Colin

Systems Admin/Engineer/Manager | Infrastructure and InfoSec | Occasional Homebrewer and BBQer | |

[Colin @EdwardsCP]

Verifying myself: I am edwardscp on Keybase.io. 7fTq6NUpRxFle4awtcWE25ouPbLdS8CjB8-x / https://t.co/Y8oplmzdkH

[Colin @EdwardsCP]

Here's the obvious workaround that dawned on me. Generate a new .pfx file with the TLS cert that uses the password 'yes'. Script ran perfectly. 😂

[Colin @EdwardsCP]

@IntuneSuppTeam pretty sure the script is automatically entering 'yes' when 'mst-cli install' is actually prompting for the password to import the TLS cert. Just not sure the best workaround to get through this.

[Colin @EdwardsCP]

@IntuneSuppTeam pretty sure the script is automatically entering 'yes' when 'mst-cli install' is actually prompting for the password to import the TLS cert. Just not sure the best workaround to get through this.

[Colin @EdwardsCP]

@IntuneSuppTeam having some issues with mstunnel-patch-2602 script to fix our MSTunnel server. Can someone DM me?

[BSides CT @BSidesCT]

#CallForPapers for #BSides CT 2025 is open now!
https://t.co/bzxp9OwA3j

[Colin @EdwardsCP]

Hey @VerizonSupport, the form in the MyVerizon app to transfer service to another account won't accept an email address with digits in the domain (i.e. [email protected]). It says "Please enter a valid email address". Been problem for a while. Anyone going to fix this?

[Colin @EdwardsCP]

... And the only thing different about this email's headers, compared to the hundreds (maybe nearly thousand) I've run through a Content Search over the years, is that there are commas in the header.
#InfoSec #CyberSec #IncidentResponse #phishing

[Colin @EdwardsCP]

If threat actors use a comma in the "From" header, it breaks MS Compliance/Exchange content search?
I have a phishing email with this header "From: HR Updates, September 30, 2024<rammyahmad[@]lehmancpa[.]com>". (remove the []'s)....
#InfoSec #CyberSec #IncidentResponse #phishing

[Colin @EdwardsCP]

...I would normally run a Content Search across all of our mailboxes with the ContentMatchQuery set to "(From:rammyahmad[@]lehmancpa[.]com)" (remove the []'s). But that's not returning any results...
#InfoSec #CyberSec #IncidentResponse #phishing

[Colin @EdwardsCP]

@bettersafetynet DeepBlue has a bunch of windows evtx, but I'm guessing you have that one https://t.co/1GMs123tas

[BSides CT @BSidesCT]

#BSidesCT will be held on Sept 21, 2024
#CallForPapers is open now!

#infosec #cybersecurity #hacking #conference #connecticut #SecurityBSides

https://t.co/dg5Hi04IN7

[Colin @EdwardsCP]

@HackingDave TPLO surgery? My 7 y/o mutt just got it done 4 days ago. We've been wondering about the whole recovery process b/c the vet has us prepped for a 10-12 week process. Only 2 tough weeks sounds much better.

[Colin @EdwardsCP]

When the client attempts to connect again after a disconnect, the VPN client first does the mTLS auth to the web service so that its IP has an allow ACL added again.  Then it does regular client UN/PW/MFA auth.
Does this reduce attack surface? I think so. Done. 10/10

[Colin @EdwardsCP]

I'm getting tired of VPN interfaces getting sprayed. It's a nuisance and can be a distraction from other more high value security alerts. I jotted down some notes a year ago with a concept for how password sprays on VPN interfaces could be completely eliminated... 1/n

[Colin @EdwardsCP]

(There's probably additional tracking that needs to happen for each public IP that's entered.  If you have a bunch of employees at the same hotel getting NAT'd out the same ip, you can't deny the connection as soon as 1 disconnects.  You need to track unique connections)... 9/n