Go ahead and give everybody a little background because there's a lot of similarities and some of the registry-based things and the same methods of attack. So let's start off with the old stuff. My favorite and common attacks in Windows are what we call keying. You have somebody who leaves an open share, you get read access to a drive. When you read the drive, all you need is a user and system.dat file. You can use a program on my web page called regraper to turn that into a .reg file. From there, let's say your victim has Netscape mail, how many of you use it? They've given you a cast password because you've said, sure enough, clicked on remember my password. So most people think, you know, let's try to crack it. Let's go ahead and disassemble it, try to break the encryption. It's like peeing up a rope. It's real simple. You export the key. You then copy the key over to your box, put it in safe preferences, set up a fake mail server, mount it across, snake the packet, your authentication will be in clear text. Same thing with online accounts, Gino, private VPNs, all of it is cached in Windows 2000 as well. All you need is read access to the registry. I'm going to move right along to shares, we have a brief overview. We have file print and sharing. A lot of people still leave it enabled. The biggest myth in NT and 2K security, people think because they remove net buoy that they're not vulnerable. They don't understand this. What we have called the net bias helper is when you have a little blue hand in a nutshell, you're sharing. No matter what protocols you think you may or may not have installed. And I'd say the most common problem with Windows is the fact that people don't know how to secure these. They don't know how to password or share. And especially within T, people have moved more and more away from a secure domain model and using things like file and print servers.  Half of them sharing their MP3s or their entire C drives, giving you, as I previously mentioned, read access to everything. I call this the cum-sodomize-me attitude towards security. Now, people think even when they're passworded, it's still not that secure.  So it's going to break outlook and everything else. We don't have to work and make a secure domain model. We just want to mesh where everybody can sort of grab what they want. I love that attitude. It's great. I'm glad I'm grabbing what I want from their networks as well. But what it comes down to is on the securing side, you need to make sure there is one machine sharing. That would be your file server. Outlook's not going to break if you make people use a secure bloody system. People have gotten way too used to the Microsoft mesh. They don't remember a lot of the original A plus certs. When they're going through the network training, all the new IT guys these days, they're not looking for what's a secure domain model. They see token ring. They see the topology. Well, what they're looking for is, hey, what's going to pass this test?   And the networks aren't releasing and people going Windows isn't secure. Okay, yeah, granted, all Windows boxes are about as secure as a plus size as model. But when you set up correctly, they can be really highly effective. Then we have the same problem with shares.  And nobody's going to be able to get my information. Oops.  You do an NBT stat. The request goes through 80 and when it replies, NetBow will piggyback over TCPIP and send you the table, stat it right out. The way to obviously fix this or you have the same problem, people will turn off any incoming, 139, 135, 137. Somebody sends in the request. NetBowy makes it easy and very secure route for itself. It makes that route any way it can. So once you've mapped a share of the IPC dollar sign, it's going to send its request or you send any NBT request to sending broadcasting. It's going to piggyback out and send its request over 80. So you've got your NBT table showing a list of shares, work groups, if you want them enumerated users, local log on accounts, land man hashes, what have you. At the point, the firewall is pretty well useless. Next, I'm going to go ahead and move into software updates. That'd be a technology.  The best way to do it is format the box and install it fresh. Because if you install 2K over old NT, you're managing to take all the beautiful, creative, innovative disasters that are in T4.0 and combine them with the instability and lack of support for 2K. That's a beautiful combination if you happen to be working in Redmond, but otherwise it doesn't work down here. To go ahead and bounce back to sharing, when 2K was first released they had a wonderful horrendous bug. You could have admin rights. You could map the admin shares if you were an unauthenticated member of the domain because you could map $C sign across the network until they went ahead and patched that in the pre-releases. But they're not always just as messy. There are other options you can go into and send the protocol, trusted IPs and such. That'd be the best place to lock it down. Personally, I think that nobody should have that on their servers. It should be one file server. You see, one company had a really secure way of transferring files in your office. I think they call it FTP. There is no reason or excuse for a mesh network. Next, I want to go ahead and move into some of the semi-new creative bugs that they managed to carry over from good old NT. Combined with the wonderful great new features of Windows, let's say, for instance, I'm sure a lot of you heard about the Microsoft Outlook vulnerabilities, which allows you to write overwrite local files. Well, a buddy of mine recently reminded me of the NT exploit where you take any executable file, any .exe, or any DLL, or binary file that has executable stream in it. You go ahead and rename it logon.scr. You then use one of our beautiful new Outlook vulnerabilities to write that to the System32 directory. So this works great on servers, too. Logon.scr is a little bouncing screen when you don't hit Control-Alt-Delete when you log in or you have it sitting there. But sure enough, it executes. When your code executes, if you can't write a decent Trojan that doesn't show anything, well, you still got the wonderful thing. By definition, the one time it's going to execute is when they're not at the computer. Personally, I think Outlook should not be left on a 2K system. You can see a lot of people trying to stay on the bleeding edge of technology and deploy 2K before it's been thoroughly tested. And once again, cutting cost corners. I cannot stress this enough. Never install 2K over 4.0. Also one of the newest creative disasters. I'm sure you all have heard of Windows Millennium, the new upgrade to 98 that's coming out. I use upgrade and then lose as possible since the term. Well, Windows 2K is using a lot of the same bastardized ActiveX things and controls, beautiful things like internet connection sharing for private users, things like allowing links. But the biggest is operating system-wide VBS support. And once you can go ahead and remove your Windows scripting host, but I can guarantee you there's going to be at least three or four things in your registry that need that. Yeah, it's a slicker and more effective GUI. The only problem is that, well, you still have VBS as support worldwide. And unlike Windows 98 and NT, it's a lot harder to go through the registry and manually edit out a lot of those keys if any of you guys have wanted around the 2K registry. You have to notice that you try going into the SAM or the Hive keys. After a bloody week, I had to go through and individually set the security permissions. It wouldn't even let the administrator read them. Security through obscurity. And what I was looking at here is that they secured the SAMs. Beautiful. They did not bother doing it for the applications. So anything under HKEY local machine, slash, Microsoft, current version, Windows, and all the installed apps.  They didn't add the extra security there. The only area you have to worry about when doing a redjet it is using redjet at 32 and having locked out and bastardized binary values that you can't touch without going every single key by hand undoing them. Now the structure of the secure keys. The secure and supposedly uneditable. They're only system ones. Where the SAMs and the user names and log onto stored. I'll go into that in a second but I want to reiterate the fact that it doesn't matter because if you've left sharing on it, you're letting it by us and it will help run. You can enumerate those with any cookbook script and get it full in about maybe two minutes. Three if you stop for a beer. I was looking through these keys and they had a very simple structure. Let's say you have user names, administrator, guest, victim, whatever. You have these three named accounts. You unlock the keys. You'll say administrator, guest, victim. And you'll see that there's an entry with each of them blank. I was looking at this hive structure and right above them under a different key. One of the HE SAMs is the exact same number of keys as the number of accounts on the machine where the simple garbage cash string is the names. And under those another seven and so on. Those keys are not really a target rich environment. All that and seven and that time to play with them yet. But the biggest problem with this is that people think because of all the new security features, when 2K is going to be locked down tight. People, you know, because it's faster and they've added all these new patches. Ooh, they put out SB6. I'm so excited. And all for a good old 4.0. The only problem is just how long has this been out? By definition, the people who have been training and going through your IT are now working in low level monkey jobs and tech support or mostly your deployment team. Yeah, a lot of them are still just getting to play with 2K. If they're worth their salt, they know how to pirate an MSDN one. Which is out loud. But a lot of them are playing with 2K for the first time. And they see the new network neighborhood interface. They see all these different icons. They see a wonderful attempt by Microsoft to hide all the user settings. And they haven't really gotten the full hang of how to customize it out. But everybody's going to rush into deploying 2K because well, it's the cutting edge of technology. And Windows NT is no longer going to release any service packs. Funny coincidence. There's no more service packs for NT. 2K is out and then all of a sudden a great slew around the time they announce that there's, we're not going to fix anything else. And new exploits come out for NT. Yeah, of course you got Pan and Caffe managers and they know how to go ahead and hit a packet storm and oh my God, there's an unrelated exploit but the Word 2000 is in there and no, the Word NT is in there. So let's go ahead and deploy it. Or you've got a lot of investors who don't like the ideas of servers running on old technology. Old equals reliable in some cases. Well, okay, I can't say Microsoft's reliable with a straight face. What I can't say is that for God's sakes, if you're working in IT or deployment, do not let your bosses deploy 2K until all your techs have had a chance to play with it. Because they get so lost in the new GUI and the features and once again, that really creative attempt to hide network neighborhood, that sucks. I mean that they haven't bothered to do the simple things. People overlook the basics.  Making sure it's all patched and updated. And yeah, it messes no problem with this. I call it's the pay-no-attention to the man behind the curtain theory. With all the new slick and shiny features and pretty icons, nobody's gonna bother to go through and hit their basic chat list, go to cert. And because the structure of the icons the network are separated. My network neighborhood and entire network computers near me. Sure thing is a beautiful touch. If I'm hacking somebody's box, I wanna know all the computers near them. All these have managed to take the horrible mesh that most corporations network neighborhood icons were and separate them into a couple of other unorganized mess. Much more effective that way. However, 2K does have a lot of good security features. That's called the off switch. And the biggest thing is it is really, I will say this, it's got a slicker feel in the interface. And if you know how to use it and you've spent a couple of months going through and playing with every teeny feature and living nothing and breathing nothing but 2K, yeah, you'll be able to learn it fine.  And of course we have Win2K and SQL. All the old SQL exploits are still applyable. What's the slew of new ones that, well like I said last year, hacking might, some hackers say they don't like Windows because hacking Microsoft is like mugging the retarded.  So let's go ahead and get back into the meat of it. Some of the new tricks and toys for it. People do not understand how to set up a, they figure they got their 2K blocks and they're using VPN, which is one of the latest buzzwords. They figure that this is gonna make them secure. They don't seem to understand that, yeah, even a firewall is enough. You've got a great big firewall laid out in front of your 2K servers. You've now got, you know, something that they haven't had any decent support on. Nobody's bothering to update the software patches because 2K is the bleeding edge. We're not gonna put any money out for it because we've already paid for how many licenses for advanced server. And you've got VPN. Of course you've got maybe 200 people in your global corporation, VPNing in from their little 98 laptops with shared seed drives.  Can you see buggered.com? The way to exploit this is simple. Go ahead and run, if you guys are familiar with the Rhino 9 tools, you can get them on PacketStorm. There's one of them called Legion. If, okay, hypothetically, if somebody were to download one of these things and let's say, give it an address, range one of your local cable modem providers, especially if you live in the Silicon Valley area, sure enough you're gonna find a lot of people's resumes, a lot of them say security with their nice map seed drives. And as you're reading through my documents, you might wanna go ahead and take the time to grab the registry and the RNA keys. I'm sure all of you know, remember the little program that allows you to dial up networking passwords from people saved dial-in accounts to cracks those. Pretend bonus course, does anybody wanna tell me what class of connection the VPN connection to dial-in is? Yep, it's dial-up networking and just as easily exploitable. So what you go ahead and do after you've given them a subscription to Nambla because you find a file called visa.rtf is you grab the keys and here comes another beautiful Microsoft feature. You have your VPN tunnel into the firewall. There's two ways to go about it here, attacking it from the 98 box. You can use internet connection sharing. Hey, I'm all about sharing if they left that enabled. If not, just go ahead and use your name and password information and then guarantee you nine out of 10 of them are not set up to verify by IP. The system does not support that, you know, trusted host. So now you can use your name and passwords and you're telecommuting in and do a little work around that company. And sure enough, since they haven't bothered securing the domain, well, I've got a big net buoy mesh there. You have all kinds of other wonderful things to go through. People think if they disable, you know, remote administration that, you know, and they don't use work groups, they figure they can just stick them all in the same mesh. Here's the web server in the same network neighborhood as the CEO's Windows 98 box. He's got John Q. Scriptkitty going. They're going, hmm, where do I want to go today? That is the easiest and most common way to harvest through Win 2K. I'm going to go through a couple other of my favorite pet exploits and I'm going to give you guys a little time for Q and A. A lot of the holes here are Win 2Ks, like I said, connection with Windows 98. They've made sure that the two can interface and much like sex between two fat people, once they've made a connection and authenticated, you can't tell where one ends and the other begins and it's all ugly. And with any outlook bugs that you're taking forever to patch, Win 2K, you know, Win 2K does offer a lot of great security features, but like I was saying before, there's no way in hell, you know, your tech's going to go through and play with them all. Well, not on your guys' time anyway, if you're hiring them and get them all set up properly. So your best bet would actually probably be, I don't really endorse a lot of products, but I'd say CyberCop would be the best bet because CyberCop keeps an up-to-date database of the NetBooey vulnerabilities and failing that if you're on a contract or brand new job, it generates enough documentation to scare the hell out of your CEO and give them to do whatever you want. Yeah, so CyberCop, it's basically, it's got your anti-security checklist and it gives you a nice vulnerability database that's presentable so you don't have to do the typing. Okay, some of the oldies, but goodies. One2k still has a lot of vulnerabilities with readable, people don't seem to understand that when you share a drive or a folder, everything under that is readable. You got NTFS permissions set? Well, it's fine and dandy. I've often been raping the system by enumerating a list of user names, password shares, seeing who's got the blank guest account. Remember your domain, so I can just go ahead and copy those. NTFS permissions are not a protection. They are false security. I mean, 98% of the exploits were before somebody, a lot of different people, decided it was time to go after Microsoft Outlook, which my personal theory on that digresses, has nothing to do with security and vulnerability. It has to do with a lot of sort of sickies and that thing at the office and dialing in and waiting for 30 minutes for it to sync a folder. But, one2k security, especially when it comes to the 98 interface, biggest problems is the connections are very highly unauthenticated. Once it's in your network neighborhood, it's a member and it's a friend. And all you need is read access to any of those boxes or their MBT stables.  So you go ahead and do an MBT step minus A. Slash slash their IP. You've got a list of their tables. First three common targets you always try. C dollar sign, admin dollar sign.  IPC first and the others. Once you've mapped the IPC and it's completed successfully, go ahead and net use any of the others. For those of you who I'm going to fast for, net slash question mark. No, excuse me, net use slash question mark. Get into a text file, read it, love it. And MBT stat, same thing. That'll give you a list of all the command lines which is ways to play with it. Now, a lot of people, they have problems hacking in MBT boxes because, well, they're UNIX geeks and think that the Windows interface is illogical. And yeah, it is. I don't want to have to hit start to shut the computer down, that hurts the mind. But the biggest problem in interfacing from the hacking side of it is, a lot of you, especially, let's say you're going through your company network and you've got a legitimate reason to access a folder like your boss is porn. And you try to connect to it. Excuse me, the file server and shared resources. You got to connect to it. And it says, connect as, ask for a password. Well, the 98 box doesn't do that. Why isn't mine working? A, because your IT department's incompetent, because you don't know how to map it. A lot of the time is the leap of light password. There's a difference between user and shared level, shares. They both have the pros and cons, but I'd recommend going for a per user authentication. And one of the best ways to make sure, this means that I'm using per user, you have a list of trusted hosts.  Well, not that easily anyway. You should at least, in my opinion, for not to be an easy hack, not be able to finish your beer before you've got all the company information. It's my opinion. But user and share level and 98, most of it's stock share level. Meaning you didn't bother connecting as who. Well, when you have 2K and NT boxes on the same network, there's a lot of 98 laptops. A lot of people don't bother with the log-on scripts and such, and they want to leave them easily connectable for people who don't have opposable thumbs and need to use 98 SE to connect and can't figure out. The main name slash username. What they do is they just leave it blank. So you have connect as. So go ahead and use username and enter no password. I can guarantee you nine times out of 10, it'll work. Because people don't bother getting the interface right on them when they have their 98 boxes coming in. You also have things like the syncing for outlook. Maybe you've ever tried to sync into an outlook domain for the first time after getting a new job. I can guarantee you you'll be missing hair and very frustrated in yelling and screaming obscenities in whatever your natural language is at the IT guy until you've got it right. Because there you have username password domain to deal with. And half the time you get people running a 10-1 network still using their company's startup name, has a domain name, maybe a DMZ there, and the external name is maybe their new name, whatever.com. So it's a big tangled mess. Most people figure the best way to deal with this big tangled mess. Even I've seen competent security people do it. As hell, let's just make shortcuts everywhere with wind and leave it blank. You cannot do this. The best way I'd recommend getting around this problem would be, well first of all, if you separate it into work groups, set the permissions properly on work groups. A big mess is unacceptable. From a security point of view, let's say you're not even worrying about an intruder. How many of you've ever tried to find, let's say a copy of Netscape or whatever you need in your corporate network and you don't know the backups? Do you go surfing through every single one of those? How much time is that costing your company? As a, or let's say you've got a project and you've got to search one of your co-workers' drives for everything. How much time is that costing your company? The insecure mesh domain topology?  How much time is lost looking for the files where if they just had one single file server, they wouldn't bother with it. If they couldn't find it there, they know it's gone. Think of how much man hours company-wide and nationwide are wasted on that. Some of my happy pet thieves. But one of the biggest part of security is usability and people seem to forget that. That's one of my biggest no scores on Win 2K. The usability is very low when it comes to usability over security.   They don't have the time to make a secure image or there isn't one secure image it'll work around because they haven't bothered investigating and checking out the user and shared passwords and networking. I'm gonna go ahead and go into a little QA and I'll go with a couple of tasty exploits I'm saving for last. In the green shirt in the front. Yeah, defined blocked. Defined blocked. What's the traffic deny? Is it deny any any? Deny any inbound? Yeah. Okay. First you can get a list of the shares. Hobbit and the Riner 9 guys they wrote a really nice NetBowy doc. It'll have, you'll see a list of names and that codes and such and it'll have the list of all the services. You go ahead and decode those and you look at the table. The next thing you do. Okay. One of my favorite things for hacking 2K boxes or any NetBowy stuff. Look at the computer name first. I think I believe it's like O3 is in parenthesis before it. The new ones. If you see OEM work group or compact one, a preferred customer your job is going to be very easy. But so much of the memory of the shares the other thing you can do is run a SID dump. You know, S2 SID and you'll have a list of Landman passwords, how long ago they were changed, expired wind fingerprint will do that for you. Won't you mean the IPC connection? You can also do a NetView. Good question. The first thing, one for it, huh? Correct. You go to 445, that before an easier method. What you do is at that point you go ahead and use the right vulnerability and just get the tables that way. Over, you know, planetrogen in there like it'll back orifice and get it out. But once you've got the information it's a big profiling hole. If you've managed to map IPC you are now a member of the world group. So go surfing through and explore and you'll find something open to make another connection through. Okay. Would I ever do five or three? It'll go out and through it, yes. Okay. With all of those blocked at the firewall what you're going to have to do is go ahead and switch attack methods but you can still get a lot of useful information like user lists, things like that from it. Okay. Don't put it. It's called separating your networks. You can also filter you know heavy-pull filtering is going to make no usability. My personal interest is I prefer a decent typology where you keep the networks off. You separate them into work groups so let's say, yeah, they get your marketing geeks. Who cares? You keep your production servers separate. You can also use like a NukeNet, you can use a NukeNet burn and set it to look for a certain or a packet filter or an IDS and set it to look for a certain series coming in, you know, you stiff the packets record. See anything that looks even vaguely like an MBT stat, it tells it to bugger off. When I go through and lock down an NT box, the first thing I do is go, how was that? The first thing I do is go ahead. Everybody's in the system. I don't go through the standard cert list and your standard secured list. I go registry level first. You got some message to distribute. Who is it? There is already a very nice NT reg patch that's written.  I don't like tripwire that much. It's not because, you know, I have any faults with the product. It's having a lot of time to play with it that much and I prefer, go ahead and hit a packet store once again. If you're gonna use, I use a combination of ViperDB for file and ReelSecure for warnings. ReelSecure isn't that very good when it comes to dealing with it, it'll give you a lot of false alarms. It comes with file modification, port traffic like that. But once you get it down, it can be very good in the reporting tool and it's a better whistleblower. And ViperDB is a damn good IDS but it doesn't have a slick interface. So I use the hybrid of those two as a preference for my home systems. Did you wanna know like production things if I was gonna do it differently for outside? There is a list of reg patches on my website actually that'll have this for you. I use the custom set. www.dis.org forward slash Mr. Mojo. M-R-M-O-J-O, no caps. And in the hacking section, if I manage to make it back to my computer in time, I'll go and double check that it's slammed up on the servers. It'll be called ntredgepatch.zip. They'll be linked to it. That's most of my standard favorites. You see the problem with using a stock customized reg patch though, is you've got a big production server that's got who knows what. Let's say I want to use Outlook, Sinking and some things. If you turn off too much stuff or you might be good for one person, isn't gonna be always good for everybody else. You have to go through and read the rem statements and make sure you don't break stuff and have the IT department once you're head. Okay, for the domain model, I like to keep it sweet and simple. I always keep my production, I always wanna keep the production servers in their own DMZ. You keep the workgroup set up. It's gonna cause a little communication problems, but in my opinion, developers should not be talking to the same machine they shouldn't have redundant connections. So what you do is go ahead and launch workgroups. Then you have an administrator in each group who has limited access to do modifications and manage them. If you don't have a personnel, just keep a title ran on it yourself. So you have your workgroup set out, your production and internal that should be not on the same servers though, as well as any developer who needs to have outside in an access, stick them in the hell outside the firewall and make sure he's not VPNing or using any kind of remote management. Was that what you wanted? Got next. Hold on. I said that, I didn't see there wasn't a point to it, but alone it is not an invaluable tool. It is a very needed thing. It's one of the basic things in your checklist. Read access to user and system and recreate the registry from the raw files. You said everyone, everyone, right? Or you can still read it or copy it. I have a lot of Trojans and programs and papers and such on how to sneak around NTFS. And what it comes down to though is if you have these vulnerable things readable, there is no way to secure, let's say you go into the program files, you just keep switching targets off. You find the account names on a different part of the system or you use good old wind fingerprint. I can't remember what it was originally called, which would give you a list of accounts and you can brute force them at that point. So here's the part where I see which one of the people who make these systems here bought me the most beer. No. What I prefer is that you don't use VPN, let's say you're doing, you have a whole bunch of boxes, co-load. I actually PC anywhere on a high encryption level. That's a really good remote networking situation. A, it runs as an NT service. Now you can set it up so when, this isn't just from a security standpoint, it's from standpoint of usability. You don't wanna have to fly to Taipei or some godforsaken place to yell at somebody in a foreign coal or to restart it when you reboot the server. And it's really simple, you're not looking through somebody else's slick interface remote networking. Now you can use like open source or site source. You can view files from monitoring and PC anywhere, so you're actually at the box. You never trust anything on Windows Box as it's being done remotely unless you can see the screen in front of you. Okay, well a lot of the biggest missing, I'll go for the simple level first. I'll take it a little up, it's a multi-parted question there. Okay, a prime example the first time is you get the tables past that. If you don't have one outbound as well as inbound packets to nine, once you make the request, it comes in through 80.  And go ahead and you can get, you know, S2s, SID dumps, all the other wonderful Windows hacking tools which will give you the accounts list. Passwords, it'll tell you blank passwords. Once you get a blank password, or we guest account, or something in these fields that's way too easy to brute force, then you go ahead and make the connection that way through an authenticated manner. Okay, you're denying the 135, 137. If you're allowing them out, we're gonna lose this in those outbound through those ports. Once you made the request via in 80, maybe those went clear. Yeah, oh, the other biggest reason it kinda slipped me there. The main problem I have with installing 2K over NT as well. Remember Loft Crack? Remember what I was saying about secured keys? Loft Crack, I don't know if they've upgraded it, the SMB stuff will still work. But when I first played with Loft Crack in 2K a few months ago, it choked. Unless if you'd installed it over a good old 2K system and guess what, it would crack the locals. Because those files are still there. Yes, anybody else interesting in skipping should be near the pool. Was there any other questions in the meantime? Oh, on your servers, yeah. Any IT boss that says you're building all the desktop to 2,000, he's incompetent, just shoot him. So what you're looking at is for a more secure connection. It'll show it, yeah. Okay, brings a good point out. Now, when you're worried about, I suppose I got the best thing you can do. You're not gonna like it. When you're saying about if you're in a situation where you have to go ahead and make a secure connection for a whole bunch of 2K laptops, I feel your pain, and it's secure and safe. Your best bet would be sure that you lock down all the NFS, give them Nuke nabbers, you know, to block the 135, 139. Make sure you've got a very, your best protection in that case is security policy. Hey, writing them, but they're wonderful. You make sure you got a secure image, which are available in it for, you can probably find those by manufacturers, or there's other places. I think cert.org has resources on where to find those. Go ahead and slap a secure image on, and your best protection in that case would be informing them. Informing your users, send them an email. Don't get too technical. See if you do this, this, this, and this, one of the things you should have been writing down in these recordings, you're gonna get attacked. So informing them, and making sure they're secure, that's your best bet. Maybe adding a port blocker. Oh yeah. Okay, so you've got a separate organization, you've got separate parts of your organization. Yeah, lots of co-locations, and you can't definitely deploy it to all those 500, and you've got an unmanaged firewall. Well the first thing for the unmanaged firewall, is you take firewall one off the box, and you install it pegs. And the next thing you do is, do not use VP and dialect connections. Like I said, policies are your best protection. They should not be tunneling in. No matter how secure you think those boxes are, and that's your best mean of protection. If you've got anybody who's got home connections, which is kind of like the laptops that go into the firewall, open this. Could I open one thing that I can have IDent for my MIRC, everybody. You got home connections? Slap a firewall on them. What the best protection is, are you IT or security? All right, so do you do IT or security? Oh, in that case, the policy is the hand of God there. Just tighten up the rules a little. And once you have a running smoothly, it should be okay, and people will find that it's more usable as a security model. 90 day free CD.  That's what those are. No I don't. You can use it as a Coaster, a Frisbee, jewelry, buggered. I'm not gonna go into that, there's research being done in that lit. Yeah, you don't get quite the new stuff until I finished it and polished it out. I said once again hit the website in a bit, but I think it sucks. And it's very dangerous. Oh, sorry, that'd be the question. You're asking about soap amounts to the Microsoft Developers Conference. I said, I haven't had a chance to go through and play with it, but from a security point of view, it looks like a really bad idea. Okay, I was just thinking the same, but what you do in that case, when you're training your new administrators, there's, you have certain network, just a lot of good security and policy stuff.  But your best bet is to sit down in front of a box and show them. The only way they're gonna have the fear of gotten done into it, you get a help out. I've done this myself. I was having an argument at a contract that once took with a guy who said, he wanted to leave everything printable. He wanted to leave all the shares and the resources redriveable. There's no reason, because we have NTFS. And we went on for days about this and finally we scheduled another meeting and about the time I walked into the meeting, the scheduled job I'd planted on his, on his home laptop the night before, went ahead and printed out a 20-page document on that biosecurity, right, as he's about to talk to a boss. That does it. Use the fear of God tactics. You've got to demonstrate it on a close personal level. I'm not really gonna go into active directory because it's a whole new can of worms. Your best bet would be checking, access to the speech on that. Go ahead and check the archives on that. Did I go out for hours on that one? Your best bet is keep it simple and old-fashioned. If you don't know how the application works or you don't know every single bit of it, don't do it. We're gonna go for cost effectiveness. I said, get a different box. Don't ever do it. There is an entire slew of holes in the upgrade. I didn't notice I didn't catch that one. He's spent a lot of time with the documents. Yeah, I'll go ahead and I'll spew out the shot at your security versus resources right now.  One of my personal favorites is packetstorm.securefly.com. Go ahead and do you guys securityfocus.org or com now, securityfocus.com. Those are usually the quickest in getting the new exploits. You also see a lot of the stuff that's kind of a hybrid of both. There's something I missed on the Hackers News Network. My site also, when I get the time to get off my button, stop speaking, mentions getting the exploits out. My site again is www.dis.org, forward slash Mr. Mocho, all in lowercase. Well, once you've got the only way to deal with SMS, once you've got the registry plate just deployed, it gets turned off. I'm not, I don't really go into that much. I use it when I've got to deploy reg patches on somebody's unsecure system. Also another good list of security resources and making sure it's locked down though SMS vulnerabilities, cyber cop. Go ahead and use cyber cop and supplement it with input from the latest websites. You don't see any hands out there. Am I missing anybody? IPaSec is a very good thing, but never dependent solely on one source of security. Oh, I almost forgot. A really simple problem you were mentioning with 2K Pro, that piece of technology that you get a lot of IT departments.  So you've got all your laptops wearing advertising web server in an unpatched and unprotected one at that. Well, I think that's about the gist of it today.


So we mentioned in one of our previous live streams that in order to climb Mount Kilimanjaro, you can't do it on your own. It's no longer possible. I don't remember what year it was, but the government in Tanzania, they have rules in place where for every person interested in climbing the mountain, you have to go with a tour operator or a travel agency, travel company that's going to basically be your escort to get up the mountain. They do make sure that people are following the rules on the mountain. Obviously with the, you know, it's very important, natural landmark in the area, so they want to make sure that people are respectful to the land and then they stimulate the business in the area. So you cannot climb Kilimanjaro on your own. You have to go with a tour operator. And when it comes to planning for Mount Kilimanjaro, I think one of the most critical and important and probably stressful decisions to make is choosing what company you're going to be traveling with, or what company you're going to be climbing the mountain with. Sure. But you can see around the world, obviously, that many places that need that regulation and such to or turning to that form, so that they can control the amount of people, they can keep people safe, and they can also make money for the local people. But that's normal. You'll find that everywhere. So that shouldn't come as a surprise that there are a lot of companies then that you can pick from for Kilimanjaro. Now probably the first major question you're going to want to ask yourself is how much comfort do you need? It's not necessarily the most important question for the climate itself, but in terms of if you're going to go, you need to set that standard early on because that'll give you a different ecosystem of potential suitors, as it were, that you're going to pick to climb the mountain. And if you're fine to just kind of go up with a lot of your own confidence fueling the way, and you don't need a lot of privacy by way of little outhouses, you don't need a lot of porters to necessarily carry a lot of extravagant things, and you don't necessarily need the guarantee or the assurances of a high quality guide to keep you safe or comfortable on the way, you might have a different budget than if you're looking for some of the more international companies that might have some very fancy outfitters and lots of porters with cool tents and logos and colors and bling and everything. So you've got to know that for you. Yeah, so definitely I think two things that are important factors. You want to make sure that the company that you're going with is within your budget. And if we were to put them into big groups, there are local agencies and then there are international companies. So international companies, we're talking about G-Adventures, for example. They do treks and expeditions not only in Tanzania, Mount Kilimanjaro, but pretty much every other high mountain, Aconcagua, they do expeditions in Patagonia. So these are big companies. I can't think of any other company like that. REI definitely takes people over. Yeah, even REI, they do some expeditions. So these are big international. Worldwide trekking. Do they do one? Worldwide trekking. So these are big international companies, either located here in the US, some of them in Australia, and some of them are in the UK. So these companies are the big ones. And then are the local companies. The local companies, they are local in Tanzania, although the staff, the porters, the guides for both type of companies are from Tanzania, from the region. But it's just that the administration and where the business is set up is international with the other ones. So now the only difference is with international companies and big companies, the price is usually higher. And with the local companies, the price is low. So one of the things for us when we travel internationally, we try to help the local communities. And I personally find it to be just nice to go with small companies in the region. This is what we did in the in-cat trail. And prices are more reasonable, but that's not what we did for Mount Kilimanjaro. Yeah, that's a picture from the in-cat trail. So really knowing, do you want to go with a local company? Do you want to go with an international big name company? That's number one. And that dictates the price. Now, the pricing for Mount Kilimanjaro, it really can go from $1,000, which is like the lowest end. And you definitely don't want to go with a company that's going to charge you just $1,000. And I'm going to explain why. And it can go up to, I don't know, $10,000. I heard that REI charges up to $8,000 for this type of climb. So there is a huge range depending on how luxurious you want your climb to be. Yeah, I can't say that I really looked at the upper end, because I didn't know interested in looking at the upper end, other than perhaps for comedic relief. But with a lot of those companies, though, as well, you'll see that have the opportunity to give you the local flow. It's a double win for you at that point. Hey, it's a bit cheaper. You support a lot of local individuals. Typically, they're very familiar with the area and the ecosystem and have a lot of other good information to give you, not that they don't hire reasonable guides on the more expensive, larger industries, larger corporations. But I can't think of a reason that I would ever not aspire to use a local one. But not to harp on people that do choose bigger ones. Again, I don't see any downside to the way that I approach hiking. So you've got to make sure that what you pick works for you. And that's universal for all things hiking. But there are some questions that you want to ask yourself. So first of all, there are so many companies with Kilimanjaro. I don't know. I feel like before I looked for the Inca Trail, I looked for Elbrus, so many other climbs, and there is a limited number of companies. There are many companies, but people usually know these are the top four companies to choose from. But for Kilimanjaro, the choices are, you know, there are so many companies to choose from. But definitely the main questions that you want to ask, you want to make sure that they have good reviews, not just on their websites, but you want to go see their reviews on Facebook, one-star reviews, five-star reviews. And one of the things that I personally do, I even reach out to people on Facebook, for example, who submitted these reviews, to hear from them directly and see, you know, what was their experience like with this company. You also want to go to the company's website, read a little bit, and make sure that they follow all of the rules that are set by the Tanzanian governments, because some of the companies that don't charge you a lot of money, like $1,000 to climb the mountain, they usually don't pay the porters as well as they should. The porters and the guys. So they compromise on how much they are paying these porters. And the porters are working very hard, and they are one of the reasons you are going to successfully make it up the mountain. So you want to make sure that they are, or the company that you are choosing is fair to the porters to be particular. There is something in Tanzania called, I think, Kilimanjaro Porters Protection Association. And then this association usually makes sure that, you know, they are following their rights, they are being paid well, they're not carrying more weight that they are supposed to be carrying on the mountain. So all of this, you want to make sure that the company at least has some sort of partnership or agrees to the KPAP rules, per se. Right. Now, we can talk about some of the things that these porters might be carrying up for you at that particular time. And we've talked about accommodations in some light format by way of sleeping. And some more extravagant things, like if they're going to carry a bathroom amenities for you to construct you a little privacy dome. No, she's very common. Yep. So some of these things are normal things that you would be able to look up. Ethics besides. And it makes sense if you went with a cheaper one to make sure to give the porters huge tips. Well, tips are going to be universal at that point in terms of being expected to be handed out, or at least, I mean, yeah, from our class, maybe in the upper echelon, things change, I suppose, but we're just yokels. Yeah, I feel like I think that tips are, you know, you're going to tip whether you are hiring a big company or a small company.  Sure, I would say it's such a weird thing, though. For me, to give the nice tips out in the moment, I feel like, and it's probably just my Western mentality that tips are like a result of quality of service, that I would rather donate money directly to a cause if I really wanted to support it, rather than handing it out to the short list of individuals in front of me as a statement of before even meeting or experiencing them. But if I went on the thing and I really enjoyed and I thought they did a great job and knocked out of the park, like, of course you would want to tip well. Of course.  They don't exactly take a visa on the mountain. I don't know. Maybe some agencies provide an alternative way to satisfy that, but I would presume not. That sounds like a hassle for them. I promise you, Homa, that's exactly how they called it when we were on the in-patriot day. They said, now it's the time for the tip-in ceremonies. And they all stand around. And it's just weird. I mean, you do want to show appreciation. And honestly, like, when you look at porters and how much weight they are carrying, it's just amazing. But anyway, so what are... I make them carry the money bags up the mountain for you. So that's the other question that you want to consider is, at least for us, when we booked this trip, there were some considerations that we wouldn't have paid attention to, really, if it wasn't this time and during the pandemic. And it's that making sure that the company has an international and a big presence in case, you know, we are sick and we can't make it to the trip. What's going to happen to your money? So before choosing a company, you want to make sure that you have some insurance in place from the company that, you know, your money is not going to be lost if your flight is canceled or if you can't make it to Tanzania for one reason or the other. So really for this trip, we decided to go with a bigger company just for safety because, you know, there's been a lot of uncertainties in the world right now. And there are things like travel insurance that'll satisfy some of those things for you as well. And sometimes even you'll find like credit cards or your regular insurance will double dip on backing you up there. I'll say one of the ways that I would think you should evaluate the quality of the service you can expect to receive and some of the capabilities that the organization might have in terms of supporting you along these ways or how much they say you have to pay for on the website.  They say reach out to us and give us a quote. And usually this is a way to engage you in some form of interaction. But at the same time, if you send somebody an email and say I'm interested and they send you back two paragraphs from the person running the shop, I'd be less impressed. And then if somebody sends me back a well formatted email because they send many of them back all the time that has a lot of information and links to other stuff on the page, that's a pretty good giveaway. I think that they have an infrastructure that's capable of supporting your needs. So I would say be willing to contact people, right? Because if you take it for base value that you evaluate the company as a number and a number only in a bulleted list of capabilities, you'll get what you pay for. And that doesn't translate exactly the way I want it to here because maybe the price is exorbitant. But I'd say that you wanna do the due diligence to actually reach out and talk with them and see really what they're made of. And you'll get a feel for it through interacting with them if they wanna do stuff and if you have questions, you ask them and they answer them. I would say do reach out to companies even if there's not a price mentioned. It's just usually for them a button that'll send the automatic email for you, you type in how many people, when you wanna go and they'll give you a whole laundry list of information. Yeah, definitely shop around and don't just pull the trigger on a specific company because your friend said it's a good company but still talk to people, ask a few companies. Sometimes it's just the way they communicate. And they, you feel comfortable with them. They answer whenever you need to. It's just the little things sometimes that help you make a good decision. What else, choosing a company. Obviously there are some details like if you have any dietary restrictions and you want to ask the company, can they accommodate you if you are a vegan or vegetarian, which some companies do, some companies don't. So these are some questions to ask before choosing a company to collide with. I wanted to make a joke, but anyway. Chocolate only diet, sorry, I was gonna call it the Monte Zuma diet. But the food and such like that too, you will find as you get up the mountain that the opportunities for diverse meals, it goes away after a period of time.  Typically when you get up that high, they have to boil water all the time because they need to make sure that it's sterilized from wherever they might collect it from. And as a result of that, there are some limitations and typically allocations that are available only to the various companies that might be residing at your stopping point or for your midday lunch point in certain areas as well. So some of those are limitations also. You shouldn't necessarily expect glamorous meals, but you will be able to get a feel for what culinary opportunities will be presented to you when you're doing your research. And again, if you talk with them and you have those special things that I'll tell you if they can or cannot accommodate. Other things to consider when you are picking a company, obviously if you're going to Tanzania for this climb, a lot of people like to add on more adventures in Tanzania. So some companies offer packages of not only the climb, but things that you can do outside of the climb like going on safaris or going on some cooking classes and things like that. So if you are interested in having one company arrange the whole Tanzania experience for you, it's something worth asking. I think there are plenty of companies who would have packages for you to choose from. I would say for me, usually this, I prefer this in terms of my default course of action, not because there aren't better ways to try to pick and choose. But typically they'll handle your luggage while you're on the adventure.  Your laptop. Right, or your laptop, or other things that you may have brought, whatever. And as a result of that, if you just stay at a hotel that's kind of like outside of these people, you might not have the guarantee before you go that they'll let you keep it in a back closet or even at their security is something that you're comfortable with. And if you go to the agency, there's kind of like that guarantee. Same as flying internationally with one big, one flight reservation, so you don't be coming in out of customs all the time, stuff like that. But, but, but, I have to have my laptop.  Oh, the poor man. Yeah, I kind of feel the same way about the laptop, but at least I feel like by having a company like this, you can rely on someone to keep your luggage safe, your computer safe, and everything else that you don't want to take with you up the mountain. What else? What are the other considerations? Usually I write down my notes, but I didn't do today, so. Sha, I think for a lot of things, you'll find standard across many of the agencies are like, how much weight can they carry for you? And what sort of things do they provide to sleep? Bedrolls, do you need to carry your own sleeping bag? Not to talk too much about the place that we've picked. But it seems normal for a lot of these agencies to provide you with a sleeping bag if you would like to for a small rental fee. As you can imagine on any of these high altitude mountains and such, or high elevation mountains, it can get cold at the top. That doesn't mean it will get cold at the top, I'm assuming all year round, but I guess I'll find out. But zero degree bags could certainly be a reasonable thing to want, and you might not want a zero degree bag for your regular daily life, or at least you might not want to spend the money on it just to use it for this trip alone, and then stuff it in the closet or hang it up in the garage or whatever. So you might want to know what sort of things they offer you in terms of rental. I think they also offered hiking poles for the place that you were going, but... Yeah, honestly, it's a business by the end of the day. They will offer, and they have experience. They've been doing this for, I don't know, 50 years or more, and they know what are the basic needs and things that people usually need up the mountain.  Even if they don't have it, they will get it for you and rent it. But it's worth pointing out, and many of you may have come across this already, some of you may have not, you cannot put hiking poles in your carry-on bag. And... They're like a weapon. Yep, I have a full video about this, talking about hiking and backpacking here that you can fly or you can't fly with, and you can find it right here. And in the event that you're doing something like that, obviously, in the event that you're gonna do this, so you might be trying to save a buck or two by not putting a bag underneath. It's all right. By putting a bag underneath the plane. So if you were gonna take your own trekking poles, that might cost you a lot more luggage. Another reason that they might offer you that is a rental. Bedrolls, I know, they'll typically carry up for us. Another thing you don't have to lug around in your bag. Bedrolls, tents, yeah. Tents, food gear, et cetera, bathrooms. So Bucket, what do you take on to the mountain? I believe you should be taking off. I don't know how mandated it is, or by that matter, how enforced it is, even if it is mandated at that matter. But I know that the agencies will make sure that they have restroom facilities and such for you that we were talking about earlier.  They might have some rituals that they take at the beginning or the end of the day to allow you to kind of clean yourself or wash yourself down. Mind if I...  I'm curious on the sleeping bag situation with the fact that you can go through like four different climate zones. I imagine the temperatures will vary through the different ones. I suspect that they will vary. I don't know if it'll be so dramatic that you wouldn't be able to use like a zero degree bag with a zipper open or maybe just lay on it or use it as a blanket and lay on your bedroll. I'm assuming if it's anything like what we had experienced at the Inca Trail that the bedrolls will be generous, which means that you probably could sleep on them and regulate your temperature. That way that being said though, we live in the desert here and it gets hot during the day, but it can get cold at night. And I wouldn't be surprised if by the time you start doing some stuff that you might only have one night on the bottom but a couple of nights on the top. And I'm sure as you get higher up in altitude, your tolerance for discomfort goes down. So I would be much more comfortable being a little too warm for a night lower on the mountain than I would be being too cold on the top of the mountain. But I totally hear you that you're going through two different zones. For all I know or for all you know, you might be able to take a little bag with you. You might not even need to use a sleeping bag the first night and we'll figure that out. But at the very least, I'm sure that the zero degree bag is justified for the top and not necessarily a burden for the bottom. But Fomat, these are all things that we will still have to experience and figure out. Well, awesome. Yeah, I'm trying to think if there's anything else that we would want to do for picking. Transport to and from the airport is usually something that'll help too. You'll find that many places will provide you with accommodations for the day before you start. So typically you have to arrive a day before your hike starts and they'll have like some sort of a orientation meeting where you'll meet some of the people you're hiking with and your guide and other things. And they'll just tell you a lot of reasonable stuff usually as well as some other stuff for on the mountain. And then I know like for example, when we did the anchor trail back there as well, they told us that you couldn't have hiking poles without rubber stoppers on them because they didn't want you chipping up the rocks everywhere. I don't know if that'll be the same thing here, but stuff like that that might be local. And then obviously when you get back, they'll also let you stay for a day too.  But those prices are usually built in but if you get there a little early or have to stay a day later, you'll usually find that you have to pay a little bit for those extra days but they will help you with finding a place to stay. I just want to add one thing. I have friends who climbed the mountain in the past and it's very common for people to not actually book or choose a company ahead of time. Like for us, we picked this company three months ago, maybe more. It feels like an eternity ago. A lot of people would travel just two, wow. It feels like a long time but a lot of people would travel to Tanzania and then when they get there, especially if they're traveling with a local agency, when they get there, they start their choosing process because you can go shop around, talk to guides and companies face to face and then you have higher chances to negotiate the price because when you are right there and they're like, okay, you just want to get up the mountain. I want to go as soon as you can. You can do that. So just throwing it out there that it's an option for you. If you don't have any time restrictions and you have more of a flexible schedule, you can still travel to the country first and then decide or choose a company to climb with. Now the things that you may have to pay attention to on your way into the country as well, there would be things like getting a visa and things that'll be mandatory for you across all agencies at that point, which will be some form of a high-altitude insurance, which is different than your regular travel's insurance. If you're going to be above, I don't remember the height or the altitude, but I think we used worldwide nomads. That sounds right for our travel stuff and they cover you up to like 19,654 feet or something goofy, but that's very obviously higher than the top of Kilimanjaro by a little bit, but not as high as the next mountain up that people would probably be going for on other continents. But you're going to need a special form of insurance so that if you have some high-altitude issue that they can evacuate you down to regular altitude and then your regular insurance, I'm assuming kicks in. Something crossed my mind right now. I was going to share it with you earlier, but I forgot. So as I started the day today and I just pulled my Instagram and I was looking, one of my friends on Instagram, she just had malaria in Africa for the first time. She's been living there probably. It's the only time she has Africa. No, she's been, well, she's also Moroccan, but she's been living in Africa in Burundi and Tanzania, like some of the Southern countries that she's been living there for five years and this is the first time she gets malaria. And I was like, and when I saw that, I was like, oh my God, thank God we got the malaria pills anyways. Well, anyway, I'm deviating from the topic. That's fine. Like I said, and then visa as well. You can either do a visa on arrival, which I think if you watch anybody online, they'll tell you need some crisp bills or you have the opportunity, I think, to do it online, which we're going to do in advance to getting there. And then you can really get a lot of the paperwork and such and some of the numbers. And then you get in, they just punch in the numbers you paid already and let you through. Obviously you're talking about vaccinations and such too. There are things that, depending on where your adventure goes or what companies you might pick may be different to you. Many of the companies, as we covered in one of our previous videos, start from within Tanzania, but not all of them, one or two of them do you start from the north in Kenya. So, and you would have to have a yellow fever, at least for there that I know of. And I'm presuming that that might be the only one that's a wild card, but I can't say that I know that for facts, for facts. Yeah, we talked about all of these vaccines. We talked about our experience with passport health on the previous livestream and I'm going to link everything in the description box like usual. Thank you so much guys for the thumbs up. I see seven thumbs up and three people still watching us. We've been going for 27 minutes and we have three more minutes to go before we wrap up today's live stream. I can tell you that you saw me walk away earlier to go get some coffee. There's no coffee in there. It turns out I just made a problem. It's longer, but thank you so much guys. We really enjoyed this live chat with you. Again, Thursday's live stream is going to be canceled for this week and. Can we say maybe just as impromptu as last one? Yeah, probably. I expect like a full stream, but if we're on the road. We'll try to say hi. We'll probably try to say hi if we fly through town, but it might not be exactly at six. Be around that time of the day if we could make it happen. And wish us good luck with this weekend's climb. Hopefully we'll make it up the mountain. Awesome. Thanks everybody. Thanks guys. Have a good day.