Day two at BSidesSF was a bit more mellow, and less hectic than day one. The crowd slowly started dwindleing down as some attendees likely made their way to RSA. Regardless, today’s sessions did not dissappoint, and there was a lot to learn from the experts on stage.Below are a few short summaries on some of the sessions I attended, including the fun visuals created by our sponsored artist Sunny from Kingman Ink.Also, many of the speakers have shared their slides online, and videos of the talks are expected to be posted soon.Digital Intelligence Gathering: Using the Powers of OSINT for Both Blue and Red TeamsSpeaker: Ethan Dodge (@_eth0)Ethan Dodge, an aspiring malware analyst, kicked off day two demonstrating just how much personal information we make publicly available on the internet – whether it be intentional or not.Leveraging the power of OSINT (open source intelligence), Dodge shared with us a recent experiment he conducted to prove how easy it could be to find sensitive data of a given personIn this case, Dodge explained how he was able to attain a person’s home address; her class locations; an unsalted hash (which he was able to crack); her close friends; job history; home IP address; and date of birth.The majority of this information was gathered from her posts on social media, including Twitter, Instagram, LinkedIn, Facebook, Reddit, as well as her Etsy page and from Have I Been Pwned?Dodge concluded by going through several possible use cases for OSINT, noting that for blue teams, OSINT could definitely help with training users to protect themselves against social engineering attacks. He also recommended companies monitor the most active employees online more closely.
Sweet Security: Deploying a Defensive Raspberry Piby Travis Smith (@MrTrav)Travis Smith, a senior security researcher at Tripwire, reflected on the difficulty of securing the Internet of Things (IoT).He observed that IoT devices are often shipped with out-of-date operating systems and unmaintained, vulnerable code. It is also difficult to install security tools onto these devices, he explained.Notwithstanding these difficulties, a variety of open-source and commercial tools can help protect networks that provide access to the Internet of Things. These include:Bro IDSElasticsearch, Logstash, and Kibana