New job - Trustwave

Thomas — Thu, 15 Dec 2011 21:20:05 +0000

In December of 2011, I accepted a new job with Trustwave. I’ll be doing pentesting full time again, and am really excited to be working with a class act in the security world!

RIF Notification

Thomas — Thu, 12 Nov 2009 19:00:15 +0000

So, the company I was working for needed to shrink in size significantly, and I was one of those identified to be released from my position. While this may seem to be a devastating event to most, I see it as a gift and opportunity! It has given me the ability to push forward with my side-business activities; specifically teaching Information System Security in the form of boot camps for ISSMP, CISSP, SSCP, Security+ and of course advanced penetration testing courses.

It is a rare opportunity that my old employee is giving me, and one that I intend to take full advantage of over the next year. I am so excited to see what the future brings!

CSI2009

Thomas — Sun, 25 Oct 2009 04:37:58 +0000

I’ll be attending and speaking at CSI2009 this week. Flying into DC tomorrow morning, talking Tuesday night (Axis of Darkness), and heading home Thursday. If anyone is going to be there and is interested in chatting over a beer, hit me up on twitter: @thomas_wilhelm

Hacker Bug-Out Bag

Thomas — Fri, 02 Oct 2009 23:09:01 +0000

October 1, 2009

A couple weeks ago, I went out of town for an extended stay. Being the technophile that I am, I naturally brought multiple laptops, cables, memory sticks, a power strip, a wireless router, and much, much more. Getting through airport security was a nightmare because of the bulk. As a result, I decided I wanted to reduce my load and, at the same time, have the flexibility to keep hacking.

I know that there has been a lot of virtual pages dedicated to minimalism surrounding computer gear, especially when related to traveling. In order to deviate from that discourse, I have found it necessary to quantify my needs and goals a bit different than others. ..

My goal is to: identify those items that are useful in conducting a professional penetration test on the road, and then find a way to minimize the weight and volume of equipment.

Some additional constraints on the project was that I could not assume access to a power source or the Internet. I also added in the difficult task of anonymity, which immediately eliminated cell phone and Internet EVDO cards (we’re looking into data tethering on pay-as-you-go phones, assuming we can do so without revealing our identity).

Me and some friends did some (very quick) brainstorming, and came up with the following list:

Hardware

lockpicks (Southord MPXS-62)
netbook (eee PC 1000H)
extra netbook battery
netbook bag (Targus CityGear (TSM097US))
universal memory card reader (SanDisk ImageMate All-in-One)
multiple memory cards (SD: 8GBx2, 2GBx2. Thumb: 1GB, 4GB)
international power adapter
extension cord (non-grounded)
Surge protector (Dynex 3-socket outlet / surge protector)
P&S digital camera
paper / pencil
electrical tape
multi-purpose tool (leatherman)
solar panel / charger
portable hard drive (Western Digital 500GB)
small toolkit
ultra-thin DVD drive (uses USB for power source)
ethernet cable
iPod Touch w/ USB cord (optional)
earjacks (included w/ optional iPod Touch)
caffeine pills (or instant coffee / tea packets)
wifi map of the region
Pre-packaged meal (e.g. MRE)

Software

Microsoft OS installed
BackTrack installed on bootable Thumb Drive
VMware and a Linux Distro (probably BackTrack again)

Digital Documents

Internet Access
The problem of Internet access can be somewhat mitigated through the use of open access wifi, but that does restrict mobility to metropolitan areas. I have an ulterior desire to be able to use this setup when camping, but until there is a way identified that will permit access to the Internet within the constraints of this project, the use of wifi points becomes a necessity.

Power
Keeping the laptop charged is a different problem. I have included a solar power kit in the list to provide a method of charging the netbook and iTouch charged when power is absolutely unavailable. Within a metropolitan area, power isn’t as much of an issue, since coffee shops and some restaurants have outlet access; one of my favorite sources of power is a mall, which often have benches near power outlets in the center of the halls (for kiosks that need power).

iPod Touch
The inclusion of the Touch has been debated as to its value in the list. The disadvantage to the Touch is the cost, additional power demands, and need to bring an additional cable (at a minimum). There is also an expectation that the Touch will be jailbroken, in order to extend the tools available and to provide access to the underlying operating system. The need to jailbreak the Touch is also considered a disadvantage; it has also been argued that a jailbroken phone could provide almost the same functionality as a netbook.

My desire to include the Touch is to provide a quick method of wifi detection/connection and Internet access for those times when breaking out the netbook is less than ideal (especially in social-engineering situations).

Other Thoughts
Disk encryption - In the future, I will look into full disk encryption of the netbook’s hard drive.

Extension Cord & Surge Protector - the Eee PC does not require a ground. I also use an AC/USB power adapter and a Linksys mobile router on occasion that also does not require a ground. Depending on the power source, a non-grounded extension cord will provide me with multiple outlets for all of my devices, should I decide to include them. An optional Dynex 3-outlet surge protector can be included in the kit.

Clothing - While clothing may be considered outside the scope of a Hacker BOB, the inclusion of gloves may be appropriate, depending on the circumstances.

External Antenna - Up for inclusion is a “pringles can” antenna and USB wireless card which can accept the antenna cable. The arguments against it is the size, but the utility of having the antenna may definitely outweigh the bulk issue. Another possibility is a long-range USB WiFi adapter, such as Wi-Fire.

Follow-ups
To determine the effectiveness of this list, I will attempt to restrict my personal computer use to the aforementioned kit for things other than work. Updates to this project will be included in this post.

Extreme Makeover: Home Edition and Marrow Donation

Thomas — Sat, 12 Sep 2009 15:25:29 +0000

Normally, I am a very private person when it comes to my personal life. However, something that happened five years ago will soon become known to millions of people across the United States… I saved a life.

On Tuesday, I was flown to Illinois so I could meet a very special woman, Joey Stott. Wife and mother, five years ago Joey had been diagnosed with Leukemia. In the end, her only option was to find an anonymous marrow donor, who eventually was myself. The process of extracting the marrow was straightforward, and the marrow transfusion worked… so far. She has continued to struggle to stay alive, since a marrow transfusion is never a sure thing. However, other than having a new blood type and all my allergy problems (sorry, Joey), she seems to have resumed her life… until recently. She had a setback with an electrical house fire, and was in very dire circumstances for many months. But all that is changing.

I received a phone call from Extreme Makeover: Home Edition asking if I would join them in providing Joey Stott and her family with a better future by rebuilding her home. Without any hesitation, I volunteered to be a part of the show. We are only three days into construction, and I have to state I am overwhelmingly amazed as to the progress on the house and the community outpouring of support for the Stott family. Yes… I am on camera… yes, I have met the designers and Ty. However, that isn’t why I joined up in this endeavor. Joey and her family have gone through some very difficult times, and although their situation is special, it is not unique. I am hoping that when this episode airs on television, more people will be aware of the National Marrow Donor Program, and how easy it is to save a life and keep a family together.

I understand that my donation has had a huge impact on Joey and her family. However, I feel that I am a small cog in a much larger machine; without the doctors and nurses involved, and without the selflessness of the donors, thousands more would die every year. Unfortunately, there are still thousands who die every year because they cannot find a genetic match.

I will be participating in the National Marrow Donor Program “Be the Match” drive here in Lena, Illinois today, in hope that word spreads locally. I am participating in Extreme Makeover: Home Edition in hope that word spreads nationally. Let’s hope that another life will be saved as a result.

- Tom Wilhelm

Best of Hakin9 Magazine

Thomas — Mon, 31 Aug 2009 01:54:08 +0000

Apparently my article on the De-ICE Pentest LiveCDs was selected for inclusion in Hakin9 magazine’s “Best of” edition, now in bookstores. The funny part of all this was that I had no idea. In fact, I had quickly browsed through the magazine multiple times before actually looking at the table of contents.

I’m quite excited that I was selected for such an issue, and hope to write more for the magazine.

Marc Jacobs Shoes
Discounted Fake Dior Online
Discounted Replica Jimmy Choo Handbags Online
Buy Discounted Designer Replica Gucci Shoes Online
Fake 3.1 Phillip Lim Online
Buy Cheap Fake Balenciaga Handbag Online
Buy Designer Replica Marc Jacobs Shoes
Discounted Designer Replica Alexander Wang Handbag Online
Buy Discounted Replica Lv Shoes
Discounted Coach Handbags Online
Designer Replica Jimmy Choo Online
Replica Chanel Handbags
Buy Discounted Chanel Handbags Online
Buy Salvatore Ferragamo Handbags
Buy Replica Thomas Wylde Handbag
Replica Givenchy Handbag Online
Discounted Fake Burberry Online
Discounted Christian Louboutin Shoes
Buy Fake Loewe Handbag Online
Fake Alexander Wang Handbags
Discounted Replica Dg Online
Replica Shoes
Discounted Thomas Wylde Handbag
Discounted Replica Christian Dior
Cheap Ysl Handbags Online
Discounted Valentino Handbag
Cheap Designer Replica Manolo Blahnik Shoes
Buy Cheap Fake Manolo Blahnik Shoes
Discounted Lancel Handbags
Cheap Fake Dolcegabbana Handbag Online
Designer Replica Dg Online
Cheap Designer Replica Dolcegabbana Shoes Online
Buy Replica Vivienne Westwood
Designer Replica Burberry Shoes Online
Fake Miu Miu Shoes Online
Buy Cheap Fake Balenciaga
Buy Discounted Fake Lancel Handbags
Discounted Fake Hermes Handbags
Cheap Lancel Handbag Online
Buy Discounted Fake Marc Jacobs Handbag Online
Buy Fake Mulberry Handbags Online
Alexander Mcqueen Handbag
Buy Discounted Designer Replica Fendi Online
Discounted Replica Dior Shoes
Cheap Alexander Wang
Buy Cheap Christian Dior Handbag
Buy Discounted Designer Replica Jimmy Choo Handbags Online
Fake Coach
Buy Chloe Handbags Online
Discounted Replica Marc Jacobs
Discounted Replica Alexander Mcqueen Shoes Online
Buy Discounted Replica Thomas Wylde Handbag Online
Buy Giuseppe Zanotti
Buy Givenchy Handbags
Fake Valentino Handbags Online
Buy Discounted Dg Online
Cheap Ysl Handbag
Buy Cartier Handbags Online
Cheap Replica Jimmy Choo Online
Buy Fake Alexander Wang
Discounted Chloe
Buy Cheap Designer Replica Dolcegabbana Handbags Online
Cheap Designer Replica Hermes Handbags Online
Buy Discounted Fake Chanel Shoes
Discounted Fake Louis Vuitton
Cheap Bottega Veneta Handbags
Buy Discounted Replica Salvatore Ferragamo Handbag
Buy Discounted Replica Bally Online
Buy Fake Yves Saint Laurent Shoes
Discounted Fake Lanvin
Replica Prada Online
Discounted Replica Bally Handbags
Cheap Designer Replica Christian Dior Handbags
Jimmy Choo Shoes
Fake Valentino Handbag Online
Buy Discounted Replica Lanvin Online
Cheap Fake Marni Online
Buy Replica Cartier
Discounted Fake Coach
Buy Cheap Fake Miu Miu Online
Cheap Designer Replica Dg Handbag Online
Discounted Lv Handbag
Designer Replica Celine Online
Buy Cheap Replica Lv Handbag
Buy Discounted Replica Ysl Handbag
Discounted Replica Yves Saint Laurent Online
Cheap Fake Christian Dior Handbags
Discounted Giuseppe Zanotti Shoes
Buy Cheap Fake Yves Saint Laurent Handbag
Buy Fake Bottega Veneta Online
Buy Cheap Designer Replica Prada Shoes
Buy Discounted Fake Ysl Handbags Online
Buy Cheap Fake Fendi Shoes
Discounted Replica Chanel Handbags Online
Buy Discounted Designer Replica Louis Vuitton Handbags Online
Jimmy Choo Handbags Online
Designer Replica Dg
Buy Replica Prada Shoes
Buy Discounted Replica Louis Vuitton Handbag
Discounted Marc Jacobs Online

DefCon 17

Thomas — Thu, 23 Apr 2009 05:38:36 +0000

I received notice today that I have been selected to speak at DefCon 17 this year. This will be the third time in as many years that I have spoken at DefCon. Strangely, I’m more excited about this year than I have in the past, partially because my youngest daughter (age 9) will be attending for the first time.

BackTrack 4 Beta is out…

Thomas — Thu, 12 Feb 2009 04:54:29 +0000

…’nuff said.

http://www.remote-exploit.org/backtrack_download.html

Ok, here’s a bit more… (notice the move from Slax to Debian)

Quote:

The Remote Exploit Development Team is happy to announce the release
of BackTrack 4 Beta.

We have taken huge conceptual leaps with BackTrack 4, and have some
new and exciting features.

The most significant of these changes is our expansion from the realm
of a Pentesting LiveCD towards a full blown “Distribution”.

Now based on Debian core packages and utilizing the Ubuntu software
repositories, BackTrack 4 can be upgraded in case of update. When
syncing with our BackTrack repositories, you will regularly get
security tool updates soon after they are released.

Some of the new features include:

* Kernel 2.6.28.1 with better hardware support.

* Native support for Pico e12 and e16 cards is now fully
functional, making BackTrack the first pentesting distro to fully
utilize these awesome tiny machines.

* Support for PXE Boot - Boot BackTrack over the network with PXE
supported cards!

* SAINT EXPLOIT - kindly provided by SAINT corporation for our
users with a limited number of free IPs.

* MALTEGO - The guys over at Paterva did outstanding work with
Maltego 2.0.2 - which is featured in BackTrack as a community edition.

* The latest mac80211 wireless injection patches are applied, with
several custom patches for rtl8187 injection speed enhancements.
Wireless injection support has never been so broad and functional.

* Unicornscan - Fully functional with postgres logging support and
a web front end.

* RFID support

* Pyrit CUDA support…

* New and updated tools - the list is endless!

With all these changes, PLUS the usual goodies and surprises we have
in BackTrack, we are truly excited about this new release.

We consider the Beta to be stable and usable. Some tools were kept
back from this version, and will be soon added to the repositories.

Downloads can be found here :
http://www.remote-exploit.org/backtrack_download.html

Keep safe,

The Remote Exploit Team

I, for one, welcome our new undead overlords…

Thomas — Thu, 05 Feb 2009 02:36:05 +0000

Nazis and zombies and raptors - oh my!

We’ve all seen those text-based road signs warning us of impending traffic hazards. Well, people are hacking them and getting clever.

So far, the signs have read:

“DAILY LANE CLOSURES DUE TO ZOMBIES.”
“RAPTORS AHEAD — CAUTION.”
“NAZI ZOMBIES! RUN!!!”
“ZOMBIES IN AREA! RUN”

Here’s the hack. Enjoy!

Global Cyber Warfare

Thomas — Fri, 30 Jan 2009 22:11:02 +0000

I have to admit I’m a big fan of William Gibson. For those who have never read any of his novels (yeah, I know… look at who I’m talking to… we’ve ALL read his stuff), he often describes the Matrix (our Internet) as a very hostile place. In his dystopia, global companies competed with each other, and that competition extended into the digital world - where life was risked and the result of a misstep was death.

It is because of this I am fascinated by news stories where countries attack other countries. The latest news takes us back to the philisophical and territorial conflict between Russia and Kyrgystan. There have been three successful attacks by Russia against neighboring countries, with the latest occuring this month. Rumor has it that the Russian government has paid for these attacks, or conducted them themselves. Regardless who is behind it, these attacks could easily be capable of destroying economies if conducted for any length of time.

I’ve always felt that the Internet was probably the best example of how Anarchism could function in modern society; and these types of attacks demonstrate the inability to regulate the Internet and “making it safe.” Can we expect larger and more comprehensive attacks? Absolutely - that is a big fear in the United States; an organized group could attack the U.S. infrastructure and military, and cripple the country.

These types of attacks will continue, and as long as I’m on the sidelines and unaffected, I will watch with anticipation to see where all this leads; whether it is what has been described by Gibson, or worse. Regardless, the more advanced countries and groups become, the quicker they will turn to cyberspace to launch their attacks.