Author: roanokeinfosec

Dec 2016 – SANS Holiday Hack Challenge Party

/ roanokeinfosec / Leave a comment

santa1

 

 

 

 

 

 

 

The SANS Holiday Hack Challenge is going to be released on Dec 9th, we’re going to party on Dec 15th:

santa2

 

 

 

 

 

 

 

 

If you’re not familiar with the challenge it is an annual event put on by Ed Skoudis and his team. It is essentially a game that involves a series of cyber security challenges designed to get you to learn a wide variety of skills. The team does a phenomenal job. It has elements for all skill levels and hints as you go along the way. Last year’s challenge was EPIC and I think my wife was ready to kill me if I didn’t stop playing. I’ll warn you, it can get addictive.

166-addiction

The challenges are kept online each year so you can continue to play, even if you didn’t complete it by the deadline. Here is last year’s challenge if you want take a look: https://holidayhackchallenge.com/ This link will likely update to the 2016 challenge on 12/9. If so, here is a list of past challenges: https://pen-testing.sans.org/holiday-challenge/

I can honestly say, after playing last year, I have looked forward to this year’s challenge all year long. My wife, maybe not so much, since I had my head buried in my laptop for 2 weeks last time 🙂 Here are just a few of the things I either learned about, or added skills to while playing last years challenge: sed, awk, scapy, python, JSON, SQL injection techniques,  numerous web application pentesting techniques, Burp Suite, mondoDB, firmware extraction, DNS CnC and data exfil. And when I wasn’t pulling out my hair, I had an absolute blast doing it!

Join us on 12/15 to work on the Holiday Hack Challenge. It is for all skill levels and you will be surprised how much you will learn. We will have wifi access available so everyone can work on the challenge. If you are a student and want to participate but don’t have a laptop, let us know and I will make arrangements so you will have somethig to work on.

To make the best use of the time at the party, go ahead and sign up for an account once the challenge is posted on 12/9.  You can start playing anytime after you get an account. I  also recommend having some sort of virtualization software on your laptop such as VirtualBox or VMWare Player, both are free. And having a VM running Kali set up. Or if Kali is your main OS you may want to have a Windows VM setup. All of that will aid you in the challenge.

gladiator

As usual we’ll have beer/soda and snacks. Just bring your brains because you’re going to need them.

dan-akroid-santa

The meeting will be at 5:30pm on 12/15 at R&K Solutions, 2797 Frontage Rd NW, STE 1000, Roanoke, VA 24017. Google Maps.

Notes from Oct 2016 Ransomware Meeting

/ roanokeinfosec / Leave a comment

notes

Special thanks to Brad at malware-traffic-analysis.net (http://www.malware-traffic-analysis.net/index.html), we used his examples for the October meeting. His site is an excellent resource for learning. He also posts updates and other malware related info on his twitter @malware_traffic.

Here is the traffic we walked through: http://www.malware-traffic-analysis.net/2016/05/13/index.html

And here is the solution: http://www.malware-traffic-analysis.net/2016/05/13/page2.html

To use Security Onion to analyze the traffic you can get the Security Onion ISO here and install it in a VM: https://github.com/Security-Onion-Solutions/security-onion/blob/master/Verify_ISO.md

Here is how to replay the traffic in Security Onion for analysis:

We also had some discussion on how to identify what different types of files really are, regardless of what the extension is; and also how you can carve them out of traffic streams using hex editors. To determine file types you use the “Magic Bytes”:  https://blog.netspi.com/magic-bytes-identifying-common-file-formats-at-a-glance/

Here are some resources on ways to extract files (file carving) from pcaps:

We talked about some quick ways to get info on IPs and domains when researching potential incidents. Here is a quick hit list:

November 2016 – Continuous Pentesting

/ roanokeinfosec / Leave a comment

continuous-battle

The next RISE meeting will be at Virginia Western community college in the Natural Science Center (directions are below). Our speaker will be Darren Manners from SyCom and he will be discussing Redspy365 and the rise of automated pentesting.

redspy

Darren designed this automated approach and he has a list of certs longer than a Nascar race. Come out and learn from one of the innovators in the field.

Here is Darren’s Bio:
Darren is the Lead Penetration Tester for SyCom Technologies, 9 years Royal Naval Intelligence (Communication Technician (Analyst)) Worked for 15 years in various security roles with VAR’s and education. Certifications obtained include; SANS Cyber Guardian (Red/Blue), SANS GSE (#42), CCIE sec (18929), OSCP, CISSP, CISA and others. Written papers on iPhone backup files for penetration testing and anomaly detection using user agent headers. Designer of RedSpy 365, Sphere of Influence (security visualization tool) and Ice-hole. (email phishing tool)
We will be meeting at our usual time of 5:30 pm on November the 10th.
Snacks and drinks will be provided as always.

Location: Charles L. Downs Natural Science Center, Roanoke, VA 24015

Oct 2016 – Your Money or Your Data

/ roanokeinfosec

robbery-ransomware

Join us for an interactive forensics scavenger hunt analyzing a pcap with some of the latest variants of ransomware. We will be looking at how Angler EK can, and often will deliver multiple infections such as Locky, CryptXXX and even some unknown goodies.

This will be an interactive session and I will try to come up with some small goodies to give away for those that solve the pieces to the puzzle first. Please bring a laptop with Wireshark installed to participate. Wireshark is a free protocol analyzer and an excellent tool for you toolbox. You can download it here: https://www.wireshark.org/

If you aren’t sure how to use Wireshark you can review the notes from our May session about Wireshark. There are also some good tutorials on Youtube. These both use the old Wireshark interface, the new one looks a bit different. All of the concepts are the same, some of the menus have just been moved around. If you have it installed, and are familiar with it, the session will be a lot more beneficial to you.

The meeting will be on 10/13 at R&K Solutions, 2797 Frontage Rd NW, STE 1000, Roanoke, VA 24017 at 5:30pm. Google Maps.

Presenter Bio:

Nate Sykes is the IT Director at R&K Solutions. Nate has worked in all areas of system and network administration. He has been involved in different aspects of security for the last 6yrs, mostly involving prevention and detection. He holds GSEC, GMON and Security+ certifications.

Twitter: @n8sec

 

Sept 2016 – Bad, Bad USB

/ roanokeinfosec / Leave a comment

Screen_Shot_2014-08-01_at_4.55.11_PM_1024x1024

We are in for a treat in September! Jeremy Dorrough is going to do an updated version of the presentation he did at DEF CON last year.

woo hoo

USB Attack to Decrypt Wi-Fi Communications

Jeremy Dorrough Senior Network Security Architect / Genworth Financial

The term “Bad USB” has gotten some much needed press in last few months. There have been talks that have identified the risks that are caused by the inherent trust between the OS and any device attached by USB. I found in my research that most of the available payloads for the USB rubber ducky would be stopped by common enterprise security solutions. I then set out to create a new exploit that would force the victim to trust my Man-In-The-Middle access point. After my payload is deployed, all Wi-Fi communications will be readable, including usernames, passwords and authentication cookies. The attack will work without the need of elevating privileges, which makes it ideal for corporate environments.

usb-flash-drive-skull-ring-2-Check Flash

Bio: Jeremy has built his career around protecting assets in the most critical IT sectors. He started his career working in a Network Operations Security Center for the US Army. He then went on to work as a Network Security Engineer defending Dominion’s North Anna Nuclear Power Station. He is currently a Senior Network Security Engineer/Architect at Genworth Financial. He is a MBA, CISSP, CEH, GIAC GPPA, CSA CCSK, ABCDEFG… Blah Blah Blah.

Jeremy has spent over 10 years researching and implementing new ways to defend against the latest attacks. He enjoys creating new exploits and feels it makes him a more well-rounded defensive Security Engineer. He is happily married and a father to two soon to be hackers. When he’s not staring at a command prompt, he is busy building and driving demolition derby cars.

Twitter: @jdorrough1

ECPI was kind enough to host this month, the meeting will be on Sept. 8th @ 5:30pm.

August 2016 – Show Me The Money!

/ roanokeinfosec / Leave a comment

Our own Rob Garbee (Bio below) will be presenting Thursday,  August 11th, at R&K Solutions (Google Maps). Rob will be talking about 5 steps to getting the funding you need for IT Security. As we all know getting the funding for personnel or security tools can often be difficult. If you haven’t had a breach everyone often assumes everything is fine. Why do we need all this security stuff? Rob will cover some strategies to win the battle with management to justify the security funding you need.

The_Art_of_War_Running_Press

Bio: Robert Garbee works as a Technical Security Analyst with a mid-tier medical service provider in Roanoke, VA.  In this role, Robert is responsible for managing risk and compliance aspects for both HIPAA related activities and overarching business concerns.   Robert has more than 20 years of experience in information technology and during that time has held IT positions in the banking industry, DOD contracting, and most recently HIPAA security and compliance.  Robert is a graduate of Liberty University with a BMIS degree and holds an ISC2 CISSP certification.  Prior to starting his information technology career Robert served seven years as a crew chief on C-5 Galaxies in the United States Air Force.

June 2016 – Security Architecture: Then and Now

/ roanokeinfosec / Leave a comment

then-and-now

We are ready and set for our next meeting on June 9th.  This meeting will be hosted by our friends at SyCom Technologies:

SyCom Technologies
2800 Electric Rd #103c
Roanoke, VA 24018

Google maps

We will start at our usual time of 5:30pm.  Our speaker this month is Allen Surface and his subject will be Security Architecture: Then and Now.  Allen will walk us through how Security Architectures have changed over the years, where they are headed and how we need to plan for these changes.  Allen is a founding member of RISE and has worked for the past eight years as a solutions architect with SyCom Technologies.  He is currently focused on designing network and security solutions for various customers in both medium and large scale networks.  Prior to moving into his Security Architect role Allen was responsible for implementing hardware solutions such as Intrusion Prevention Systems, Firewalls, and DMVPNs.   What this says is that Allen is one of us!  He is a down in the trenches kind of guy that is willing to share his experiences with us.  Come on out and support one of own and hear his take on where we are all headed as IT Security Professionals.

Taming the Shark

/ roanokeinfosec / Leave a comment

105687

Another great meeting with a lot new faces and a lot of familiar ones. Big “Thanks!” to David Raymond (@dnomyard) for presenting and ECPI for hosting. David was kind enough to provide us a copy of the slides, you can grab them here:

fun_w_wireshark

If you want some more practice with pcaps and malware definitely check out: http://www.malware-traffic-analysis.net/  Just be careful if you export HTTP Objectshazmat out of those as they do contain actual malware. Don’t infect yourself! 🙂

Brad (@malware_traffic), who runs that site, does an outstanding job posting tutorials as well as breakdowns of current samples and traffic patterns. He joined Unit 42, Palo Alto’s Threat Research group,which does some excellent in depth write-ups on malware. This write-up on Locky ransomware and Nuclear EK is a good example: http://researchcenter.paloaltonetworks.com/2016/03/locky-ransomware-installed-through-nuclear-ek/

IMG_4053David Raymond presenting

IMG_4057David,  Michael and Rob

IMG_4056Just talkin’ shop

Also, don’t forget the RBTC Vulnerability Management forum is coming up as well as RVASec. If you know of other “local” security events please email roanokeinfosec@gmail.com and we will get them posted to the site.

Last but not least, if there is a topic that you would like to request for a presentation please let us know. We will do our best to line up a speaker. Or if you can speak on a topic please let us know and we’ll get you in the line up!