<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.emailstyle17
{mso-style-name:emailstyle17;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-AU link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Totally agree - Security begins with the weakest link and ends with the strongest one, and then gets thrown out the window by auditors! I mean users, I mean life!! ;)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>/rant BEFORE it all goes to hell (ie now), please, please DO comprehensive logging - there’s **nothing worse than ol ‘let’s just re-install from scratch and make sure it’s patched this time’ trick.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Sure it’s a great way of pretending to yourself and/or a team etc that somehow now things are ‘safe’ again, but the feeling really has nothing to do with reality (Anyway that is not convinced of this, please feel free to email me).<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Others on the list may have alternative suggestions, but as a free solution, I’m a fan of SNARE (<a href="http://www.intersectalliance.com/projects/">http://www.intersectalliance.com/projects/</a>, <a href="https://en.wikipedia.org/wiki/Snare_%28software%29">https://en.wikipedia.org/wiki/Snare_%28software%29</a>) and it works for Windows too (with a little massaging). /rant<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I’m sure everyone knows this, but I’m biologically compelled<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>**Ok except the security auditors because they reeeeaaly DO need their Dropbox to discuss your legal requirements for security!!! ;)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> ausnog-bounces@lists.ausnog.net [mailto:ausnog-bounces@lists.ausnog.net] <b>On Behalf Of </b>Shane Bryan<br><b>Sent:</b> Monday, 4 February 2013 22:56<br><b>To:</b> ausnog@ausnog.net<br><b>Subject:</b> Re: [AusNOG] Interesting and perhaps quite scary security presentation from HD Moore of Metasploit fame<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><p><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'>Yep or Department A finds out some sensitive documents are in the public domain and questions how, yet insisted that some of their staff all use a dropbox account to share some files with an external contact, such as auditors. But then, of course, neglected to change the password after some recent redundancies.<br><br>Security begins behind the firewall.<o:p></o:p></span></p><p><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'> <o:p></o:p></span></p><div><div class=MsoNormal align=center style='text-align:center'><span style='color:black'><hr size=2 width="100%" align=center></span></div><div id=divRpF31077><p class=MsoNormal style='margin-bottom:12.0pt'><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'> <a href="mailto:ausnog-bounces@lists.ausnog.net">ausnog-bounces@lists.ausnog.net</a> [ausnog-bounces@lists.ausnog.net] on behalf of Aqius [aqius@lavabit.com]<br><b>Sent:</b> Monday, 4 February 2013 6:26 PM<br><b>To:</b> 'Mark Newton'; 'Mark Smith'<br><b>Cc:</b> <a href="mailto:ausnog@ausnog.net">ausnog@ausnog.net</a><br><b>Subject:</b> Re: [AusNOG] Interesting and perhaps quite scary security presentation from HD Moore of Metasploit fame</span><span style='color:black'><o:p></o:p></span></p></div><div><div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>And why anyone on this list that allows a device to stay on default passwords should be shot, beaten, and then shot more before they are allowed to come back to the list ;)</span><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'> <a href="mailto:ausnog-bounces@lists.ausnog.net">ausnog-bounces@lists.ausnog.net</a> [<a href="mailto:ausnog-bounces@lists.ausnog.net">mailto:ausnog-bounces@lists.ausnog.net</a>] <b>On Behalf Of </b>Mark Newton<br><b>Sent:</b> Monday, 4 February 2013 18:15<br><b>To:</b> Mark Smith<br><b>Cc:</b> <a href="mailto:ausnog@ausnog.net">ausnog@ausnog.net</a><br><b>Subject:</b> Re: [AusNOG] Interesting and perhaps quite scary security presentation from HD Moore of Metasploit fame</span><span style='color:black'><o:p></o:p></span></p></div></div><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p><div><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'><span style='color:black'><br>On 04/02/2013, at 17:17, Mark Smith <<a href="mailto:markzzzsmith@yahoo.com.au" target="_blank">markzzzsmith@yahoo.com.au</a>> wrote:<o:p></o:p></span></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><p class=MsoNormal><span style='color:black'>To me both the volume of ineffectiveness, and the apparent lack of taking advantage of it is a surprise.<o:p></o:p></span></p></div></blockquote><div><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p></div><p class=MsoNormal><span style='color:black'>Three useful axioms:<o:p></o:p></span></p><div><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='color:black'>1. Most of the infosec industry is selling snake-oil, and is actually quite crap. No matter how much they hyperventilate about their ability to mitigate threats, you can spend as much money with them as you want, and it'll make almost no difference to Anonymous' ability to pull a Sony on you.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='color:black'>2. In the rare cases where the infosec industry isn't crap and actually tries to bring these probes to a human's attention, the human will inevitably ignore the traces in the IDS logs as "background radiation" until <i>after</i> they're 0wn3d.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='color:black'>3. Your network is nowhere near as special and interesting as you think, and there probably aren't hoards of Chinese or Russian hackers trying to make off with your precious unique intellectual property. With rare exceptions, if you get 0wn3d it's due to random chance rather than concerted effort, and the random chance probably isn't significantly diminished if you spend more money on whizzy black boxes (see "1" above)<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='color:black'>For almost everyone, the only <b>real, practical</b> protection they have is, "It's a big Internet and I'm a tiny, tiny fish."<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='color:black'>And for <b>almost</b> everyone, that protection is good enough to quantify the losses from successful attacks at some place similar to the losses due to equipment failures.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='color:black'>And that, in a nutshell, is why we can still buy equipment today with default admin passwords :)<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='color:black'> - mark<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p></div></div></div></div></div></div></body></html>