Some big news that came out this past week was the fact that Microsoft is monitoring Skype conversations to some extent.  This was verified by Jurgen Schmidt in a recent article from “The H Security.”

I’m assuming this may have been done by Microsoft to better position themselves in case of any government requests for data.  I understand the reasoning, but was disappointed to hear about it nonetheless.

Well, the good news is that we do not have to use Skype.  I feel this was a good wake up call to be more aware of encrypted communications.  We didn’t think too much of this before the recent Skype news, but rather trusted that the encryption was still in place.

A fellow WNC InfoSec member recently brought to my attention ‘Off The Record’ (OTR) and it’s available use with Pidgin and Google Talk.  OTR allows for encryption, authentication, deniability and perfect forward secrecy in case your key is compromised.  This all seemed great and I thought I had found a viable alternative to Skype.

Unfortunately, Google recently  announced they will be moving away from XMPP and transitioning to their Google Hangouts platform for instant messaging.  This will undoubtedly break the OTR capabilities in Pidgin/Adium, in my opinion.

Now what??

Well, the same WNC InfoSec member who educated me on OTR also passed along some info on Jitsi.  Utilizing the ZRTP encryption protocol, Jitsi offers an open source solution to VOIP communication.  You can check out more features here.

Looking forward to testing out Jitsi further and seeing if it can be a reliable/secure form of communication.  I am also very interested in hearing your experiences with secure alternatives to Skype, so please leave a comment below!

 

I came across a “tcpdump > wireshark” video from Hack3rCon 2010.  Kenneth Scott, a.k.a. pwrcycle, goes through an excellent primer for tcpdump and shows off his ridiculous “screen” ninja skills.  Check it out if you haven’t seen it already.

After watching this video and having my mind blown, I asked why have I not been to securitytube.net before?!?!  I was amazed that a resource like this even existed and I wanted more of it!

This lead me to start digging into their “Megaprimers” section.  Topics include: Metasploit Framework, Exploit Research, Windows/Linux Assembly, Buffer Overflows, etc.

I have just started the Linux Assembly Megaprimer and am loving it so far.  The videos are easy to digest and follow, while beginner to intermediate concepts are taught along the way.  *Please note that this is one of the three recommended primers to view before moving on to Exploit Research.

I am coming to find that I really enjoy learning about exploit development,   so I signed up for an Intro to Exploit Development workshop next week.  I feel more confident having been able to get a head start on some of the concepts that will be covered, thanks to SecurityTube!

So if you haven’t visited, what are you waiting for?!  Go check them out now and start increasing that skill-set.  🙂