Netsoc

Hey Folks

As per usual, this will be in KA-3-05 from 6pm.

We will be doing a system administration workshop this Monday for installing and configuring services on a linux server. This will be hands on using vmware player on the lab machines.

We will be covering the basics such as

• Installing daemons/services
• configuring services
• adding users
• Analysing logfiles
• configuring network settings
• Setting up firewalls

Workshop notes, please download a torrent program such as utorrent portable.

Navigate to http://147.252.234.51 and download “ubuntu-11.10-desktop ” etc torrent and open it and start downloading

Once you have the iso downloaded, please read this file on how to set up vmware with the image setupvmware

To clarify for anyone who’s not using vmware, the setup should be a “bridge network connection” and we will be running a live cd not installing it

Once vmware and ubuntu is setup, please boot up and select “TRY UBUNTU”

Update: Great turn out, hope everyone found this as enjoyable as I did. Here are some photos of the event

Hey Folks, for anyone who hasn’t seen it, this is the email sent to the owasp Ireland mailing list. It’s free but you need to signup in advance.

DATE: 30th March at 17:00

Dear all,

We have the great pleasure to invite you to the upcoming OWASP Dublin event next Friday 30th March at 17:00 (registration opens at 16:30) in Google Ireland Engineering offices at One Grand Canal Plaza Building (located on Grand Canal Street Upper, beside the junction of Warrington Place and Barrow Street).

You could find a placemark for the building on this map : http://goo.gl/ZGASA

This event is free and open to EVERYONE but registration is mandatory. In this occasion, we have two great speakers from the UK coming only to deliver these talks.

Workshop #1 Details – Application Hacking: Beyond the OWASP Top 10

Whilst many guides, tools and methodologies stress the importance and expand the ubiquity of the OWASP Top 10, many of the more interesting vulnerabilities are those which are not. In this talk, MDSec present some results from our assessments which defy even the broad classification of the OWASP Top 10.

Guest Speaker: Marcus Pinto
Twitter: @mdseclabs

With nine years’ experience, Marcus Pinto is an industry thought leader in Information Security, having authored the Web Application Hacker’s Handbook Series, and delivered numerous private training courses, conference training, seminars and awareness days on technical subjects worldwide. Marcus has managed end-user security, consultancy and internal penetration testing teams for government and financial sector organisations.

Workshop #2 Details: iOS Application (In)Security

The mobile application market has exploded in the last few years. With Apple holding a majority market share in the consumer market and a growing foothold in the enterprise, iOS application security has never been so important. In this talk, MDSec will present some of the lessons learned from evaluating iOS applications covering the platform security features, blackbox app assessment and the security relevant APIs.

Guest Speaker: Dominic Chell
Twitter: @deadbeefuk

Dominic is a director of MDSec, a UK based security consultancy specialising in a range of technical security assessment services including Mobile security. As a researcher, Dominic has been publicly acknowledged by numerous vendors, including Apple, for vulnerability disclosure.

Registration: http://www.regonline.com/beyondtop10

Any questions, please let me know.

Thanks,
Fabio

_______________________________________________
Owasp-ireland mailing list
Owasp-ireland@lists.owasp.org
https://lists.owasp.org/mailman/listinfo/owasp-ireland

Looking to get into security more? Want to learn how systems are really compromised or just plain want to learn how to hack? Come along to the security workshop training on Monday for a workshop by guest, Mark Denihan

When: Monday- 5th March 6pm
Where: KA-305 in Kevin st Annex building

Here’s what he has to say about the workshop

Situation: This semster vmware player is on the lab pcs. I wanted to host workshops using ubuntu + vulnerable vms for security/system administraiton. This collection includes around 10 gigs of vms, isos and tools.

Problem: Even with 100Mb connections, downloading from one location (Be it the internet or the M drive etc), would saturate the downlink with 30/40 labs (ontop of everyone elses traffic). Usbs are slow and even sharing between lab pcs would be hectic.

Solution: I remember twitter using bittorrent for server deployment. (http://torrentfreak.com/twitter-uses-bittorrent-for-server-deployment-100210/). So this evening, when the labs emptied out for this weekend, I setup a torrent tracker – RivetTracker  -http://sourceforge.net/projects/rivettracker/, which was quite easy. All you need is a mysql username + password and some php server space. It has a similar setup to wordpress the first time. You’re given a username + password you can use to upload new torrents to it.

I was expecting it to be more difficult than it turned out to be but we just grabbed some torrent clients, logged onto all the lab PCs, set them all up to download the torrent. Was quite cool watching all the lab pcs max out upload/download speeds. We didn’t time the process unfortunately but it was quite fast.

Funny enough, this process turned out to be faster than transferring the collection to usb and transfering across to a shared smb drive. So one of the labs now has a nice collection of 10 gigs of security research tools on the E: drive (tempdata) although this is liable to be wiped after a certain period of time. Fred Mtenzi (security lecturer) has kindly given permission for this collection to be stored on the M drive under “netsoc” directory so even if this collection is lost, you can download it again from here without hunting around too much.

Final Notes: This isn’t of the usual importance that usually makes it to a website post however I did think it worked REALLY smoothly and worked surprisingly well. While the implementation is trivial and nothing new, It would be well worth a look for deploying tools in the lab. After I had it all done, I considered that a multicast solution might have worked better since they were all on the local network. Ah well, always next time!

Update: People were asking me to upload a screenshot of my setup.  Unfortunately I don’t have a screenshot of when all the clients were connected, but this is the aftermath. An announcement recent about rivettracker highlights a LOT of security vulnerabilities. Specificly, sql injection. The code looks horrific and the latest version off sourceforge is still vulnerable. A bit of google-fu also shows there’s a lot of servers out there running this… dangerous. This seems like a semi-easy target we may try exploit in a workshop. Here’s the report here http://packetstormsecurity.org/files/110416/rivettracker-sql.txt

Also quick note, we have patched the version we use in the labs each week however you’re welcome to verify it yourself!

We’ll be doing a system administration Talk on Tuesday 28th on system administration with the light being on debian. This will be a semi introduction to debian in general with a highlight on the system administration. Hope to see you all there!

When: 6PM Tuesday 28th February
Where: KA G 026

Topics will include but are not limited to

• Installing packages/services
• How to configure services
• Networking
• Firewalls with iptables
• Locking down the system
• Libraries + development headers and compiling services from source