former33t

@former33t wrote:

To be able to hackReading comprehension ftw:

So the computer has RAS enabled so dad can help out when he’s not around…  he doesn’t need to be an NSA cracker.  He doesn’t even need to be able to hack his way out of a paper bag.  He has access to the machine.  Full disk encryption won’t fix that.  It won’t even help.

If you…

[Read more]

@dante: Thanks for pointing out unclear posts!

@former33t: I agree with you, but something we both forgot to mention is WHERE you work. Big cities may pay more than small ones, competition is different everywhere and countries also make a huge difference.

Oh and yes, I am incorporated…  😉

@former33t wrote:

I do know what I get paid though so I would guess you aren’t getting out with any quality testing done for under $3k.

If the price was $3k, how much time would you expect to use on such a pentest then? I’m just wondering since I honestly don’t know the overall pricing either  😉

Thanks for the great responses former33t and Ketchup.  I would say everyone has brought up valid point in helping me figure this out (and hopefully other readers). 

@former33t wrote:

Bottom line, go get Security+ or CISSP (associate since you don’t have the experience) or anything else on the DoD 8570 matrix.

Sounds like a good idea.  Like I sa…[Read more]

@former33t

Its not just the feds that prefer 4-year degrees. I worked for an Engineering firm a few years back that basically put a glass ceiling on all non-degreed employees. A college grad could come in making more than a non-degreed employee with 10 years experience! It all goes back to, “It depends.”

@former33t wrote:

Last, remember that you don’t have to be root to get valuable information.  If on a db server, I really want the db, mail server == mail…

sil and former33t went further for you on where I was leading.  End point is, exactly as former33t put it in the quote above…  Ultimately, at the end of the day, the point is showing wh…[Read more]

@dynamik: The syllabus gives an idea of what to expect: http://www.offensive-security.com/documentation/cracking-the-perimiter-syllabus.pdf and you should be able to complete http://fc4.me/ as well. You can try out the FC4.me challenge without registering.

The skills I think that are required to do the course only would be:
– Web Application…[Read more]

@former33t wrote:

I’ll add to the sentiment that there were too many people for the Riv.  DEFCON either needs a new location next year or it needs to pre-sell tickets and limit numbers (like ShmooCon).  Personally, I’m all for a new location.

So H1t M0nkey, I agreed with some of your picks and I didn’t get to see the last two.  I wasn’t very im…

[Read more]

@former33t – Glad to help!

@Grendel – Glad to hear they’ve got the space issues taken care of and that socializing is going well into the early morning. I think that’s one aspect of 14 I missed was the “after party.” I remember the darts now that you mention it too.  I was there mostly for the lockpicking at first but didn’t do nearly as well as…[Read more]

@former33t wrote:

I know some government employees that are looking for new positions because they can’t pass exams (or “don’t want to deal with the headache”).  Better for all of us I say…

Yep, agree. I’m currently contracting and due to someone I work with (gov’t employee) not interested in passing exams, I might have a good shot at getting…[Read more]

@former33t wrote:

In the US, you are required to submit research on number theory to DoD for pre-publication review (the original intent was to give them a heads up on a prime factorization flaw to avoid breaking public key crypto).

Interesting, didn’t know that before. Looking forward to the full paper as well.

@former33t wrote:

Even if they were with a hosting company (and I think they were) the hosting company is not liable for hackers on your website.  Nothing comes cheap in computing (especially security).  I had a client with a hosting site who didn’t update joomla (CMS) and got exploited.

Not trying to argue, but it depends on the hosting c…[Read more]

@former33t wrote:

Bill, I love the idea you shared about the outlandish ideas.  I’ll be sure to use this both in consulting and at my normal job.  My boss routinely ok’s things that I’m positive he doesn’t comprehend (and as a result doesn’t read).  A reality check might force a positive change.

Yeah, absolutely. Not only gets them to ac…[Read more]

@former33t wrote:

Some companies are content knowing that a professional would have to expend > X man weeks to exploit the platform the code is running on. That’s how lots of these get found. 

Agreed.  I know of a few software companies, whom I’ll allow to remain nameless, so I don’t get hung by my contacts for bringing them into the s…[Read more]

@former33t wrote:

That video sucks.
The networking instructor introduced herself and played the video to “get our feet wet in networking”.
(showing the video was a joke but I wasn’t laughing…).

I wouldn’t go that far. I think that’s right up the alley for my parents if they ever wanted to understand networking, or I forced them to understand…[Read more]

@former33t wrote:

Awesome.  I couldn’t be happier.  I’ll be sure to post book reviews as I get the books (and read them of course).

Thanks Don for a great site with great sponsors!

congrats! can’t wait to see the reviews!

@hayabusa: just wait until you received the books, them the drooling will start for sure!

@former33t wrote:

Well, China is always my favorite country to blame.  Due to the lack of sophistication, I don’t think that the attack came from China.

Thats a stupid comment. Go read about china!

Your CTF project sounds interesting, good lock. I also like that you will offer something to play with also for the unexperienced users. 😉

I am not sure if you understood my initial posting correct or if I misunderstood you last post. I am not looking for specific guides/ videos etc. for myself but thought about offering such things to others. I…[Read more]

@former33t wrote:

Yeah, that thought hadn’t escaped me, but you wouldn’t believe the number of INTERNET ACCESSIBLE boxes I find in pen tests that are only logging locally.

… Sad, but very true.

I did figure out if you send the send the correct kill signal you can pause lots of logging, clear out the stuff you want removed, and then restart…[Read more]

@former33t wrote:

The way I read it, the system took steps to NOT intercept private data.

yeah… ok