Working in Sydney: updates from “Down Under”
It’s been about a week since I arrived in Sydney and it’s passed really quickly. I headed to Sydney on Sunday, July 6, via London, and will stay here for two weeks to work on an ISO 27001 security project that will extend to beginning of 2009. The offices I’m working at, in Darling Park, are really nice, and the views over Darling Harbour simply awesome, as you can see below.
Now that my body is starting to recuperate from the 8 hours time difference, I’ve decided to upload a few pictures to the Photos area. There aren’t that many at the moment, but I’ll keep uploading more as I go.
Lessons learnt from a severe security incident
After a week of ISO 27001 auditing in the UK and a busy week aftewards, I finally managed to get some time to read my favourite blogs. I was doing so, when I read an interesting post in the Internet Storm Center that analyses some lessons learnt from a severe incident affecting The Planet, a well known hosting provider.
Being a BSi instructor for the BS 25999 courses on Business Continuity, I find these kind of real-life examples very instructive for being used at class, although I try to to get students to talk about their own experiences as much as possible.
So have a look at The Planet outage - what can we all learn from it? and let me know your thoughts.
In the following weeks I’ll be creating a new section of my blog where I will put together a list of Business Continuity resources (among others) I can share with my students at class. So stay tuned!
Password Cracking ‘Pass The Hash’ style
One of the most time consuming tasks a penetration tester has to face is password attacks. Traditional password attacks involve password guessing, password cracking or a combination of both. While the first can take anything from days to months, the latter can take from hours to days, depending on the quality of the password dictionary and the available CPU power among others. Tools that make use of Rainbow Tables, like Ophcrack, have significantly reduced those times to hours or even minutes, especially for systems that use weak password schemes like LM or NTLMv1.
All of the above describe how the password attack picture was before a new technique, called ‘Pass-The-Hash’ made its way into the hacking scene. Although someone may think this technique is quite new, it was actually back in 1997 when Paul Ashton posted on Bugtraq a Windows exploit named “NT Pass the Hash” along with the theory which the exploit was based on. This Unix-based tool implemented a modified version of a SMB client that allowed the use of captured LanMan hashes, without having to decrypt them first. However, it wasn’t before last year when Core Security finally took this concept to the next level and produced a much more powerful tool called ‘Pass-The-Hash Toolkit’, which now runs on Windows and works with NTLM hashes. Let’s see how this technique works in more detail.
Previous Articles
Welcome to Passionate about Information Security on ismaelvalenzuela.com
Since he founded G2 Security, one of the first IT Security consultancies in Spain, Ismael Valenzuela has participated as a security professional in international projects across UK, Europe, India and Australia. He holds a Bachelor in Computer Science, is certified in Business Administration, GIAC Certified Forensic Analyst, GIAC Certified Intrusion Analyst, ITIL, CISM, CISSP and IRCA ISO 27001 Lead Auditor by Bureau Veritas UK. He is also a member of the SANS GIAC Advisory Board and international BSi Instructor for ISO 27001, ISO 20000 and BS 25999 courses.
Random Photos
Recent Comments