Welcome!

Government Cloud Authors: Pat Romanski, Elizabeth White, Liz McMillan, Dana Gardner, Gopala Krishna Behara

Related Topics: Government Cloud, Agile Computing, Cloud Security

Government Cloud: Blog Feed Post

Snowpocalypse 2010: Report From ShmooCon 2010

I spent Friday evening attending the FireTalks

Here I am at ShmooCon 2010 right in the middle of what people here in Washington DC are calling Snowpocalypse 2010. The Metro, busses, and taxis are all closed down and essentially the city has shut down. Being from Cleveland I find it a little laughable but it’s still a pretty bad storm. Well that hasn’t stopped ShmooCon from going strong.

This being my first hacker con it took me a little while to get acclimated to what kind of talks would be interesting and relevant to me as a network/firewall security guy. The first talk I found interesting was about an OWASP project called OWASP BWA (Broken Web Application). This project combines many of the web app testing programs into one place to help you sharpen your web app testing skills. You can install the iso in a VM as a place to test against. BWA combines Mutillidae, WebGoat, etc with some old versions of real programs like phpBB 2.0.0 and WordPress 2.0.0. Essentially it’s a one stop shop for broken web apps. The thing I found especially interesting was that it integrates with many WAFs like mod_security. This way you can test your WAF (Web App Firewall) to see how much it’s really blocking. This seems like a decent way to audit your WAF yourself. It’s good from time to time to test your firewalls to make sure they’re blocking everything they claim/should be.

The other talk that I found interesting was a demonstration of a Perl script that someone wrote to exploit the most recent VMWare vulnerability. Using an XSS attack the script (called gueststealer) can be put on to the hypervisor and it will steal the vmdk and vmx files of all the guest machines running there. So if you haven’t done your VMWare patches I suggest you start putting plans in place to get that done.

Another thing I’ve learned is a bit about lockpicking. I spent some time with some other con attendees learning how to pick from them. I got through a few 3pin locks and a Master lock rather easily. It definitely scared me a little how easy it was. The easiest lock to get through I thought was the wafer locks which you see a lot on filing cabinets and car doors. A set of wafer keys will get you into those cabinets and cars in literally seconds. It makes me glad our stuff is stored encrypted and and not in a filing cabinet somewhere.

I spent Friday evening attending the FireTalks. A series of 15 minutes talks not technically sanctioned by ShmooCon but with some talented people sharing what they know/learned/built. The most interesting of which being the SET v0.4 talk given by Dave Kennedy. He did a good job despite having real snowballs being thrown at him while he was presenting. I’ve seen his work on SET presented before but he has added some great features like exploits for Mac, Linux, as well as Windows which was the only OS supported before. He also put in self-signed Java applets so the user thinks the applet running is actually from the legitimate site that you just cloned. If you want to test how good your company’s security awareness policy is use SET (shameless plug: And once you’ve tested call us at Hurricane Labs to help you get to where you need to be).

I’m looking forward to more learing tomorrow and I’ll let you know what happens.

Talk to you then,

Matt

PS – You’re probably reading this on Saturday when I posted it. I didn’t post on Friday because the wireless here isn’t all that secure and I couldn’t pick up the wireless from our hotspot up in my room. In case you don’t know, NEVER use the wireless at a security conference. It’s just asking for trouble.

Read the original blog entry...

More Stories By Hurricane Labs

Christina O’Neill has been working in the information security field for 3 years. She is a board member for the Northern Ohio InfraGard Members Alliance and a committee member for the Information Security Summit, a conference held once a year for information security and physical security professionals.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


IoT & Smart Cities Stories
The platform combines the strengths of Singtel's extensive, intelligent network capabilities with Microsoft's cloud expertise to create a unique solution that sets new standards for IoT applications," said Mr Diomedes Kastanis, Head of IoT at Singtel. "Our solution provides speed, transparency and flexibility, paving the way for a more pervasive use of IoT to accelerate enterprises' digitalisation efforts. AI-powered intelligent connectivity over Microsoft Azure will be the fastest connected pat...
There are many examples of disruption in consumer space – Uber disrupting the cab industry, Airbnb disrupting the hospitality industry and so on; but have you wondered who is disrupting support and operations? AISERA helps make businesses and customers successful by offering consumer-like user experience for support and operations. We have built the world’s first AI-driven IT / HR / Cloud / Customer Support and Operations solution.
Codete accelerates their clients growth through technological expertise and experience. Codite team works with organizations to meet the challenges that digitalization presents. Their clients include digital start-ups as well as established enterprises in the IT industry. To stay competitive in a highly innovative IT industry, strong R&D departments and bold spin-off initiatives is a must. Codete Data Science and Software Architects teams help corporate clients to stay up to date with the mod...
At CloudEXPO Silicon Valley, June 24-26, 2019, Digital Transformation (DX) is a major focus with expanded DevOpsSUMMIT and FinTechEXPO programs within the DXWorldEXPO agenda. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive over the long term. A total of 88% of Fortune 500 companies from a generation ago are now out of business. Only 12% still survive. Similar percentages are found throug...
Druva is the global leader in Cloud Data Protection and Management, delivering the industry's first data management-as-a-service solution that aggregates data from endpoints, servers and cloud applications and leverages the public cloud to offer a single pane of glass to enable data protection, governance and intelligence-dramatically increasing the availability and visibility of business critical information, while reducing the risk, cost and complexity of managing and protecting it. Druva's...
BMC has unmatched experience in IT management, supporting 92 of the Forbes Global 100, and earning recognition as an ITSM Gartner Magic Quadrant Leader for five years running. Our solutions offer speed, agility, and efficiency to tackle business challenges in the areas of service management, automation, operations, and the mainframe.
The Jevons Paradox suggests that when technological advances increase efficiency of a resource, it results in an overall increase in consumption. Writing on the increased use of coal as a result of technological improvements, 19th-century economist William Stanley Jevons found that these improvements led to the development of new ways to utilize coal. In his session at 19th Cloud Expo, Mark Thiele, Chief Strategy Officer for Apcera, compared the Jevons Paradox to modern-day enterprise IT, examin...
With 10 simultaneous tracks, keynotes, general sessions and targeted breakout classes, @CloudEXPO and DXWorldEXPO are two of the most important technology events of the year. Since its launch over eight years ago, @CloudEXPO and DXWorldEXPO have presented a rock star faculty as well as showcased hundreds of sponsors and exhibitors! In this blog post, we provide 7 tips on how, as part of our world-class faculty, you can deliver one of the most popular sessions at our events. But before reading...
DSR is a supplier of project management, consultancy services and IT solutions that increase effectiveness of a company's operations in the production sector. The company combines in-depth knowledge of international companies with expert knowledge utilising IT tools that support manufacturing and distribution processes. DSR ensures optimization and integration of internal processes which is necessary for companies to grow rapidly. The rapid growth is possible thanks, to specialized services an...
At CloudEXPO Silicon Valley, June 24-26, 2019, Digital Transformation (DX) is a major focus with expanded DevOpsSUMMIT and FinTechEXPO programs within the DXWorldEXPO agenda. Successful transformation requires a laser focus on being data-driven and on using all the tools available that enable transformation if they plan to survive over the long term. A total of 88% of Fortune 500 companies from a generation ago are now out of business. Only 12% still survive. Similar percentages are found throug...