Packet Pushers Podcast» Healthy Paranoia

It's the latest dudilicious episode of Healthy Paranoia! This time we'll be covering the topic of information sharing and analysis centers (ISAC), specifically in the research and educational networking sector, aka REN-ISAC. Joining Mrs. Y on this adventure into the land of dudeness is Wes Young, REN-ISAC Principal Security Engineer and Architect (El Duderino), Keith Lehigh, Lead Security Engineer from Indiana University (the Duder) and bromance expert and developer, Liam Randall. We'll explore subjects such as: The history of ISACs. The benefits of information sharing or crowdsourcing security. Which intelligence feeds are better: paid or free? Mrs. Y's bandwidth envy. Why mixing beer, zombies and lawyers is always a bad idea. As always, Healthy Paranoia is security-douchebag-free, a place where nerds run free and the dudes abide. Show Notes: REN-ISAC Security Event System The Collective Intelligence Framework (CIF) Collective Intelligence Community Farsight Security, formerly Internet Systems Consortium Security Information Exchange (ISC SIE) Intelligence Exchange in a Free Market Economy by Wes Young Presidential Decision Directive 63 and Homeland Security Presidential Directive 7 Anti-Phishing Working Group Assorted presentations on CIF

Get ready for another nerdilicious episode of Healthy Paranoia featuring Andrew Case, digital forensics researcher and a core developer for the Volatility Framework. Liam Randall joins Mrs. Y. as they discuss topics such as: The difference between forensics and incident response. Malware analysis vs. reverse engineering. Why you should treat a compromised system like a leper flesh-eating zombie.* UPDATE: Andrew Case was just named "Digital Forensics Examiner of the Year" at this year's Forensics 4cast Awards. Show Notes: Forensicswiki.org Sleuth Kit and Autopsy Chaos Communication Congress RegRipper by Harlan Carvey Brian Carrier Registry Decoder Remnux Kali Linux (because Backtrack is so last year) Windows Forensics email list Volatility Labs Memory Forensics Training Defeating Windows Memory Forensics Joanna Rutkowska Malware Analysis: N00b to Ninja in 60 Minutes by Grecs FTK - Forensic Toolkit EnCase Cuckoo Sandbox F-Response *Someone was offended by my use of the term leper, because technically, leprosy isn't that infectious. Unless you happen to hang around gangs of armadillos.

Welcome to another lofty episode of Healthy Paranoia where we take on the profound problem of security certifications, specifically the Certified Information Systems Security Professional (CISSP). Joining Mrs. Y and Greg Ferro is an illustrious cast of infosec luminaries, including; well-known security analyst Wendy Nather, Novainfosec.com founder Grecs, IPv6 fanatic Joe Klein, and the enigmatic Jay James. We cover topics such as: Cert Junkies How listening to this podcast will fulfill your CPE requirements Cloud constipation and why Greg Ferro is like Roto-Rooter That Richard Bejtlich's name should always be invoked in respectful, hushed tones (genuflection optional) Show Notes: The Post that started it all, "Going Paperless." A take on professionalizing security by Dave Shackleford with a response from @451's Wendy Nather. A post from Rich at Securosis, "Why I'm Not a CISSP." "Your CISSP is Worthless - So Now What?" by Dave Shackleford "10 Reasons Why Security Professionals Get Hired" "What makes a good information security professional?" April Fool's CNIP certification DoD 8570 NSA National Centers of Academic Excellence

Announcing the latest episode of Healthy Paranoia from Mrs. Y featuring the case of Terry Childs, the infamous former Network Administrator arrested for refusing to provide passwords for San Francisco's FiberWAN system to management. She's joined by Jeana Pieralde, Chief Security Officer for the City and County of San Francisco, along with two members of the Packetpushers executive board, Greg Ferro and Ethan Banks.* Stay tuned for a Kickstarter project to fund the Lifetime Channel movie. Show Notes: Terry Childs Wikipedia entry "After verdict, debate rages in Terry Childs case" from Computerworld "Terry Childs juror explains why he voted to convict" from Network World "A year after Terry Childs case, privileged user problem grows" from Computerworld "Judge Won't Lower $5M Bail for SF IT Administrator" from PC World The Introvert Advantage: How to Thrive in an Extrovert World Daniel Goleman and Emotional Intelligence Kasper Search *This program contains excessive literary references, unnecessary sarcasm, lefty-British politics, and possibly gratuitous references to unicorns. Parental discretion is advised.

Join Mrs. Y, Taylor Banks and esteemed Nerd Captain Ivan Pepelnjak for another exciting episode of Healthy Paranoia!  In this installment, we discover the day the security industry stood still for Bro IDS with expert and project contributor Liam Randall. Just a few of the fun facts you'll learn include: The real meaning of "bromance." What happens when someone says "no" to Ivan. It's impossible to record a Packetpushers or Healthy Paranoia episode without making unicorn jokes. It's also impossible to record a Packetpushers or Healthy Paranoia episode without bringing up SDN. The accurate translation of "Klaatu barada nikto" is "Disable Java now." Show Notes: Bro Quickstart & packages Intro to Google Capirca AOL's Trigger OpenFlow and Bro IDS PF_Ring Liam Randall's Bro Presentations The fun and amazing Security Onion cPacket Nebula ELSA (Enterprise Log Search and Archive) Dualcomm Technology (inexpensive network taps)

Darkness falls across the land, The hacker hour is close at hand. Creatures crawl in search of 0-days To terrorize your enterprise. And whosoever shall be found, Without the soul for clamping down, Must stand and face the nerds of hell, And rot inside a clear text shell. The foulest stench is in the air, The funk of unencrypted drives. And grizzly exploits from every area, Are closing in to steal your data. And though you fight to protect the org, Your body starts to goo. For no mere mortal can resist The evil of the Shmoo* Join Mrs. Y. for a series of guerrilla style** interviews  at Shmoocon, Bruce Potter's wildly popular security conference held in Washington DC. Listen in for some humor, scary anecdotes and wisdom from luminaries in the infosec community, including; Deviant Ollam (pronounced Olav), physical security expert, lockpicker, author and member of the board of directors of the US division of TOOOL, the open organization of lock pickers. He also runs lock pick village at Defcon and Shmoocon. Crypt0s, president of hacker/makerspace and computer learning center Unallocated Space*** in Severyn MD, also known for an entertaining Defcon talk on McCarran International Airport's poor security. Jack Daniel, (not related to the bourbon) nominated in blogger hall of fame by RSA,  also as co-creator of B-Sides and co-host for the infamous Pauldotcom infosec podcast. Rob Fuller aka "mubix," certified checkbox unchecker and fearless leader of NoVA Hackers, the preeminent security group in the DC Metro area. Creator of Shmoocon Epilogue, the new "after con" hot ticket. Georgia Weidman, security researcher and founder of Bulb Security. She was awarded a DARPA Cyber Fast Track grant culminating in the creation of the Smartphone Pentest Framework (SPF) an assessment tool for smartphones in the enterprise. Johnny Long,aka j0hnnyhax, security expert, author, pioneer in the field of Google Hacking, founder of Hackers for Charity. The recording quality is rough, because I had to grab quiet corners where I could. But the content makes it all worthwhile.    *Pathetic homage to the intro from Michael Jackson's "Thriller." **You'll really get the double entendre once you listen to the podcast. *** No Deathbot video, but this is pretty cool.

It's time to be "shaken, not stirred" by the latest episode of Healthy Paranoia! You'll have "the living daylights" scared out of you by Mrs. Y as she gathers a trio of experts to discuss SCADA and ICS  security issues. Joining the Packetpushers in their underground lair: Joe "The Mastermind" Klein* Dale "Bond, Digitalbond" Peterson Bob "Goldfinger" Radvanovsky As usual, you'll hear the smooth vocal stylings of Ethan Banks, holder of a "license to kill" for bad engineering. Show Notes: Terms  SCADA (supervisory control and data acquisition) ICS (industrial control system) - SCADA is a type of ICS CIP (critical infrastructure protection) PLC (programmable logic controllers) - type of ICS Smart Grid Modbus protocol References and Resources Unsolicited Response podcast Infracritical's SCADA and CIP mailing lists S4 Conference (great archives of past conferences!) Scadapedia (excellent resource for everything SCADA) NSA Perfect Citizen Program Shodan Project Shine Project Basecamp SCADA Strangelove SCADA in the cloud?! Hackers breach heating system Backdoor in ICS Prisons and jails use SCADA systems with PLCs, Scada Hackers Hardware hacker Travis Goodspeed *Special thanks to Joe Klein for contributing additional resources.

Descend into the heart of darkness with Mrs. Y as she explores the topic of social engineering with Chris Hadnagy, noted expert, podcast host and author of Social Engineering: the Art of Human Hacking. You'll learn fun facts like: The difference between persuasion and manipulation. Subtle ways to influence people. The secrets of facial expressions, paralinguistic cues and body language. What social engineers can learn from actors. How Greg Ferro is like a Koala bear. Joining the Packetpushers on their journey investigating the hidden secrets of the mind: Taylor Banks, Pentester, security entrepreneur and show favorite. Ron Reck, Linguist and specialist in "big data" analytics. Show Notes: Definition and Techniques of Social Engineering How To Break a Terrorist by Matthew Alexander It's Not All About Me by Robin Dreeke The Power of Nonsexual Touch The Social Engineer Toolkit (SET) with a great tutorial Paul Ekman's book Telling Lies FACE and METT training Derbycon 2012 presentation by Chris Hadnagy, Nonverbal Human Hacking Links to other prominent social engineers; Kevin Mitnick, Dave Kennedy (author of SET), Chris Nickerson, Chris Silvers A Challenge For the Actor by Uta Hagen Amy Cuddy: Your Body Language Shapes Who You Are Determining the Impact of Eric Clapton on Music Using RDF Graphs

Just when you thought the Winter Solstice, Hanukkah, Kwanzaa or Christmas couldn't get any better, Healthy Paranoia's Mrs. Y rustles up some wireless experts for an episode on 802.1X! Joining the Packetpushers Posse: Matthew "Rowdy" Gast, author of multiple O'Reilly books and chair of the security task group at the Wi-Fi Alliance. "Buffalo" Blake Krone, CCIE-Wireless and host of the "No Strings Attached" podcast. Jennifer "Widowmaker" Huber, blogger and CWNE. As usual, you'll hear Greg Ferro prancing with unicorns, mocking storage protocols and ranting about Windows XP. Show Notes: From the 802.1X IEEE standard, This standard specifies the use of EAP, the Extensible Authentication Protocol (IETF RFC 3748), to support authentication using a centrally administered Authentication Server and defines EAP encapsulation over LANs (EAPOL, Clause 11) to convey the necessary exchanges between peer PAEs (Port Access Entity) attached to a LAN.  From EAP RFC 3748, Extensible Authentication Protocol, an authentication framework which supports multiple authentication methods.  EAP typically runs directly over data link layers such asPoint-to-Point Protocol (PPP) or IEEE 802, without requiring IP.  EAP provides its own support for duplicate elimination and retransmission, but is reliant on lower layer ordering guarantees. EAP encapsulation on IEEE 802 wired media is described in [IEEE-802.1X], and encapsulation on IEEE wireless LANs in [IEEE-802.11i]. Additional EAP RFCs include 3580 (RADIUS) , 4017 and 5931 . Also a nifty EAP cheat sheet from Packetlife.net's Jeremy Stretch.

Yes boys and girls, today we tell a story of clouds. The Packetpushers attack the subject of virtualization security. You'll hear Greg Ferro and Ivan Pepelnjak* wax eloquent about unicorns and an amazing Larry Ellison imitation by Tony Bourke. We're also joined by a new friend, awesome security researcher** and entrepreneur Taylor Banks, who manages to help us keep the snark level up to Packetpusher standards. Show Notes: NIST definition of the Cloud Ace Hackware (Where Mrs. Y. does all her holiday shopping.) A series of great posts by Ivan on virtualization and the cloud. (He also has some amazing webinars on the subject.) The “appliance” approach to Big Data and Private Cloud by Brad Hedlund Cloudwashing, according to Dilbert. Hypervisor Attacks: Bluepill and Cloudburst CVE-2008-4917 and CVE-2008-4916 Cross-VM Side Channels and Their Use To Extract Private Keys   *Hopefully someday I'll be able to spell Ivan's name without looking it up. **Hey, I don't have to keep telling people that security researcher = hacker, right?

Travel into another dimension  - a dimension of wireless networking. That's right, Healthy Paranoia takes on the subject of 802.11 with the challenges facing a secure deployment. You'll find out why you should never use WEP (aka wireless equals pwned), that SSID cloaking is a waste of time, and how Greg really feels about Microsoft XP. Joining us on this journey: Blake Krone, Cisco CCIE (wireless), blogger and host of the No Strings Attached podcast Thomas d'Otreppe, Security researcher and author of open source wireless security suite Aircrack-NG Mike Kershaw, Security researcher and author of open source wireless security suite Kismet Andrew von Nagy, Cisco CCIE, CWNE, and blogger @ Revolutionwifi Show Notes: Aircrack -NG Kismet WiFi Security or Descending Into Depression and Drink by Mike Kershaw MDK3 Metasploit Moxie Marlinspike and ChapCrack and Andrew von Nagy's analysis  

Join Healthy Paranoia for The Matchup of the Century: The IPv6 Security Smackdown! Where builders and breakers wrestle with some of the most difficult security challenges surrounding the protocol. We discuss some of the common vulnerabilities, make recommendations for getting started (safely) and even find time to lament the evils of Carrier-grade NAT (CGN). Michele and Ethan are joined by a cast of luminaries, including: Fernando Gont, security researcher* Eric Vyncke, Cisco Distinguished Consulting Engineer and author Joe Klein, security researcher* TJ Evans, IPv6 instructor and engineer Jim Small, Sr. Consultant - Network/Security Architecture and Engineering, CDW Scott Hogg, Cisco Press author and Director of Technology Solutions for RMv6TF Show notes: NIST Guidelines for the Secure Deployment of IPv6 Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government NSA: Firewall Design Considerations for IPv6  NSA: A Filtering Strategy for Mobile IPv6  NSA: Router Security Configuration Guide Supplement - Security for IPv6 Routers  IPv6 Fact Sheet  Internet Society | IPv6  NIST: Estimating IPv6 & DNSSEC External Service Deployment Status  Controversial ZDNET article Hurricane Electric Global IPv6 Deployment Progress Report Arbor Networks Worldwide Infrastructure Security Report 2011 Volume VII  SI6 IPv6 Toolkit IPv6 Hackers Mailing List  The Hacker's Choice IPv6 Attack Tool Kit IPv6 Security Lab:Veripy  IPv6 Security, by Scott Hogg and Eric Vyncke gogoNET Live! 3 , Event for professionals to go v6 UPDATE: check out Ivan Pepelnjak's upcoming webinar on IPv6 security. Wish I had enough hours in the day to view them all. I think this requires an xkcd comic. * Security researcher is really just a nice way of saying hacker or breaker.

This is a recording of a talk I gave at Appsec DC 2012, "Security Is Like An Onion, That's Why It Makes You Cry." Okay, busted, I'm recycling. You can blame Greg. He seemed to think there was value in releasing it as a podcast episode. But in all seriousness, I'm a big proponent of applied neuroscience and the benefits of emotional intelligence in the workplace. As an engineer, when I started to figure out how the  human machinery works, things got much easier for me. But don't worry, that doesn't mean I've been replaced by one of those HR zombies that give you a four-color personality test to find out where you fit in the rainbow of a politically correct workforce. Oh no, I feel a quickmeme coming on....   If you want to view the slides with the talk, you can access them here.

It seems appropriate this Labor Day, a holiday that pays tribute to the American worker, to rediscover the lost talent of making stuff. So the Packetpushers pulled out their tricorders and went in search of the ultimate nerd haven, the hackerspace. If you aren't familiar with the term, according to Urbandictionary.com, a hackerspace is: A facility to incubate nerds and equip them with tools. Currently found in all major cities, hackerspaces exist to pool nerds' resources together and enable them to build and invent ever newer and better things. Most hackerspaces are equipped with rapid prototyping machines (3D printers, laser cutters, CNCs), metal milling tools, welding, electronics, and millinery. And in this Healthy Paranoia episode it's a nerdy, geeky delight chatting with a few heroes from the hackerspace front: Travis Good, co-founder of NoVA Labs,  Ben Mendis of Project Byzantium and Brad Barr, president of HacDC. So fasten your seat belts, because this show is +1000 on the nerd meter!* Links Hackerspaces.org Instructables Hack a Day A Hackerspace Manifesto 10 Rules for Students, Teachers, and Life by John Cage and Sister Corita Kent Makezine Thingiverse Backyard Brains: Neuroscience for Everyone *Special thanks to Coverville for allowing the use of samples from "Smooth Federation," an instrumental jazz tribute album featuring covers of Star Trek music.

Drum roll, please! Introducing Healthy Paranoia, the new security podcast hosted by Michele Chubirka aka "Mrs. Y." and her esteemed colleague, Ethan Banks. I know what you're thinking, "Do we really need another security podcast?" Give a listen to episode one, where we ask questions like:Is it better to be Oppenheimer or Leonardo? What's the difference between a hacker and a cracker? Does Greg Ferro record in his underwear?This and many other critical questions will be answered by this podcast! In Healthy Paranoia, we plan to take off the tin foil hats and discuss practical issues in security, no crypto required. We'll be focusing on the "build" aspect of security and less on the "break it." *No unicorns will be harmed in the recording of this podcast, although they will frequently be on the receiving end of bad jokes.