<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style>@font-face {
font-family: Cambria Math;
}
@font-face {
font-family: Calibri;
}
@font-face {
font-family: Tahoma;
}
@page WordSection1 {margin: 72.0pt 72.0pt 72.0pt 72.0pt; }
P.MsoNormal {
MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman","serif"; FONT-SIZE: 12pt
}
LI.MsoNormal {
MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman","serif"; FONT-SIZE: 12pt
}
DIV.MsoNormal {
MARGIN: 0cm 0cm 0pt; FONT-FAMILY: "Times New Roman","serif"; FONT-SIZE: 12pt
}
A:link {
COLOR: blue; TEXT-DECORATION: underline
}
SPAN.MsoHyperlink {
COLOR: blue; TEXT-DECORATION: underline
}
A:visited {
COLOR: purple; TEXT-DECORATION: underline
}
SPAN.MsoHyperlinkFollowed {
COLOR: purple; TEXT-DECORATION: underline
}
SPAN.EmailStyle17 {
FONT-FAMILY: "Calibri","sans-serif"; COLOR: #1f497d
}
MsoChpDefault {
FONT-SIZE: 10pt
}
</style><style id="owaParaStyle">P {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
</style>
</head>
<body lang="EN-AU" vlink="purple" link="blue" fPStyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">
<p>Yep or Department A finds out some sensitive documents are in the public domain and questions how, yet insisted that some of their staff all use a dropbox account to share some files with an external contact, such as auditors. But then, of course, neglected
to change the password after some recent redundancies.<br>
<br>
Security begins behind the firewall.</p>
<p> </p>
<div style="FONT-FAMILY: Times New Roman; COLOR: #000000; FONT-SIZE: 16px">
<hr tabindex="-1">
<div style="DIRECTION: ltr" id="divRpF31077"><font color="#000000" size="2" face="Tahoma"><b>From:</b> ausnog-bounces@lists.ausnog.net [ausnog-bounces@lists.ausnog.net] on behalf of Aqius [aqius@lavabit.com]<br>
<b>Sent:</b> Monday, 4 February 2013 6:26 PM<br>
<b>To:</b> 'Mark Newton'; 'Mark Smith'<br>
<b>Cc:</b> ausnog@ausnog.net<br>
<b>Subject:</b> Re: [AusNOG] Interesting and perhaps quite scary security presentation from HD Moore of Metasploit fame<br>
</font><br>
</div>
<div></div>
<div>
<div class="WordSection1">
<p class="MsoNormal"><span style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 11pt">And why anyone on this list that allows a device to stay on default passwords should be shot, beaten, and then shot more before they are allowed to come
back to the list ;)</span></p>
<p class="MsoNormal"><span style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 11pt"></span> </p>
<div>
<div style="BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0cm; PADDING-LEFT: 0cm; PADDING-RIGHT: 0cm; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<p class="MsoNormal"><b><span style="FONT-FAMILY: 'Tahoma','sans-serif'; FONT-SIZE: 10pt" lang="EN-US">From:</span></b><span style="FONT-FAMILY: 'Tahoma','sans-serif'; FONT-SIZE: 10pt" lang="EN-US"> ausnog-bounces@lists.ausnog.net [mailto:ausnog-bounces@lists.ausnog.net]
<b>On Behalf Of </b>Mark Newton<br>
<b>Sent:</b> Monday, 4 February 2013 18:15<br>
<b>To:</b> Mark Smith<br>
<b>Cc:</b> ausnog@ausnog.net<br>
<b>Subject:</b> Re: [AusNOG] Interesting and perhaps quite scary security presentation from HD Moore of Metasploit fame</span></p>
</div>
</div>
<p class="MsoNormal"> </p>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p style="MARGIN-BOTTOM: 12pt" class="MsoNormal"><br>
On 04/02/2013, at 17:17, Mark Smith <<a href="mailto:markzzzsmith@yahoo.com.au" target="_blank">markzzzsmith@yahoo.com.au</a>> wrote:</p>
</div>
<blockquote style="MARGIN-TOP: 5pt; MARGIN-BOTTOM: 5pt">
<div>
<p class="MsoNormal">To me both the volume of ineffectiveness, and the apparent lack of taking advantage of it is a surprise.</p>
</div>
</blockquote>
<div>
<p class="MsoNormal"> </p>
</div>
<p class="MsoNormal">Three useful axioms:</p>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">1. Most of the infosec industry is selling snake-oil, and is actually quite crap. No matter how much they hyperventilate about their ability to mitigate threats, you can spend as much money with them as you want, and it'll make almost
no difference to Anonymous' ability to pull a Sony on you.</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">2. In the rare cases where the infosec industry isn't crap and actually tries to bring these probes to a human's attention, the human will inevitably ignore the traces in the IDS logs as "background radiation" until
<i>after</i> they're 0wn3d.</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">3. Your network is nowhere near as special and interesting as you think, and there probably aren't hoards of Chinese or Russian hackers trying to make off with your precious unique intellectual property. With rare exceptions, if you get
0wn3d it's due to random chance rather than concerted effort, and the random chance probably isn't significantly diminished if you spend more money on whizzy black boxes (see "1" above)</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">For almost everyone, the only <b>real, practical</b> protection they have is, "It's a big Internet and I'm a tiny, tiny fish."</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">And for <b>almost</b> everyone, that protection is good enough to quantify the losses from successful attacks at some place similar to the losses due to equipment failures.</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal">And that, in a nutshell, is why we can still buy equipment today with default admin passwords :)</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
<div>
<p class="MsoNormal"> - mark</p>
</div>
<div>
<p class="MsoNormal"> </p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>