Aaron Hurt

InfoSec Professional. At home and at play I'm a husband, a dad, and an outdoor adventurer who has a penchant for online gaming.

[Aaron Hurt @aaronhurt]

Staying ahead in cybersecurity rarely feels like being ahead at all.

The threats keep changing. The business keeps moving. The technology never sits still. And security teams are expected to balance risk, speed, usability, compliance, and trust all at once.

I love it.

[Cyber_Racheal @CyberRacheal]

Hydra is free.
Nmap is free.
OpenVAS is free.
Kali Linux is free.
Wireshark is free.
Portswigger is Free.
Burp Suite is free.
Metasploit is free
John the Ripper is free.
OSINT Framework is free.
Shodan (basic tier) is free.
TryHackMe & Hack The Box (basic tiers) are free.

You claim you want to learn cybersecurity yet you give excuses about resources.

Nothing has to be perfect.

Not a fancy certification to begin.
Not a $1,000 course to practice.
Or even the “perfect” setup.

All you need is your laptop, phone, an internet connection, and the decision to start today.

Every day you delay, someone else is learning, practicing, and moving closer to the career you say you want.

Stop waiting for the “right time.”
Stop blaming the lack of resources.
Stop making excuses.

Start now. Learn now. Improve now.

Looking for a mentor when you have done nothing is a waste of time.

[Jan Kopecky @rnmx123]

@nyxgeek On related note, did you know, that 7z (running as admin), can browse to "PhysicalDrive0" (so \\.\PhysicalDrive0\3.Basic data partition.ntfs\Windows\System32\config\) and copy file from there? SAM is not locked, AV/EDR don't seem to give a damn :)

[BlackRoomSec @blackroomsec]

Please share this far and wide. As far and wide as you can. NIST Password Guidelines for 2024 are in the process of being updated.

This is a HUGE pet-peeve of mine (when vendors in particular are still operating like its 2017 and keep changing passwords every 60 days, STOP DOING THIS, it's outdated and has been shown to put you MORE at risk than less -- NIST explains why it does in this document, meticulously outlining user behavior**) so I'm sharing this in the hopes all of you will pass it along to your bosses.

The Special Publication series governing passwords is SP 800-63 "Digital Identity Guidelines".

The 2024 version is 800-63-4.

Here: https://t.co/oX8YEJHxXg

The companion docs are also on that link. They are 800-63A, 800-63B and 800-63C. These are different documents for different scenarios in play at your org.

The previous update was in2020.

The changes in the 2020 version from the 2017 version were numerous but one of them was that the password verification method should NO LONGER require passwords be changed at specific intervals (i.e. every 60 days) but in the following circumstances instead:

1. After a breach/compromise
2. User request

2024 repeats this and adds a bunch more guidlines but here is a screenshot of page 13 of the new 800-63-4 (note the # 4 after it) which outlines how your systems should now and moving forward, be handling passwords.

This goes for Active Directory, too. All your systems which have passwords should align with these guidelines provided there isn't another standard or framework you must adhere to which overrules this.

Most frameworks, however, have moved away from arbitrary password resets and complexity rules.

**We cybersec researchers and hackers use wordlists from breaches in a variety of different ways. Hackers use them in tooling to crack passwords whereas researchers use breach dumps to see the kinds of passwords users are creating and the psychology behind them.

Using complexity rules gets you the user psychology of:

Password1
Password2
and so on

Use phrasing instead and allow for spaces, which is important. Humans type phrases with spaces. They also mention phish-resistant methods and most vendors are on-board with MS going to be turning off all Legacy Auth next month, across all free accounts and tenancies.

I'm so excited for the new changes!

Ok I'm off my soapbox.

Share the love! Thank you!

[Aaron Hurt @aaronhurt]

@itsNTBmedia I wonder if she's considered information security as a profession? That'll be better, right?

[D-Coder @Damn_coder]

𝗙𝗥𝗘𝗘 𝗖𝗲𝗿𝘁𝗶𝗳𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗰𝗼𝘂𝗿𝘀𝗲𝘀 𝗳𝗿𝗼𝗺 𝗚𝗼𝗼𝗴𝗹𝗲:

1. Learn programming with JavaScript
https://t.co/GYv17vZmUC

2. Google's Python Class
https://t.co/85L0YMTYwy

3. Machine Learning Crash Course
https://t.co/vUbmkEuIGS

4. Fundamentals of Digital Marketing
https://t.co/dFQNOuFNOa

5. Introduction to Baseline: Data, ML, AI
https://t.co/6NNMNpm6R1

[L.A.M.Z @OlamideTowobola]

CISCO is offering FREE trainings and certifications for people looking to learn:

- Data Analytics,
- Data Science,
- Cybersecurity,
- JavaScript,
- Python

These are self-paced courses, so you can practice as you learn.

Open this THREAD to get started on your learning.

Repost for someone who needs this.

[Jake Williams @MalwareJake]

Great advice. I know at least one person who was helped out of a bad situation by a check-in like this.

[Aaron Hurt @aaronhurt]

My daughter found you! But we obviously weren't going to interrupt

[Aaron Hurt @aaronhurt]

@MikeStackpole are you at gencon this year?

[Aaron Hurt @aaronhurt]

@PicturesFoIder in my head I go 20+40 = 60, then 8+7 =15, 60+15=75

[Aaron Hurt @aaronhurt]

@rez0__ I freaking missed it again

[Aaron Hurt @aaronhurt]

An insightful thread. If you're into smart home hacking, privacy, or general mobile knowledge, this thread should peak your interest.

[HaxRob @haxrob]

A friend asked me to find out why his connected lightbulb app was asking for his location, so I ducked out to Australia’s favourite hardware store, Bunnings, and grabbed one to check out.

The Android grid connect app has 500k+ downloads.

Let’s take a quick look! 🧵
(1/n)

[Aaron Hurt @aaronhurt]

@MalwareJake I had to Google it, but now it makes sense. Lol.

[Aaron Hurt @aaronhurt]

@0xMatt @SwiftOnSecurity Can I get the source? I would love to borrow heavily from it! 🤣

[Aaron Hurt @aaronhurt]

The end is near? 🍻

[SwiftOnSecurity @SwiftOnSecurity]

Troubleshooting walkthrough:

Tonight I need to write a narrative of a case where a user complained a new browser add-in broke their mouse. This got escalated to me as the final tier.

I'm going to lay it out here first, because saying I'm working while laying in bed sounds cool.

[Aaron Hurt @aaronhurt]

Dinner conversation: if we really care about the environment, we should van carbonated drinks.... 🤔

[Aaron Hurt @aaronhurt]

@shortxstack One week of maternity leave is criminal.

Maternity leave needs to be the maximum.