Rant Back – ValSmith

Val Smith recently wrote a post on the new Attack Research / carnal0wnage blog titled:
”Security Conferences, pen tests and incident response”

Here are my thoughts on what he wrote:

In paragraphs 2-6 he talks about two points. The first being that Hacker Conferences have become sort of commercialized with most speakers going for their day in the lime light or to pimp some product/0day. And the second being a lot of the talks are things that most can’t go home / back to work and test out or implement.

I agree with him on both points.

On the first point I think that one detail was left out of this evaluation. Size. Back when DEFCON was <500 people, almost everyone knew each other. 90% of those attending had the passion, had the fire for that what makes our line of work such an art. Now that our community has become “popular”, that percentage is around 20-30%. These numbers aren’t based on any stats, just something that I have been observing as well.

On the second point, my first security conference was ShmooCon ‘06. I was glued to might seat in each talk I attended, and in just 3 short years I have seen EXACTLY what he’s talking about. I used to have to decide between awesome talks in the same hour. Now I actually find times where I’m not interested in anything being presented for that hour. But, rooms still get packed so I guess that’s just my own pickiness.

Penetration Testing and Incident is the second portion of his post and I really think he’s hit the nail on the head, Pen Testing and Incident Response should work closely together. I want to throw Vulnerability Assessment and Forensics into the mix as well, feeding each other, sharing data, and assisting. The segmentation of duties / teams is killing collaboration.

Lets get back to the basics, and really show what this community is capable of.

AnonymASS - Hiding Behind The Tubes

First I wanted to say, sorry for this and the last installment of Room362 being non-technical. They are topics that I feel strongly about and so felt impelled to share.

One of the biggest problems in the world, IMHO, are people who have unfounded hate. This is compounded by the anonymity of the Internet. Allowing that hate to have no reprocussion or identity. Let me also say I have a deep respect for Free Speech, the depths of which I fear, few truly know. What I don't have a respect for is people who abuse that right. It's ultimately a respect of your fellow man/woman/it, that transends any nationality, race, creed, or color.

Now that you know where I stand, let me step down to a slightly lower soap box. On my last post about ethics, I received a comment from an individual who posted under the guise of not only a false email and name, but also from a proxied address. They were on my side of the argument and were digusted with Dave's. His/her/it's post was pointed, rude, and had no constructive criticism or facts. It was deleted. It does not deserve a direct response. So I am issuing a response to all who tred here.

These types of posts are allowed to flow on other forums, blogs, and mediums of the Internet. They WILL NOT be allowed here. Period. 

You may think of me what you will, pompous, self righteous. I don't care. I will keep my bit of the Internet clean how I see fit. 

Lastly, I hope I demonstrated this fact already, but I want to reiterate it here. I will never delete comments on any side of any discussion I have here, even if I disagree with the comment. I enjoy debat and discussion. I am religous in my faith fight for free speech and it's application on the internet.

You have something to say fine. You better do it with respect or you can take your posts to slashdot, digg, or some other place. They won't see the light of day here.

Twitter API Problem

Most of you Twitterholics have seen this beautiful status. You get a total of 100 API calls per Twitter account per hour. What happens if you use all of your afforded calls? You can just use http://www.twitter.com/ no problem right? Well you loose a lot of what makes Twitter clients so useful (search, grouping, instant updates.. etc).

Well, what if you leave you client up at home? TweetDeck by itself uses most of the API calls just by itself. So in this scenerio, you are destined (at least for that day) to spend it on the twitter site, which as we already discussed, leaves much to be desired.

Mom taught me never to point out a problem without suggeting a solution, so here is what I think would be an awesome addition to Twitter, that might have other advantages as well:



This is at the bottom of gmail. It allows you to see where else your account is being accessed from (IP). You can also click "Details"  and click to log out of all other sessions. This would be nice in twitter for a couple reasons. It would allow you to block/logout the client you left at home, but also check to make sure the IPs that are accessing the API on your behalf are your own.

Just a suggestion..

My iPhone runs Windows

(This is the 3^rd time I am writing this post, FF Fail, then Word crashed, so please excuse the lack of passion)

The moment that PDANet published that they released an updated version that allows USB tethering, I ran home and “QuickPWNd” my phone (which took all 5 minutes). Loaded the app and now I had the coveted TETHERING. I was free of my bind to Comcast or Free Public Wifi. However, over the next few months, my iPhone started getting slower and slower to respond. Crashes happened on apps that never had a problem before (including Safari). It would even crash on incoming calls.

5 minutes ago (now more like 20), I had it crash again and slow responsiveness down to unbearable speeds. (2 minutes from touch to fully started app). When I had an internal debate: Would I go home and de-PWN it, or deal with it? With that same thought I realized that at the core of most of the technologies we use today, Windows, Twitter, MySpace (now Facebook), is an underlying need, freedom, or other feature that they provide that makes them ‘bearable’.

Twitter’s FAIL WHALE is famous because Twitter crashes or is down A LOT. Why do you still use it? Windows is an utter mess of code and BSOD even had a hardware device made for it. Why do you still use it? ...you get the point.

I’m not going to revert my iPhone back. You know why? Because the freedom that it provides me, (like typing a blog post for the 3^rd time going 65 miles an hour in the back seat of a car) is worth it, to me.