<![CDATA[[SecurityRatty] tag: shannon]]> http://securityratty.com/tag/shannon Sun, 25 Feb 2007 21:00:00 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[Phreaknic 12 (2008) Hacker Con]]> http://securityratty.com/article/4f1c46cc8d2c53438d8656355e1bfa74 http://securityratty.com/article/4f1c46cc8d2c53438d8656355e1bfa74 Phreaknic 12 (2008) Hacker Con

This is a quick and dirty video documentary of the things that when on around the talks and event at Phreaknic 12 (2008). Don't watch if you get sick at shaky cam movies like Blair Witch or Cloverfield. A rough timeline of the content in the video is as follows:

        Intro and leaving Louisville with Brian. Morgellon talks about hacking the Arduino micro controller platform. Sorteal talks about the LiVes Open Source video editor. AT&T Batman building by night. Mojo-JoJo soldering some stuff for the shooting range. The patron gods of hackerdom. Registration. Con swag overview. Morgellon  gets his discreet logic on. AK-47 building with HandGrip and Buttstock. Froggy talks up Notacon, which I plan to go to next year. Skydog explains the Jware chair toss event, and then we compete. Rootwars hacker wargames. I ask Int80 about using his nerdcore music in some of my videos. NotLarry explains rootwars. Some iPhone hacking with Lee Baird and John Skinner. I do a little Bluecaseing/Warnibbling with the Bluetooth on my Nokia n810. John, Lee, Brian and I go to the German restaurant. I blind DOSman with the light from my camera and check out what folks are doing with the Arduinos Droops brought for folks to play with. I check back in on R00tW4rz. I blind Droops. I talk Ettercap filters with operat0r. USB door key fun with the Arduino. More breadboard fun. Nokia n810 + Ettercap Filter + Lemon-part = win. Int80 gets down with his own bad self, and the rest of Phreaknic. I find an energy drink with protein. Folks play with the hardware keyloggers I brought, and we have some epic fail with the IBM Model M + USB adapter + Mac OS 10.5. Winn Schwartau joins in on the keylogger fun. DOSman and Zack use a directional antenna from the 9th floor to search downtown Nashville for WiFi access points. Zoom in on Al. John and Lee eat jerky. Daren and Shannon from Hak5 blind me this time. :) Then they do a quick interview. I interview TRiP about the legalities of wardriving, sniffing and leaving your access point open so you have plausible deniability of copyright infringement (most likely it won't hold water in court if you are a computer geek). I give Hak5 Daren beef jerky. Ziplock had more con badges than God. I meet up with Iridium. I talk with Nightcarnage about the audio/video setup at Phreaknic. As I predicted, the Potters won the WiFi Race. I say why this was the best Phreaknic ever. Using green lasers on crack dealers. Techno in the dark, the Aiptek action HD does not do well in low light. Nicodemius shows off his Minority Report like multi-touch table. Hula hoop contest. I check back in with Jeff Cotton and his USB keyed door. I strap on my gear to leave the con. Brian and I do a wrap up of our thoughts on Phreaknic 2008.

]]> Wed, 29 Oct 2008 02:59:17 +0000 con phreaknic video con swag overview source video editor talks sorteal talks hacker con lee eat jerky Phreaknic 12 (2008) Hacker Con <![CDATA[Phreaknic 12 (2008) Hacker Con]]> http://securityratty.com/article/91dad2a3ec5ac9d4f78bd2d1a2bb18c2 http://securityratty.com/article/91dad2a3ec5ac9d4f78bd2d1a2bb18c2 Phreaknic 12 (2008) Hacker Con

This is a quick and dirty video documentary of the things that when on around the talks and event at Phreaknic 12 (2008). Don't watch if you get sick at shaky cam movies like Blair Witch or Cloverfield. A rough timeline of the content in the video is as follows:

        Intro and leaving Louisville with Brian. Morgellon talks about hacking the Arduino micro controller platform. Sorteal talks about the LiVes Open Source video editor. AT&T Batman building by night. Mojo-JoJo soldering some stuff for the shooting range. The patron gods of hackerdom. Registration. Con swag overview. Morgellon  gets his discreet logic on. AK-47 building with HandGrip and Buttstock. Froggy talks up Notacon, which I plan to go to next year. Skydog explains the Jware chair toss event, and then we compete. Rootwars hacker wargames. I ask Int80 about using his nerdcore music in some of my videos. NotLarry explains rootwars. Some iPhone hacking with Lee Baird and John Skinner. I do a little Bluecaseing/Warnibbling with the Bluetooth on my Nokia n810. John, Lee, Brian and I go to the German restaurant. I blind DOSman with the light from my camera and check out what folks are doing with the Arduinos Droops brought for folks to play with. I check back in on R00tW4rz. I blind Droops. I talk Ettercap filters with operat0r. USB door key fun with the Arduino. More breadboard fun. Nokia n810 + Ettercap Filter + Lemon-part = win. Int80 gets down with his own bad self, and the rest of Phreaknic. I find an energy drink with protein. Folks play with the hardware keyloggers I brought, and we have some epic fail with the IBM Model M + USB adapter + Mac OS 10.5. Winn Schwartau joins in on the keylogger fun. DOSman and Zack use a directional antenna from the 9th floor to search downtown Nashville for WiFi access points. Zoom in on Al. John and Lee eat jerky. Daren and Shannon from Hak5 blind me this time. :) Then they do a quick interview. I interview TRiP about the legalities of wardriving, sniffing and leaving your access point open so you have plausible deniability of copyright infringement (most likely it won't hold water in court if you are a computer geek). I give Hak5 Daren beef jerky. Ziplock had more con badges than God. I meet up with Iridium. I talk with Nightcarnage about the audio/video setup at Phreaknic. As I predicted, the Potters won the WiFi Race. I say why this was the best Phreaknic ever. Using green lasers on crack dealers. Techno in the dark, the Aiptek action HD does not do well in low light. Nicodemius shows off his Minority Report like multi-touch table. Hula hoop contest. I check back in with Jeff Cotton and his USB keyed door. I strap on my gear to leave the con. Brian and I do a wrap up of our thoughts on Phreaknic 2008.

]]> Wed, 29 Oct 2008 02:59:17 +0000 con phreaknic video con swag overview source video editor talks sorteal talks hacker con lee eat jerky Phreaknic 12 (2008) Hacker Con <![CDATA[Phreaknic 12 (2008) Hacker Con]]> http://securityratty.com/article/215684d0c6bd7ef7ac4756e6b556cf79 http://securityratty.com/article/215684d0c6bd7ef7ac4756e6b556cf79 Phreaknic 12 (2008) Hacker Con

This is a quick and dirty video documentary of the things that when on around the talks and event at Phreaknic 12 (2008). Don't watch if you get sick at shaky cam movies like Blair Witch or Cloverfield. A rough timeline of the content in the video is as follows:

        Intro and leaving Louisville with Brian. Morgellon talks about hacking the Arduino micro controller platform. Sorteal talks about the LiVes Open Source video editor. AT&T Batman building by night. Mojo-JoJo soldering some stuff for the shooting range. The patron gods of hackerdom. Registration. Con swag overview. Morgellon  gets his discreet logic on. AK-47 building with HandGrip and Buttstock. Froggy talks up Notacon, which I plan to go to next year. Skydog explains the Jware chair toss event, and then we compete. Rootwars hacker wargames. I ask Int80 about using his nerdcore music in some of my videos. NotLarry explains rootwars. Some iPhone hacking with Lee Baird and John Skinner. I do a little Bluecaseing/Warnibbling with the Bluetooth on my Nokia n810. John, Lee, Brian and I go to the German restaurant. I blind DOSman with the light from my camera and check out what folks are doing with the Arduinos Droops brought for folks to play with. I check back in on R00tW4rz. I blind Droops. I talk Ettercap filters with operat0r. USB door key fun with the Arduino. More breadboard fun. Nokia n810 + Ettercap Filter + Lemon-part = win. Int80 gets down with his own bad self, and the rest of Phreaknic. I find an energy drink with protein. Folks play with the hardware keyloggers I brought, and we have some epic fail with the IBM Model M + USB adapter + Mac OS 10.5. Winn Schwartau joins in on the keylogger fun. DOSman and Zack use a directional antenna from the 9th floor to search downtown Nashville for WiFi access points. Zoom in on Al. John and Lee eat jerky. Daren and Shannon from Hak5 blind me this time. :) Then they do a quick interview. I interview TRiP about the legalities of wardriving, sniffing and leaving your access point open so you have plausible deniability of copyright infringement (most likely it won't hold water in court if you are a computer geek). I give Hak5 Daren beef jerky. Ziplock had more con badges than God. I meet up with Iridium. I talk with Nightcarnage about the audio/video setup at Phreaknic. As I predicted, the Potters won the WiFi Race. I say why this was the best Phreaknic ever. Using green lasers on crack dealers. Techno in the dark, the Aiptek action HD does not do well in low light. Nicodemius shows off his Minority Report like multi-touch table. Hula hoop contest. I check back in with Jeff Cotton and his USB keyed door. I strap on my gear to leave the con. Brian and I do a wrap up of our thoughts on Phreaknic 2008.

]]> Wed, 29 Oct 2008 02:59:17 +0000 con phreaknic video con swag overview source video editor talks sorteal talks hacker con lee eat jerky Phreaknic 12 (2008) Hacker Con <![CDATA[Hardware Keyloggers use detection and mitigation Phreaknic Presentation slides posted]]> http://securityratty.com/article/a4ffb7265555883a6ec1791fa2e0813f http://securityratty.com/article/a4ffb7265555883a6ec1791fa2e0813f Phreaknic was a great time this year, as always. I've posted the slides from my hardware key loggers presentation at the above link.
I'd like to thank the following people:

Sky Dog and crew for making it happen.
Droops/Morgellon for their presentation on Arduino, time for some hardware hacking.
Sorteal for showing me the LiVes Open Source video editor.
Marie for the dance and conversation.
TRiP for an excellent talk on the legalities of wardriving.
HandGrip/Buttstock for the Open Source AK-47 talk.
All the folks who let me interview them.
DOSman and Zack form being DOSman and Zack.
Lee Baird and John Skinner for comparing mobile hacking notes with me (Yippy hacking with the iPhone / iPwn).
Ziplock for the encouragement.
Int 80 for the Nercore entertainment.
Scott Moulton for the talk "At Least TEN things you didn't know about your hard drive!" Go check out his forensics and hard drive recovery videos.
Nathan Hamiel/Shawn Moyer for "Satan is on my Friends List: Attacking Social Networks", looks like I need to get into some CSRF.
Darren, Shannon and Mubix of Hak5 for the interview.
operat0r for the Ettercap ideas.
Brian for driving me down.

And everyone else I'm forgetting. It was a great weekend.

]]> Sun, 26 Oct 2008 13:26:51 +0000 source ak-47 talk talk zack form zack nathan hamielshawn moyer excellent talk source video editor slides ettercap ideas Hardware Keyloggers use detection and mitigation Phreaknic Presentation slides posted <![CDATA[Hardware Keyloggers use detection and mitigation Phreaknic Presentation slides posted]]> http://securityratty.com/article/e9f6c48276a2b3f0f66121e4f7c467f1 http://securityratty.com/article/e9f6c48276a2b3f0f66121e4f7c467f1 Phreaknic was a great time this year, as always. I've posted the slides from my hardware key loggers presentation at the above link.
I'd like to thank the following people:

Sky Dog and crew for making it happen.
Droops/Morgellon for their presentation on Arduino, time for some hardware hacking.
Sorteal for showing me the LiVes Open Source video editor.
Marie for the dance and conversation.
TRiP for an excellent talk on the legalities of wardriving.
HandGrip/Buttstock for the Open Source AK-47 talk.
All the folks who let me interview them.
DOSman and Zack form being DOSman and Zack.
Lee Baird and John Skinner for comparing mobile hacking notes with me (Yippy hacking with the iPhone / iPwn).
Ziplock for the encouragement.
Int 80 for the Nercore entertainment.
Scott Moulton for the talk "At Least TEN things you didn't know about your hard drive!" Go check out his forensics and hard drive recovery videos.
Nathan Hamiel/Shawn Moyer for "Satan is on my Friends List: Attacking Social Networks", looks like I need to get into some CSRF.
Darren, Shannon and Mubix of Hak5 for the interview.
operat0r for the Ettercap ideas.
Brian for driving me down.

And everyone else I'm forgetting. It was a great weekend.

]]> Sun, 26 Oct 2008 13:26:51 +0000 source ak-47 talk talk zack form zack nathan hamielshawn moyer excellent talk source video editor slides ettercap ideas Hardware Keyloggers use detection and mitigation Phreaknic Presentation slides posted <![CDATA[WellPoint customer information exposed for a year]]> http://securityratty.com/article/b6ed464e6a6644fda5d62ce2d87cb4d9 http://securityratty.com/article/b6ed464e6a6644fda5d62ce2d87cb4d9 Security Breach

Date Reported:
4/8/08

Organization:
WellPoint, Inc.

Contractor/Consultant/Branch:
An unnamed data management vendor

Victims:
Customers

Number Affected:
~128,000

Types of Data:
"may have included Social Security numbers and pharmacy or medical data"

Breach Description:
"Personal information that may have included Social Security numbers and pharmacy or medical data for about 128,000 WellPoint Inc. customers in several states was exposed online over the past year, the health insurer said Tuesday."

Reference URL:
BusinessWeek
The Courier-Journal
RTT News

Report Credit:
Associated Press via Tom Murphy at BusinessWeek

Response:
From the online sources cited above:

Personal information that may have included Social Security numbers and pharmacy or medical data for 128,000 WellPoint customers in several states was exposed online over the past year, the Indianapolis health insurer said yesterday.
[Evan] Exposed for over a year and nobody (at WellPoint or the vendor anyway) noticed until recently?  WellPoint is a large company with millions of confidential records and conflicting business issues, but is this any excuse?

WellPoint, which has had other data security issues in the past, recently learned about the problem, fixed it and is notifying customers, spokeswoman Shannon Troughton said.

The nation's largest health insurer by membership is offering free credit-monitoring services for those customers, but has received no reports of identity theft or credit fraud.
[Evan] Uh.  There's the short-sighted, limited effectiveness credit-monitoring again.  Credit monitoring can limit the damage done by fraudsters, but only after some damage has already been done.

The latest security lapse stems from two servers maintained by an outside vendor that Troughton declined to identify.

The vendor specializes in data management.
[Evan] Not very well.  Part of data management is data security or vice versa.

WellPoint had learned early last year that a server was improperly secured, and that information on about 1,350 customers may have been exposed online and was vulnerable to Internet search engines. The insurer fixed that breach quickly, Troughton said.

But the company recently learned that a second server had problems which exposed information for more than 128,000 customers to Internet access for about a year. That data had some code protection and couldn't be found by people using search engines.

That problem has been corrected, Troughton said, and the company is working with experts to improve its security.
[Evan] Yeah.  I hope the experts are really experts.  This really calls for some.

It is still using the same vendor.
[Evan] Really?

"We're constantly working to fortify and bolster our security," she said.

Commentary:
I just wrote the WellCare breach, and now we have the WellPoint breach.  Both are health care companies and both involved unsecured online information.  Weird.

Anyway.  This is definitely a preventable exposure of personal information that should have been identified much earlier.  Due to this and other facts surrounding previous breaches, I think there is cause for serious concern.

Past Breaches:
March, 2007 - Medical Data on Empire Blue Cross Members May Be Lost
February, 2007 - Healthcare groups bleed patient data

]]> Wed, 09 Apr 2008 10:23:03 +0000 data management vendor vendor data management data medical data patient data data security data security issues wellpoint WellPoint customer information exposed for a year <![CDATA[Speaking of Security Podcast #89]]> http://securityratty.com/article/6f05c34ab6acbfd91d6879df0497df2e http://securityratty.com/article/6f05c34ab6acbfd91d6879df0497df2e Click here to listen/download (09:40).

Speaking of Security Blogger Shannon Kellogg talks with Matt Buckley about the state of information security from a Washington, D.C. point of view.

]]> Sun, 13 Jan 2008 21:00:00 +0000 matt buckley information security click listendownload view washington Speaking of Security Podcast #89 <![CDATA[Speaking of Security Podcast #69]]> http://securityratty.com/article/7fc41e8385c9aa0098b0a186f3402ff7 http://securityratty.com/article/7fc41e8385c9aa0098b0a186f3402ff7 Click here to listen/download (10:55).

Speaking of Security Blogger, Shannon Kellogg, interviews Hord Tipton, former CIO of the U.S. Department of Interior. Hord shares a bit about how he led the reorganization and development the Department's IT infrastructure across eight major bureaus and how his focus moved more and more toward information security initiatives.

]]> Mon, 23 Jul 2007 20:00:00 +0000 interviews hord tipton information security initiatives department focus moved security blogger major bureaus hord shares shannon kellogg led Speaking of Security Podcast #69 <![CDATA[Speaking of Security Podcast #62]]> http://securityratty.com/article/682836a4b0faf883392537daa5f5fd04 http://securityratty.com/article/682836a4b0faf883392537daa5f5fd04 Click here to listen/download (10:21).

Paul Joyal checks in with our man in Washington, blogger Shannon Kellogg, about the doings on the hill as well. EMC encourages all amateur movie-makers to enter You-Tube-like shorts for Inforati Video Awards (IVA) contest. The best entries in three categories will earn prizes (not to mention fame and bragging rights) for their creators, with the winners announced at EMC World in Orlando May 21-24.

]]> Sun, 13 May 2007 20:00:00 +0000 paul joyal checks blogger shannon kellogg enter you-tube-like shorts inforati video awards emc world emc encourages amateur movie-makers mention fame orlando Speaking of Security Podcast #62 <![CDATA[Speaking of Security Podcast #51]]> http://securityratty.com/article/263552d0a735deb83bb4f344ad394487 http://securityratty.com/article/263552d0a735deb83bb4f344ad394487 Click here to listen/download (10:36).

Recently at the industry-wide RSA Conference in San Francisco, Speaking of Security blogger, Shannon Kellogg, sat down with Ron Teixeira, Executive Director of the National Cyber Security Alliance, to discuss that organization’s national information security awareness programs. We invite our listeners to learn more about this important initiative.

]]> Sun, 25 Feb 2007 21:00:00 +0000 industry-wide rsa conference shannon kellogg security blogger executive director san francisco ron teixeira discuss invite recently Speaking of Security Podcast #51