What a awesome week! Last weekend (April 5, and 6th) was Security BSides Orlando 2014. So much was packed into just two days. To start out Kevin Johnson from Secure Ideas gave an awesome keynote touching on the value of certifications, and the potential of creating a centralized licensing institution. One example he gave was for a penetration tester to become "licensed" he would have to perform a real world pentest and provide a report to a "bar" of InfoSec professionals. This would be an in person review of the candidate where they would be asked questions about their testing methodologies to determine if they truly know what they are talking about.

After the keynote talk the speaker portion of the event started. There were two tracks with a wide range of topics including Windows Phone 8 security testing, physical security, human body hacking, phishing, hackerspaces, survival, and software defined radio. Two very special speakers we had this year were Larry Pesce, and Jack Daniel. Larry gave a talk about how to continue computing post-apocalypse. He went into the details of creating an EMP cabinet to protect your devices from electromagnetic pulses. Also, he described how you can take advantage of various HAM radio devices to continue remote communication. Jack Daniel talked about the demands of InfoSec and how sometimes it can feel overwhelming. On day two Jonathan Singer and Malik Mesellem did workshops. Jonathan gave an introduction to hardware hacking, and Malik walked through web application pentesting with bWAPP.

During the talks the events hall also had a lot going on. I spent the majority of my time with my CTF team playing Hack Miami's Kommand & Kontrol CTF. We ended up coming in a very close second place. The CTF hours were from 10AM - Midnight the first day, and 10AM - 4PM the second day. Also in the events hall was the vendor’s area, and a lock pick village.

SANS 2014 SEC560 Review

Immediately following BSides Orlando was SANS 2014. Monday we started class in SEC560 Network Penetration Testing and Ethical Hacking. Having previously played NetWars, Cyber Quests, SEC504, and various SANS Hacking Challenges all written/created by Ed Skoudis I was very excited to take a course taught by him. He is an excellent teacher and explains the topics of the course in a way that is easy to follow. SEC560 in itself follows a similar timeline in regards to testing methodologies (Planning, Recon, Scanning, Exploits, Post-exploits, Web) as the Offensive Security Penetration Testing with Kali course follows but with a lot more depth. For example, Offsec PWK teaches a lot of the same tools as SEC560 but requires you to learn the advanced options for each one on your own. SEC560 walks you through the majority of options for tools like NMAP, Scapy, and Metasploit. I really enjoyed day 5 during the web application portion of the class a lot. We walked through Cross-Site Scripting attacks, Cross-Site Request Forgery attacks, and SQL Injection. Day 6 was Capture the Flag day. I can't give away any details about the challenge but I can say that it was awesome. It was a very well thought out test of the skills that you learn during the course. Within the CTF were a few cases that required what Ed calls "Eureka" moments. Here is a pic Ed took of our team having one of those moments:

We ended up winning.

SANS always has a ton going on during these events. I went to a few of the night talks. Monday night was APT Attacks Exposed. This was an in depth walkthrough of a computer forensic investigation from the initial alert, through memory analysis, and determining whether what was thought as being the initially compromised system was patient zero or not. Rob Lee, Alissa Torres, Phil Hagen, Jake Williams, and Lenny Zelster did a fantastic job on this keynote. If you attended this talk and are interested in learning more about digital forensics I recommend taking SANS FOR508 course. Most of their walkthrough was pulled straight from that course.

Heartbleed

It was very interesting being at a massive security conference when the news about the OpenSSL "Heartbleed" vulnerability came out. I had the opportunity to talk with a broad range of security professionals and hear about their own concerns regarding Heartbleed. SANS put together a few last minute talks to go into the details of this vulnerability to shed some light on what has happened and what needs to be done. I attended a session by Jake Williams where he outlines the vulnerability in a very detailed fashion. If you missed it you can watch the archived version here: https://www.sans.org/webcasts/openssl-heartbleed-vulnerability-98105

NetWars

Last but certainly not least is NetWars. NetWars is an epic hacking challenge put together by Counter Hack Challenges. To begin you are given a Linux virtual machine where you have unprivileged access to the system. There are 5 levels in NetWars. Level 1 and 2 can be completed on the VM they provide, and 3 through 5 require you to SSH in to their challenge environment. Each level has around 13-15 questions. To get to the next level you have to get enough points on the previous one and then answer a "gateway" question. I have participated in NetWars at the three previous SANS events I have attended. Each time I have done it I have gotten closer and closer to winning. This year’s NetWars was a complete revamp of the questions and challenges. During night one I pushed through level 1 and 2 as fast as I could. I didn't try to answer all of the level 1 and 2 questions the first night because I knew I could spend time on those after NetWars closes at 9:30PM. I wanted to get into level 3 and get as far as I could while I had access. After night one I was in 6th place. I spent the rest of the night and some of the next day finishing up the level 1 & 2 answers so by the time night two of NetWars rolled around I was able to fully focus on level 3. About half way through night 2 of NetWars I was sitting in second place. An hour or so later I had a few "Eureka" moments as Ed calls them and jumped into first place. The last thirty minutes of the challenge they turned off the scoreboards so you don't know if someone passes you or not. The game ended at 9:30PM and I was ecstatic to see that I came out on top.

If you are thinking about attending a SANS event I highly recommend it. I always leave with new knowledge, and ideas. I also recommend challenging yourself by checking out NetWars.