Ben April

CTO Maltego Technologies GmbH, Security researcher, tools guy, and all around geek. Opinions are my own.

[Ben April @bapril]

Awe shucks. I’m honored to be on such a rarified list. Thanks gang, I greatly appreciate the shout out!

[DomainTools @DomainTools]

Continuing #NationalGratitudeMonth! Thanks for all you do for the community @NicoleBeckwith, @BSides_NoVA, @DavidJBianco, @bapril, @kyleehmke, @MalwareJake, @th3_protoCOL, @Jhaddix, @SwiftOnSecurity, @TipsyBacchus, @HackingDave, @ANeilan

[Ben April @bapril]

Um… WTF?

[Kinnaird McQuade @kmcquade3]

Okta allowing login bypass for any usernames with 52+ characters is insane

Official Security Advisory: https://t.co/3b4v30q53z

[DomainTools @DomainTools]

Social media provides an abundance of info for investigators, but too much can lead to information overload. @bapril from @MaltegoHQ discusses this challenge and how orgs can leverage social data as a source of intel for investigations: https://t.co/JDpCIjuHal

[Maltego @MaltegoHQ]

[1/3] Don't miss the interview with #Maltego CTO, @bapril, on the latest @thecyberwire as he breaks down how social media has become a key source of intelligence for all digital investigations: https://t.co/7xYWEfA66U

[Ben April @bapril]

@AlyssaM_InfoSec @xToolOfficial Very cool!

[Ben April @bapril]

Let's hope this gets picked up quickly by operators.

[BlackRoomSec @blackroomsec]

Please share this far and wide. As far and wide as you can. NIST Password Guidelines for 2024 are in the process of being updated.

This is a HUGE pet-peeve of mine (when vendors in particular are still operating like its 2017 and keep changing passwords every 60 days, STOP DOING THIS, it's outdated and has been shown to put you MORE at risk than less -- NIST explains why it does in this document, meticulously outlining user behavior**) so I'm sharing this in the hopes all of you will pass it along to your bosses.

The Special Publication series governing passwords is SP 800-63 "Digital Identity Guidelines".

The 2024 version is 800-63-4.

Here: https://t.co/oX8YEJHxXg

The companion docs are also on that link. They are 800-63A, 800-63B and 800-63C. These are different documents for different scenarios in play at your org.

The previous update was in2020.

The changes in the 2020 version from the 2017 version were numerous but one of them was that the password verification method should NO LONGER require passwords be changed at specific intervals (i.e. every 60 days) but in the following circumstances instead:

1. After a breach/compromise
2. User request

2024 repeats this and adds a bunch more guidlines but here is a screenshot of page 13 of the new 800-63-4 (note the # 4 after it) which outlines how your systems should now and moving forward, be handling passwords.

This goes for Active Directory, too. All your systems which have passwords should align with these guidelines provided there isn't another standard or framework you must adhere to which overrules this.

Most frameworks, however, have moved away from arbitrary password resets and complexity rules.

**We cybersec researchers and hackers use wordlists from breaches in a variety of different ways. Hackers use them in tooling to crack passwords whereas researchers use breach dumps to see the kinds of passwords users are creating and the psychology behind them.

Using complexity rules gets you the user psychology of:

Password1
Password2
and so on

Use phrasing instead and allow for spaces, which is important. Humans type phrases with spaces. They also mention phish-resistant methods and most vendors are on-board with MS going to be turning off all Legacy Auth next month, across all free accounts and tenancies.

I'm so excited for the new changes!

Ok I'm off my soapbox.

Share the love! Thank you!

[Ben April @bapril]

@AJVicens I wouldn't care when I board if I had a designated overhead bin space. While we're at it, can we stop pretending the space under the seat in front of you is useful for anything but feet for moderately tall people?

[Ben April @bapril]

I advocate for teaching people to create phishing lures. Learning phishing as a creative process improves detection. Punishing a user for clicking on a link is just dumb, makes them less likely to report that they are a human being.

[Ben April @bapril]

@TracketPacer I’ll suggest if someone doesn’t understand why a hub is useful, maybe they don’t really understand why we invented switches in the first place… Stay strong!

[Ben April @bapril]

@TracketPacer As you said a crossover is just an A and B end on the same wire. Somebody (else) is missing something…. Color-coding wise “568A Crossed” looks wrong to me, but functionally it will work just like a “568B Crossed”…

[Ben April @bapril]

With fear for our democracy I dissent!

[Ben April @bapril]

Looking forward to seeing how it works for you.

[Ben April @bapril]

@AmyPearlman @AlyssaM_InfoSec With every new class of tool I've observed a cycle, you start using it for everything. As you learn the process and quirks you get more selective, to the point usage drops. After that when you do use it you are planning projects with that capability in mind. Usage will drop.

[Ben April @bapril]

@AlyssaM_InfoSec Having access to a good laser cutter/engraver Is like having access to a 3D printer, welder, or milling machine. They all unlock entire new classes of problems that you can now solve or parts you can now create.

[Ben April @bapril]

@AlyssaM_InfoSec I went for an OMTECH 60W. I didn’t want anything that required a service to run. It’s a bit less “magic” but I get more control. I use Lightburn software ($120 and IIRC $60/year).

[Ben April @bapril]

@AlyssaM_InfoSec That’s a fair worry. I got mine during COVID, Used the crap out of it for two years. Use it less now than I did in 2020-2021, but still fire it up every couple of weeks as projects inspire me. Used it today to mark some audio adaptor.

[Ben April @bapril]

@AlyssaM_InfoSec As I developed jigs, tools and proces I now spend less time making scrap. Lots of trial and error (time/scrap) at the beginning, now that I’ve got tools and experience, I can go from and idea to a complete part in usually a few minutes.

[Ben April @bapril]

I always a pleasure to chat with Kali and the @DomainTools crew!

[DomainTools @DomainTools]

The next iteration of our mini series is here! We're chatting with @bapril of @MaltegoHQ and @uuallan of @RecordedFuture covering topics like AI, sanctions against the #LockBit Ransomware leader, #cybersecurity comic books, and more! 🎧 listen here: https://t.co/FD6VZ6LhlL

[Ben April @bapril]

We called this spyware yesterday..

[Molly White @molly0xFFF]

back in my day we called this spyware