A new lecture by Robin Dreeke on Social Engineering - Earning trust

In the past February 2013, the Social-Engineer.org crew interviewed again the behavioural and rapport builder expert Robin Dreeke. The podcast can be found here.

Robin Dreeke shared in this interview some input coming from a new book related to trust and empowerment. Here you will find a very personal set with some of the points he mentioned:

Empathy foundations

 - The three key questions to ask in an input-gathering conversation are how, what and why.
- Dopamine goes to our pleasure centers - our brain rewards us then.
- Getting our interlocutor to get their brain rewarded by you talking to them should be our goal.
- It is important to understand context. How can we adapt ourselves to understand their way of being?

The tribe

- We need to understand the tribe mentality.
- When we are part of a tribe, it means survivability.
- Our ancestors had the need to belong to a tribe.
- Our brain rewards us when we feel part of a tribe.
- We could use DISC to identify communication styles.
- How do we do it quickly?

Make it all about them from the psychological viewpoint

- We should not memorise anything we are planning to say.
- Proposal: Use sympathy and an artificial time constraint.
- We can practise sympathy e.g. help me find a Valentine’s day gift for my partner.
- Our conversation would identify direct individuals (people oriented persons).- If they get us to do most of the talk (then they are passive).
- Just by analysing the way they dress they will tell us whether our interlocutor is people-oriented or indirect, task-oriented or analytical.

 Demographics and culture

- One very simple technique - the easiest listening technique is have nothing to say - shut up!
- Key point: We want to validate them, we need to be focused on what they say, so shut up!
- The second we need to say something, we need to discard it!
- Example of input-gathering sentence: “I had a similar experience, tell me about yours”.
- If necessary, we can give a little bit of info but let's remember it’s about them.
- People are constantly testing how much we will accept them, if we accept them, they will tell us a little bit more about them.
- We need to become that person that will accept them unconditionally.
- We need to control our non-verbals so that we don’t reveal that we are judging them.
- It is almost as if we turn the conversation into a science experiment about people.
- One step further would be how did they decide to dress that way?
- Our focus will influence our approach, we want to know why that person
made some decisions.

Curious people

- What do we do with people who keep on asking questions?
- This is a validation coming to us.
- We could bounce it back and be conscious of the information we are giving away.
- If it keeps coming back to us, we'd better cut the engagement.
- Internet based social networks - people are constantly seeking validation - that is why people have thousands of friends e.g. in facebook.

Job interviews

- In a job interview, we'd better put in context how we can help them and their company.
- Currently, given labour market limitations, we could go back to a time constraint, e.g. "let’s run a contract o three months and you test me".
- Become fascinated about people.
- No one will hire us because of us but because of the benefits we can bring to them.
- Feel the emotion behind what you are saying.
- Positive psychology - be happy with what you are doing now.

Getting closer to the empathy palace

Happy empowering 2014!

How Things Gain from Disorder: Nassim Taleb - Applicable to Infosec?

The series of lectures by Entrepreneurial Thought Leaders by the Stanford University's Entrepreneurship Corner is always a must-visit place for those 'eternal learners' who follow these posts or these tweets.

In this occasion I highlight some thoughts extracted from a lecture that Nassim Taleb gave (@nntaleb at @edcorner) on part of the content from his book Antifragile: Things that gain from disorder. Are those thoughts applicable to our Information Security world? Let's see.

As always, a modest disclaimer: These lines by no means replace the reading of this interesting book (or, at least, the watching of the lecture at Stanford).

- The aim will be to look in our activities for a convex function of luck (and not for a concave one). This way, by producing small changes in our activities, we could be aiming at getting greater results. In other words, look for something in which if you lose, you lose small but, if you earn, you win a lot. Look for anti-fragility.

I would consider a proactive defence approach in IT Security an anti-fragile field. A series of small information security preventive and detective improvement measures can bring superior benefits. However, the endless possibilities to undergo an attack by any of the current threat actors is probably a fragile environment. A small mistake in defending against threats could lead to big losses.

- There are certain fields in our lives in which forecasts cannot be made on statistical probability (e.g. he mentions the financial world).

This statement hints an alternative view to the book I wrote titled "Secure IT Up! Cyber Insurance Due Diligence" with regards to cyber security. It cannot be completely managed based only on statistical calculations (a long collection of statistically rare cyber incidents can be a reality).

And now some adjacent wisdom pills also from the talk:

- The sponsor of an option should also have disincentives together with incentives so that, if the adventure fails, they also undergo a kind of failure.

- Be aware of those sponsors trying to hide (but not mitigate) risks from you.

This piece of advice on avoiding hiding risks is also applicable to Information Security.

- Respect and even promote the culture of subtracting (in opposition to the culture of adding): e.g. Mankind will be better off if some toxic elements are taken away (e.g. those who damage public health).

Avoiding complexity facilitates the work of the Information Security practitioner.

- Contrary to common academic views, hands-on practice leads to technology. Technology leads to science (and not vice versa i.e. science leads to technology and technology leads to practice).

This last thought deserves some reflection wearing our Infosec hat. Would we improve Infosec at a faster pace if we allocate funds initially thought for governance to secure DevOpS?


 Happy anti-fragility!

Build your anti-fragile option

Avoid untrusted Wi-Fi APs. Creating a Wi-Fi Access Point in Ubuntu.

3G is too slow for what you need to do with your smartphone?
You don't trust the Wi-Fi access points of your location?
However, you have a trusted Linux Ubuntu box with a somehow trusted Ethernet (cable-based) connection to the Internet (and a Wi-Fi card)?

Then this is the summary of the steps you need to follow to be able to use the Linux Ubuntu box as wireless Access Point.

The command lines to implement it are the following:

1. Installing hostapd:
# apt-get install hostapd
# nano /etc/hostapd/hostapd-minimal.conf
Dan Bishop's provides an example of hostapd config file. 

2. Installing bridge-utils:
# apt-get install bridge-utils
Dan Bishop's provides an example of config file.
Edit your /etc/network/interfaces config file according to Dan Bishop's reference. It will probably look similar to this:

auto lo
iface lo inet loopback
auto br0
iface br0 inet static
        address yourlanaddress
        netmask yourlannetmask
        network yourlannetwork.0
        broadcast yourbroadcast.255
        gateway yourlangateway
        bridge-ports eth0 wlan0

3. Disable the NetworkManager app by editing the config file and changing managed=true to =false

#gedit /etc/NetworkManager/NetworkManager.conf
[ifupdown]
managed=false

4. Stop the NetworkManager service
#service network-manager stop

5. Re-start networking (although it is an outdated way):
# /etc/init.d/networking restart


6. Enabling Internet from the bridging box:
# ip route add default via ipaddressofyourcablerouter
# dhclient br0
More info on this on the Ubuntu documentation.

If you would like to configure the way the dhclient works, make the corresponding changes in the /etc/dhcp/dhcient.conf config file.


7. Start hostapd (-dd is the verbose switch):
# hostapd -dd /etc/hostapd-minimal.conf

Finally, if you need to revert back to the previous state:

Option 1 (clear-cut one):
Retrieve the old /etc/network/interfaces config file and uninstall hostapd and bridge-utils.
#apt-get install purge hostapd
#apt-get install purge bridge-utils

Use purge if you would like to delete also the config files. Otherwise simply use apt-get remove.

These are the 2 references used to write this post:
 - Dan Bishop's using hostapd to add wireless access point capabilities in Ubuntu
covers hostapd.
- Ubuntu documentation on NetworkConnectionBridge covers the installation of bridge-utils and how to enable Internet on the bridging box.

This last reference from Ubuntu manpages on bridge-utils provides background information on bridge-utils.

Option 2 (keeping hostapd and bridge-utils):
Retrieve the old /etc/network/interfaces config file or comment out the lines related to the bridge (normally br0) and add (or uncomment) the loopback section (actually, the only one required in that file as you are going to resume using NetworkManager).
auto lo
iface lo inet loopback

The first two lines above are required so that NetworkManager starts at boot time (as mentioned here).

And edit back the NetworkManager app by editing the config file and changing managed=true (it was = false for hostapd and briedge-utils to work)
#gedit /etc/NetworkManager/NetworkManager.conf
[ifupdown]
managed=true

Finally, restart the network and the NetworkManager service (to avoid a reboot this time)

#/etc/init.d/networking restart
#service network-manager restart

... and double-check that /etc/rc.local is OK for this scenario in terms of services started or not started
(in this case, the little app bum, boot-up manager, could come in handy)

By the way, if you get the message "unable to resolve host: your host name", make sure that your host name appears in the files /etc/hostname and also in /etc/hosts.

Finally, if you would like to check that both machines, your computer and your mobile, are now part of the same lan, a very easy way to do it is:
#nmap -sP ip.address.of.your.lan.0/24

Happy browsing!

Surfing the sky!

Security site to bookmark: www.wtfuzz.com

The information security practitioners community in emerging countries is worth mentioning. The author of the blog that I recommend on this occasion, wtfuzz.com, is from India. His name is Rishi Narang. On twitter he defines himself as a consultant, author and researcher in cyber psychology and threat intelligence.

The first posts date from 2010. As of 2011, Rishi Narang writes about security at least six times a year. This no-frills blog is an example of the value of Internet as a marketing and personal branding vehicle. He published in 2013 two articles with detailed and useful hands-on content about the (in)security of session "cookies"  in renowned places like Outlook, Google, Twitter, Linkedin, Facebook and Yahoo. Both articles were accompanied by a video, a proof of concept "script" to "guess" those "cookies" and a summarizing table of the analyzed "cookies".

The three conclusions drawn from these two articles on "cookie-based" session maintenance are:

- "Cookies" need to expire on the server that sends them, at least when the session expires and, preferably, periodically.

- The preference of using HTTPS and HTTP as transport protocol.

- These session "cookies" need to be created in a truly random manner.

The popular security publication SC magazine reported the vulnerabilities that Rishi Narang found in those big Internet names and published a link to his blog. Surely he has received an invitation to share his analysis and contribute to improving the security of some of these companies' cookies or the proposal to join a web development security provider.

In short, wtfuzz.com card is an excellent presentation of an inquisitive security professional.

Outside the typical IT security, in this blog you can find a non-technical article titled "It's you and me". It was published in October 2012. It talks about human emotions and differences between women and men. Perhaps this is why Rishi defines himself as a cyber psychology researcher?

Vulnerable tower... and cookies?
 

Happy cooking!

You can also read this entry in Spanish.

Linux commands hodgepodge (II)

Again this post is an unusual one. The second unusual one after the first one on linux command lines. The reader will not find a series of paragraphs with a ine of thought in it but rather a collection of command lines and related telegraphic recommendations for some aspects of the Linux Universe (e.g. Ubuntu).

Happy command line experience!

- To install a debian package via command line
# dpkg -i deb package

- To list the packages we have installed
dpkg -l

- To indetify whether a package name is installed
dpkg -l | grep package name

- To get rid of configuration files from packages that are not installed anymore
dpkg --list |grep "^rc" | cut -d " " -f 3 | xargs sudo dpkg --purge

The legend of the dpkg --list output can be found here.

- To know which Ubuntu is installed
lsb_release -a

- To know which linux kernel is installed
uname -a


- To remove a debian package (leaving the configuration files)
#apt-get remove packagename

- To remove a debian package and the related configuration files
#apt-get purge packagename

- To find which files have being created in the last 24 hours
find -mtime 0


- To download a blogspot blog
wget -m http://securityandrisk.blogspot.fr

(you can also try with http://securityandrisk.blogspot.de/search?max-results=2000)

- To know the status of networking interfaces
#rfkill list

- To unlock one of them
#rfkill unblock number

- To start the firestarter firewall
#/etc/init.d/firestarter start

- To dump all traffic seen by the network interface not sent to or by your box and not part of multicast or broadcast
#tcpdump -i eth0 net 192.168.x.0/24 and not host 192.168.x.a and not multicast and not broadcast

- To identify active Internet connections (only servers)
#netstat -tulpn

- Nice and easy way to identify the networks this box has been
#grep -i NetworkManager /var/log/syslog

- To edit the scheduler in linux
crontab -e

- The basic way to use vi or vim:

To move into the text: h l j k
To replace a character under cursor with c rc
To insert before or after the cursor i a
To open a new line below or above the current line o O
To delete a character x
To undo the last command u
To select a line yy
To paste a line p P
To write and exit :wq
To toggle edit/meta mode ESC

When installing packages, you will find the config files in /etc/apt/apt/conf and the binary files in /usr/bin

- You need to define a network interface in Linux via a config file and not via NetworkManager? Then this is the location and syntax
edit /etc/network/interfaces
in the file
iface eth0 inet static
address 192.168.1.2
netmask 255.255.255.0
gateway 192.168.1.1

- You need to define a DNS servers in Linux via a config file and not via NetworkManager? Then this is the location and syntax
/etc/resolv.conf
nameserver 8.8.8.8

- You need to declare the name of your host via a config file? Then this is the location and syntax
/etc/hosts
127.0.0.1 localhost

- You need to swith on/off a network interface in Linux via the command line and not via NetworkManager?
Then you can use ifup/ifdown or
sudo ifconfig down
sudo ifconfig up

- A quick way to become root?
sudo su -

- Need to get processes associated with a name
ps aux | grep name

- A non-elegant way to kill a process?
killall processname

- You need to get rid of the disturbing sound with typing
sudo modprobe –r pcspkr

Command lines enlighten us