Digital Forensics Tips

I planned on doing a few blog posts in December but due to a few great December surprises I wasn’t online much. My month started off by taking a much needed relaxing week of vacation in San Diego with my wife. On the last day of our trip I got the type of email everyone hopes for: “I know this is last minute, but would you like to go to the SANS CDI conference in DC next week?”. CDI was my first east coast SANS conference and it was well worth the trip. I got to spend a lot of time with some absolutely amazing people and it was truly one of the best weeks of my life. I’m not sure yet what conferences I’ll be going to in 2015 but I can’t wait to find out. It was a great end to a fantastic year. I got the opportunity to attend several SANS trainings in person as well as online. Got a chance to attend some other penetration testing training. Got to attend my first Blackhat and Defcon thanks to the generosity of Don over at ethicalhacker.net and made some great friends with similar in...

Recently on the SANS DFIR mailing list one of the members announced he had put together a Network Forensics challenge for anyone who wanted to participate. The challenge is at http://blog.mywarwithentropy.com/2014/11/spy-hunter-holiday-challenge-2014.html where you can download a large pcap and a PDF with instructions. I’ve only had a small amount of time to play with the pcap but it’s very well done and I’m looking forward to digging deeper into it.

I recently attended the SANS SEC575 Mobile Device Security and Ethical Hacking class in Las Vegas and I wanted to post some of my thoughts on the course. Day One: Architecture and Management Day one started off with a quick overview of mobile device issues that would be addressed in the course and a lab which has the students extract sensitive data from a network capture file with mobile device traffic. After that there are four “what you need to know” sections about iOS, Android, Blackberry and Windows Phone devices. The sections cover technical specifications, key points, protection mechanisms etc. These sections are well done and provide a solid foundation for the rest of the class. The next section in the book covers building your own lab using devices, emulators and simulators. There are two exercises where you configure an Android emulator and interact with it using ADB commands. The labs throughout the entire course were very well done and helped reinforce the topics being taugh...

Congratulations to James Lieu for winning the paperback copy of “Hacking Exposed 7: Network Security Secrets & Solutions“. Last week I attended the SANS SEC575 Mobile Device Security and Ethical Hacking course at Network Security 2014 in Las Vegas. It was an enjoyable class and I just finished the first draft of my index (the book for day #3 is close to 300 pages!). I plan on writing up a review of the course in the next few days. In addition to the class I was able to spend time with some great people and participate in both nights of Core Netwars. Netwars would be fun no matter what but it was made even better by sitting with friendly and knowledgeable people. I ended up getting about half a dozen questions into level 3 and finished 14th on the alumni scoreboard. While I always feel like I could have done better Netwars is a great way to see the progress that I’ve made from year to year and I felt a lot more comfortable than I have in previous years.

Congratulations to book giveaway #1 winner Matt Williams (@mattwilliams31) who won a paperback copy of Richard Bejtlich’s “ The Practice of Network Security Monitoring: Understanding Incident Detection and Response “. Book Giveaway #2 is for a paperback copy of “ Hacking Exposed 7: Network Security Secrets & Solutions “. Once again I’m limiting the book giveaways to U.S. residents only to keep the shipping costs down but I will do a giveaway later this year that will be open to everyone. The drawing is open until 10/26/2014 so good luck! a Rafflecopter giveaway

Earlier this year I wrote an extremely short post discussing the Red Team Field Manual (RTFM) book. I’m currently on my third copy of the book (I’ve given the first two away) and I have a copy in my backpack at all times. I recently saw some traffic on a SANS mailing list about similar book geared towards blue teamers and had to check it out. Like the RTFM, “ Blue Team Handbook: Incident Response Edition ” is small, affordable and is more of a collection of steps and command examples than a traditional book meant to be read from start to finish. The Blue Team Handbook covers topics such as Windows and Linux volatile data system investigation, network traffic analysis techniques, suspicious network traffic patterns and Snort configuration and usage. Amazon now lists an updated version 2.0 of the book with 20 new pages including information on database incident response. The book is currently listed for under $14 on amazon and is perfect to keep with the RTFM in my backpack. If having a...

My “A First-Timer’s Experience at Black Hat and DEFCON” article I talked about in my last post is now live on the front page of ethicalhacker.net along with a picture of Kevin Mitnick and I. When the article went live earlier this week I couldn’t help inserting a mental caption of “A hacker & a hack” when I saw the picture 🙂 Even though it wasn’t a technical article I’m still quite honored to have an article on the front page of ethicalhacker.net and it’s a nice reminder of the progress I’ve made over the past two and a half years. To spread around a little of the good fortune I’m going to give away some books that I already had copies of but got additional copies of at Blackhat. I’m limiting the book giveaways to U.S. residents only to keep the shipping costs down but after all the book’s are given away I’ll think of a small giveaway that I’ll open up for everyone. Giveaway #1 is for one paperbac...