Data vs Life.

In my opinion, data that people generate in terms of the movement of their lives should not be owned by gatherers of this data. Photographs are a separate argument but will eventually become part of this too. Google has long had an engine to connect cell phone photos to objects.

Some of my friends accuse me of conspiracy theory stuff, but I really am not. I do not subscribe to the idea of a separate little group that runs the world (I am not by definition a Republican). I do think "the invisible hand of the free market" nutjobs are being socially engineered. And experience shows there is always one more legal level to reach for.

Collecting data is one thing because we give it up of free will. If database management systems could be controlled by one entity, we are all screwed. But it is after all a brilliant business play.

http://developers.slashdot.org/story/10/01/09/136244/Why-Oracle-Cant-Easily-Kill-PostgreSQL?from=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+Slashdot/slashdot+(Slashdot)

Relativity theory of training and travel

Instructors that travel confront several issues and there are both good and bad. I always chose to view it optimistically. A bootcamp is just one long day at work, but then being at home is several days in normal time that I can enjoy with my family and keep my skills sharp for the next class.

But this is a relative view, since the one long work day I share with students is still 4-8 (or more) days for others in the real world. It is something that can be managed but requires specific effort.

If you are a student preparing for a bootcamp class make sure you do two these two things above all else:

1. Tell your family, friends, about it and explain the investment. You will drop off the planet for a while in their concept of time, they have a right to know why you are doing this and what you are getting out of it. They will become your encouragement and support structure if you establish expectations in advance. At work, delegate all pertinent tasks and remind your boss to leave you alone. "If he is paying for it, you want to make the most of it" it is a simple but effective argument.

2. Set a designated time to call someone at home each day. Spouse, children, friends, or coworkers. Stay connected but be in control of this communication. No emails or text messages during the afternoon lecture as that will cost you 10-15 questions on the exam at least. But if you show you are willing to make time to contact the people who are important to you, it will be easier for them to understand rule number 1.

Travel training for a living is both very difficult at times and extremely rewarding. For students that only do this occasionally, your instructor can be a great resource for how best to approach this area. Your personal comforts and family needs must be part of the equation if you are going to be able to dive into the studies distraction free.

Preparation makes this possible.

Considering Privacy and Copyrights

My friend Mark brought up one of my favorite topics "Airport Security" and this always leads to a discussion of privacy rights, another of my favorites.

It is my belief that no one should legally hold the copyright to information about personal lives or habits. Consider the following statement: "We’ve found that they might also suffer from an illusion of control bias that makes them unable to distinguish publication control from control of access to personal information"

Your credit report, and all of its contents should belong to the human subject. You shopping patterns, search patterns, and GPS patterns should also be owned by you. I don't think this the same as a photograph or sound recording, which are completely different debates.

We (I included) give up so much data in exchange for free services (such as posting on this blog), and it would be intellectually dishonest to think these products would not turn into a business model. Be careful, if we are asked to sign away licenses how far would that fine print go?

http://www.computer.org/cms/Computer.org/ComputingNow/homepage/2009/1209/W_SP_NudgingPrivacy.pdf

Taking Tests, Social Engineering and Acting....

My 2.6 year old daughter was approached by a talent scout in a shopping mall. The friendly man said, "She is cute, she should be in ads or movies." He gave me his card, I gave my number and a few weeks later we had an appointment.

On a lark we went. No money for this my wife and I agreed. It is either a scam or an adventure.

When we got there the agent said "Before they can read, they only go off looks and you never know what they want. But you (considering me) could be an Italian, Latin, French, Irish ..... 30% of all movies are film in Utah because its a non-union state and all they have here are blond haired blue eyes. You have a real shot.

He asked me to read a few lines but here is the good part. During this interview the agent subtly explained two things; "When they ask you to mark, say your name and the agent that represents you" the second; "Don't memorize the lines, just do the scene".

After some more small talk about what extras are paid and so on, he gave me the lines and left the room. My assignment was to look them over for awhile and prepare a short demonstration.

When he came back in he said "Mark!" I stated my name and his company. "Action when ready". He was clearly just seeing if I could follow the most basic of instructions. Internaly I laughed because so many of my students are too busy checking email or sharpening their highlighter weapons to listen. I notice this and utilize the data in every class.

I read the scene, I sucked because I was being tested. Just playing around for fun I could do that scene pretty well. I thought about students taking tests, its not much different really. During class reviews we prove this over and over that when not being tested people usually exceed expectations.

He said "Let me help you and lets try this again...." then he proceeded to create an emotional place I really didn't want to go that fit the words of the script. I did better this time, but still with hesitation and again didn't follow the second instruction. I tried to memorize and pass the test rather than just doing it.

He tried to sell me acting classes.

This is what trainers understand; some students come to learn and others come to be made to realize they already "know" and just have to be more flexible. In both cases, the mind has to be opened and challenged, made uncomfortable at times, then encouraged.

Its far easier on my side of the projector where I usually sit.

We went there on a lark because my daughter was recognized in a mall and what parent doesn't think their kid is a potential rock star? The switch happened and perhaps I was the target all along. Clever social engineering notwithstanding the price is actually reasonable. Not every risk is a threat; I might do it just for fun. If I start acting out movie scenes in my classes like my friend and mentor Larry does, you will now understand where this comes from.

What I took away from this most of all was a reminder I give to you: Next time you take a test, don't be tested, just answer the questions and see where you are. You might pass or you might fail this particular benchmark, but that is all it is. You ultimately decide your own settings and spoil in the rewards of earning having exceeded them.

But you first must play the scene and find out where you rest.

Holiday wishes:

As I write this I am enjoying another Stromboli in a restaurant in Philadelphia. They claim to be the inventor, and I would not doubt them because it is awesome. I always try to eat the local food in new places. Its a benefit of the job and I must say that occasionally this is a mistake, but 9 out of 10 times this is far better than the standard chain blah.

For one thing, you get to hear a few stories.

I am in the middle of a three week 20 teaching days in 21 days (the one day off is travel) stretch of 10 hour days and the sound of my own voice is getting on my nerves. But I love the challenge. The students are always people I am happy to have met and today we completed a CISSP class. Tomorrow they will take their exams while I take a train to DC and prepare for a new set of ECSA/LPT students. I also miss my family today, and that puts me in a reflective mood.

As I wait for my order and nibble at some garlic bread I overhear a conversation between the waiter and a regular, each have thick “Jersey” accents. I enjoy accents, and this one definitely has its own special character that seems to be in touch with living through both hard and good times. The customer says he just got laid off after 40 years at the same company.

My political beliefs about what the source cause of things like this are and the many debates I enjoy with my misguided friends that disagree are suspended for this moment. I would like to think that his experience would be good for something. So I am hoping to overhear some good news in this story.

In reflection I wonder that with all of the complaining I do about things that are beyond my control there is one thing I can absolutely do as an activist, as an evangelist, and as a teacher by profession. I can tell people every chance I get; "Pardon my bias; but one way or the other, please keep learning new stuff. Change it up, expand and live. Be available for challenges, sacrifices and changes. They need it, and you need to do it".

To be fair this can be a hard thing to do sometimes. I do not feel that those who choose a simpler life should be punished for it. There is always a part of me that frankly wishes for it on some days. And this gentleman, 40 years a wise expert in what he knew how to do will either have to find a new path or he might just get a job tomorrow with the competitor. I don't know. I never got to hear the rest of the story. But I cannot help but wonder, if at some point did he just stopped growing?

I have no idea if my conclusion is at all relevant to this man's situation or a reflexive response to the predicament I find myself in. But …..

My holiday wish to all; Stay curious. Learn new things next year and never underestimate your capacity to do so. Then next year, share what you know. In this world this is your only "job security".

Whitehouse security breaches and Balloon hoaxes

The two that broke into the whitehouse have done this sort of thing before, they take the Captain Janks idea (a frequent crank caller to popular media shows and contributor to the Howard Stern show) a few steps further by actually being there. In this case, simple social engineering accomplishing a physical breach in places this absolutely should not happen is the joke.

The recent balloon hoax, where a large balloon was launched into the sky with a fictional child trapped in the basket below (he was later found safe but hiding) had caused rescue efforts to waste resources and time. The media was fixed on it in a way similar to watching OJ Simpson's Bronco glide down the road doing nothing for several hours.

Tiger Woods, popular golfer and manicured by a force of public relations people to be the perfect celebrity, showed he was human and made a "gasp" mistake. It was an interesting one, after a fight with his spouse he crashed his car into a tree. Tiger is doing the opposite of the others in controlling the story, he is trying to hide from it. He is worth an estimated Billion, and there are a lot of people that suck off his success that do not want his archetype tarnished. This only makes the media more curious.

ISOC recognizes six elements to social engineering: Authority, Scarcity, Liking, Reciprocation, Commitment, and Social Proof. Perhaps a seventh principle should be added: Entertainment.

Should Windows be Free?

There are different meanings of "free" in this conversation. As the phrase goes "Free as in speech, not as in Beer". In one case free refers to open sourcing the code, and in the other, it means being available free of cost or licencing fee.

I suppose my question could be interpreted either way. In the free of cost point of view, they did with IE back in the Netscape era, and giving away Windows would certainly impact competition with Linux and Apple.

Some argue that Microsoft's own practices propagate much of the security issues we have today for example, if Windows was free this wouldn't happen (http://www.pcmag.com/article2/0,2817,2355982,00.asp). We would also not have to worry about Virtual Machines being considered entirely knew instances of the computer. The world would be such a simpler place if there was no need for hacked copies of Windows operating without security updates. How much of the botnet activity on the Internet can be traced to this? Consequently, I would be out of a job, as would entire research companies.

I won't get into the economic dilema's of solving problems entire industries are built around, but the term "disruptive technology" comes to mind. What would be more disruptive than an Open Source Windows OS? If Windows 7 was believed to be secure, and the average price of a laptop or desktop was nearly a factor of 10 less than Macintosh ($300 vs $3000 after hardware upgrades) how would that impact Apple? If the Open Source community were willing to use Windows would Linux be necessary?

Either way, an alternative revenue model would have to be created. Programmers deserved to be paid too. Whether this would be any better or worse than what we currently deal with would remain to be seen.

CEH Review Guide is Released !!

The process of writing was extremely interesting. Being my first one, I learned alot that will make the next one twice as easy so I definitely hope to do this again. Thanks to Larry, Nick and Barry for their help along the way.

Cengage was a great publisher to work with as well. So if any others out there get the chance to write for them, I highly recommend it.

The book is available on Amazon. The ISBN number is: 1435488539

A Reminder About Using Wifi On The Road

I while back I performed a test using my AirPcap NX on an airplane that was offering GoGo inFlight service. I sampled about 3 minutes of traffic in Wireshark and parsed it using a tool called "Network Miner".

Short story, I saw that people were using Facebook and in two cases could connect photographs I captured to people on the Airplane. Others were booking Hotels for their business trips (persumably), and some were login into places that revealed passwords because they did not first establish a secure tunnel. That as far as I went with the test, the point was made.

I got to thinking abut how many mobile devices such as Cell phones come with WiFi connectivity. Perhaps to save on data costs, they could be set to automatically switch to Wifi when a network is available. This means a cell phone that is normally extremely difficult to breach, would be placed on an unsecured network and become susceptible to sniffing, MiTM attacks, and the whole gamut. Why on earth would anyone want to do that? Buy an unlimited data plan and turn WiFi off.

Keep in mind that public wifi is still public wifi, even when you are using a phone instead of a laptop. The Airplane technology mostly wants you to stay on the gateway long enough to give up a credit card and pay the $10, after that, you are one your own unless they change the technology.

Teaching Abroad - Germany

I recently completed a trip to Germany to teach a CEH class. This was my first experience there. It turned out to be a wonderful place and the entire process could not have been better or more enjoyable.

A couple noteworthy items for future reference:

The battery life of a netbook + its portability were invaluable on this 15 hour flight. I got a lot done and hardly noticed the time.

When renting computers for a classroom in another country, specify English. Our version of XP in the classroom computers was German, and so were the keyboards. We worked through it, but and thankfully the students were good sports about it and mostly thought it as funny.

Also, get to the location a day early or leave a day later. The class will take up all your time, so be sure to play tourist and see some things too.

Third, since most of what we do in CEH is illegal in Germany, even to possess the tools in some cases.......well I am not quite sure what to about that :)

Intense School featured on "The Today Show"

We were asked to do a piece on the insecurity of wireless networks. The cameras came into our CEH class for some footage, and I was interviewed, but none of that made the final cut. Our friend Chris did a wardrive in Houston and did a great job giving them the demos and soundbites they were looking for. It turned out to be a pretty good piece.

http://today.msnbc.msn.com/id/26184891#33530153

Should practices tests be perfect?

We have had many conversations behind the scenes about this topic. There are no shortage of questions about the ethics and proper use of practice questions in technical training. I believe in them, but should they be always perfect, clean and error free?

A perfect practice exam is far less confusing to a student, and there is no question that incorrectly marked answers keep a learner off balance. But the other side to that coin is that a few curve balls, perhaps 3-5 in 100 questions, discourages memorization and promotes discussion in class.

Ultimately whether or not practice questions are an effective learning and assessment tool is almost entirely left up to the way a student handles them. Memorizing is actually the hard way to do things, and it leaves the student rigid and unprepared if the actual test is off by as much as one word on a relatively simple question.

Understanding the exam concepts is the shortcut, because much of the time even questions where all the noise and trivia are not familiar to the test taker, the answer can be figured out from knowing what the question is trying to communicate.

Many will disagree and I will be criticized on evaluations for having practice exams with a few errors in them, but I am for anything that requires the student have to assess their own confidence in how they are really understanding the material. This is not to say there will always be errors in my tests, but there might be, I'll never tell.

Two Tenents of Teaching

There are two things a person must accept before agreeing to be an instructor:

You cannot call in sick during a bootcamp. (This one comes to mind because I am battling a headcold that all the masking agents in the world can't get rid of)

The second one is a bit more complicated. To borrow a phrase from "A Course in Miracles"; All human expression is either love or a cry for help".

This might be a bit dramatic for a classroom environment, but the point is that most of the time a frustrated student is really just a curious one that hasn't found a way to line up their perceptions with the material. The instructor must never take this personally, even if the he is personally attacked in the process or the course itself is scrutinized to the point of missing the point.

Usually one good eye to eye conversation can resolve this issue. Do not wait until the last day of class to have it. Note to students; ask for this conversation. Instructors; watch out for the need for one and be proactive about it. The outcome is almost always improved if the right amount of empathy is involved.

Hacker Halted Wrap-up

This morning I have returned from HH and must get back to work. As always, I had a great time at the conference, and want to congratulate EC-Council of their hard work putting it together. Some of the highlights were:

Awards: Steven DeFino is "CEI (Certified EC|Council Instructor) of the Year" for the third year in a row and Intense School is the "North American Authorized Training Partner of the Year" for the second year in a row.

Cruise: Terremark sponsored a large yacht and invitied 350 V.I.Ps aboard for a 2 hour cruise that finished at a club in Downtown Miami. It was a perfect evening and the crowd included CEHs from all over the world. It was a party, 'nuff said.

Talks: Too many too good ones to write about them all. Its always fun to take a few days to listen to others talk about security for a change, and I picked up on a lot of new ideas and learned of some things I will blog more about as I research them further. Virtualization and cloud computing, Cyberwarfare, and online fraud were topics that received coverage from a view different angles.

In short, try to plan on being there next year if at all possible. I think you will be glad you took the time and leave with much to think about and inspired energy to expand your studies into new directions.

Hacker Journals - Examples fast and noise free

One of the most frequently asked questions I get is "What is a good website I should be visiting for news, downloads, videos and all things related to security?"

The intent behind this question has changed a bit over time. It used to be that I wanted to provide a long answer involving podcasts, blogs, rss feeds, ways to search YouTube for videos and explain the hazards of downloading "hacker tools" without looking through the source code first.

These days, time constraints are increasingly discouraging security professionals from staying informed. There are two many resources and too much noise to get through. Here is the solution:

http://www.hackerjournals.com

This is a clean, easy to read, noise free aggregation site that combines all of the above into one resource. Its still a fairly new site, so give it some time to fill in more content. But I highly recommend it as a book start page or favorite already.

Series (2 of n): How practice questions work

This series was introduced in a post on August 5th.

This installment address the approach to creating the questions. Reverse engineer the process; the best way to understand technical exams is to try to write one yourself. Keep in mind the following criteria:

You want about a 65% average score the first time they take it, assuming an appropriate audience. Too easy a test is a waste of their time and to difficult a test is a transparent display of how much you think you know or can look up on Google. The practice exam is a teaching tool, first and foremost.

Now, consider this simple approach to just one individual question:

• What do you want the tester to prove he understands?
• Is this better asked directly or indirectly?
• Should they answer the right answer or illiminate the from the wrong ones?
• Is this a question where distractin noise is appropriate, or should you just keep it short?
• What objective of the final "real exam" goal is this practice preaparing them for?

Every practice question can take from 10-30 minutes to create from concept to explaination. In a business day then it would be production to crank out 30 questions. The real questions might have hours of argument from a board of brains behind them. These aren't just made up random trivia, each must be thought through. Each question and false choice has a purpose.

Now, as you are studying for your next exam....try to anticipate what really seems to capture the truth and presence of the class. Step into the shoes of the psycho(metrician) and ask what would it take to fool...you.

Process Oriented Programming

Often times in the CISSP and Security+ classes we are confronted with the need to come up with examples that illustrate detailed terms that don't translate well into "business language".

Some things just suck if they were to happen. And explaining this to a cost/benefit manager is sometimes an exercise in awkwardness for both parties. Here is a good example for the "programmery" (my term) knowledge domains in CISSP. The ones where we get into the weeds about registers and processes and so on:

Follow this link http://www.physorg.com/news169133727.html

This is a practical example of injecting instructions to a process while it is running, voting machines make an example everyone, not just those that work on the secret systems most will never see can understand.

"How to solve it"

While researching a test question about virus scanners I ran across these ideas regarding "heuristics". It came from a book written in 1945 called "How to solve it".

These are probably the best four suggestions I can give a student on how to deal with the CEH/ECSA/LPT materials. Remembering first off that perhaps the most fundamental heuristic is "trial and error".

1. If you are having difficulty understanding a problem, try drawing a picture.
2. If you can't find a solution, try assuming that you have a solution and seeing what you can derive from that ("working backward").
3. If the problem is abstract, try examining a concrete example.
4. Try solving a more general problem first (the "inventor's paradox": the more ambitious plan may have more chances of success).

Series (1 of n): Using practice exams effectively

Part of the current book project I am doing involves writing practice questions. In doing this I have put a lot of thought into the topic and wanted to share some of that here.

First, just to get the controversial part out of the way, I believe in practice questions. They are ethical and it is fair to try to get them as close to the real thing as possible, at least in terms of scope, style, and difficulty level of the real test. That is my opinion and other instructors might disagree.

A risk of providing practice exams is realized if the student can subconsciously understand them to mean "The instructor is essentially taking this test for me, if I do what these questions say and I will pass." I say subconsciously because I have never heard a student actually say this out loud, but I can tell by the way they ask questions about the exam and their general preparation habits when this perception is taking hold. This is the source of the understandable criticism of practice tests, but it can be managed and handled correctly.

As I write the questions for the book, I am placing in some controls. In the interest of security-open-source-minded full disclosure I don't mind explaining them. The best cryptosystems are well known and understood, but are still hard to solve. That is the good model for practice exams as well. Along the way, discussions about real exams are likely to be brought up as well.

To keep the blog postings reasonable in size, I will address specific topics of practice exams, and how to get the most out of them over the course of several postings. In case you are working on some right now start with this thought:

“Practice exams are extensions of lab, lecture and other learning modes. Not replacements for them, and not shortcuts to avoid them.”

Never forget to enjoy ideas

On a personal note, this weekend was a birthday celebration for both me and my daughter. I am 40, she is 2. A recent student is enjoying a commencent for his bachelores degree with his family in AZ. In one weekend he is recognize for both this and a new ECSA certification. He also has a great personal story.

I am on cloud nine for a number of reasons.

My daughter's presents involved a lot of assembled parts. She (who understands remote controls, cell phones, and will not fall for fake laptop toys verses dads office computer) tried to help assemble her own presents. Those moments were so much damn fun I can't begin to get into it.

I was reminded of a quote from Mr. Rogers many years ago; "Play is serious business for children. It is how they learn" (If you don't know who this is, please wiki 'Mr Roger's Neigborhood)

Is this much different for adults? We often forget to play with ideas. We forget to have fun doing what we do. Even the most dry and boring compliance thing can be approached with the curiosity and wisdom of a child that has not yet learned the "I don't care about this crap, just give me the answers to the test" attitude. Our discipline depends upon this.

Nuance in information assurance is a Mandelbrot formula. There is always something else buried in the details. The only way to enjoy tackling a challenge is inderstand how to play with it.

My friend Jason that just graduated, has this spirit too. I was glad to have met him as he is the very definition of this principle. My daughter is a person I cannot possibly be more proud of as she teaches me what it is like to grow up in this age, and reminds me about what hacking is really about.