Archive for July, 2009

Follow us on Twitter (getFYRM)…and RSVP Deadline Passsed

Posted in Black Hat, Conferences, DEFCON, Events with tags , , , , on July 30, 2009 by Tim

You can follow us on Twitter under getFYRM. We’ll be tweeting updates this weekend for the happy hour tonight (see below) and for the netbook winners.

The RSVP deadline for the happy hour tonight has passed. See Tony or Matt if you still want in. Also catch them for swag and a chance to win one of two Asus netbooks.


U.S. needs to attract more Cybersecurity Ninjas

Posted in Government, Jobs on July 27, 2009 by Matthew Flick

I’m not sure why I continue to keep a close eye on this administration and the Federal Government, but I guess someone needs to step up to do it. Hannity & Colmes, Limbaugh, and Jon Stewart might know the government but they sure don’t know security ;) I also think being so close proximity wise to the nation’s capital I’m constantly inundated with news clips, stories, and critiques that it’s hard not to form some opinion.

A report released by Partnership for Public Service, a nonprofit organization devoted to building a better federal work force and Booz Allen Hamilton, a management consulting firm, finds the Federal Government is at risk of being unable to fight off attacks on the nation’s computer networks unless it strengthens its cyber-security work force. The report identified the four main challenges “as uncoordinated leadership of cybersecurity workers; a cumbersome hiring process that discourages people from seeking government jobs and fails to provide a career path for those who do; and hiring managers and human resource specialists who disagree on the quality of IT candidates.”

The report contained several recommendations for actions to help resolve some of the issues right now. One point that is strongly suggested is that agencies should put someone in charge of hiring cybersecurity talent now and not waiting for instruction from the White House’s new cybersecurity coordinator. The report also included a checklist for cybersecurity talent management agencies can use as a reference point.

I think its fair to say the public sector continues to lag behind in most things information security related. The lack of budget, resources, training and awareness is not too different than what we see in the private sector. However, the disparity in those areas especially with some of the “most critical” agencies can be disturbing. I hope President Obama and his cybersecurity appointed folks move fast to address the raised issues in this latest report. I totally agree each agency should move forward independently but at the same time coordinated strategic efforts and sensible guidelines/frameworks are going to be critical across our government. I hate to admit it, but I do think a major roadblock is going to be the pay scale for government positions. Security folks are at the top of the IT pay scales and right now don’t translate well on the government’s GS scale. A bit cliché but money talks.

Please President Obama, please get your cybersecurity A-team put together quickly, get advice with cybersecurity thought leaders and representatives in the private sector, and give the agencies serious security budgets to get things accomplished. We need more ninjas on our side, protecting our “cyber-borders”.

We’re Hiring!

Posted in Jobs with tags , , on July 23, 2009 by Matthew Flick

We are looking for a National Account Executive and a Senior Security Consultant. Ideal candidates would have experience with application and network security (selling and delivering, respectively). Both positions are remote. Send your resume to

Bluetooth 3.0 + HS: Compromising Your Security at 24 Mbps

Posted in Wireless Security with tags , on July 1, 2009 by Tony Flick

On April 21, 2009, the Bluetooth 3.0 specification was adopted by the Bluetooth Special Interest Group (SIG). This new specification includes new attributes such as:

  • High speed data transfer of large files (~24 Mbps)
  • Bluetooth low energy

The new specification achieves these new attributes by including an 802.11 radio, aka Wi-Fi, that allows lower energy usage when attempting to transfer large amounts of data. While ultra-wideband (UWB provides ~480Mbps) was widely rumored to be included in the upcoming specification, it was absent from the final release. Utilizing the Wi-Fi radios will increase the data transfer speed, which results in a lower per bit energy usage. The Bluetooth radio will still be utilized for the initial operations such as device discovery, initiating connections, and profile configurations. The result is that Bluetooth 3.0 devices will utilize the appropriate radio to minimize power consumption.

While this new specification promises significant speed improvements and efficiency, new technology always presents new risk. The new high speed data transfer protocol works by first initiating the connection via the traditional Bluetooth protocol. Then, the device creates an ad-hoc connection (peer-to-peer) between the two devices creating a personal area network (PAN). The new standard calls for 128-bit AES encryption, which is commendable; however, the 3.0 specification remains backwards compatible. So, if one device is an older generation, the devices will use the older specification to perform communication. Thus, the communication between the two devices will be susceptible to the traditional attacks against Bluetooth.

When performing traditional wireless security assessments, one of the most common recommendations is to configure wireless clients to only join infrastructure networks (Access Points). But as mentioned before, the transfer of large amounts of data will go over an ad-hoc connection. Thus, the communication between the two devices will be susceptible to the traditional attacks against ad-hoc networks.

By combining the two radios, the Bluetooth SIG will advance the abilities of Bluetooth devices, but will also introduce new attack vectors. Within the next year, devices will be emerging that implement the Bluetooth 3.0 + HS specification. The question then becomes, are you going to get bluejacked at 24 Mbps?