7/30/2019 Guerrillas in the wires (with notes)

1/183

Gorilla in anon mask

1

7/30/2019 Guerrillas in the wires (with notes)

2/183

2

7/30/2019 Guerrillas in the wires (with notes)

3/183

3

7/30/2019 Guerrillas in the wires (with notes)

4/183

4

7/30/2019 Guerrillas in the wires (with notes)

5/183

Apple loo

5

7/30/2019 Guerrillas in the wires (with notes)

6/183

Sorry ya had to wake up early

6

7/30/2019 Guerrillas in the wires (with notes)

7/183

And sit there to pay atteention

7

7/30/2019 Guerrillas in the wires (with notes)

8/183

To my stupid ppt

8

7/30/2019 Guerrillas in the wires (with notes)

9/183

9

7/30/2019 Guerrillas in the wires (with notes)

10/183

Got drunk last night

10

7/30/2019 Guerrillas in the wires (with notes)

11/183

partied

11

7/30/2019 Guerrillas in the wires (with notes)

12/183

Will try not to puke while I am on stage

12

7/30/2019 Guerrillas in the wires (with notes)

13/183

Ps.. I sweardeal with it

13

7/30/2019 Guerrillas in the wires (with notes)

14/183

14

7/30/2019 Guerrillas in the wires (with notes)

15/183

15

7/30/2019 Guerrillas in the wires (with notes)

16/183

16

7/30/2019 Guerrillas in the wires (with notes)

17/183

17

7/30/2019 Guerrillas in the wires (with notes)

18/183

18

7/30/2019 Guerrillas in the wires (with notes)

19/183

19

7/30/2019 Guerrillas in the wires (with notes)

20/183

20

7/30/2019 Guerrillas in the wires (with notes)

21/183

21

7/30/2019 Guerrillas in the wires (with notes)

22/183

22

7/30/2019 Guerrillas in the wires (with notes)

23/183

23

7/30/2019 Guerrillas in the wires (with notes)

24/183

24

7/30/2019 Guerrillas in the wires (with notes)

25/183

25

7/30/2019 Guerrillas in the wires (with notes)

26/183

26

7/30/2019 Guerrillas in the wires (with notes)

27/183

Who we are

27

7/30/2019 Guerrillas in the wires (with notes)

28/183

Code review

28

7/30/2019 Guerrillas in the wires (with notes)

29/183

Incident response

29

7/30/2019 Guerrillas in the wires (with notes)

30/183

Risk Assessment

30

7/30/2019 Guerrillas in the wires (with notes)

31/183

Physical security

31

7/30/2019 Guerrillas in the wires (with notes)

32/183

PenTesting

32

7/30/2019 Guerrillas in the wires (with notes)

33/183

Red Teaming

33

7/30/2019 Guerrillas in the wires (with notes)

34/183

Converged attacking

34

7/30/2019 Guerrillas in the wires (with notes)

35/183

Adversarial modeling

35

7/30/2019 Guerrillas in the wires (with notes)

36/183

36

7/30/2019 Guerrillas in the wires (with notes)

37/183

Why are you here?

37

7/30/2019 Guerrillas in the wires (with notes)

38/183

We have to wake up and fix this issues of getting owned ALL the time

38

7/30/2019 Guerrillas in the wires (with notes)

39/183

Most security programs deenses and testing is. Monkeys taking potshots

39

7/30/2019 Guerrillas in the wires (with notes)

40/183

40

7/30/2019 Guerrillas in the wires (with notes)

41/183

41

7/30/2019 Guerrillas in the wires (with notes)

42/183

Got an email and asked to talk

42

7/30/2019 Guerrillas in the wires (with notes)

43/183

Insert airplane pic

43

7/30/2019 Guerrillas in the wires (with notes)

44/183

Insert rant pic

44

7/30/2019 Guerrillas in the wires (with notes)

45/183

About all of the Anonymous / lulzsec etc stuff that was going on all over the world

45

7/30/2019 Guerrillas in the wires (with notes)

46/183

So why do people get pwned over

46

7/30/2019 Guerrillas in the wires (with notes)

47/183

N over

47

7/30/2019 Guerrillas in the wires (with notes)

48/183

N over

48

7/30/2019 Guerrillas in the wires (with notes)

49/183

7/30/2019 Guerrillas in the wires (with notes)

50/183

N over

50

7/30/2019 Guerrillas in the wires (with notes)

51/183

51

7/30/2019 Guerrillas in the wires (with notes)

52/183

52

7/30/2019 Guerrillas in the wires (with notes)

53/183

So I started thinking about this more as a fight than a IT technical issue Brazil HAS

been in a wars.

53

7/30/2019 Guerrillas in the wires (with notes)

54/183

There was a method to it maybe it was a

Sneak Attack pic ( because it seems like many of the companies that got owned had

no idea it was coming..

54

7/30/2019 Guerrillas in the wires (with notes)

55/183

55

7/30/2019 Guerrillas in the wires (with notes)

56/183

Evolution of warfare over time

56

7/30/2019 Guerrillas in the wires (with notes)

57/183

Timeline of major wars

57

7/30/2019 Guerrillas in the wires (with notes)

58/183

Persians ( pic from 300) got their ass handed to em by the Scythians ( nomadic

mounted hit and run beheaders)

58

7/30/2019 Guerrillas in the wires (with notes)

59/183

Romans: tons of battles with the hit n run types: Notable Caesar getting overrun by

the Britons. "the enemy never fought in close array, but in small parties with wide

intervals; and had detachments posted at regular stations, so that one party covered

another in turn, and fresh, unspent warriors took the place of the battle weary.

59

7/30/2019 Guerrillas in the wires (with notes)

60/183

Goths vs romans.

gurellia fighting prevailed

60

7/30/2019 Guerrillas in the wires (with notes)

61/183

killed in battle or vaginia dentia?

61

7/30/2019 Guerrillas in the wires (with notes)

62/183

Ottoman Empire was held off for 25 years by the Albanians and Vlad III Dracula

stepped in with gurellia tactics of his own

62

7/30/2019 Guerrillas in the wires (with notes)

63/183

1000s of years passed and the term for these tactics was finally given during the

Napoleonic era. The great army of the midget meglomaniac was given a constant and

brutal beating by the spanyards ( insert pic of napoleon

63

7/30/2019 Guerrillas in the wires (with notes)

64/183

El Empecinado or Juan Martn Dez

Spanish coin term gurellias for small war. Guerrilla (Spanish

pronunciation: [eria]) is the diminutive of the Spanish word guerra "war", literally

"little war"

64

7/30/2019 Guerrillas in the wires (with notes)

65/183

Americans vs the redcoats

65

7/30/2019 Guerrillas in the wires (with notes)

66/183

Groups of ordinary men, women, children, farmers and more took to arms and hit

the forces where they could and whenever they could.

66

7/30/2019 Guerrillas in the wires (with notes)

67/183

Just like in the 1000 years before them they analyzed the opposing Superpower and

looked for the vulnerability in their fighting style that would even the battlefield and

they found it.

67

7/30/2019 Guerrillas in the wires (with notes)

68/183

hacking sql injection

68

7/30/2019 Guerrillas in the wires (with notes)

69/183

Just like in the 1000 years before them they analyzed the opposing Superpower and

looked for the vulnerability in their fighting style that would even the battlefield and

they found it.

69

7/30/2019 Guerrillas in the wires (with notes)

70/183

Lulz pic

70

7/30/2019 Guerrillas in the wires (with notes)

71/183

To fight these masses all you had to do was hide behind a tree

71

7/30/2019 Guerrillas in the wires (with notes)

72/183

72

7/30/2019 Guerrillas in the wires (with notes)

73/183

or something solid and fire. Insert pic of wall

73

7/30/2019 Guerrillas in the wires (with notes)

74/183

And you win Show lulsed pwned page/ tweet of docs drop

74

7/30/2019 Guerrillas in the wires (with notes)

75/183

So what do we learn from all of this war nonsense?

75

7/30/2019 Guerrillas in the wires (with notes)

76/183

76

7/30/2019 Guerrillas in the wires (with notes)

77/183

G-War has a structure as defined by mao and further by che

77

7/30/2019 Guerrillas in the wires (with notes)

78/183

78

7/30/2019 Guerrillas in the wires (with notes)

79/183

79

7/30/2019 Guerrillas in the wires (with notes)

80/183

he situation became critical. In August 1902 a Brazilian guerrilla force with little more

than 2000 men under the leadership of Jos Plcido de Castro, started a victorious

insurrection. Plcido de Castro was a 26 year old southerner and "gaucho" who

adapted to the Amazon jungle conditions the same agility and mobility that the

guerrillas had practiced on horse in the backwoods of the Rio Grande during the

Federalist Revolution. 7

In January 1903, after many battles, the Bolivian forces were decisively defeated and

withdrew. Plcido de Castro was proclaimed governor of the independent state of

Acre. On January 17, 1903 in a diplomatic victory by the Baron of Rio Branco, the

Treaty of Petrpolis was signed. 8 Brazil bought the region from Bolivia for 2 million

pounds, a commitment to build the Madeira-Mamor railroad, and an agreement to

cover the payment owed to the Bolivian Syndicate of 110 thousand pounds. 9 On 25

February 1904, the independent state of Acre was dissolved and was incorporated

into the Brazilian Federation as the Federal Territory of Acre.

Plcido de Castro combined rare skill and understanding of the strategic aspects of

the geographic, political, economic and social factors which brought the citizens of

Acre to the armed fight. In his military operations, Castro applied a strategy of

genuine Napoleonic inspiration, using the classic principles of the art of war. Then

with reduced numbers, he adapted his forces and tactics to the enemy, weather, and

terrain conditions, leading a highly mobile guerrilla campaign.

80

7/30/2019 Guerrillas in the wires (with notes)

81/183

This success of these tactics is not just the element of surprise but a keen

understanding of the battlefield and the technologies used in the fight.

81

7/30/2019 Guerrillas in the wires (with notes)

82/183

82

7/30/2019 Guerrillas in the wires (with notes)

83/183

If the attacker knows your environment better than you you have lost.

83

7/30/2019 Guerrillas in the wires (with notes)

84/183

We build our defense to protect against auditors. We build our defense to protect

against auditors and we dont TEST like attackers.

84

7/30/2019 Guerrillas in the wires (with notes)

85/183

We make rules and ignore if they are followed

85

7/30/2019 Guerrillas in the wires (with notes)

86/183

People make standards. And they are ONLY a standard. The BASE LINE. The

ABSOLUTE MINIMUM. If the standard COULD protect you. It would bean that your

company was not unique. If you are not unique its highly unlikely you are a market

leader. Do you want to be the best in the business.. Or just in business and hope

for the best

86

7/30/2019 Guerrillas in the wires (with notes)

87/183

Tickmark legends, reports

87

7/30/2019 Guerrillas in the wires (with notes)

88/183

88

7/30/2019 Guerrillas in the wires (with notes)

89/183

They are there to check your design

89

7/30/2019 Guerrillas in the wires (with notes)

90/183

And see if u meet best practices.

90

7/30/2019 Guerrillas in the wires (with notes)

91/183

Keep you safe (blanket security). Vendors want u to buy shit.. But u can get around

ALL of it

91

7/30/2019 Guerrillas in the wires (with notes)

92/183

92

7/30/2019 Guerrillas in the wires (with notes)

93/183

93

7/30/2019 Guerrillas in the wires (with notes)

94/183

Since you can own the box and usually fund the crypto keys

94

7/30/2019 Guerrillas in the wires (with notes)

95/183

95

7/30/2019 Guerrillas in the wires (with notes)

96/183

96

7/30/2019 Guerrillas in the wires (with notes)

97/183

97

7/30/2019 Guerrillas in the wires (with notes)

98/183

98

7/30/2019 Guerrillas in the wires (with notes)

99/183

Floppy drive

99

7/30/2019 Guerrillas in the wires (with notes)

100/183

100

7/30/2019 Guerrillas in the wires (with notes)

101/183

Basic encoding ( dong encoder)

101

7/30/2019 Guerrillas in the wires (with notes)

102/183

102

7/30/2019 Guerrillas in the wires (with notes)

103/183

103

7/30/2019 Guerrillas in the wires (with notes)

104/183

104

7/30/2019 Guerrillas in the wires (with notes)

105/183

105

7/30/2019 Guerrillas in the wires (with notes)

106/183

106

7/30/2019 Guerrillas in the wires (with notes)

107/183

107

7/30/2019 Guerrillas in the wires (with notes)

108/183

108

7/30/2019 Guerrillas in the wires (with notes)

109/183

109

7/30/2019 Guerrillas in the wires (with notes)

110/183

Our businesses are the superpowers of the digital age and we are spendin out moniy

on the same tired square/stacked munitions of defense offense.

110

7/30/2019 Guerrillas in the wires (with notes)

111/183

Let someone else build your program and grade you? How does that help?

111

7/30/2019 Guerrillas in the wires (with notes)

112/183

Let MANY people build your program??? Too many cooks in the kitchen and NONE of

them are cooking FOR YOU

112

7/30/2019 Guerrillas in the wires (with notes)

113/183

An open source standard that you have to pay for? Hrm. Thats not open source.

Besides. It teaches you very little about your environment and how your company

really works get your head OUT of Information Technology

113

7/30/2019 Guerrillas in the wires (with notes)

114/183

Pass picture

114

7/30/2019 Guerrillas in the wires (with notes)

115/183

115

7/30/2019 Guerrillas in the wires (with notes)

116/183

116

7/30/2019 Guerrillas in the wires (with notes)

117/183

THIS IS BULLSHIT! Made for people who dont understand how humans learn

117

7/30/2019 Guerrillas in the wires (with notes)

118/183

118

7/30/2019 Guerrillas in the wires (with notes)

119/183

119

7/30/2019 Guerrillas in the wires (with notes)

120/183

Track how you do during a test. Not just pass fail

120

7/30/2019 Guerrillas in the wires (with notes)

121/183

NO ONE can tell you how risky something isWITHOUT KNOWING YOUR BUSINESS

121

7/30/2019 Guerrillas in the wires (with notes)

122/183

122

7/30/2019 Guerrillas in the wires (with notes)

123/183

123

7/30/2019 Guerrillas in the wires (with notes)

124/183

124

7/30/2019 Guerrillas in the wires (with notes)

125/183

125

7/30/2019 Guerrillas in the wires (with notes)

126/183

126

7/30/2019 Guerrillas in the wires (with notes)

127/183

Is sending it to the cloudreally a BUSINESS decision? A budget decision or just a

way to try and pass off the risk to someone else? Remember. Even if your CLOUD

gets hacked its still YOUR business name on the front page of the papers and the

stock price that crashes

127

7/30/2019 Guerrillas in the wires (with notes)

128/183

128

7/30/2019 Guerrillas in the wires (with notes)

129/183

Since we are in EU I forgot the most important step step 0

129

7/30/2019 Guerrillas in the wires (with notes)

130/183

130

7/30/2019 Guerrillas in the wires (with notes)

131/183

131

7/30/2019 Guerrillas in the wires (with notes)

132/183

132

7/30/2019 Guerrillas in the wires (with notes)

133/183

133

7/30/2019 Guerrillas in the wires (with notes)

134/183

134

7/30/2019 Guerrillas in the wires (with notes)

135/183

135

7/30/2019 Guerrillas in the wires (with notes)

136/183

Map all business plans/goals to the crap you are buying or the policy/process you are

putting in place

136

7/30/2019 Guerrillas in the wires (with notes)

137/183

Buy stuff.. If it doesnt fit. Push harder. *WRONG*

137

7/30/2019 Guerrillas in the wires (with notes)

138/183

138

7/30/2019 Guerrillas in the wires (with notes)

139/183

139

7/30/2019 Guerrillas in the wires (with notes)

140/183

Goal of testing.. Double knock out. If you have fun fighting your testersand playing

the game. You are ready for the big fight

140

7/30/2019 Guerrillas in the wires (with notes)

141/183

141

7/30/2019 Guerrillas in the wires (with notes)

142/183

142

7/30/2019 Guerrillas in the wires (with notes)

143/183

143

7/30/2019 Guerrillas in the wires (with notes)

144/183

144

7/30/2019 Guerrillas in the wires (with notes)

145/183

145

7/30/2019 Guerrillas in the wires (with notes)

146/183

Vulnerability scanners are dien. Researchers are releasing less of their work because

they make more $$$ in private sale. With the # of exploits being released reducing

and the scanners only identifying things that have been released.. The decay of

accuracy is growing at alarming rates

146

7/30/2019 Guerrillas in the wires (with notes)

147/183

Shells dont mean shit!

147

7/30/2019 Guerrillas in the wires (with notes)

148/183

Nerdfights are NOT what you should prepare for. Dont train to fight your pentester,

train to fight an ATTACKER that has no rules nothing to lose and only something to

gain.

148

7/30/2019 Guerrillas in the wires (with notes)

149/183

149

7/30/2019 Guerrillas in the wires (with notes)

150/183

Start A Fight, figure out how hard you can go. What level can you stop and what level

knocks you out

150

7/30/2019 Guerrillas in the wires (with notes)

151/183

www.pentest-standard.com

151

7/30/2019 Guerrillas in the wires (with notes)

152/183

Insert PTES logo and link

152

7/30/2019 Guerrillas in the wires (with notes)

153/183

Mike Tyson : Prophet of Infosec Everyone has a plan until they get punched in the

face

153

7/30/2019 Guerrillas in the wires (with notes)

154/183

154

7/30/2019 Guerrillas in the wires (with notes)

155/183

155

7/30/2019 Guerrillas in the wires (with notes)

156/183

Dont expect users to pick up their own.

156

7/30/2019 Guerrillas in the wires (with notes)

157/183

157

7/30/2019 Guerrillas in the wires (with notes)

158/183

We got lost ( lost picture)

158

7/30/2019 Guerrillas in the wires (with notes)

159/183

Industry Emerges (industrial age picture)

159

7/30/2019 Guerrillas in the wires (with notes)

160/183

160

7/30/2019 Guerrillas in the wires (with notes)

161/183

161

7/30/2019 Guerrillas in the wires (with notes)

162/183

162

7/30/2019 Guerrillas in the wires (with notes)

163/183

7/30/2019 Guerrillas in the wires (with notes)

164/183

164

7/30/2019 Guerrillas in the wires (with notes)

165/183

165

7/30/2019 Guerrillas in the wires (with notes)

166/183

166

7/30/2019 Guerrillas in the wires (with notes)

167/183

167

7/30/2019 Guerrillas in the wires (with notes)

168/183

168

7/30/2019 Guerrillas in the wires (with notes)

169/183

169

7/30/2019 Guerrillas in the wires (with notes)

170/183

170

7/30/2019 Guerrillas in the wires (with notes)

171/183

171

7/30/2019 Guerrillas in the wires (with notes)

172/183

172

7/30/2019 Guerrillas in the wires (with notes)

173/183

173

7/30/2019 Guerrillas in the wires (with notes)

174/183

174

7/30/2019 Guerrillas in the wires (with notes)

175/183

175

7/30/2019 Guerrillas in the wires (with notes)

176/183

176

7/30/2019 Guerrillas in the wires (with notes)

177/183

177

7/30/2019 Guerrillas in the wires (with notes)

178/183

178

7/30/2019 Guerrillas in the wires (with notes)

179/183

179

7/30/2019 Guerrillas in the wires (with notes)

180/183

180

7/30/2019 Guerrillas in the wires (with notes)

181/183

181

7/30/2019 Guerrillas in the wires (with notes)

182/183

182

7/30/2019 Guerrillas in the wires (with notes)

183/183