Hackit+ - Ethical Hacking training course

I'm excited to write about a little project I've been working on.  I've helped a team of very special and talented folks with creating Premier Course ware for Ethical Hacking.  It is a paid program for instructing on hacking from the very introductory levels.  If you've never worked on security before, or if you are thinking of trying to, but all the material you find out there is way too advanced, then try Hackit+.

With lessons that start with explanations of virtual machines and Linux all the way up to advanced exploitation techniques, this course will bring you from 0-60 in just 15 lessons.  The product has just launched, but the community plans are strong and engaging.  With user driven forums for members only along with access to download and try to hack example virtual machines.  Launching new ones all the time to test your lessons learned.  These virtual machines comprise "Hackville" which is what they call the collection of virtual machines which represent citizens and businesses inside a simulated town.  With resources and persons simulated with virtual machines, these test your learned material and challenge you to creative problem solving.

This courseware is not your traditional fare.  It is engaging and pushes the student to try and experiment and learn by doing.  This course is not for a passive student base.  But for people who are curious about the field of Penetration Testing, Security or just wanting to learn from the bottom up, this course is engaging and has the promise of a strong community structure to keep you engaged for months to come after your complete the course.

There is a certification exercise at the conclusion if you are so inclined, this process will earn you a certificate of completion that will be backed by the Hackit+ team.  This certification is included with the courseware at no extra charge.  Visit the website for the details and dive in if you too would like to learn how hacking works, even if you don't have any previous experience.

I do apologize, I normally don't endorse products on this blog, but as it is very much in line with my philosophy on these things and the Tin Foil Hat Show podcast, I thought it an interesting piece for anyone who normally follow what I'm writing about.

Happy Hacking.  And remember: If it hacks you, you should HACK IT BACK!
--
CafeNinja

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License.

GPG Encryption - Attention in the details

I was working the other day, after setting up a new computer. When I noticed a strange item on the mailserver...the unencrypted copy of an encrypted message I had sent.

I realized later that it was the setting inside the mail client that had set "fcc_clear" option set. There was a simple option to deactivate it. Let me explain a bit the logic.

The reason you might wish to store a clear, plain text copy of your outgoing encrypted email, is that if the message is encrypted to a key that is _not_ yours, you won't be able to decrypt it later. So to be able to see, what you wrote in your last encrypted message to someone else, it saves a copy in the clear.

The problem then enters the room. When your message is actually being saved to a network server, it is just as subject to compromise by the forces of evil as the corporate monster. So, my point being, that you should be vigilant about the software you are using and suspicious of any new or unknown computer system.

I've personally gone to signing all of my emails with gpg both personal and professional as a point of guarantee of origin. Mobile is possible, but I'm working on the easiest/best way to manage that. I would HIGHLY recommend that everyone look to make it a part of their email life. If we get a critical mass of real people signing emails, we can start making that a receipt condition and watch the spam just stop.

--

CafeNinja

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License.

Mobilize PGP - IOS vs. Android

I have recently considered GPG quite a bit.   I can imagine quite a few uses for which is it not generally used that could greatly increase the authenticity of the internet, while at the same time generating a real world "web of trust" which if were as common in the vernacular as "Facebook" then many of our issues today on the net could be resolved.

I've demonstrated with a Tin Foil Hat listener how easy it is to set up gpg and use it with one of several desktop email clients.  I would have to say that I think desktop email support for gpg is a fairly common feature.  But I then thought that for my work and personal emails, I tend to process quite a bit of that on my mobile devices.  Mostly these messages are for consumption and processing and don't have a high security requirement.  But with both my ipod touch and my andoid mobile phone I thought I'd run the two head to head to discover what might be available and at what price.

Please also understand that this comparison does not enter into commercial phylosophy, political alignments or any kind of sponsorship agenda.  I just wanted to know which of the two device platforms would allow me to use pgp on a mobile device in the easiest manner.

On my IOS 4.3 iPod Touch 2nd Gen, I did find some application offerings for PGP (commercial version of gpg) which either cost ~$50 or ~$4 for decrypt only.  I found no applications which used gpg, but that might be due to the gpl limitations in the iTunes App Store.

On my Android phone I had already installed the APG app which is free in price.  This is the pgp portion of the solution since the native google mail app is great for the interface, it doesn't support pgp at all.  Then I discovered the K9 mail applicaiton which is also free and works direclty with APG for encryption support and it really does work.  I was impressed as well, K9 is very similar to the google mail app while maybe being even a bit more responsive.

So, in conclusion if gpg encrypted or signed email is critical to you or your work I would strongly recommending an Android phone with APG + K9 mail.

--
CafeNinja

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License.

Featured Interview on The Frostcast - Part Deux

Oops, I did it again.  With the help of Jonathan Nadeau, and making another appearance on the Frostcast.  In this episode we had a very specific discussion on the personal cloud project that I'm working on at the house. 

We talk about the hardware and the server applications being run up to present in more detail than I've covered on the Tin Foil Hat Show to date.  So please, check out his podcast. 

I did discover during this interview that the shownotes for the Tin Foil Hat show are handi-accessible which makes me very happy.  As always I had a great time chatting with Jonathan, and I'm really looking forward to more from him in the future.   I've linked to Jonathan's welcome announcement at the FSF's intern program.  And make sure to stay tuned to all the Frostbitemedia podcasts to hear about his upcoming projects that he told me about off-line.

 --
CafeNinja

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License.

Let's start talking about keys

I have received quite a few requests after the last Tin Foil Hat Show asking for gpg keys to be shared so that webs of trust could be built. While I won't be able to organize a key sharing party like the one described in "Little Brother" by Cory Doctorow, I do believe in the security and trust levels that are supported by GPG keys.

I'd like to offer my key for the Tin Foil Hat Show as the contact point for key sharing. I would be happy to sign, read or verify anyone's key if you wish to share it. My key is "0x5110932D" and you should be able to import tinfoilhatshow@gmail.com from hkp://pgp.mit.edu:11371 or hkp://keyserver.ubuntu.com:11371 as I have uploaded them there.

If you have created a key based on Tin Foil Hat Show, make sure you export them to a keyserver so that it can be validated as a real key. I look forward to anyone who would like to test their keys or signatures out writing to tinfoilhatshow@gmail.com.

--

CafeNinja

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License.

Gmail: mutt vs. web interface

I am a very serious gmail user.  I think it's a good service.  I have already written on this blog that I am a serious fan of the mutt email client.  Please understand that I don't feel that any other gui mail client competes for the speed with which I can process my email.  So I don't want this to be a email client vs. email client war, I've already said my peace on that and if you don't like that please find another blog.

I do think it's important to check and see what the critical differences are in the two methods I use to access the service.  Clear declaration, that I use imap with mutt so I am not caching or storing the email local (i.e. POP3) which might make a difference in this argument.

After using the web interface with the google labs on for keyboard shortcuts, and giving myself a solid two week time frame during which to become proficient with using the keyboard with the web interface.  I have to say that is can be quite efficient on it's own and very usefull, so the below comparison has everything to do with web+keyboard vs. mutt and the efficiency with processing/managing emails.

Gmail web Pros:
Search speed: very fast and process all headers and body.
Open Access: any OS, any PC commands and interface available

Gmail web Cons:
No gpg support: not for key verification, not for encryption.
Conversation presentation: does invite confusion about where messages are

Mutt pros:
More refined searches: the limit statements are crazy specific
GPG support: completely, inline.
Closed Access: w/ssh access offers only encrypted channel

Mutt cons:
Software requirement: somewhere there must be software installed
Complete searches: if you do a search of body content takes a long time

I have to confess, that with multiple accounts, I have a serious need for some features on some accounts and needs for other features with others.  I actually have one account that I use both interfaces with often.

Find you comfort level, be realistic about access and real needs, if you would like to have high security and choose mutt, it might be very uncomfortable to use a mobile phone for access with a crampped keyboard.

Be practical, pragmatic and safe.

--
CafeNinja

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License.

Paranoid security or just modern Privacy?

As many of you have noticed I'm posting in my social networking streams using base64 decode statements.  I just wanted to explain that I will be doing this even for the mundane.  I have had the ephifany that "some is good, more must be better" is maybe not the way I intended for my social live to be.

I should explain that I expected that these would be mostly walled gardens with each social networking service offering it's unique and special approach to the broadcast communication issue.  As more of these services have started integrating, using back door API's and making it a giant collective, that while my single voice is not important, it adds to a logarithm of what is the collective whole. 

I am not foolish, I don't think that my posting the command to decrypt what I post keeps my messages "secure", and that is not my intention for them.  What I do hope to succeed in is that my messages aren't being grokked for the commercial, financial and statistical benifit of corporate entities for whom I hold no allegiance, holding or care.  It's mine, and I made it for public consumption.  As I see venture capitalist investing millions of dollars in companies who scrub what is the internet collective for profit and gain, I am saddened.  I would understand if doing this created a benefit for the consumer or the internet as a whole. 

My goal is to allow me, my family and my friends to continue using the tools as they were originally designed without offering my portion of mind-share away.  I feel that, especially in the case of the base64 posts, I achieve the goals of:

1. communicating with family and friends with miniumum tech overhead.
2. make it easy for someone to ignore me on a broadcast stream.
3. upset the machines on the far side of the services I use from gaining profit over my ideas and opinions.

I would be lying if I didn't see the added benifit of this preparing myself and family for secure communications in the case we feel corporations or the state care far too much about what we say or limiting our freedoms.  This is just an advance warning that it only escalates from the base64 posts.  It is my humble opinion that what used to be called "paranoid" measures, by todays standards, can at best be referred to as moderate privacy.

--
CafeNinja

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License.

Steganography - Some new fun

After reading an article in Linux Magazine, I've been playing with the steghide program available on most linux distros and popular repos.  I am quite impressed with this programs ability to insert quite a bit of information into an image or wav file.

The word steganography is of Greek origin and means "concealed writing" (citation wikipedia).  Really, as a word it is just describing covert messaging.  It offers no context in which it must occur or any kind of standard.  This technique is designed to put the message in a quite public place, kind of like the symbology clues you might have heard about in "The DaVinci Code".  The concept of security through obscurity is primary here.

The program recodes color codes in a jpg file to replace a shade of color with another and then uses the digit difference to insert the message.  The steghide program actually takes the image and the message and shuffles them together on the level of the data.  The receiver would NEED to know to look for the message since there is no visible indicator of a hidden message.

The application steghide is a command line tool.  There is a gui tool called steg-gui, but I didn't feel like compiling it, and since not in my repos I didn't use it yet.  So I won't offer any opinion of it here, maybe in the future if it can manage to be included in the repos.

As another example.  The image of Bettsy above, is also a steganograph.  Feel free to have a go and treat the image like a captcha.  After steghide is installed the following will produce the message that is this blog post, give it a try.

wget https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8lzJH8uunbgYj61D3nW8Exqt_2XR5lVu4SGFbx53bOXXHasWOPduf5cqEgyGSrERsvep3eWKHFX2k1Evq06Uu9otnaVpBe32LznDwxhV3lTFBcLdOy7cFfmhiK1PwfhhTfO0rgGVq6v91/s320/steg-post.jpg && steghide --extract -sf steg-post.jpg

Enjoy,
--

CafeNinja

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License.

vim + gpg + dropbox = secure passwords

Finally accomplished a multi-system synchronized encrypted password file.  Let me tell the short and then the long version.

The short version is
1.) gpg encrypt a text file
2.) store it in a shared dropbox folder
3.) add vim gnugpg plugin.

The long version of the story is that Dropbox has added a functionality to share a folder with other Dropbox users.  I have a Dropbox account for each operating system that I use (3).  So I can modify on one machine and it will get pushed to all the other machines.  I also found the dbcli.py script which lets me run dropbox on a headless machine.

I already have 2048 bit pgp keys created.  I used that key to encrypt a text file to myself.  The file I had was a text file that I was using to record my passwords.  With the command "gpg --encrypt filename"  will produce an encrypted copy with the *.gpg extension.  This new file I placed in the shared dropbox folder and created a symbolic link to it in my home directory.

Then after creating the folder ~/.vim/plugin and moving the gnupg.vim into that folder I was able to open and edit the gpg encrypted file after typing my passphase for the key.  This extension turns off the auto-backup feature of vim to prevent a clear text copy from being anywhere but ram.  Once writes to the file are made, it will re-synchronize with the other computers automatically.

With this new process I am able to view, search and edit my password file even on a mac (with vim and gpg installed).  Of note, I also have a Truecrypt volume in this same shared folder and once a month I do a plain text export into the hidden volume of a Trucrypt drive.  This allows me additional access even if I do not have the permissions to install all the needed components.

Now I can use strong secure and unique passwords for every online service I have.  I even took the opportunity to generate a few passwords and keep them in the password file directly in the case I needed to update a login without command line access to pwgen.

--
CafeNinja

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License.

Password Generation for security

Security and safe passwords are very important in today's online world.  I used to have unique passwords for "levels" of security.  Realizing that if some service from low level was compromised that access to the next level would be easy.  I realized that the best way would be a strong secure password for each online service was the best way to go.  This way there is no way to "escalate" privilege level from one online service to another.

Since I already have a method for recording my passwords, which I'll get into during another post, I though I'd share the command that I use to create new passwords.  I use the package "pwgen".  The output of this command as quoted by Bessy produces quite a few unique passwords which satisfy most secure password definitions.  Most are produced with a portion of it that can be pronounced as a word, which make them in the realm of possibility to actually remember.

Output looks like:

cafeninja@vegeta:~$ pwgen --alt-phonics --capitalize 9 10
joo0kai2Y loh6Chi6y Chei4pei8 AiNoch2ua eeXeeF8Ee veeh3Eer4 Vah2fee8v ve4uegh7E Oa6chahmo Ish2voc2c

Using this tool I can make secure passwords for any account online.  I recently used this command repeatedly as I converted my multitude of online passwords from levels (5 different passwords) to a single password for each.

--
CafeNinja

This work is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 United States License.