Teaching in DC

Ok - just another week teaching Wireless classes - this time in Washington DC - well, actually just out by the Dulles (IAD) airport. I had a total of 30 hours at home (it was sublime and we got to go and watch Ratatouille with all the kids on Saturday - then home for a great meal (thanks Jill)


Well - the classes went well - I did get to go by the famous 'Wegman's Flagship' store, it is a fantastic supermarket - well very upscale supermarket. Jeff from my office has convinced Ryan that this is the 'only' store to buy food at... and we should have one in Utah!

I was able to go into Alexandria on Wednesday evening to have dinner at the 'Charthouse' right on the Potomac - with the guy who we rented space for the WLSAT class earlier in the week.


Friday after class - after packing up all four cases, I was able to get over to IAD to pick up Jill, and timed it so well she was only waiting under a minute when I pulled up!

We drove down through the back-country of Virginia down to Charlottesville, home of UVA - it was an eye-opening drive across beautiful rolling hills of the Appalachia Piedmont area of Central Virginia. Tomorrow... Thomas Jefferson's Monticello.

Home, Arizona, and New Zealand in 48 Hours...

Since we had a Ward Picnic by Timpanogos Temple on Wednesday night - it was very good by the way (check out pics at Karrissa's Blog) - I was unable to get down to an Open Pit Copper Mine outside of Safford Arizona on Wednesday night. So...

Early Thursday morning I drove up to the SLC airport ready to board a US Airways flight to Phoenix at 5:15am (that's getting up WAY EARLY if you ask me) - then the flight was cancelled an I had time in line to ready an entire book (Ranger's Apprentice III) - Then luckily was able to get on a Delta flight at 8:45 to PHX - rent a car, and drive three hours across the Arizona mountains to Safford.

After meeting up with the Phelps Dodge mine engineers and getting dressed in Steel-Toed Boots, Bright Orange Vest, Hard Hat, and Safety Glasses - drove out into the dessert to conduct an RF Site Survey of a new mine location. (this was a gig with Todd Lammle) - The temperature in the truck while doing the survey showed 124 degrees (51C) - now that is pretty hot!

Got back in the car and drove the 3 hours back into Phoenix to spend the night in an Airport Hotel ready for a 6:00am flight back to SLC.

Friday Morning - bright and early (yet still over 100 degrees in Phoenix) returned the rental car and flew back to SLC - picked up the Honda Element and drove to work for a couple of hours. Then home to pack for a week in NZ and then Jill was nice enough to drive me back to that wretched Airport for a United flight to LAX.

Arriving in LAX I was forced to transfer over to the International Terminal (a story in itself) and at the Air New Zealand counter found that United's computer glitch had deleted my flight record. After a couple of hours on the phone, fighting with the staff, etc... I was finally on a late night (1:00am) flight to Auckland... fast forward 13 hours later. (wasn't that easy... just say fast forward and it all disappears)

I took a taxi to the Bed & Breakfast on Ponsonby Road just outside the Central Business District of Auckland at a place called Amitees. I've stayed her before and it's a nice, albeit small, little place to stay. Though it is very close to walk from here to the venue where I'm teaching.

One night after class I decided to try out the Fish and Chips at "Aucklands Best" - you choose the actual fish fillets from an assortment on ice in the store window - then they battered and fried them up for you on the spot. I have to admit - it was very good! I chose an Orange Roughy - not something I would have thought would make good fish and chips - but it came highly recommended. They wrapped it up in the standard newspaper way. I was amazed on how delightful it was - hot, crispy, yet NO STAIN from any excess oil on the newspaper. Amazing.

Here's some of the new fruits I saw on the way to class yesterday. It's the middle of winter here - like Seattle winters - cold, rainy, and grey.

Well, a couple more days and I get to come home! - Yea!

Yech!

Waiting for a delayed flight home from JFK to SLC I noticed a lady with REALLY LONG FINGERNAILS waiting by me... So I took a couple of pictures.



It seems like she is the World Record Holder for the longest fingernails.

How does she do anything at all? Someone has to help her eat, get dressed, wipe, everything - 27 years just to get in the record books... Sheez! Get a life!

http://articles.news.aol.com/news/_a/woman-has-longest-fingernails-in-world/20060928142809990002

I routinely see different celebrities on my travels - even had Steve Young sit next to me on a flight to NYC... but I try to follow the First Class Etiquette rule and don't talk... but I did listen in on this lady telling another passenger how many many Men have 'come on' to her thinking these fingernails were VERY SEXY... yech!

Apple Store...

I decided to do something fun after class today - straight from class I took a subway up to Central Park and walked around a bit, then headed over to the Apple store on 5th Avenue. The store is actually all underground, with a central atrium made of glass. The glass cube above ground is all you see. The glass cube on top has a spiral staircase going down to the store, and in the center is an amazing glass elevator... all the walls, ceiling, doors, of the elevator are made of glass. Way cool...


The store was amazingly crowded with hundreds of people milling around, working on computers, buying stuff, or asking the Mac gurus questions at the 'Genius Bar' - They didn't have the little cables that I was looking for... so I took another subway down to J&R Computer World down by the 'Twin Towers' area.

It was a nice extra diversion before getting some dinner and heading back to the hotel room.

Jill's gone... boo hoo...

Well, today Jill and I ate breakfast in the Hotel buffet thing... then took a subway over to the NYC Manhattan 1st Ward for their sacrament meeting. We got there with plenty of time to spare... about 5 minutes. We stood on the wrong platform, the one with the route 1 sign, but on this particular Sunday, the 1 line was on the express platform... after a bit of confusion we got 'er figured out and on our way.

After church we took another subway to Times Square then the Shuttle over to Grand Central Station, then a train ride North to Tuckahoe. Jill's fee were 'killing her' since she has these 'church shoes' that for Orem work fine. Jump in a car, drive to church, walk in church, then drive home. But here in Manhattan, it was walking to the Subway, up/down stairs, back to the Subway, between trains, and then finally the walk from the Tuckahoe Train Station to Laura's house... a bit too much on 'Church Shoes'

We had a nice visit with Laura, Alan and the kids. Of course I liked playing with the kids - isn't that what Uncles are for? Though I miss getting in on the adult discussions. Laura had a nice lunch prepared for us (thanks Laura!) then Alan was nice enough to drive us back to the Train Station. Alan had just come home and we got to talk a bit about his trip to Madrid. And see the great gift he brought back for Connor, not only was it a full Real Madrid soccer outfit, but was signed by David Beckham himself!

I thought it'd be easier for Jill's feet to catch a cab from Grand Central back to the hotel, even though it was only two stops or so on the subway - but the Taxi was stuck in traffic, something about a couple of street fairs going on today. But we made it back, and got Jill and her stuff packed and on her way to the Airport in time. (I heard from her via cell phone from the Gate)

I then got to spend an enjoyable (not) two hours in a very hot muggy laundrymat to get my clothes ready for next week. (I just can't seem to allow myself to pay a hotel some $100 or so to wash a week's worth of clothes!)

Next week... another week of teaching AirMagnet here in NYC.

Manhattan - AirMagnet & Jill

Well, I arrived ok at LGA and took a taxi in to the LaQuinta hotel on West 32nd - right by Greeley Square.

Woke up early and took a cab down to the venue - the Mason's Grand Lodge of Manhattan - 131 West 23rd - but the building is being rented by the New York Convention Center. We had 8 student packed into a room made for barely 7 - but the Advanced Site Survey and WLAN Design class went very well indeed. I walked back to the hotel and waited for Jill to arrive on her flight to JFK - she got in about 1 am.

I taught the second day while Jill was working on a final assignment of writing a variety of papers for one of her nursing classes all day. We walk around the area and ate at a grill in the first floor of the Empire State Building - our table was right next to one of the brick posts that hold up that awesome building. On the way back to the Hotel Jill found an H&M store and we HAD TO stop and do some shopping... Then some Korean Yogurt (it was way to tart and yogurty for me)

Today we went for MORE shopping - but this time I brought along an Anne Perry mystery and sat by a table in Greeley Square and waited while Jill shopped.

Then off to the Gershwin Theater for 'Wicked' !! The show was great - everything I'd heard and more. Very enjoyable - we had pretty decent seats in the middle section about 18 rows up.

Then a early dinner at Applebees... yes I know we could get Applebees in Utah... but it was raining at the time we got out of the Matinee and it was the closest place.

Then back to the hotel for Jill to change her shoes, then two more hours of shopping at H&M - I finished an entire novel in the time Jill spent shopping! But it is a joy for her to get stuff for her kids.

Tomorrow we'll go to Church at the Manhattan Ward (where the Temple is) and then catch the train up to Tuckahoe to spend a couple of hours with Laura, Alan, and the kids before taking Jill back to JFK for her flight home.

Florida State University - Tallahassee

Three days of Wireless Consulting for Florida State University in Tallahassee. Worked with their IT department on doing Site Surveys and analysis of their Wireless LAN infrastructure. The campus has over 45,000 students and 12,000 employees all in a city of only 120,000 - pretty much a college town. Well that, and it is the State Capitol.

These folks are mighty proud of their Football and Basketball teams - Go Noles!

The buildings are all made of brick - lots and lots of brick - The place is huge!

Off to NYC on a delayed flight - Tallahassee --> Tampa --> NYC - arriving at LGA at 1:30am and have to teach at 8:00am... whew!

Review of Nokia N800 for Wireless LANs

Bruce asked if I'd write up a review of my experiences with the Nokia N800 - here you go...

Earlier this year Nokia released an updated version of their popular Nokia N770 Internet Tablet. The N800 excels at being a small, light-weight, device capable of WiFi as well as Bluetooth access to the Internet.

I could go on an on about how this little device has changed how we access the Internet in our home. Instead of lugging around laptops, we have a couple of N800s that the kids access for Internet queries, (just what High School did ‘King James’ go to – while watching the playoffs), to googling, to streaming music, conducting mulit-user IM sessions, to just about anything you’d want to use the Internet for – but in a very small package.

The screen resolution is amazing! If the iPhone has this screen, I’ll be in line to buy one. Even though I’m so old now I have to use bi-focals to read the small stuff – I’m comfortable with the N800’s little screen – the resolution makes it possible to fit so much in a little package.

But for the interest of this Blog I’ll move on to the use of the N800 in a wireless analysis mode.

I saw an announcement for a new piece of wireless security gear – called a Silica. This software/hardware bundle puts the intelligent penetration attacks and exploits of Immunity’s Canvas software in a small Nokia. It looked WAY COOL and I *wanted* to have one. But the $3,600 cost felt a bit prohibitive.

I’ve since had a chance to play with a Silica – and was suitably impressed – I still haven’t parted with the $3,600 but here’s a bit of a review of the tool.

This is a customized version of the Canvas tool – shoehorned into this small form-factor Linux device (Nokia N800) It is VERY easy to use. Just turn it on and click the start scan…

It will run through a series of scans of the local wireless networks, then attempt to penetrate using a variety of currently known exploits to find and exploit holes in your wireless LAN. It’s like having a little team of hackers sitting in you hand.

I’ve found it to be easy to run with the Nokia in your pocket. Very unobtrusive! – but in reality it takes up to 20-25 minutes to do a full attack against a single AP. Not like while doing a real penetration test you’ll have an excuse to ‘hang around’ a specific area waiting for the attack to finish. (Though you could easily hide the device and come back to pick it up later – but that $3,600 cost will probably make you think twice about leaving it outside of your view)

The reports it gives are in HTML format – you can just e-mail them to yourself, or copy them off onto the SD cards used by the N800

It does a pretty cool thing when attacking a MAC-Filtered AP – it automatically finds an associated STA and spoofs it MAC address to get associated.

It doesn’t do ANY WEP Cracking or WPA cracking, or anything but the exploits that are in Canvas.

Ok, now for the less expensive, yet still fun stuff using a Nokia N800. As part of our Wireless LAN Security Assessment Toolkit course development. We came across the N800s, fell in love with them, then re-arranged and re-wrote many of our course lab exercises to specifically use the N800s. We added wVoIP, video over IP, as well as catching IM traffic, web browsing, and other conversations sent over wireless to use the N800 as our client of choice when ‘watching’ the open Wireless LANs and re-constructing conversations via packet capture.

Then we thought, “is there anything more we can use the N800s for”?

Since the N800 is just a little Linux computer… we added SSH, Terminal Shell, VNC, FTP, etc. to the system. Then once we got that running, it was a quick couple of steps to get Kismet and Metasploit running!

So just using Open Source software we were able to take the little $400 Nokia N800 and make it ‘like’ a Silica!

Just slip this little ‘bad boy’ in your pocket running kismet and go WarWalking to get all the APs in your area, including finding ‘hidden’ SSIDs. Or, start Metasploit and let ‘r rip – attempting whatever known exploits are available for Metasploit.

(By the way – this is NOT a fast device for Metasploit – but Way Cool to have running)

On the other hand – it makes a great Kismet platform!

We’ve got ours running the classroom with GoogleTalk and Gizmo Project for wVoIP and IM – but you have to have a Wifi access to use it, so this wont’ take the place of your cell phone. (It is possible to pair this device via Bluetooth to a cell phone running G3 speeds – but the easy way is with Wifi)

One more thing that is just *fun* to use the Nokia N800 and Wireless LANs – and I found this out by accident. I was testing in our offices a new access point – so I had the N800 associate to this new AP and started a ‘Hitcast’ session listening to some Internet Radio station. I kind of liked the station and so put the ‘radio’ in my pocket so I could have some tunes with me as I finished up writing up the analysis of this new AP. I checked my watch and realized the mail would have arrived, so I went out to the mailbox – down a long flight of stairs, outside the steel-sided building my office is in, and across the parking lot to the community mailbox to check the mail.

It wasn’t until I was heading back up the stairs and a co-worker commented on my choice of music that I noticed this little wonder continued to stream music the entire way. Thus was born the Audio Site Survey! Just associate, then walk till the music drops… Simple easy and leaves your hands free to work on other things while doing a fairly decent site survey. Cool!

There you go – a quick review of the Nokia N800 and how one might use it with Wireless LANs – if you want to see more about our Wireless LAN Security Assessment Toolkit class, check it out over at www.hotlabs.org/wlsat - as part of Bruce’s Blog you can use the discount code ‘Bruce1071’ to get $1,500 off the class.

Enjoy!

Keith Parsons - Managing Director

Institute for Network Professionals

Editing & Penetration Testing Certification

So right after Sunday School, back to the airport for a series of planes and rental cars getting me to the hotel in Myrtle Beach SC around 3:30am on Monday.

The conference was held at the Myrtle Beach Marriott... nice hotel...

But I got to stay instead at the Fairfield Inn...

The TechnoSecurity conference started on Monday morning - I sat in only one session on Monday, and one session on Tuesday - the rest of the time I was in the hotel room doing testing and editing on the WLSAT course student materials - to make sure the instructions worked on the hardware. Also doing some extra additional labs and adding screen-shots where necessary.

Then on Wed/Thur spent my time 13 hours on Wed sitting in on an ECSA/LPT course - this is high level security assessments and vulnerablity scans... (Ethical Hacking) then another 8 hours on Thur - followed by a 2-hour certification exam. I passed! Yea! So with that one exam (and an FBI character check, passing three other exams, and studying over 1200 pages of text...) I received the Licensed Penetration Tester certification.

I never thought of the title, in the IT industry you hire people to do Penetration Tests all the time, it's the standard way of 'proving' you have strong security and that hackers can't break through your perimeter... but when I mentioned it to Jill on the phone... she started to giggle. I guess it has other conotations...

Karrissa put up a 'joke' sign for me when I came in late Thursday night - the whole family is so proud of my License to do Penetration Testing...

Brent's Graduation - Honeywell

After a quick flight back from Baltimore after the Lacrosse Finals - What a finish!

A day at work, then we had a great day watching Brent's High School Graduation. Karrissa's got the pictures from the Graduation. Then right back on a flight later that afternoon to head back east once again. This time to Ft. Washington PA - about an hour north of Philadelphia.

This was a custom wireless training for the Honeywell folks who install a variety of meters and sensors for the oil refinery and tank farm business. It was great to work with some folks who've been out in the field installing real stuff in hard-core locations. I learned a lot about the hazardous materials handling needs and outdoor wireless equipment.

A quick three-day (Th-Sa) class then back to Orem Saturday night so I could come back and teach Sunday School...

Baltimore - NCAA Lacrosse - Div III and II Championships

After walking nearly 2 miles in 90 degree weather (near 100% humidity) over to the stadium (M&T Bank Stadium where the Baltimore Ravens play) we got to find some nice seats in a bit of shade to watch the first lacrosse game. NCAA Division III - and I've since learned to be in the Division III the student can NOT have any form of scholarship for athlete players. Div II allows for some types of financial aid, but NOT scholarships, and Div I gets to spend the big $$ for student athletes.

Well of course before the start of the game there had to be a singer out there with her own rendition of the Star Spangled Banner. Good voice, country TWANG, and she just couldn't sing the regular notes and had to 'spice it up' - I like the good old-fashion song. I did especially enjoy the words and story behind the song. Being that we were within 2 miles or so of the actual Fort McHenry the song is about. The original poem by Francis Scott Key was initially entitled 'In Defense of Ft. McHenry'. So it had special meaning to me to be able to be here and remember those sacrifices for our country on this special Memorial Day weekend.

We did get to see this original flag that flew over Ft. McHenry
that fateful day back on September 20th, 1814 during the War of 1812
while on a family vacation to Washington DC a few years ago.

Then on to the games - the Div III teams played great Lacrosse, a real joy to watch and see what good teams and individuals can do. Salisbury defeated Cortland State, 15-9 We sat kind of high up in the stands and had a nice view to see how plays and slides moved across the field. Later we went down near the field for a closer look - it was much more like our High School games then.

The second game was a disappointing, boring defensive game nearly 50 shots on goal between both teams and a final score of 6 to 5. (the last score came as an accident when a pass missed it's intended target and sneaked into the goal with 1 second on the clock) Yes - I know that sounds exciting, but even that couldn't make that game better. Le Moyne, edging out Mercyhurst 6-5

Tomorrow will be the Division I title match between Duke and Johns Hopkins - it should be a great match.

I have photos to prove we were there - mine's a bit out of focus, but the sign behind me is in focus. Don't the boys look like they are having fun!!?

Lots of photographers down on the field - but this guy was right up behind me with a 6-shot- per-second camera - I turned around to look at who had the fast camera and this is what I saw...

Baltimore with Brent for NCAA Lacrosse Finals

After getting up at 4:30am to catch a 6:00am flight - I spent the day on planes and airports getting to Baltimore. After checking into the "Lord Baltimore Radisson" and getting a very small room behind the frieght eleveator... I was able to meet up the Brent, Michael Rife, Jake Ferrin and his parents for a nice dinner at the Cheesecake Factory on Baltimore's Inner Harbor. It was very crowded downtown Baltimore last night. The hotel was full of Lacrosse Fans.



Today we'll be heading over to the M&T Stadium where the Raven's play to watch some more Lacrosse (NCAA Division 2 and 3 Championship games) Then Tomorrow is the Division 1 championship game between Duke and Johns Hopkins. Last night the boys bought team logo'd lacrosse shirts and shorts.

It is in the 90s with near 100% humidity... I'm so looking forward to sitting in the sun all day! But the games should be good and I'll enjoy being with Brent and his friends.

Orange County - Class and Jazz

This week's visit was to Orange County - Southern California. I taught for 5 days a set of AirMagnet classes at the Hilton across the street from the John Wayne Airport in Irvine.



Yep - just week of work.

Then since I was flying out on Saturday to Baltimore to meet up with Brent and friends for the NCAA Lacrosse finals... I had an evening free. I went over to Barry & Donna's for dinner... great pork ribs (slathered in my special BBQ sauce - but since they are now 'out' I'm going to have to make another 2007 batch soon)



Then we went to a local Jazz club called 'Steamers' - though it was very hot, very crowded, and had a rude waitress... the Music was great! The lead singer was phenomenal, the supporting instrumentalist inspired and it was a great night out with friends. I think I'm going to have to pick up a CD from Jackie Ryan - I liked her style.



CD Pre-Release for "You and The Night and The Music"
A special evening with the incredible trio that played on the CD: Tamir Hendelman piano, Christoph Luty bass and Jeff Hamilton on drums. Plus special guest, Rickey Woodard on tenor sax.

First WLSAT Class in DC

After a mad rush to finish up the labs, print the student binders, and make all the student kits... we finally held our first new class. Called Wireless LAN Security Assessment Toolkit - WLSAT in Washington DC last week.

We had all four course developers there to teach the specific labs they had written, and so we could use this opportunity as a 'Train the Trainer' to get cross-trained on the items we personally didn't write.

I flew into Baltimore with Jeff and Mark on Sunday. We stopped at IHOP #551 - a terrible choice for a place to eat - the corn tasted of soap, the food was cold, the service atrocious, it was just terrible.

We had 14 students at this first session - all had a great time playing with and learning on their student kits. The Nokia N800 little tablet computers were a hit!

The course flowed much better than I could have anticipated. Yes, we have a bunch of little edits to make, and additional steps to put in different labs, but overall "two thumbs up"!

Not a Road Warrior Week

Ok... I wasn't a road warrior this week. Stayed at home all week working on the course development for our new Wireless LAN Security Assessment Toolkit class. We only have one more week before the first class and we still have LOTS to do.

The class has over 45 hands-on lab exercises and comes with over $13,000 worth of software and hardware. Ryan's been working on inventory and binder cover pages, Karrissa on editing all of our lab exercises, and me ordering up all the stuff for the first couple of classes as well as writing more lab exercises.

I did a new lab exercise on WarDriving... that is driving around with a GPS and a Wireless Card tracking where everyone's Wireless Access Points are located - then putting it on Google Earth... see below.

One more week at home working on this class, then I start a 7-week road trip (home for weekends mostly)