InfoSec Basics Labs

When I started learning infosec in college, I realized how different labs can be depending on the how the teacher/course maker made the labs. I ended up breaking down styles into a few categories:

  • Complete command-by-command instructions with explanations of each command
  • Command-by-Command instructions with no explanations
  • Instructions on the order of tasks and which tools to use, but having to figure out how to use that tool on your own
  • Instructions on the order of tasks and being given a repository of tools to use

Each method gives different advantages and disadvantages. I prefer the last option, because I think it forces the student to research and learn about the tools. Additionally, any of these can and should be supplemented with questions along the way and at the end to draw conclusions. Anyone can regurgitate information, but these questions are designed to force the student to think about what they did and how they did it. That understanding is pivotal to creating prepared infosec professionals as we are expected to be able to figure stuff out on our own.

One of the projects that I have worked off and on for a long while is the CTF Wiki. The project started as me trying to think of something I do to give back to the community, specifically a visible resource, however at the time, I wasn’t very knowledgable. Although I am not in love with just living for documentation, I found that CTFs did not show differences between them or have any more documentation then a basic repository of solved challenges assuming you found that. As I started to document the essence of each challenge: categories of skills, timing, hints, format of the challenge and so on, I also started documenting the tools and use cases. Due to lack of time, I haven’t had time to update the CTF Wiki in a long time which frustrates me greatly.

Recently, I was asked to help mentor an awesome person that has decided as she learns more about infosec, she will help me transition the site to its new home, format and help add information. Anyone else that is willing to help in this effort, please send me a email. My email is ( Forgotten ForgottenSec com ) and is on the front page of the CTF Wiki. This started roughly 2 months ago and as time progresses, we get closer to launching the new site which has me really excited. As the CTF Wiki transitions to Github, this allows all contributors to be credited via their coding resume aka Github. This is a amazing opportunity for students to show they are going above and beyond what the classroom has provided and helping to give back to the community.

Just recently, a student from my college asked me to be his mentor. It amuses me how much I offer to help and basically no students took me up on it, however two people now came to me which is awesome. Regardless, I got him working on a slightly different project that became the subject for this post. The CTF Wiki has become more then just CTF info when I started to incorporate the tools and ideas needed to work on these challenges. When I was in college learning, I tried to get students to work with me to play various CTFs and realized we had to start off with really easy challenges to get people having fun and thinking. Some struggled to go beyond basic classwork and get into infosec challenges. At the time, the labs the school had were mostly my least favorite type of lab which is basically step-by-step commands with few to no questions forcing students to think. Regardless, I plan on folding a infosec lab repository into the CTF Wiki for learning. If you have labs you are willing to share, there will be a section on the CTF Wiki explicitly for that. My goal is to have myself and others working to improve labs to teach various portions of infosec. Crowd-Sourced labs will provide the community with better resources for both students, instructors, and allow students aren’t paying for a formal education to receive quality training for free similar to the idea of Coursera, but open to anyone to use or improve. The new site is not yet ready for launching, but I expect for it to be ready in the coming months and I am really excited to have a few labs posted by launch. If you have labs that you want to share now, please let me know.

Attending Conferences

In the 5 years that I have been working in InfoSec, I have been to a few dozen conferences across the east coast and across the country. I have attended every conference I have been able to as I feel I get a lot out of visiting them especially the first time I go to each event. Many people have been to more conferences then me, but here is my list of what I have visited so far:

Shmoocon Washington, DC
BSidesDC Washington, DC
BSidesCharm Baltimore, MD (just outside)
BSidesDE Wilmington, DE
Summercon New York City, NY
Thotcon Chicago, IL
Derbycon Louisville, KY
Circle City Con Indianapolis, IN
Hack Miami Miami, FL
Defcon Las Vegas, NV
BSidesLV Las Vegas, NV
Hack3rCon Charleston, WV (not to be confused with Charles Town… very different)
Shmoocon Epilogue Fairfax, VA

Each has a focus and each has value depending on your goals. Many of them even have a focus that is varied in intensity depending on the event. Regardless, depending how you participate in the conference will change your experience dramatically. Regardless of what you end up doing, realize that a twitter account is almost necessary to get the full experience. Many professionals I know have Twitter accounts they only utilize during conferences, which is perfectly acceptable. Here is a list of some of the possibilities of things to do:
Attendee Type:

  • Attending Training
  • Hallway Con/BarCon/Eating with other con participates
  • Challenge Player
  • Attending Parties
  • Attending Talks
  • Attending Villages

Other Badges:

  • Vendor/Sponsor
  • Staff/Volunteer
  • Organizer
  • Trainer
  • Speaker

Some people devote the entire conference experience to one of the above, but ideally, you should attempt to participate in as many of these as possible at each con you attend. At least as many of the attendee type things to do at cons as well as speaking and training. It is a very different and interesting experience to be any of the first three types of “Other Badge” participants. Being a staff, volunteer, vendor or sponsor shouldn’t take up your entire con experience. Ensure you participate and enjoy since you showed up to the conference. I will break down each type of attendee experience:

Attending Training:

Some have said Training is one of the more common justifications for attending conferences at this point which makes sense to me. Many conferences offer relatively inexpensive training compared to dedicated training events like SANS. You can experience some unique trainings that may not be quite as polished as a professional training event, but at a fraction of the cost. Additionally, there are some topics that just aren’t available in a professional training environment at the moment. It is a great learning experience and in many cases is a negligible cost difference. These trainings are almost always given by practitioners not professional trainers meaning their real world experience in the subject material is significantly better. Most people I’ve spoken to would much prefer a more knowledgable trainer rather then a more polished trainer if you have to choose between the two. I attend any training I can at conferences. It can take up a significant amount of time, but I am rarely disappointed. In many cases, training is available on the days leading up to the conference which increases your learning opportunity. If possible always participate as it sets the tone for the rest of the con and you can form relationships with other students that can make the con more fun and create a lasting network of others interested in subject of the training which can be very valuable in addition to networking with the instructor during the conference.

Hallway Con/BarCon/Eating with other con participates

This is my second favorite portion of conferences, yielding only to training. Given the lack of social nature of many in the information security field, I attempt to appeal to peoples sense of appetite by ensuring at each meal I eat, there is at least one person I haven’t eaten with that con. To achieve this, I tweet relatively in advance before eating and ask who wants to join me, tagging the conference and any other random tags I think are appropriate. Additionally, if the wait is long, I tend to ask random people “Who doesn’t want to wait in line?” in a attempt to get random people I don’t know to join me. This is especially applicable at Defcon. The most common thing I end up doing at most cons is hanging out in the hallway talking with people. Sometimes about a talk that I have just seen, but more often asking what they have been working on or researching. This has led to some amazing opportunities and connections with others that share similar research interests. Often I end up explaining some of my projects and/or research as well. This has led to some contributors in a few of my projects and sometimes it just increases peoples awareness and sometimes all I get is negative commentary like “that is a waste of time”, but everyone is entitled to their opinion. Sometimes their negativity is correct; sometimes its not. If I decide a conversation is not useful, I just move on. There are typically between a hundred and two thousand attendees at every conference listed above besides Defcon. If your conversation with one person isn’t interesting or useful, move on or change the subject. Many times, these conversations end up at the bar.

Many people in InfoSec like to drink. I don’t mind, but I am not in love with drinking. I tend to only drink what I enjoy drinking which causes some issues, but often it allows the willingness to open up and have better conversations. Social anxiety appears rampantly. Libations help… If don’t want to drink, don’t. If someone pressures you to drink, tell them no clearly and if they continue, hangout with someone else. There are plenty of people that have fun at conferences without a drop of alcohol like Jayson Street, although some believe Diet Pepsi is his alcohol. It is a choice; not a requirement.

Regardless talking with others and learning/networking through private conversations is extremely valuable. This allows for peer review of your findings/research, learning of others research, projects, tools and ideas. Many of these conversations have led to ideas for projects and research. Sometimes the only value I get out of conversations is laughing with someone and a contact for the future if I ever get a interest in whatever that persons expertise is in. Remember that while you may be knowledgable in a subject, there is always someone that is also researching that same subject and others who don’t even know that research topic exists. High level conversations about research and projects is commonly found in the bar.

I tend to hang out in the smokers area quite often regardless of not smoking. the outside area for smokers always contains a few folks and people need to do something besides sit on their phones, so there is almost always good conversation wherever the smokers area.

Challenge Player

Over the last couple years, information security challenges have exploded in popularity in both the professional and student portions of information security community. Most value practical application far above any paper showing non-practical knowledge. The challenges force students to take the theory they learn via traditional college system and supplement it with practical challenges that force students to think and apply those concepts in someone practical applications. Working professionals enjoy the opportunity to do the same. Challenges come a wide range of formats including Attack Challenges, Defensive challenges and the most popular Jeopardy style. These challenges touch on a broad range of different skills including:

  • Crypto
  • Forensics
  • Web Exploitation
  • Binary Exploitation
  • Recon
  • Reverse Engineering
  • Programming
  • Packet Analysis
  • Log Analysis
  • Lockpicking
  • Social Engineering
  • Wireless Challenges

These categories make-up the practical skill-sets covered in most InfoSec jobs. While playing these challenges, learning, research and working with others can teach you an incredible amount.

Attending Parties

Depending on the particular conference, most of the parties are similar. Loud music, very few people dancing, tons of alcohol and lots of people out the in hallway chatting just outside the party area, far enough away to have a conversation without screaming, but close enough to hear the music. I strongly recommend ear plugs for most of these as in the party area, the noise can be deafeningly loud. Similar to bar con/hallway con and meal-time, given libations, most attendees tend to chat easier at party time. There are always some who get destroyed; either help them or ignore them. As mentioned before, I do recommend enjoying some alcohol, but getting plastered is not recommended. It can be quite the fun escape, but your at the event to teach, learn, and network; Being sick does not help.

Attending Talks

This may seem somewhat intuitive, but it is rarely worthwhile to view talks. Given the numerous other options for things to do. This assumes most if not all talks are recorded. I tend to attend talks that aren’t recorded and other conference portions. If there is a talk on a subject and I believe I have questions or if I am extremely interested in that subject or if I know the speaker and just want to support/troll them, I will attend the live talk, otherwise I am almost never in talks. Know which talks are recorded and which aren’t. Every once in a while, there is a recording issue and talks won’t be recorded, but that is rare. When talking with others, find out what are the most interesting talks they’ve been to, if any, and why. This helps after the con when I watch videos.

Attending Villages

Villages are interesting areas focused in a particular subject. Some examples are the awesome folks at Wifi Village (the folks that host the Wireless CTF), TOOOL, Hardware Hacking Village, and ICS Village. These contain the experts in a given subject. Many contain talks given on advances in that specialty area. I visit every one I can at every con I go to.

Suggestions


Rooms

At conferences, you only sleep a few hours per night and you don’t want to leave your expensive toys in your room. Plan to split a room with someone. Always put the sign up requesting not to be disturbed, this helps to avoid maids with sticky fingers. Any supplies you need, you can get from the front desk. Staying at the con hotel has advantages and disadvantages. The conference hotel will have unsafe wifi/network, but thats also true of surrounding hotels. It is significantly easier and faster to get back to your room to change, drop equipment/swag, and get back to the festivities.

Gear

In most cases, a minimal amount of equipment is ideal. The less to carry around the better. If your taking a technical training, then bringing a laptop is necessary, but otherwise avoid it. Keep a minimum amount of extra cloths and plan to have some extra space for stuff picked up at the conference as swag still takes up space. After a few hours of walking around, even a few pounds can make a noticeable difference. This is the benefit I mention above in the rooms section. If your room is in the conference hotel, it is much easier to drop off the swag bag and backpack. Bring a rechargeable battery for your phone/tablet.

Twitter

As I mentioned above even if you only utilize it during conferences, create a account and watch the Conference & Conference Organizer twitter account and the associated hashtag. It is the easiest way to get info on whats going on. Setup your twitter on phone and make sure your phone rechargeable battery is charged and you have a adapter for your phone. I almost always tag the con account and hashtag when I go eat and find someone else that wants to go. Many others do the same. It is a great opportunity to meet other professionals and have some great conversations.

Goal

If you have a idea of what your looking for to start, that helps. Some typical goals:

  • Recruit other professionals or be recruited
  • Get advice technology choices within your organization
  • Learn how to implement a new technology
  • Learn how mature a technology you have implemented
  • Build your professional network to prepare for the future
  • Advertise your projects or business

Conclusions

So there is a ton of information in this post that is hopefully useful, but I was asked if I consider conferences worth attending. As a information security professional , the exposure of various technologies, solutions and ideas combined with the ability to learn quickly how to implement the correct solution is extremely important. In a larger organization, you can be more specialized in a particular technology, toolset and/or role, while in smaller orgs, your part of everything. I heavily value exposure to various technologies and experts to help with hard decisions. Conferences supported by twitter is how I do that. Conferences allow me to have discussions on critical questions and issues that can’t be answered in 140 characters or just shouldn’t be. Following up on twitter with people you meet in person help lead to personal projects, research and new thoughts.

As you long as you pick the right conference to participate in, you will be exposed to new tools, ideas, and/or people that will help you progress. I found conferences extremely valuable to my development as a professional and now that we am preparing multi-day in-depth Snort Basics and Snort Tuning classes, going to conferences has become even more valuable as I connect with more groups that need the training that we are putting the finishing touches on. If your ever at a con, come say hello; if you can’t find me, tweet at me and I will come find you.

PS: Make sure you know what the distance is to your event. Committing to showing up to a conference, being on the road for an hour of what you think is a 90 minute drive and having the GPS say, 5 hours remaining is really bad, especially when you have no hotel and planned on driving home.

Avoid Joe Mccray/Strategic Security

After some friends complained they also got screwed over, I felt it was finally time to write about a trainer that has wronged many.

While looking for some reasonable training, I found Joe Mccray, Strategic Security, that seemed to be supporting the community and offering inexpensive rates. I even spoke with a local person that had worked with him as a “Security Rookie” who said good things. Despite my better judgement about paying for semi-intro classes, I decided to try a class. I learned to trust my judgement more on training.

I signed up for “Catch Me If You Can: Bypassing AV/HIPS/NIPS Online Workshop” in August of 2013. This was supposed to run noon until 4pm on August 17th and 18th. I confirmed regardless of the errors on the initial email sent as well as the fact video’s of both days would be sent.

At the end of the day, he sent out a txt file with some of the commands used and promised he would send out the videos shortly. He also sent information created by a group called Web Application Security Consortium. These were solid resources albiet being a few years old at the time of distribution.

At the end of the first day, he sent a invite to the second day with the wrong times listed (he had noon until 10pm instead of noon until 4pm). Regardless, I confirmed again the times for the following day and asked when he would release the video for day 1. He confirmed the times for Day 2. An hour before Day 2 was scheduled to start, he sent a email:

“I’m sorry to have to do this on such short notice. But I’m leaving for the airport right now. I have to help a customer with a compromise so I will not be able to run this class today. Please accept my sincerest apology as I know several of you are in other timezones and that makes attending this workshop very difficult. I promise I will make it up to you.

Again, please accept my apology and I’ll see you next week.

BTW…yesterday’s video and class notes I’ll take care of sending to you when I get off the plane and get to my hotel later tonight.”

I was annoyed, but didn’t make a big deal of it as emergencies can happen. He sent out a invite for the following week with again the wrong times (he had noon until 10pm instead of noon until 4pm). On 8/26, the supposed make-up day, he didn’t show up. A few days later, I emailed and again asked for the video’s from day 1 and when the makeup would occur.

Rather then complete the session promised, he decided to replace day 2 with another class he had made. This one on a completely different subject and during the week instead of on the weekend like the original. So two weeks after the class was supposed to have occurred, he never sent out the rest of the info from class 1 and never had class 2. He also had only offered to move into a different class.

The make-up class he offered got pushed back a additional week as well. Then he ended up canceling class one of the days due to a “network outage”.

I still have yet to receive the video from the first class and have long since given up on it. I told him the way things were handled were poor at best with no response. Over the 1.5 years since, dozens of people have told me similar stories of being severely disappointed with his unprofessionalism. One of his own friends went as far as to apologize to me and tell me Joe is a good person, but a “terrible person to do business with”. I have heard numerous stories from friends that he repeatedly cancelled classes, didn’t share materials and was just generally unprofessional considering he is charging money for his trainings. I have encountered numerous trainers that have been significantly more professional in free classes then he was in classes he charges money for.

Additional instances of people publicizing their issues with his content or teaching:

  • A significant portion of the content from a paid webinar were stolen from Exploit Lab without credit or permission (see: http://blog.exploitlab.net/2013/02/defending-our-work-part-2-exploit-lab.html ) as well as covering some of the concepts incorrectly.

    Some of the comments show the kind of person Joe is and the type of work you can expect from him:

    • “msploit12 February 2013 at 12:52
      I’m incredibly happy to hear someone has finally outed strategicsec. Over the past year I’ve watched a lot of things unfold with Joe McCray. You just have to look at his security rookies ‘program’ to understand what hes up to. His unpaid ‘rookies’ have in many cases preformed recon for actual pentests. Hmm unpaid people doing for the benefit of a company, yep thats a violation of labor laws. I also have personal knowledge of Joe linking to and hosting pirated books and courseware for his ‘rookies’ and other people. He also has his ‘illegally unpaid’ rookies put together some of his class material which is sold.”
    • Another former ‘rookie’ commented:
      “throw away13 February 2013 at 00:25
      As a former ‘rookie’ I can attest to this. Under the guise of giving us ‘real world’ experience he is essentially getting free labor and charging the clients for his (really our) time. Rookies are tasked with creating his training material which usually involved him providing a ‘rough draft’ and us fixing errors and importing it to his letterhead. Often, when having to research the problems we found that the material was pirated from SANS reading room, GIAC Gold papers, or other publicly available sources with no attribution to the original source or author. There was some original content generated, but it was far and few between and almost always created by unpaid ‘interns’ that was in turn sold through his training programs.”
  • Another former ‘rookie’ said via Twitter DM when asked about the program:
    “I bailed pretty early. After a couple weeks of working for free, I stopped. It was obvious he was just trying to take advantage.”
  • More Recently, someone commented some more issues ( http://nathanheafner.com/home/2014/02/17/in-depth-and-personal-infosec-training-thats-affordable/ – sadly the comments show mixed results )
    “Michael • 2 months ago
    You must have got in early. I’m in the middle of taking a class with Joe now (Pentest candidate program). He advertised the classes as being Monday and Wednesday, 7-9pm for December-February. However he has already cancelled 7 classes, and most of the other ones were only about an hour in length. Some members of the class are saying it’s a scam, others are saying he’s just winging it.

    Either way, I would strongly advise anyone against taking classes with Joe.”

  • A friend that was in the Security Rookies program said that Joe used them to write his material and do unpaid work for his company. You can get some experience, but at the cost of being used.

Someone from CarolinaCon adamantly defended Joe as he was criticized on Reddit

While Joe may be knowledgable, I compiled these stories so people understand what they are getting into. If you are looking at the Security Rookies Program, there are people that have gotten a lot from it, but it is at the cost of being used. Some people have had a positive experience… While I am bitter and would never do business with Joe or recommend anyone else do so, he is knowledgable and he has given opportunities to some that are not easily obtained…

=====================================================================
A friend just shared another story with me:

On December 1st Strategic Security will launch the Pentest Candidate Program. This program is designed to satisfy the basic requirements to be a penetration tester. The program covers the common technical requirements, common soft skill requirements, and via a partnership with several penetration testing firms the top candidates will be given job interviews at the end of the program for a remote penetrating testing position (remote meaning you can work from home).

If you already have a US Security clearance, currently live in the DC, Maryland, Virginia area and you are one of the top candidates you may be given the opportunity to interview for a cleared penetration testing position.
This is your chance. If you REALLY want to become a penetration tester then this is the perfect combination of training, mentorship, and opportunity.

What is covered in the program?
This program is hard, but rewarding. It covers the following subject areas:

Command-Line Kung Fu
Linux Command-Line Fundamentals
Windows Command-Line Fundamentals

Network Penetration Testing
Scoping a penetration test
Performing a penetration test
Reporting penetration test findings

Web Application Penetration Testing
Scoping a web application penetration test
Performing a web application penetration test
Reporting web application penetration test findings

Python For InfoSec Professionals
Log parsing with Python
Pcap parsing with Python
Network testing with Python
Web App testing with Python

Preparing for a job as a Penetration Tester
Resume assistance
Assistance with building a portfolio based on this program
Mock interview
Interviews with up to 15 Penetration Testing firms for top candidates
Interviews with up to 5 DoD contractors for top cleared candidates

How is the program delivered?
On Monday of each week you will be assigned a set of tasks that required to be completed by Sunday at midnight EST. These tasks usually include:
Required reading
Required videos to watch
Required lab exercises to perform
On Mondays and Wednesdays from 7-9pm EST a live online training session/QA period will be held. The sessions will be recorded each day so you do not have to worry if there are scheduling issues.

The program will run from December to February (3 months) with job interviews for top candidates being held in March.

The program cost is $150 per month for 3 months, or $300 as a 1-time fee for the program.

This class is only $300 so signup now!

Example on how he still cancels classes.

Guys, I am really sorry but I have a family emergency to tend to. I will double the length of tomorrow’s class to cover for tonight.

He claimed he had partnerships in his advertisement email:

The program covers the common technical requirements, common soft skill requirements, and via a partnership with several penetration testing firms the top candidates will be given job interviews at the end of the program for a remote penetrating testing position (remote meaning you can work from home).

Preparing for a job as a Penetration Tester
* Resume assistance
* Assistance with building a portfolio based on this program
* Mock interview
* Interviews with up to 15 Penetration Testing firms for top candidates
* Interviews with up to 5 DoD contractors for top cleared candidates

Participants commentary on that:

As part of the class…he advertised that the students in the DMV area could get jobs afterwards if they performed well in the course. The only thing he did in that regard was have HR professionals present the skills and credentials they look for when hiring infosec people. It didn’t appear that he really had jobs for these students….instead…just provided some information on how to get jobs (which is far from the same thing)

Your first challenge:
Use the OSINT_Innophos doc as a reference and perform/document an OSINT assessment against any one of the following companies:

NSA
HSBC
Coke
Exxon Mobil
KPMG
Accenture
NewYork-Presbyterian Hospital
Kroger
Dillard’s
Royal Caribbean International

Tools
Here are some tools that I think you should consider using for this challenge:

FOCA
Maltego
Search Diggity
ShodanHQ
Firefox PassiveRecon
EDGAR
theHarvester
gxfr.py
VisualRoute
Recon-NG

Now I am not a pen tester, but suggesting people preform OSINT on the NSA is a really bad idea, even passive recon. The last block quote was straight from an email from Joe.

We didn’t receive feedback on their OSINT assignment. I don’t want to assume….but…I would guess that McCray probably rarely hands out feedback (but..thats an assumption and not based on factual evidence)… I help with OSINT report around 12/6-12/14 on a company. Used google docs. I dont know how well we did.

The PPT attachment shows Joe canceling 4 classes (assuming I counted correctly) and he asked the students to help him with one of his *real life pentests* Im assuming he was doing for his business.

The Hangout is a chat with the people in the class. It first starts off with everyone trying to solve problems together and quickly takes a turn where people are asking if class will ever be held again.

No feedback on the sketchy assignment. Canceling ~15% of the classes; 4 classes out of 26. He had excuses each time, but after reading all the various stories, I keep hearing about cancellations including 50% of the classes I had with him.

If you wish to contribute a story, just submit it as a comment or send it to me, good or bad!