustream.tv/channel/pauldotcom-security-weekly-live-stream">PaulDotCom UStream Channel</a></p>

<p>Icecast: <a href="http://radio.pauldotcom.com:8000">PaulDotCom Radio</a></p>

<p>Please join us, enjoy the show live, and thanks for listening!</p>

<p>- Paul, Larry, Mick, John, & Carlos</p>]]>
        
    </content>
</entry>

<entry>
    <title>Common Sense: Your Greatest Weapon</title>
    <link rel="alternate" type="text/html" href="http://pauldotcom.com/2009/06/common-sense-your-greatest-wea.html" />
    <id>tag:pauldotcom.com,2009://1.686</id>

    <published>2009-06-16T12:46:55Z</published>
    <updated>2009-06-17T12:51:37Z</updated>

    <summary>Taking Time To Go Fishing (Not Phishing) I was enjoying a relaxing day of fishing last weekend, a low-tech hobby that I have enjoyed since I was probably 5 years old. I had all of the essential components that make...</summary>
    <author>
        <name>Paul Asadoorian</name>
        
    </author>
    
        <category term="Security" scheme="http://www.sixapart.com/ns/types#category" />
    
    
    <content type="html" xml:lang="en" xml:base="http://pauldotcom.com/">
        <![CDATA[<h4><p>Taking Time To Go Fishing (Not Phishing)</p></h4>

<p>I was enjoying a relaxing day of fishing last weekend, a low-tech hobby that I have enjoyed since I was probably 5 years old.  I had all of the essential components that make for a successful day of fishing: good weather, cigars, beer, and beef jerky.  I set out to fish some of my favorite spots on the pond, using my tried and true artificial lures that are known to work on this pond in these conditions (I will spare you all the details).  I noticed that there was one other fishing party on the pond who had navigated their small boat over to the dam and begun fishing, albeit with live bait.  If there is one thing I believe in as a fisherman, it is that using live bait is <em>cheating</em>. I mean sure its fun every once and a while, and certainly useful for keeping the kids occupied while fishing as you tend to catch a lot more fish.  In any case, I was fishing within site of the folks on the dam who were not catching any fish and caught two small fish right in front of them.  On the second fish I noticed something interesting sticking out of the fish's mouth, a set of nasty little pinchers!  The fish must have been hungry because not only did it consume a crawfish, but also my imitation worm.  I decided to change spots to just across the pond where there was a prime spot with some logs sticking out of the water.  I changed baits to an imitation crawfish (digging through the tackle box to find one) and on my first cast as soon as the lure hit the water my line started pulling. I reached forward and then quickly leaned back to set the hook.  To my pleasant surprise it was a 3 pound large mouth bass,  the largest I had caught all season!  Needless to say this had to frustrate the folks fishing off the dam with live bait.  Am I a master fisherman headed for the professional fishing circuit?  Not even close, but it speaks to common sense that we all need to have.</p>

<div style="text-align:center;"><img src="http://tenable.typepad.com/.a/6a00d8345495f669e201156ff9d2f9970c-pi" alt="yellingatbass.png" border="0" width="320" height="310" /></div>
<strong><div style="text-align:center;">Yes, I frequently yell at the fish; they like it though.</div></strong>

<h4><p>Adapting To The Changing Landscape</p></h4>

<p>How does this relate to our field?  It doesn't really, i just wanted to share my fishing story with you.  Just kidding (sorta)!  We certainly need to exercise common sense in the security field, and there are far too many areas where we are using tried and true methods of defense (or offense) and its just not working as well as it used to.  The big question is, why?  The landscape and environment is constantly changing, and we need to observe what's in our environment if we are to be successful hackers, defenders, and fisherman.  For example, consider the following areas:</p>

<p><li><strong>Web application assessments</strong> - Some customers may give push back about this one, but we need to continue to put this on the forefront of our penetration testing agendas.  Web application testing, by real human beings, should be a part of every external penetration test.  Attackers are <a href="https://securitymetrics.org/content/attach/Metricon2.0/Grossman_Metricon_2.pdf">exploiting our web applications</a>, <a href="http://www.verizonbusiness.com/resources/security/databreachreport.pdf">stealing our data</a>, and <a href="http://www.phishtank.com/stats/2008/04/">using it to trick users</a>, and we should too!</li>

<p><li><strong><a href="http://www.willhackforsushi.com/?page_id=137">Wireless "security"</a></strong> - Ah yes, of course, WPA2 came out and we're all safe, right?  This is a prime example of how the crawfish is hanging out of the fish's mouth, but we're still fishing with worms.  Attackers are exploiting wireless to gain access to your networks.  Here's another secret: <em>the protections you've put in place to stop them aren't working</em>!  <a href="http://www.aircrack-ng.org/doku.php?id=simple_wep_crack">WEP</a>, <a href="http://www.willhackforsushi.com/?page_id=50">WPA</a>/<a href="http://www.willhackforsushi.com/presentations/PEAP_Shmoocon2008_Wright_Antoniewicz.pdf">WPA2</a>, and most <a href="http://www.willhackforsushi.com/papers/ids-wids-history.pdf">IDA/IPS devices </a>do little to stop attackers, yet we see so many organizations doing little about it except recognizing that it's broken and going off to work on the firewall upgrade project.</li></p>

<p><li><strong>Collecting logs and not checking them</strong> - This is the equivalent of catching the fish, but never even looking in it's mouth to see what its eating.  Some organizations have spent a lot of money on solutions that collect, aggregate, and correlate their logs.  Sure,<a href="http://www.loganalysis.org/">it takes some work to configure and use these solutions</a>, but how many are being used to prop open the server room door? (thanks to Carole Fennelly for that story!)</li></p>

<p><li><strong>"Client security"</strong> - Its pretty clear that attackers are going after the client.  Everything from phishing, to xss, to straight up exploiting client software (like adobe products), <a href="http://carnal0wnage.blogspot.com/2009/03/attacking-layer-8-client-side.html">the client is the low hanging fruit</a> in your network and has been for some time.  Guess what?  This isn't changing!  As penetration testers one theme that I gathered from many people and presentations at the penetration testing summit was we are beefing up post-exploitation, in a big way.  At the center of this effort is our very own<a href="http://darkoperator.blogspot.com/2009/01/meterpreter-post-exploitation-scripts.html"> Carlos "darkoperator" Perez who is writing and maintaining several Metaspoloit Meterpreter scripts to automate post-exploitation</a>.  During our own penetration testing exercises once we've gained access to a client, we can use that as a jumping off point to gain access to other systems.  I don't mean jumping off exclusively from the network necessarily, but maybe that client has some piece of information that leads us to your data, like a browser history, stored password, re-used password, or spreadsheet of passwords.  Don't even get me started on <a href="http://www.indepthdefense.com/2009/01/metasploit-visual-basic-payloads-in.html">anti-virus software and how its supposed to help...</a></li></p></p>

<div style="text-align:center;"><img src="http://tenable.typepad.com/.a/6a00d8345495f669e201156ff9cc4c970c-pi" alt="bass-holding.png" border="0" width="320" height="236" /></div>

<h4><p>Conclusion</p></h4>

<p>Organizations need to take a long hard look at their overall defensive strategies on a regular basis. Adjust your strategies and be adaptive.  I think the hardest part is keeping management up to speed.  It seems like just when we convince them that one technology is vital to your survival from attacks, something new or different crops up and changes the landscape.  Then, well, lather, rinse, repeat (we started with firewalls, to Anti-Virus, to IDS/IPS).  You need to identify security strategies that stand the test of time and put effort into them, such as: </p>

<p><li>Well-formed security policies</li>
<li>Procedures that enforce the policies</li>
<li>Vulnerability management programs </li> 
<li>System Hardening</li></p>

<p><br><p>The above items are like a net - they will always catch <strong>some</strong> fish regardless of the conditions.</p></p>

<p>Paul Asadoorian<br />
PaulDotCom Enterprises</p>]]>
        
    </content>
</entry>

<entry>
    <title>PaulDotCom Security Weekly - Episode 155 - June 11, 2009</title>
    <link rel="alternate" type="text/html" href="http://pauldotcom.com/2009/06/pauldotcom-security-weekly---e-13.html" />
    <id>tag:pauldotcom.com,2009://1.685</id>

    <published>2009-06-16T02:31:15Z</published>
    <updated>2009-06-16T02:31:17Z</updated>

    <summary>Special guest Peter Kleissner, WMIC command line fun, and more! Full Show Notes Direct Audio Download Hosts: Larry &quot;HaxorTheMatrix&quot; Pesce, Paul &quot;PaulDotCom&quot; Asadoorian, John Strand, Mick Douglas Audio Feeds:...</summary>
    <author>
        <name>Paul Asadoorian</name>
        
    </author>
    
        <category term="Security Weekly" scheme="http://www.sixapart.com/ns/types#category" />
    
    
    <content type="html" xml:lang="en" xml:base="http://pauldotcom.com/">
        <![CDATA[<p>Special guest Peter Kleissner, WMIC command line fun, and more!</p>

<div style="text-align:center;"><img src="http://pauldotcom.com//3426887143_e648d3792b.jpg" alt="3426887143_e648d3792b.jpg" border="0" width="500" height="375" /></div>

<p><a href="http://pauldotcom.com/wiki/index.php/Episode155">Full Show Notes</a></p>

<p><a href="http://media.libsyn.com/media/pauldotcom/pauldotcom-SW-episode155.mp3">Direct Audio Download</a></p>

<p>Hosts: <a href="http://www.pauldotcom.com">Larry "HaxorTheMatrix" Pesce</a>, <a href="http://pauldotcom.com">Paul "PaulDotCom" Asadoorian</a>, <a href="http://www.pauldotcom.com">John Strand</a>, <a href="http://www.pauldotcom.com">Mick Douglas</a></p>

<p>Audio Feeds: <a href="http://pauldotcom.com/podcast/psw.xml"><img src="http://pauldotcom.com/images/xml.png"></a>  <a href="http://www.odeo.com/channel/38062/view"><img src="http://pauldotcom.com/images/badge-channel-black.gif"></a><a href="http://phobos.apple.com/WebObjects/MZStore.woa/wa/viewPodcast?id=91472687"> <img src="http://pauldotcom.com/images/itunes.gif"></a></p>]]>
        
    </content>
</entry>

<entry>
    <title>Episode 155 Announcement - Getting stoned with Peter Kleissner</title>
    <link rel="alternate" type="text/html" href="http://pauldotcom.com/2009/06/episode-155-announcement---get.html" />
    <id>tag:pauldotcom.com,2009://1.684</id>

    <published>2009-06-11T14:43:17Z</published>
    <updated>2009-06-11T14:43:18Z</updated>

    <summary>The stream should be active around 18:45 EDT (6:45 PM Eastern), Thursday, June 11th. We should begin recording the live show around 19:00 EDT. Please keep in mind that these times are estimates. Our guest this episode is Ikarus Security...</summary>
    <author>
        <name>Paul Asadoorian</name>
        
    </author>
    
        <category term="Security Weekly" scheme="http://www.sixapart.com/ns/types#category" />
    
    
    <content type="html" xml:lang="en" xml:base="http://pauldotcom.com/">
        <![CDATA[<p>The stream should be active around 18:45 EDT (6:45 PM Eastern), Thursday, June 11th. We should begin recording the live show around 19:00 EDT. Please keep in mind that these times are estimates.  </p>

<p>Our guest this <a href="http://www.pauldotcom.com/wiki/index.php/Episode155"> episode</a> is Ikarus Security Software's <a href="http://web17.webbpro.de/index.php?page=peter-kleissner"> Peter Kleissner</a>. Peter will discuss his research regarding his "Stoned Vienna" project for Windows Bootkits, which will be presented at Black Hat this summer.</p>

<div style="text-align:center;"><img src="http://pauldotcom.com//stoned.jpg" alt="stoned.jpg" border="0" width="300" height="200" /></div>
<br>
Dark0perator will discuss <a href="http://pauldotcom.com/wiki/index.php/Episode155#Tech_Segment:__Carlos_.22Dark0perator.22_Perez_on_Running_wmic_in_shell">running wmic in a shell</a>.   

<p>Don't forget to join in on the IRC channel during the stream - we can take live comments and discussion from the channel!  Find us on IRC at irc.freenode.net #pauldotcom.</p>

<p>When active, the live stream(s) can be found at:</p>

<p>Ustream: <a href="http://www.ustream.tv/channel/pauldotcom-security-weekly-live-stream">PaulDotCom UStream Channel</a></p>

<p>Icecast: <a href="http://radio.pauldotcom.com:8000">PaulDotCom Radio</a></p>

<p>Please join us, and thanks for listening!</p>

<p>- Carlos, Larry, Mick, John, & Paul</p>]]>
        
    </content>
</entry>

<entry>
    <title>PaulDotCom Security Weekly - Episode 154 - June 1, 2009</title>
    <link rel="alternate" type="text/html" href="http://pauldotcom.com/2009/06/pauldotcom-security-weekly---e-12.html" />
    <id>tag:pauldotcom.com,2009://1.682</id>

    <published>2009-06-08T16:27:20Z</published>
    <updated>2009-06-08T16:27:22Z</updated>

    <summary>Live from Las Vegas, the entire crew gets together for the first time live on stage! Note: We did NOT figure out a way to get free access to &quot;adult&quot; programming at the hotel. Although we heard some reports that...</summary>
    <author>
        <name>Paul Asadoorian</name>
        
    </author>
    
        <category term="Security" scheme="http://www.sixapart.com/ns/types#category" />
    
    
    <content type="html" xml:lang="en" xml:base="http://pauldotcom.com/">
        <![CDATA[<p>Live from Las Vegas, the entire crew gets together for the first time live on stage!</p>

<div style="text-align:center;"><img src="http://pauldotcom.com//paris-tv.jpg" alt="paris-tv.jpg" border="0" width="500" height="375" /></div>

<p><strong>Note: </strong>We did NOT figure out a way to get free access to "adult" programming at the hotel.  Although we heard some reports that it was as easy going into the setup menu, add/delete channels, then using the regular channel up/down buttons.  So we heard...</p>

<p><a href="http://pauldotcom.com/wiki/index.php/Episode154">Full Show Notes</a></p>

<p><a href="http://media.libsyn.com/media/pauldotcom/pauldotcom-SW-episode154.mp3">Direct Audio Download</a></p>

<p>Hosts: <a href="http://www.pauldotcom.com">Larry "HaxorTheMatrix" Pesce</a>, <a href="http://pauldotcom.com">Paul "PaulDotCom" Asadoorian</a>, <a href="http://www.pauldotcom.com">John Strand</a>, <a href="http://www.pauldotcom.com">Mick Douglas</a></p>

<p>Audio Feeds: <a href="http://pauldotcom.com/podcast/psw.xml"><img src="http://pauldotcom.com/images/xml.png"></a>  <a href="http://www.odeo.com/channel/38062/view"><img src="http://pauldotcom.com/images/badge-channel-black.gif"></a><a href="http://phobos.apple.com/WebObjects/MZStore.woa/wa/viewPodcast?id=91472687"> <img src="http://pauldotcom.com/images/itunes.gif"></a></p>]]>
        
    </content>
</entry>

</feed>
