Chris Roffe

Making network detection, forensics, and response go brrrrrrrr.

[Chris Roffe @croffe]

One of the Cybersecurity AI Assistant models I'm working on really puts the "ass" in assistant:

[Chris Roffe @croffe]

@shenetworks I recommended bash. You've already got Python and Go for the heavy lifting, being fast in a shell — log triage, pcap slicing, pipeline glue, remote box work. Every SOC, IR, and detection eng role is strengthened by it. If you’re in a windows shop; powershell.

[cats with powerful impression 🐾 @catshealdeprsn]

You're doing amazing sweetie

Source: heidiwranglescats via Instagram

[blackorbird @blackorbird]

Exposing Russian Malicious Infrastructure: 1,250+ C2 Servers Mapped Across 165 Providers
https://t.co/FZ2pSGzcFI

[Sweep @0xSweep]

Two guys ran an entire hacking operation in a PRISON for months

In 2015, two prisoners in Ohio were assigned to a recycling program where they dismantled old computers

Instead of scrapping the parts, they started stealing them

Carried components over 1,100 feet past guards, metal detectors, and multiple security checkpoints

Then built two working PCs and hid them behind a plywood board in the ceiling of a training room closet

They ran cables from the ceiling into the prison's own network

Stole login credentials from an employee by watching him type his password

Set up Bitcoin wallets, Stripe accounts, bank accounts and credit card applications using another inmate's stolen identity

Downloaded VPNs, the Tor browser, password cracking tools and what investigators called "a large hacker's toolkit"

Created fake security passes to access restricted areas of the prison

This entire operation ran for months

They only got caught because one of the computers used so much bandwidth it triggered an automatic alert

The Inspector General said it was "almost as if it's an episode of Hogan's Heroes"

Two guys with recycled computer parts and a ceiling tile built a cybercrime operation inside a state prison

[Chris Roffe @croffe]

@bettersafetynet @AtomicGaryBusey Agree. The digital twin approach is a massive efficiency, definitely force multiplies existing staff. Saying it can/will reduce headcount is so mid.

[Chris Roffe @croffe]

@EdwinTich @chrismwojcik

[Chris Roffe @croffe]

@TracketPacer

[Chris Roffe @croffe]

@TracketPacer That’s a sexy pic.

[TracketPacer @TracketPacer]

weird network stuff on the carpet

[Chris Roffe @croffe]

@A_dmg04 @sc0nesandc0ffee One day. You will FOR SURE get an exfoliating with stacks of gel… just gotta hang in there.

[Chris Roffe @croffe]

@HackingLZ

[Chris Roffe @croffe]

@cyb3rops Lots of people have been learning about Obsidian lately 😉

[Bryson 🦄 @brysonbort]

It's getting cold out there,
Bring them inside.

[Chris Roffe @croffe]

@brysonbort @kmcnam1 Love the SG1 Vs Replicator vibes.

[Chris Roffe @croffe]

@vxunderground Did you also smell burnt toast and get flush?

[Chris Roffe @croffe]

@HackingLZ I’m a big fan of the “Oxford” style pads that have a light cardboard folding cover that you stick tape on and label.

[Chris Roffe @croffe]

@bettersafetynet Everyone uses the Requests library at one time or another. Maybe.

[Chris Roffe @croffe]

@LisaForteUK

[Chris Sanders 🔎 🧠 @chrissanders88]

Investigation Scenario 🔎

A teacher’s laptop shows a spike in traffic to api[.]school-supplies-check[.]com every morning at 8:05 AM. You cannot access anything at this domain.

What do you look for to investigate whether an incident occurred?

#InvestigationPath #DFIR #SOC

[Chris Roffe @croffe]

@infosec_fox Gardening. You should see my flowers there’s always 1-2 things blooming from March-October. Seriously.