JerryGamblin.com @jgamblin-blog - Tumblr Blog

No Common SSIDS

I wrote nocommonsssids to quickly remove the top ssids (from wigle.net) from the preferred network list in OSX so that it does not auto connect to them.

Running this will help stop you from being caught by an EvilAP attack along the line of the Mana Common demo I put together earlier this month. You should also run a VPN anytime you connect to a public wireless network.

Using Mana To Spoof Common SSIDs.

I had the opportunity to speak at a “micro- conference” yesterday for the Midwest Cyber Security Alliance with the state auditor Nicole Galloway.

I wanted to use this opportunity to make a bold statement since I knew there would be influential people in the audience who wanted to listen Nicole talk about her new cyber security auditing initiative.

I wrote Mana-Common that builds on Dominic White’s amazing Mana project.

My project used in conjunction with a Ralink 5370 Chipset USB Wireless Card broadcasts 7 of the most popular SSID’s according to wigle.net. Protip: It is easily modified to target smaller audiences who may have saved corporate SSIDs on their devices.

Here is a demo of the terminal output:

Here is a screenshot of my iPhone picking up the networks:

If you have any questions please reach out to me on twitter @jgamblin.

HackAPie: A Wireless Hacking Sandbox

I am getting ready to teach a “Building Your Own Security Lab” series of classes and I really needed a safe place for people to try their hand at wireless hacking.

I built HackAPie that uses a RaspberryPI (this canakit) and openwrt that broadcasts 5 unique wireless networks to crack using tools like wifite and kali.

There are still a few bugs to work out but people have asked me if I would share this and I think I have it in a place where I am comfortable doing that. If you have any suggestions or questions please reach out to me at [email protected] or @jgamblin on twitter.

The most honest hacking comic ever.

Building A Security Lab

My mentor and I are in the middle of spinning up an information sharing group with local security professionals and next Friday is our first “working session” and we are discussing what building a security lab* looks like and costs.

We really hope to start walking through the tools in future meetings but here is what my security lab build looks like and roughly costs.

(Not sure why my blog doesn’t like tables. Here is a link to the excel spreadsheet.)

I really hope to pick up some information on what other people have in their labs that I am missing.

*I am not sure if the correct term here is lab, toolkit or security testing platform. You pick.

You Should (Probably) Turn Off Wi-Fi Assist

If you do not have unlimited data on your iOS device you will want to turn off Wi-Fi Assist in iOS9. Wi-fi Assist uses your data connection when you are on a slow Wi-Fi network.

To turn it off go to Settings > Cellular > Wi-Fi Assist > Off.

MotionPie - The RaspberryPi Security System

I have been looking for sometime to get a few security cameras setup around my house. I have thought about the dropcam and oco options but they were both fairly expensive and didn't have the options that I wanted.

What I did have was a raspberry pi 2, two old web cameras and a 6 year old who likes to build stuff. We spent some time this weekend working with a project called MotionPie based off of MotionEye this weekend and we really like it.

It does take a fair amount of computer, network and linux knowledge but if you have a raspberry pi and google I am sure you could figure out.

I hope to see added (and help since it is an open source project): Dropbox support. Ability to select motion detection area. Ability to change the theme colors.

Here are a few pictures from the project.

The 10 Minute Free* Private VPN

People ask me all time what the one thing they should do to “stay safe” on the internet is. If I had to pick one it would be to use a VPN when you are on a network you dont own or trust.

It has always taken a little bit of technical skill to setup a private VPN but my friends at WebDigi have done an amazing job of making setting up a free (if you dont use it too much) private VPN on AWS easy.

Here is the blog post on how to set it up. Here is the projects github page. Here is the walkthrough video:

Here are some tips from me:

Use LT2P and not PPTP. It is safer.

Try to delete and rebuild the image twice a month to delete the logs and get a new IP address (Yes, I am paranoid).

It is free to start but if you send a lot of traffic through the VPN it can end up costing you a few bucks a month. Setup billing alerts.

What are you passionate about?

What are you passionate about? My mentor asked me that question this week as we were talking about what “true success” looks like. In the end you will never feel truly successful if you are not doing what you are passionate bout. There are people who are passionate about being amazing help desk technicians who feel (and are) more successful than the CIO who would really rather be the CFO.

As a reminder to do everything I do with passion I now have this as the lock screen on my phone:

Kali 2.0 ISO’s

I attended the Kali Dojo at Blackhat this week where I was able to look at the new version of Kali 2.0 that is coming out next Tuesday.

If you are interested in getting an early look here are instructions on how to build your own.

Here are direct links to the two ISO’s I built: kali-linux-sana-amd64.iso kali-linux-light-sana-amd64.iso

Please be sure to grab the official release on Tuesday!

#blackhat #kali

Surviving and Thriving at Blackhat

Since it is that time of the year for all good security professionals to get ready to fly to Vegas I decided to put together my own “Surviving Blackhat” blog post.

Make a Friend. Being in security is sometimes a thankless job. You are going to a place with 30,000 other professionals who do the same thing you do and know the struggle is real. Sure, someone may try to social engineer you into you telling them your mothers maiden name but you might find a friend who does forensics that you can call at 0200 when you think you are 10 minutes away from being fired.

Have A Meal With An Important Security Partner. The companies that help you secure your company are at blackhat and want to hang out with you. Take advantage of it.

Have A Meal With Some Friends (That You Pay For). Pick a night (I suggest Tuesday) and make plans with a group of friends to have an amazing meal somewhere in Vegas without a vendor (unless you are really friends with a vendor).

I would suggest the Italian American Club for an affordable and amazing dinner.

Do Not Go To Every Party! Seriously... there is no way to attend all of these. Pick one or two that you really want to go to. I would suggest the Nike Party and the RiskIQ party.

Dress Like An Adult (for meetings). Save the Black T-shirts and Flip-Flops for DEFCON. To quote Jay-Z:

I don't wear jersey's. I'm 30 plus gimmie a crisp pair of jeans and a button up.

Get Swag And Give It Away. Pick up way more swag then you need. You have co-workers that are covering for you. Nothing says “Thank you” like showing up on the 10th with a book bag of T-Shirts from companies you never heard of.

Get Smart! 90% of the smartest people in the industry are going to be within 4 miles of each other for 168 hours. LEARN.AS.MUCH.AS.YOU.CAN.

Have Fun! Part of the reason you are in Vegas is to recharge your batteries and have fun. Do that.

#blackhat

RandomMAC.py

I spend a lot of time working in the starbucks near my office. It is a great place to slip away from the office for an hour when I need to do some heads down work but dont want to be completely anti-social.

Even though I always use a VPN one thing that always bothered my was that Starbucks was grabbing my MAC address every-time I logged in:

I am not a big fan of being tracked like this so this weekend I wrote randomMAC for OSX to quickly change my MAC address.

So now when I log in at Starbucks I am passing it a random MAC:

#osx #starbucks #security

Disable Frequent Location Tracking in iOS 9

I have been using the iOS 9 Public Beta 2 and one of the things that I do not like (and has really been freaking me out) is the Frequent Location Tracking.

I was getting alerts like this:

This made me have the following thoughts:

I am not going to Columbia right now.

Am I going to Columbia right now?

Why does my phone think I am going to Columbia right now?

Wait... why does my phone think I am going to Columbia?

The answer to this is a new-ish feature in iOS 9 called “Frequent Locations” and it does a stalker quality job of keeping track of you:

You can and should turn this and Location-Based Alerts and Location-Based iAds off in: Settings > Privacy > Location Services:

#ios #ios 9 #iphone #security

Compare Two Files

At work this week I needed to compare two files to see if they had the same MD5 or SHA256 hash. After spending way too long trying to get hashdeep and md5deep to work correctly and not finding anything else to easily do this I wrote compare.py today.

This script is the definition of utilitarian but I hope it can help you also.

#python #hacking #security

Just Say No To Security By Listicle!

I see these types of listicles on LinkedIn or Twitter a few times a week: 5 tips to protect your business against cyber crime Ten ways to prevent a data breach and protect your small business 3 tips to keep your company secure from hackers

They are written by *security experts* and they say effective security is as easy as:

Running su -c 'yum update’ every week.

Picking a good password.

Blocking everything from China.

The only way to respond to these articles is:

The truth is SECURITY.IS.HARD!

When an *expert* writes an article based on the premise that effective security is achievable by following a canned security framework they devalue the whole security industry. Implementing security in any organization is about performing the unique risk analysis and that cant be achieved through a checklist.

So the next time you see one of these listicles just say...

Fathers’s Day Performance Review

“Mr.Gamblin this is your sixth year in the role of my father. How do you think this year has gone?” - My son during my imaginary yearly performance review.

Most holidays are set aside to celebrate an event that happened in the past while father’s day is mostly a day to celebrate what was accomplished in the past year. It is impossible for me to celebrate without stopping and thinking about the past year. The easiest way to do this is to go straight to some classic performance review questions and apply them to my parenting skills. So here are the five questions I asked myself this morning:

"What went well this year and what might have gone better?" "What can I do differently next year?" “What are the most important goals for the coming year?” "What knowledge or skills do I need to develop to meet my goals in this job?" "In the past year, what achievement am I most proud of?"

Overall I think I did a good job this year but being a dad is one of the few roles in my life where I do not mind and actually expect to get a few “needs improvement” and no “exceeds expectations” because I am the one setting the expectations and I can never do enough for my son.

#fathers day

Trending Blogs

Recently Viewed Blogs

JerryGamblin.com