rishabhd

Closed everything and now I grow potatoes.

End, of an era. RIP.

Operation Elop is also a fascinating read.

https://medium.com/@harrikiljander/operation-elop-6f2b043f52...

Getting Akira vibes from that Video.

Do this exercise whenever you are offered junk food — move your head from left side to right side thrice.

The site which changed my life. Happy Birthday HN.

For me, the line was drawn when they forced users to migrate to Google workspace. Looking to de-couple my life with Google.

Rhesus Macaques, native to Indian subcontinent follow similar culture —- gregarious, matrilineal and unfortunately violent.

Loved it. After trying two three times in vain, I landed up at words.js and cheated. To each to its own I guess.

Also popular for some unfortunate reasons as well, it is becoming the exfil and sync tool of choice for ransomware operators.

context : first hand experience in IR

Reminds me of the timeless piece by William Gibson on Singapore, “Disneyland with the Death Penalty”.

ref : https://www.wired.com/1993/04/gibson-2/

Reminds of the ordeal of Simone.

https://www.evilsocket.net/2016/07/27/How-The-United-Arab-Em...

On a different note, I like the Rick and Morty one as well. Not sure if this is going to fit investor pitches except in very esoteric cases. I used this during a cyber security session though with success.

reference : https://blog.reedsy.com/guide/story-structure/dan-harmon-sto...

This might be a big deal, but I have been mentoring this guy on an on and off basis, he does not have a laptop, is not a CS student (was studying for medical exam - NEET) and writes all his code on an android cellphone. He got interested in cyber security and wrote his first functional keylogger (disclaimer : it was good exercise to teach him basic *nix utilities and how native functionalities can be leveraged by an attackers to their end, not for malicious objectives) using his phone as an IDE, compiler and what not.

Talent, can come from anywhere.

https://github.com/shivamsuyal/Android-Keylogger

side note, he just completed his 12th class (us equivalent of high school) and is looking to research more in cybersec.

Pardon my ignorance, but how is lobbying legal? Isn't it actually funding and nominated people for incentives, unlike a true democracy. Isn't it effectively quid-pro-quo?

Or, as Google is simply dialing it to 10 now, it will then dial this down to 5 post reactions and people will be okay with this eventually, unfortunately.

When instead it should not have been done at the first place.

You may want to use internet archive to go beyond paywall. Loads fine for me.

https://web.archive.org/web/20210531112440/https://www.econo...

Pretty common in India as well. 3-4 years back people used fo abuse gps like crazy when uber/ ola targets were defined by number of rides and KMs done per day. Then they removed bonuses entirely and there was a sharp decline in rides done and KMs driven.

Too much attention and too brazen attack tactics. XSS shut down ransomware discussion and ransomware groups are having a market correction moment as of now. Shutting funds was easier, probably Kremlin asked gents at whitebit to hand off things before anyone loses fingers. Ultimately, this would simply mean that the targets would be carefully chosen, affiliates screened and new ransomware would be announced in coming months (or weeks even) which would target enterprise/ businesses.

Key lesson as summed up beautifully by an old timer in our team "You don't mess with big oil."

It was an honest mistake, I misunderstood that it meant to show something cool you have identified on internet. Sorry if I caused any trouble.

This will come in handy during DFIR, although we have different workflows for doing live analysis on machines for now.

I am not sure if it was a satire or an actual article from someone concerned.

RIP Dan, he was a legend.

I would recommend simply having a very generalised discussion on your infra from a birds eye view and see if they can provide some inferences, add/ suggest any customised test/ use cases, share previous experience in similar infrastructure/ industry. Intent is not to assess them technically, afterall their biggest strength is that they are jack of all traits and master of something that might not even exist in your infrastructure. Their shared experience can help identify issues that you may not even consider since it was out of your work domain.

For example, my infra+hardware guy reported mousejack vulnerability as an extra observation during 2.4 Ghz spectrum security assessment. The core scope was wifi spectrum, but since he had an understanding of devices operating in that spectrum, he was able to compromise vulnerable wireless mice (logitech ones) at a client which operated in the same spectrum. Most OSWP guys don’t even know about it, you can have my word on it.

Disclaimer : working for one

Edit : added more details

Check their approach both technically and project wise. See how do they scope out your requirements. See how do they respond to your requirements. Ask for references, see their previous work. See how do they define risks for customers in similar segments. Are you comfortable with their (sample) reporting, can it be customised to fit your requirements? Do they have people who are adept at what you require? A naive example - if you have APIs, but they are sending in an infra pentester (read: wintel/ network specialist) who has no experience in web APIs, then you would not get complete results. Ask if they are comfortable in having a discussion with potential pentesters at their firm before engagement, see if they are a good fit. We encourage our clients to pick profiles from available pool and interview/ have a discussion with them (if required) to see if they are a good fit.

But even before doing this, document your requirements. Why do you want a pentest (customer requirement/ regulatory compliance/ inventory risk classification/ inner peace et al). I have seen plenty of horror stories wherein a poorly scoped pentest (both sides of table - from customer and provider) provided no value to the customer. Ensure you have a dev/ UAT environment that is a replica of prod incase you are not comfortable in doing pentests in prod (yes this happens as well). Else, you won’t get accurate (or even representative) results for VA/ PT. If in doubt, start with VA, assess what is wrong, fix, do a pentest. Rinse repeat.

I worked with a customer who had huge gaps in their security ecosystem from identification, detection and recovery perspective. When they approached us, I asked them what is the need of this and why now. They had no concrete answer for that. Hence, they went back, worked on scope and we worked together. Fast forward 6 years, add periodic VAs, a well oiled pentest program and yearly red team assessments have matured them from a security standpoint a lot.

For instance, year one, they had poorly secured email infrastructure and got compromised through phishing. Year five, phishing is nearly mitigated with appropriate anti-spam, policies, hard MFA, employee trainings, external sender alerts, quick suspicious email reporting, appropriate SPF/ DKIM/ DMARC policies, vetted vendor/ client email contacts, signed macros, DDE disabled, deprecated legacy protocols, powershell/ script execution disabled and monitored et al. You can probably imagine how many scenarios were conducted and guidance given to their tech teams to ensure vectors like these were addressed over a period of time as part of their pentest/ phishing exercise. You can probably understand their will to actually implement these recommendations as part of pentest exercise and ensure these are fixed through repeated simulations.

I probably want what you have now, mundane fixed schedule job which gives you the time and freedom to work on your passions post your office. Could very well go with wood working and infosec research. Those passions can (probably) be leveraged later for a different career opportunity or a small, bootstrapped startup. I know friends who were pure play project managers but worked on their passions after office hours (whenever they had time). Now they are working on their passions at a job that pays them to do so.

Its projects like these that makes me wonder that what the actual heck am I doing with my life.

Stupid question from someone who has zero idea about this field :

What are the chances they unknowingly create a new virus/ bacteria for which no known defenses are present. How is this probability mitigated during design process and what protocols are followed for ensuring this doesn't happen. I did read about bio safety levels, but I feel they themselves could be bypassed.

Impressive Barnum statements, these are actually very good.

I remember this, I feel old now.