Penetration Test != Audit != Assessment
If someone is selling you a network penetration test, and then running a vulnerability scanner and handing you a report, you’re not getting what you paid for, period.
Category: voip
Padding the Numbers: Vulnerability Duplication
Recently the OSVDB Blog had an interesting article regarding vulnerability duplication via the “hazard of 0day” wherein a vulnerability being exploited in the wild was mistaken for a new vulnerability when in fact it was not. This caused many of the vulnerability database vendors to issue new IDs, send out threat warnings, bring in the […]
CSI 2007
CSI 2007 was the first time I’ve ever attended a CSI conference. I was actually a CSI member way back in the day when I was running my own consulting firm and needed as many business development avenues to explore as possible, but after closing my consultancy and going back to work for The Man(tm) […]
ToorCon 9
ToorCon is always one of my favorite conferences of the year, and this year was no different. Actually, I take that back, it WAS different, it was even better than usual. I got something out of almost every talk that I attended, and the conference ran very smoothly. The conference is small and intimate and […]
Speaking at CSI 2007
I’ve been invited to speak at the Computer Security Institutes’s Annual Conference (CSI 2007) this November in Washington D.C., on the subject of VoIP Attacks. This presentation was originally intended to be a “state of the industry” type talk given every year or so, and the last time I gave it was at EUSecWest last […]
Real-time Steganography with RTP Video
Apparently, some guy purchased video of all of the DEFCON 15 talks on DVD, then ripped them all to MP4 and uploaded them to Google Video. If you couldn’t make DEFCON this year and wanted to see my talk, or don’t have the patience to read the 50 page paper but have about an hour […]
Real-time Steganography with RTP Whitepaper
My paper detailing the research I presented last month at DEFCON 15 was published today in Uninformed Journal Vol. 8. The paper is entitled “Real-time Steganography with RTP” and details using steganographic techniques to establish a covert channel within the protocol commonly used for the media channel in VoIP calls as well as a reference […]
DEFCON 15
DEFCON 15, in their second year at the Riviera, seemed a little more settled than the turbulent vibe from last year. Unfortunately DEFCON already seems to be outgrowing this space as a couple of the talks I wanted to see were standing room only and attendees were spilling out into the halls. The badge this […]
BlackHat 2007
BlackHat Briefings 2007 was a bit disappointing this year. This year, the first day of briefings had an entire track devoted to Voice Services. Being the sole VoIP researcher for TippingPoint’s DVLabs, I of course attended this entire track. In short, three words: waste of time. Out of 5 talks on VoIP security, I learned […]
Speaking at DEFCON 15
I’ve been invited to speak at DEFCON 15 this August which is being held at the Riviera Hotel & Casino in Las Vegas. I’ll be presenting on some new research I’ve been working on involving VoIP and steganography. The presentation will be entitled “Real-time Steganography with RTP.”