Johnny Long says thank you to IndySec

http://www.hackersforcharity.org/long-journey/thanks/

IndySec (http://bit.ly/5oyQrb) blew the top off our donor cloud recently! I’ve never seem so much activity on the cloud, and thanks to them, HUNDREDS of families will be fed through our food for work program in Kenya.

IndySec 12/17

IndySec @ BW3, downtown Indy.

Thursday (12/17)

I will be there at 5:30

Goals:

• Talk about the next charity event
• Beer
• Watch the Colts

Location:

7 East Washington Street

Indianapolis, IN 46204-3504

Phone: 317-951-9464

Thank you

The charity event was awesome! Thank you to all involved. Props to Iowa, Irongeek and crew, Brad from FishNet, D-Day and AC of vNugglets.com, Todd, Brian, and Jake from BlueLock. You made this event happen.

Mr. Johnny Long even sent out a personal thanks.

The folks at Indysec are AMAZING!!! They've BLOWN UP our donor cloud!!!http://bit.ly/5oyQrb... Thanks guys!!!

IndySec is this Thursday - Join us and help plan IndySploit 2.

Cheers,

Steve

Thank you!

I never thought I'd being saying this, but we are closing registration for the Charity event --- we are at capacity! Thank you to everyone who helped us get the word out.

We look forward to seeing you tomorrow.

Plan on a CTF event in the coming months!

Cheers,

Steve

IndySec Metasploit Unleashed Charity Event

What is the event?
In short, IndySec is hosting a community event based on the Metasploit Framework (MSF).

So, these guys, and a host of others, put this together as a way to raise money for Johnny's food program. Got it? Cool.

When is the event?
Saturday December 12th from 1:00 PM to 5:00 PM (with some social time afterward).

What do you get?
A sense of community, a networking opportunity, instruction from local security professionals, an attack lab, lunch, and you assist in Johnny's life-saving mission.

What is the donation amount?
$30.00. Yeah, take that training budget.

So who gets your money?
The Hackers for Charity Food Program. This is a relationship between you and Johnny's charity. IndySec does not touch your money; however, we would like the collective group to fill out the donation form in a similar way. More on this later.

Are we going to teach the entire class?
Nope. We would need two days to do it justice, so we will just hit some high spots over a Saturday afternoon.

Where is the event?
BlueLock on the world wide west side (of Indy).
6325 Morenci Trail, Indianapolis, IN
(Note, you must bring ID when you sign in to the facility. This is a BlueLock requirement.)

What should you bring?
A laptop with Backtrack or the MSF installed. Formal requirements now posted.

How do I register?
You can't anymore. We are at capacity and therefore registration is closed.

Want to learn more about Johnny's perspective?
Watch his 2009 Defcon presentation.
It's what got me thinking about doing a charity event - the talk blew my mind.

How can I help?
Email Steve. moore.steve (a t) gmail

My company wants to help provide X, Y, or Z. Who should they contact?
Again, email Steve. moore.steve (a t) gmail

IndySploit Pre-req Checklist

The "formal requirements" as mentioned in the IndySploit Charity Event Announcement:

What should you bring?

1. a laptop, complete with additional power source (power adapter, additional battery, solar panels, etc.) and functioning wireless NIC
   - primary network access will be via wireless access point
   
2. your donation confirmation email (a hard copy will help expedite check-in at the event -- again, this is for some basic donation verification)
   - donation/registration how-to, in case you missed it
   
3. the MetaSploit Framework (MSF), in the form of one of the following:
1. installed on your laptop (or the VM from which you intend to perform your attacks)
   - MSF installer: http://www.metasploit.com/framework/download/ (v3.3 released 17 Nov 2009!)
   
2. a BackTrack session, by either:
1. booting your laptop (or a VM) from a live BackTrack CD/DVD, and then performing updates*
2. installing BackTrack onto your laptop or a VM on your laptop, and then performing updates*

- BackTrack install/live CD: http://www.remote-exploit.org/backtrack_download.html

* Performing back|track 4 updates: "If you are using back|track 4 as your platform, you can always update to the latest version of the trunk by issuing a 'svn up' in the '/pentest/exploits/framework3/' directory."


What we will provide you:

1. two (2) attack target systems per attendee -- one (1) Windows XP SP2 guest, and one (1) Ubuntu Server 7.04 guest, as described in the "Required Materials" section of the Metasploit Unleashed page
   - these attack target guests will:
   
   1. be housed on VMware hosts, so you need not host these on your laptop
      
   2. have the prescribed configurations made and packages installed
   3. be on the previously mentioned internal network
2. DHCP address(es) on the internal network for your laptop/attack system
3. internet access via the internal network
   
4. the rest of the items mentioned in the charity event announcement (A sense of community, a networking opportunity, instruction from local security professionals, an attack lab, lunch, and you assist in Johnny's life-saving mission)

Additional notes:

• Please have your attack machine functional/ready (tool kits, wireless networking, etc.) to go before arriving. This event focuses on using the Metasploit Framework (MSF)
  
• This is not a switch/router/WAP attack session -- the gear involved in the attack lab is necessary infrastructure for everyone

Donor Cloud

IndySec is this week!

IndySec is this Thursday!

Time: 6:00 (11/19)
Location: The Broad Ripple Brewpub
842 E 65th St
Indianapolis, IN 46220

Just ask for the IndySec table. Email me if you plan to come so we can get the correct table size, please. moore.steve (a t) gmail

IndySec Metasploit Unleashed Charity Event Registration

What is the event?
See this page for more information.

How do I register for the event?
First, you need to donate $30 (or more) to Johnny's food program. This can be done in one of two places--the previous link or at the "Donate Here" page of the Metasploit Unleashed web site.

While not required, we would prefer that you use "http://indysec.blogspot.com" as the URL and "IndySec-YourFirstName" as your link text as shown below (click image for higher resolution):



Why put IndySec-YourFirstName in there? Because if you check out the "Donor Cloud" on the food program page, we can flood it with IndySec. Our original plan was to all use "IndySec" and make our name really big, but the Donor Cloud is not that advanced--it just updates the date and doesn't add up the donations. Boooo.

Anyway, clicking on the "Donate" button will take you to the following PayPal page. Simply log in or create a PayPal account to complete the transaction.



The confirmation page should look similar to this:



Next, click on the "View Printable Receipt" link which will present you with the following screen.



Print this page and take it with you to the event for your donation verification. Just save your PayPal email receipt in case you forget the printed confirmation.

After making your donation, please RSVP for the IndySec event by filling out the following form:

SORRY, REGISTRATION HAS BEEN CLOSED FOR THIS EVENT

IndySec Meeting 10/15

Hello All,

Join us for a shared IndySec and "Informal InfoSec Group" gathering.

I hope you can make the trek to 146th and Meridian to The Fox and the Hound. Things will start around 5:30.

There should be some very interesting people in attendance. This is a social event.

Thank you,
Steve

IndySec Meeting 9/17

We turn 3 at the Claddagh!

Claddagh Irish Pub
3835 E 96th St
Indianapolis, IN 46240
Time: 6ish pm



Ask the greeter for the IndySec table. If you would, please send an email if you plan to attend.

MSF update: The the full version should be ready by the end of this month. If all goes well, plan on our MSF event mid to late Oct.
Additional information here

Thank you,
Steve

Updates!

First, IndySec turns 3 this month! Thank you.

Thank you to everyone who was able to attend our last meeting. Where else could you find a BA lock picker from Bloomington, a Chinese malware expert, and a defcon speaker? Yeah, all IndySecticons.
Good times.

Lastly, I've still not heard anything further from Muts on the MSF charity event. As soon as I hear something I will pass it along. I have been amazed at the interest and the offers to volunteer - Thank you. We already have a location selected and some sponsorship lined up as well! Stay tuned.

IndySec 8/20

Back at the Claddagh this Thursday.

Ask the greeter for the IndySec table. Please send an email if you plan to attend.

Claddagh Irish Pub
3835 E 96th St
Indianapolis, IN 46240
Time: 6:00 pm

FYI - this is obliviously not the MSF event. We are still working out the details.

Thank you,
Steve

Metasploit Unleashed Training + Hackers for Charity + IndySec

It's coming....

Still working out the details, but we are planning on live event in Indy to benefit Hackers for Charity. My goal is to take the asynchronous training below and merge it with a live, community-based event.

With a charitable donation you will receive;

• world class training covering the Metasploit Framework from Offensive Security
• a Saturday of learning with your peers
• a networking opportunity
• a live attack lab with volunteers (who actually do this stuff)
  
• a sense of community
  

......... and you'll be helping Johnny's life-saving mission.

I am working with Muts for some additional information.
Proud to say a local business has already donated lab space!

Email me if you are interested.

July IndySec Canceled

Due to travel, illness, and scheduling issues there will be no IndySec meeting tonight.

See you after DEFCON.

IndySec Cookout

What: IndySec Cookout
When: Friday June 19th @ 6:00PM
Where: Lando's Place
Reply to cookout .at. landonix.com for location. Carpool when possible.

Events:
Lockpick village plus related gifts
Hack a box (virtual machine with multiple vulns, potential dog and pony of commercial exploit frameworks)
HTPC setups

Feel free to present on anything security/technology related

Seating:
Please bring a folding chair/lawn chair or something to sit upon.

What to bring (technical):
Portable storage device / laptop

What to bring (non_technical):
We would appreciate each person to bring a side dish, beer, chips, firetruck, or goat

Remember, Landon does not care about your dietary needs.
Thursday IndySec is canceled.

Cookout will be Friday June 19th @ 6:00PM

Friday won!

Landon will provide more details. . . more to come.

Vote!

It's cookout time.

Please vote for your preferred day and join us for the IndySec summer cookout.

Thanks,
Steve

IndySec 5/21

IndySec is this Thursday!

Time: 6:00ish
Location: The Broad Ripple Brewpub
842 E 65th St
Indianapolis, IN 46220

Look for the orange Shmooball or just ask for the IndySec table.










Note: The cookout has been postponed until June. More info on the way.

Thanks,
Steve

IndySec 4/16

IndySec,

Back at the Claddagh this Thursday.

Ask the greeter for the IndySec table. Please comment to the blog if you plan to attend.

Claddagh Irish Pub
3835 E 96th St
Indianapolis, IN 46240

See you around 6:00ish. No speaker this month, just a social night.

Cheers,
Steve

Malware Tools

Here are links to the tools that I talked about. Thanks to everyone who came and thanks to Bluelock once again for hosting.

Reverse Engineering Malware Cheat Sheet
http://www.zeltser.com/reverse-malware/reverse-malware-cheat-sheet.html

Ollydbg
http://www.ollydbg.de/

Ollydump to find OEP and dump process from memory
http://www.openrce.org/downloads/details/108/OllyDump

Hide from IsDebuggerPresent in Ollydbg:
http://www.openrce.org/downloads/details/111/IsDebuggerPresent

upx
http://upx.sourceforge.net/

un_fsg
http://programmerstools.org/node/208

PEiD
http://www.peid.info/

PEiD plug-ins
http://www.peid.info/BobSoft/Plugins.html

Volatility
https://www.volatilesystems.com/default/volatility

Volatility plug-ins
http://www.forensicswiki.org/wiki/List_of_Volatility_Plugins

Mantech Memory Dump
http://sourceforge.net/project/showfiles.php?group_id=228865

HB Gary Fast Dump
http://www.hbgary.com/products-services/fastdump-pro/

March IndySec

March IndySec time!

Brian Carter will be presenting "Unpacking Malware, tools and techniques for analyzing encrypted and compressed malicious binaries."

The March IndySec will be hosted at the Bluelock data center. The facility is topnotch and includes a training area --- perfect for our event.

Date 3/18 (Wednesday, not the usual Thursday)
Time 6:30 PM
Location 6325 Morenci Tr. Indianapolis, IN 46268 Google map here.
Food We will order pizza after everyone arrives.

We have a great speaker at a great location - see you there.

-Steve

March IndySec Firetalks

March 19th is the next IndySec! 

For March, we would like to do a series of quick "fire talks" at the next IndySec. The idea has been adapted from the 09 podcasters meetup at Shmoocon. Information, credit, and proper description here.



What is a Firetalk?

“FireTalks” is a supportive environment in which to either share insights or learn from others. Whether polishing a presentation (story) for conferences, meetings or training, firetalks are the way to share, learn and improve.

Talks are generally 10-15 minutes. Anyone may submit a talk. If you need help or have questions, please email me at this address :



Also, the February IndySec had around 15 people in attendance. Thanks for the great turnout!  

March will be our 27th IndySec. 

Cheers,
Steve

IndySec (2/19)

IndySec,

We are back at the Claddagh this month (hey, we have $40 to spend in gift cards).

Ask the greeter for the IndySec table. Things will start around 6pm. Please comment to the blog if you plan to attend.

items to discuss
1. Shmoocon recap
2. i am developing a "Practical Security" presentation/class and would like some feedback

Claddagh Irish Pub
3835 E 96th St
Indianapolis, IN 46240

Cheers,
Steve

IndySec next week -- 2/19

IndySec,

In January, team IndySec brought home dinner plate gold at the Claddaugh international games (really just a trivia contest). First prize was $40 in Claddaugh bucks (easily converted to beer). Upon victory, Ed and Brian did a chest bump which was later followed by an extra long man hug.

Question to the list: We have the spoils, do we defend the crown and spend the booty!?

(so, do you want to meet back at the Claddaugh pub @ 96th / Keystone?)  If no, then maybe our next speaker will get the $40 gift card?! 

Shmoocon rocked. See you Thursday, 2/19.

Let me know. Thanks!
Steve

IndySec dinner tonight 1/15

Join us at the Claddagh Irish Pub for the January IndySec dinner.

Ask the greeter for the IndySec table. Things should start around 6pm. Please comment/email if you plan to attend.

Claddagh Irish Pub
3835 E 96th St
Indianapolis, IN 46240

Map here

Cheers,
Steve