Yesterday (not as on the ball as Rob) at SANSFire

Yesterday (not as on the ball as Rob) at SANSFire
Last night I presented a series of tips and gotchas whilst setting up a home lab for Malware and Packet collection. Packet and Malware Collection for the Home Network, Research Starts at Home! - Richard Porter, ISC Handler - Wednesday, July 11 * 8:15pm - 9:15pm If you are just getting started in the Information Security Field, or want to practice your packetFu or MalwareFu? A place to start is on the home network! Often at a SANS Conference you will hear the Instructors, Faculty or even the Handlers reply with "Get Written Permission!" With that, you have permission on a network you own. This talk will go over setup, tools, pit-falls and things to be aware of for the home network. This discussion is a useful addition to both Security 503: Intrusion Detection In-Depth and Forensics 610: Reverse Engineering Malware. It was well attended, and thanks for all the kind words. There were so many requests for my presentation and tips that when we recover from SANSFire, I will write another diary on more hints and tips but here are a couple: 1 - Roomate/Spouse/KId Alerting: Let them know you will be capturing traffic (Or not ) 2 - Power: Check power where your lab is, your home wiring may be in series [1] [1] http://en.wikipedia.org/wiki/Electrical_wiring @packetalien - Twitter And thanks again for all those who attended. Check back for more tips about running a lab at home (along with the Dionaea Virtual machine, when it is more stable.) From SANSfire 2012, signing off!	Richard 167 Posts ISC Handler
Subscribe	Jul 13th 2012 7 years ago
Home electrical circuits aren't wired in series - our devices are designed to run with a consistent AC voltage and a current that varies on demand. Outlets on a series circuit would have a very variable voltage. Two 120 V light bulbs in series on a 120 V circuit would be (approximately) half their intended brightness. Home wiring is done in parallel. I think you intended to recommend that people not overload their circuit breakers. Watch how much current you draw through one pair of wires. Circuit breakers are designed to break a circuit before your wires get overloaded. If you put things like powerbars, extra outlets, and surge protectors in the circuit, sometimes you introduce a point of failure lower than that which the home's breaker was designed to protect against.	Anonymous
Quote	Jul 13th 2012 7 years ago
@karl Thank you for the clarification, and pointing out the details. That is exactly what I meant and will update the diary.	Richard 167 Posts ISC Handler
Quote	Jul 13th 2012 7 years ago
Yeah, I suspect instead of "in series" he meant that home wiring is often daisy-chained from outlet to outlet. This is really common practice, at least in US residential construction. It leads to very strange symptoms when the neutral becomes open at an outlet early in the chain.	Anonymous
Quote	Jul 13th 2012 7 years ago

Last night I presented a series of tips and gotchas whilst setting up a home lab for Malware and Packet collection.

Packet and Malware Collection for the Home Network, Research Starts at Home!

- Richard Porter, ISC Handler
- Wednesday, July 11 * 8:15pm - 9:15pm

If you are just getting started in the Information Security Field, or want to practice your packetFu or MalwareFu? A place to start is on the home network! Often at a SANS Conference you will hear the Instructors, Faculty or even the Handlers reply with "Get Written Permission!" With that, you have permission on a network you own. This talk will go over setup, tools, pit-falls and things to be aware of for the home network. This discussion is a useful addition to both Security 503: Intrusion Detection In-Depth and Forensics 610: Reverse Engineering Malware.

It was well attended, and thanks for all the kind words. There were so many requests for my presentation and tips that when we recover from SANSFire, I will write another diary on more hints and tips but here are a couple:

1 - Roomate/Spouse/KId Alerting: Let them know you will be capturing traffic (Or not )

2 - Power: Check power where your lab is, your home wiring may be in series [1]

[1] http://en.wikipedia.org/wiki/Electrical_wiring

@packetalien - Twitter

And thanks again for all those who attended. Check back for more tips about running a lab at home (along with the Dionaea Virtual machine, when it is more stable.)

From SANSfire 2012, signing off!

Richard

167 Posts
ISC Handler

Home electrical circuits aren't wired in series - our devices are designed to run with a consistent AC voltage and a current that varies on demand. Outlets on a series circuit would have a very variable voltage. Two 120 V light bulbs in series on a 120 V circuit would be (approximately) half their intended brightness.

Home wiring is done in parallel.

I think you intended to recommend that people not overload their circuit breakers. Watch how much current you draw through one pair of wires. Circuit breakers are designed to break a circuit before your wires get overloaded. If you put things like powerbars, extra outlets, and surge protectors in the circuit, sometimes you introduce a point of failure lower than that which the home's breaker was designed to protect against.

Anonymous

@karl Thank you for the clarification, and pointing out the details.

That is exactly what I meant and will update the diary.

Richard

167 Posts
ISC Handler

Yeah, I suspect instead of "in series" he meant that home wiring is often daisy-chained from outlet to outlet. This is really common practice, at least in US residential construction. It leads to very strange symptoms when the neutral becomes open at an outlet early in the chain.

Anonymous