Part problem dissection, part solution discussion, part political rant, peppered with a bit of humor and wit.

This talk explores the death and subsequent re-birth of the penetration test. Comprised of conclusions drawn from the collective experiences of two seasoned pen-testers, our talk is filled with facts, fun and rhetoric. We will describe the landscape, the problems, and offer real solutions…

In our talk, we will explore the problems with modern-day pen-tests and pen-testers, and ways to stand out amongst the frauds selling their lackluster vuln-scan services under the guise of a true penetration test.

We discuss penetration tests that are overly tool-driven and/or lacking in methodology as well as pen-testers who lack the experience and creativity to identify the architectural problems that real attackers frequently exploit.

Along the way, we’ll discuss the difficulties faced by real penetration testers and complement these with real-world war-stories to provide both context and comic relief.

Most importantly, we’ll discuss how to solve these problems, through contributions to open methodologies, transparency in process, and shifts in technological paradigms. We’ll tell you how to deal with the latest technologies, even those that change day-by-day. For those that take penetration testing seriously, this talk will be a fun, informative and enlightening presentation on the things we need to do to keep pen-testing worthwhile. Attendees will learn how to perform pentests accurately and obtain compelling and valuable results that ensure real return on investment for their clients.

Carric and I presented to a full room, and we got lots of good feedback and close to an hour of q&a in the after-preso breakout session.

The presentation is approximately 52 min in length, so grab a cup of coffee, settle in and enjoy! If you’d like to discuss any of the issues we raised in our presentation, please feel free to opine below, and / or email me directly (all perspectives welcome)!

In this post, I’ll focus on three specific travel-related web-sites that I’ve found useful in preparing and managing my itineraries and organizing my travel, and in some cases coordinating meetings and events with other travelers along the way.

The first of these resources is a web-site that originally began as a tool designed to manage and organize itineraries, but has evolved over time into a social-networking tool that also encourages cross-coordination of travel. TripIt is a site (service?) that allows you to either enter your itinerary manually or forward your travel confirmation emails to automatically build and create nice, printable itineraries with all of your travel events categorized, organized and displayed chronologically (along with weather, maps, directions and in some cases, events for each of your destinations).

I began using TripIt around this time last year, and ignoring a few minor glitches, have become rather enamored with the service. What’s nice about TripIt is that in most cases, creating your itinerary is no more complicated than forwarding a few emails and hitting print. In most cases, TripIt will automatically recognize and extract information from confirmation emails provided by most major airlines, hotel chains, rental car agencies and more. Further, early this year, TripIt added support for reservations made through OpenTable (which I mentioned in a recent blog post on low-cost dining for frequent travellers), which means you can now forward OpenTable reservations directly to TripIt to add dinner plans to your itinerary, a minor but effective organizational detail.

While I’ve managed to connect with a handful of friends using TripIt, I have also found many reluctant to sign up, due primarily to the site’s new focus on social networking, and for those who are already inundated with requests to join MySpace, FaceBook, LinkedIn, etc., the thought of signing up for yet another social networking tools is daunting. IMHO, TripIt is quite useful individually, and if you never connected with a single person, it’s still quite effective for managing and organizing your own itineraries.

For those less interested in itinerary management, but who are interested in the social networking / travel coordinating component of TripIt, a self-described luddite friend later directed me to Dopplr, another web resource that ignores the finer details of your itinerary and instead focuses simply on where you’ll be, when, and who you know that might also be there. In fact, with Dopplr, all you need to do is specify a destination and a date, and you’re done. Since I have friends that use one of the services but not the other, I’ve maintained a presence at both, though it was becoming a bit tiresome to maintain my schedule at both web sites on a regular basis. Fortunately, hackerjoe pointed me to the new Dopplr feature that allows Dopplr to be subscribed to calendar-based RSS feeds for input, and since TripIt provides such an RSS feed… all I have to do now is maintain my itineraries in TripIt and Dopplr automatically picks up on where I’ll be and at what times.

Last week, as I began my migration from an old Nokia E61 to a new BlackBerry Curve (ick), I stumbled across another old resource that’s been given a fresh new face, and a feature-set that virtually mirrors that of TripIt. For any of you not previously familiar with WorldMate, they’ve launched a new update to their service, now dubbed WorldMateLive. Previously, the service consisted of a smartphone client that allowed you to check flight status and weather, do currency conversion and a bit more, but the upgraded service now also provides itinerary management akin to TripIt. In a similar manner, you simply forward your confirmation emails to WorldMateLive, and they will automatically build your itineraries and keep them in sync with your smartphone.

While I generally prefer TripIt, due to its popularity and the number of friends and colleagues with whom I’m already connected there, WMLive is a compelling alternative, and with their very attractive smartphone client, it may eventually encourage me to migrate. Unfortunately, the “free edition” of WorldMateLive is largely an up-sell to their Gold Edition, which at $99/year is yet another travel expense I don’t need for the simple privilege of being able to check flight status and book flights through their client (things I can already do quite easily with my existing travel providers’ SMS and mobile web interfaces).

That’s it for now! In point of fact, it’s time for me to run upstairs and pack for my trip to Fort Lauderdale this week (you can find details at TripIt, Dopplr, and WorldMateLive if you also plan to be in the area :), so I hope you found at least one of the above resources to be interesting if not useful, and maybe I’ll see you in one of the myriad destinations I have planned for this year and next!

For those who know me, you’ll know that I travel quite a lot. It’s only July, and I’m already Platinum on Delta and Diamond on Hilton for the year, so suffice it say, I spend a lot of time away from home. [sigh]

Traveling a lot generally means eating out a lot, and I’ve managed to hone a few techniques to both reduce my dining expenditures and generate occasional rewards. Specifically, I’m a member of two services that have proven to be quite effective at saving me money eating out. While I don’t want this article to appear to be a blatant marketing pitch for either service, I figure I would be remiss not to share this tip.

Over time, I’ve come to really appreciate RewardsNetwork (formerly iDine). The basic premise behind the service is that within most major cities, they have a handful of restaurants that offer “dining rewards” in the form of cash back on purchases. Although the rewards vary by restaurant, there are numerous restaurants in most major metropolitan areas that offer as much as 10% - 20% back on purchases, and that’s after tax and tip!

In addition to RewardsNetwork, I’ve also begun to really leverage OpenTable within and around my own home city as well as while out of town. If you are not already familiar with OpenTable, it’s primary function is as an online reservation service, allowing you to pre-book reservations at a wide variety of restaurants, and features the ability to invite guests, add reservations to Outlook or iCal, etc. Furthermore, when dining at restaurants booked through OpenTable, you receive dining “points” which ultimately add up to enough value to produce cash-value dining certificates as rewards. Basically, 10,000 points gets you a $100 gift certificate at any restaurant that uses OpenTable (and there are quite a lot of them).

The kicker here is that there are several restaurants within major cities that are members of both RewardsNetwork and OpenTable, which means you can get as much as 20% cash back for dining, plus as many as 1,000 points for making a reservation, which essentially translates into 20% of your total bill plus $10 towards future meal purchases. All in all, it’s an easy and effective way to not only save money, but earn yourself some free meals at any of hundreds of very nice restaurants in your own home town.

Hope this tip proves useful for some of you! And for those of you that are members of either TripIt or Dopplr, maybe I’ll see you at dinner sometime!

Update:

I neglected to mention that when dining at RewardsNetwork / OpenTable restaurants, I always use a rewards credit card, generating me additional points, cash and/or miles for all of my restaurant purchases.

1. Admit that you are powerless over bots.
2. Believe that a power greater than yourself exists and is necessary to identify and eliminate malware, botnets, and the Windows hosts that contain them.
3. Make a decision to turn your will and your life over to ShadowServer, Malfease or another similar volunteer effort.
4. Make a searching and fearless inventory of your Windows machines.
5. Admit to another security expert that you [have/do] run Windows.
6. Demonstrate readiness to remove Windows from your PC.
7. Humbly ask other experts to remove Windows from your machine.
8. Make a list of all other machines you’ve infected.
9. Make amends to those infected, i.e. with Mac OS, Ubuntu, FreeBSD or similar.
10. Continue to inventory remaining Windows hosts, and when infected, format & re-install.
11. Seek through prayer, meditation and continuing malware research to improve your understanding of the growing malware threat as we know it.
12. Having had a spiritual awakening, carry this message to other Windows users.

Please enjoy and disseminate widely.

While I’ve long debated the real value of professional certifications in the IT industry (I’ve known numerous highly-certified ignoramuses), it would be ignorant to refute the hard data that demonstrates the perceived value of certification and the resulting remuneration benefits.

Further, not all certifications are alike, and since I have approximately a dozen certifications myself, I can tell you conclusively that some effectively demonstrate proficiency, while others are barely worth the paper they’re printed on.

This blog topic was actually prompted by a very interesting post at TechTarget entitled The Value of the VCP (VMware Certified Professional). Personally, I believe the VCP is amongst a very few certifications that do a good job of testing and proving proficiency.

In his post, Joe Foran draws the conclusion that the single-test VCP certification by itself actually holds more value than any other multiple-test vendor certification (including those from Red Hat, Citrix and Cisco)! Joe’s post was certainly an interesting read, and if you plan on pursuing professional certifications, you owe it to yourself to pay attention to his sources.

Disclaimer: I am a VMware Certified Instructor, and teach VI3 VCP courses. So, don’t just take my word for it, do your own research.

I’m off to Anchorage, Alaska tomorrow to teach a VMware VI3 class, and am actually quite giddy about it. Alaska remains one of the few place in the US that I haven’t yet visited, but still want to. I emailed Bruce Potter looking for recommendations on things to do in Alaska, and his [summarized] response was: “Drink and eat. seriously.” Seems the food there is outstanding and good venues are plentiful. He specifically suggested several great restaurants and bars, and quite a few natural sights to see as well.

I’m crossing my fingers that I’ll manage to see some northern lights while I’m there. Based on my lovely wife’s research, it looks like I may have to drive a couple hours north for maximum visibility, but if the conditions are right, it will be well worth the trip.

Look for pictures upon my return…

When I purchased my MacBook Pro, I bought it with the intention of dual-booting into Ubuntu to run VMware Server so that I could run VMware ESX inside of a virtual Machine. Shortly thereafter, VMware Fusion was released, rendering my original intent academic.

Nonetheless, earlier this week I decided to revisit Ubuntu, given that changes since I originally installed it have improved hardware support and the end-user experience significantly. In fact, I’m now running Mac OS X and Ubuntu via dual-boot and using the very same copy of Ubuntu inside of a VMware Fusion virtual machine when I need to run them both side-by-side. Want to do the same thing (or something similar)? Click “Continue reading” below…

Ubuntu on the MacBook Pro

In lieu of regurgitating the process of installing Ubuntu on the MacBook Pro (mine is the Santa Rosa model), I’ll refer you to KnoxWiki’s page on Debian GNU/Linux on Apple Macbook Pro and the MacBookPro/SantaRosa page on the Ubuntu Wiki, which collectively provide thorough details on the process. Once you’ve got Ubuntu running natively on your MacBook, come back here and I’ll show you how to get your real Ubuntu running inside of a virtual machine in VMware Fusion.

Creating a virtual machine to house your natively-installed Ubuntu installation

Note: This process is essentially the same if you’d prefer to run XP or Vista via Bootcamp and boot the same copy of Windows inside of a VMware Fusion virtual machine.

Ok, now that you’ve got Ubuntu successfully installed and running in it’s own partition, it’s time to make that partition available to a virtual machine in VMware Fusion, allowing you to boot the identical linux installation inside of osx.

First, you’ll need to create a new virtual machine, which you can do using Fusion’s New Virtual Machine Assistant. Assuming you used the 64-bit Ubuntu installer, it’s important that you select “Ubuntu 64-bit” on the Choose Operating System dialog. Keep the virtual disk small, as you won’t be needing it after setup. At the final dialog of the VM Assistant, uncheck the “Start virtual machine” box and click Finish.

Next, we’ll need to create a vmdk to represent the physical disk partition on which Ubuntu is installed. To do so, open up Terminal.app (or iTerm, or…), then:

1. cd into the VMware Fusion app support directory:

   cd “/Library/Application Support/VMware Fusion”

2. List the partitions on your physical drive:

   ./vmware-rawdiskCreator print /dev/disk0

3. Create the raw disk mapping for use in our virtual machine:

   ./vmware-rawdiskCreator create /dev/disk0 X /path.to/Ubuntu.vmwarevm/rdm.vmdk ide

   (where X is the number of your linux partition, as identified in step 2, path.to is the path to your newly created VM, Ubuntu.vmwarevm is the VM’s container folder, and rdm.vmdk is the name given to the raw disk vmdk you are creating)

4. Finally, add references to your newly created vmdk into your VM’s config file (i.e. Ubuntu.vmx):

   ide0:0.present = “TRUE”
   ide0:0.fileName = “rdm.vmdk”

Voilà! Now power on the pseudo-VM, and revel in the glory of your new MacBook/PhysiVirtuBuntu!

On Saturday, September 15, 2007, Beth and I had to make the extremely difficult decision to euthanize our beloved dog, Cain, whose cancer had finally taken the wag from her tail. She had fought, lived and loved, against all odds, for over a year.

At times she believed she was a lion, though she more closely resembled a fox. Other times, she pranced like a gazelle, leaping and galloping through her house and her yard, always in pursuit of a playful squirrel and ready at a moment’s notice for a ride in the car, regardless of the destination. She loved animals and people alike, and although shy, never took more than a few moments to welcome someone into her home, and only shortly thereafter, into her family.

Cain is survived by her step-siblings, Hamilton and Sedona, her mommy and daddy (Beth and I) and our respective families, and her first parents, David and Andrea, who delivered her into our home, our hearts, and our lives just 8 years ago.

Cain lived just over 11 years (born during Hurricane Fran, ~09/1996), and loved and was loved by everyone who met her. She was a beautiful dog with a beautiful personality, and she will live on in our hearts forever.

KnowThreat will soon be offering VMware VI3 Training, on behalf of VMware, Inc. To celebrate the announcement, I thought I’d post this quick walkthrough detailing my process for building an installing a full VMware Virtual Infrastructure environment using ESX 3 and VC 2 within virtual machines in VMware Fusion Beta on Mac OS X 10.4.10. This environment proved to be ideal for simulation and testing (though performance obviously leaves a bit to be desired) and saved me the trouble of using an Ubuntu daily build just to do the same thing in VMware Workstation via Linux on the same hardware. Further, with VMware Fusion’s new “Unity” feature, I can run the VI Client alongside all of my other OS X applications as if it were natively built for the Mac!

After using it pretty constantly for the past two weeks, I can say that VMware Fusion is certainly an excellent basis for the forthcoming GA product, and though there are still a few minor features missing and kinks to work out before we see a 1.0 release, I’ve been very pleased with its functionality and performance thus far.

In Part I of this walkthrough, I’ll show you how to setup VMware Fusion to allow ESX to install, then setup bi-directional connectivity between your laptop and your virtual infrastructure.

Preparation

Before you begin this process, I recommend you free up plenty of disk space. On my first run through this process, I created the virtual disks for both ESX and Windows XP with a bit too little available free space. This process itself can be made significantly easier with the assistance of either Disk Inventory X or GrandPerspective, both of which provide visualizations of your filesystem that should make removing existing disk hogs significantly easier. I’d suggest you leave no less than 20 - 30 GB available specifically for your virtualization environment if you plan to put it to any real use.

The Physical Environment

• MacBook Pro 15“ C2D 2.4 GHz, 2GB, 120GB SATA
• VMware Fusion Beta 4
• VMware ESX, VC, and VCB Insall CDs
• Wired 4-port switch, connected to the Internet
• Private network address space allocated to Virtual Environment

The Virtual Environment

• VMware ESX 3, with 2 CPU’s, 1.5GB RAM, 20GB Local VMFS
• Windows XP Pro for VMware VC 2, single CPU, 384MB RAM, 8GB disk
• Windows 2003 Server VM, single CPU, 256MB RAM, 4GB disk
• Ubuntu 7 VM, single CPU, 384MB RAM, 4GB disk
• 20GB SAN datastore

Building your VVI (Virtual Virtual Infrastructure)

Building our environment essentially just consists of creating and customizing a VM to host VMware ESX Server, then creating additional VMs using default settings to hold our VC and other Guest VMs.

Create our ESX VM

• Choose OS: ”Linux“
• Choose Version: ”Red Hat Linux“
• Save as: Whatever You Like
• Where: Wherever You Like (faster HDs better)
• Disk size: ”8.00GB“
• Disk Advanced: Check ”Allocate all“
• Uncheck ”Start virtual machine and install“
• Select ”Use os installation disk“
• Hit ”Finish“

Now, go into the VMs Settings dialog and increase Memory to the amount specified as the ”Recommended maximum“ in the Memory dialog. Select 2 Processors. Set Network to Bridged.

Close VMware Fusion, browse to the location of your ESX VM, select it and choose ”Show Package Contents.“ Then open up the .vmx file and ensure the following values exist as specified.

virtualHW.version = ”6“
scsi0.virtualDev = ”lsilogic“
ethernet0.virtualDev = ”e1000“
ethernet0.addressType = ”generated“
monitor_control.restrict_backdoor = ”TRUE“
monitor_control.vt32 = ”TRUE“
virtualHW.productCompatibility = ”esx“

Close the Package Contents window in Finder, Re-open VMware Fusion, and we’re ready to move on.

Boot your ESX VM and install ESX

When you first boot your new VM, Fusion will prompt you to recreate the virtual disk, as it was originally created using a different virtual SCSI adapter. In order for the VM to function properly, you must allow VMware to recreate the virtual disk. Ignore any warnings and move on.

Now, insert your ESX installation CD, boot your VM and install ESX. When giving ESX an IP address, make sure to use an IP on an unused private subnet, not your existing Internet-facing subnet! For example, if your existing network is a 192.168.1.0/24, give the ESX machine an IP within 192.168.254.0/24 or something within 172/12 or 10/8. Next, we’ll add an alias to our wired interface so that we can communicate ‘pseudo-privately’ with our VVI while maintaining Internet connectivity from our laptop.

Setup and Test Connectivity

First, you’ll need to give your MacBook an IP on the private subnet that you established for your ESX VVI. To simplify this, we’ll add an alias to our wired interface. Note that this technique will not work on your wireless (en1) interface, as packet forwarding is handled differently and will prevent your laptop from communicating with its VMs.

taylor@[~]: ifconfig en0
en0: flags=8863 mtu 1500
        tunnel inet  -->
        inet6 fe80::42b:79fb:fa97:ea12%en0 prefixlen 64 scopeid 0x4
        inet 10.254.254.100 netmask 0xffffff00 broadcast 10.254.254.255
        media: autoselect (100baseTX ) status: active
        vlan: 0 parent interface: 
        bond interfaces: 
taylor@[~]: sudo ifconfig en0 alias 192.168.254.100 netmask 255.255.255.255
taylor@[~]: ifconfig en0
en0: flags=8863 mtu 1500
        tunnel inet  -->
        inet6 fe80::42b:79fb:fa97:ea12%en0 prefixlen 64 scopeid 0x4
        inet 10.254.254.100 netmask 0xffffff00 broadcast 10.254.254.255
        inet 192.168.254.100 netmask 0xffffffff broadcast 192.168.254.255
        media: autoselect (100baseTX ) status: active
        vlan: 0 parent interface: 
        bond interfaces: 

After adding the interface alias, you should be able to ping your ESX VM on the new subnet while maintaining the default route for your laptop through your existing upstream gateway. Note that the VM will otherwise be isolated, as it has no knowledge of any other subnets, nor a route to or through any default routers.

At this point in time, you should have a working ESX installation within a VM on your MacBook and a pseudo-private subnet on which the two can communicate.

In Part II of this series, I’ll show you how I setup VC and my virtual-virtual machines, as well as how I setup a virtual SAN for ESX datastores and VM usage!