131–140 of 152 posts
Earlier quoted context omitted.
Love this: http://www.metasploit.com/about/penetration-testing-basics/ "You can become a penetration tester at home by testing your own server and later make a career out of it." Sounds like the old style correspondence school ads - a bit hokey. http://www.thefreedictionary.com/correspondence+school I would have rewritten that as: "Many people have actually made a career out of being a penetration tester by first tes…
http://gogd.tjs-labs.com/show-picture?id=1160663127&size... "By and large, Management agrees that there is but one adequate solution to the problem ... a solution that can be applied only by Management itself."
But he added that cybercriminals typically have access to botnets -- large collections of infected computers -- that are able to achieve the same task without detection. What do botnets have to do with crawling the web for unsecured devices? I'm not sure I understand the correlation.
I think it's because you can use botnets to divide up the vast IPv4 search space among the individual bots and crawl it exponentially faster.
Earlier quoted context omitted.
You can absolutely learn to do penetration testing on your own time with your own servers. We have a script we give people to do the same thing. If you feel like you have a knack for systems programming, being a good systems programmer is 1/2 the hard part of appsec; the other 1/2 is literally "taking pleasure in finding creative ways to break things", and you can find out if you have that personality streak in just…
When you say "a script" what do you mean? A script that configures a server incorrectly to let you see the kind of things you can do?
I wonder, why noone turned off traffic lights or something like that to do mischief? Also, why no terrorist yet used those security failures to do terror? Once a random dude managed to log into ISS controls... Ever wondered what happens if some terrorist crash ISS into New York?
I apologize for the downtime/ delays, this was a big surprise this morning and I clearly wasn't prepared for the full on-slaught of CNN etc. If you have any questions about Shodan I can try to answer them here.
They also missed ERIPP, which does something similar. This is all old news though, these things are constantly mentioned in other security reports. Even the government knows these things exist, which means that CNN is not scouping anyone :)
ERIPP is cool (I spoke to the author years ago), but to my knowledge it hasn't been updated in a while. And I cover 20+ services at the moment, so it's not just HTTP.
In general, It is pretty humorous that these things still catch people by surprise :)
+1 for the System Shock reference :) http://en.wikipedia.org/wiki/System_Shock
Gog.com recently released it for new systems: http://www.gog.com/gamecard/system_shock_2 Apparently it works well under wine, too.
If you can get it to run, you should check out the Thief games as well. They use the same engine.
Earlier quoted context omitted.
I don't think you could crash the ISS into New York. I don't even think that's possible. It doesn't have the engines necessary to get back to the surface.
Getting down is way easier than getting up. ISS has some engines, crashing on earth is very simple, you can just thrust in the opposite direction that you are going (thus falling into the planet, although slowly and probably astronauts can find the attacker and put it back into orbit before anything serious happens) or you can trust in a diagonal of sorts, to slow your speed AND toward the planet (if you just acceler…