mandrake

[Doug Burks @dougburks]

Wireshark is a great tool but looking at traffic packet by packet can be overwhelming and you may lose the plot of the story.

It's much easier to read a story if it has chapters, a table of contents, and an index.

Check out SO-CRATES as it helps you tell that story! https://t.co/J4tumWEJuS

[CiberBaur @BotBauR]

Acaba de confirmarse: Los actores de FortiBleed están colaborando con grupos de ransomware como Inc y Lynx, y también están explotando una vulnerabilidad zero-day en Nextcloud, lo que les permite monetizar el acceso a miles de firewalls Fortinet.

FortiBleed no es una vulnerabilidad única, sino una campaña de “credential harvesting” y access brokering contra dispositivos Fortinet FortiGate y SSL VPN. No hay CVE asociado a FortiBleed; el impacto proviene de interfaces de gestión y SSL-VPN expuestas a Internet, ficheros de configuración FortiGate que almacenan hashes de credenciales, y uso de hashes antiguos con SHA-256 + salt.

Los actores detrás de FortiBleed operan como initial access brokers (IAB), industrializando la obtención y validación de accesos que luego se venden a grupos de ransomware. Esto ha permitido a Inc y Lynx obtener acceso a miles de firewalls Fortinet, lo que les permite llevar a cabo ataques de ransomware y otros tipos de ciberdelitos.

¿Hay parche? No, ya que FortiBleed no es una vulnerabilidad única. ¿Qué deben hacer los afectados HOY? Revisar sus firewalls Fortinet y asegurarse de que no estén expuestas a Internet, cambiar las credenciales y habilitar el MFA. ¿Estás en riesgo? Revisa esto: verifica los logs de acceso y monitorea el tráfico de red para detectar cualquier actividad sospechosa.

#Ciberseguridad #Ransomware #SeguridadDigital #PYMEsMX

https://t.co/pwRwjRl9Dv

[mandrake @hsOpenMind]

@mrgeovas No siempre el cielo es gris... Siempre se escapa un rayo de luz para iluminar al correcto. Lo que sea que te este afectando, deseo que pase pronto. No todos los días son iguales, recuerdalo.

[mandrake @hsOpenMind]

@Rainmaker1973 @xdownloaderbot download this

[Massimo @Rainmaker1973]

How to shoot high-end photography

[Nicolas Krassas @Dinosn]

Claude Code / Codex Skill for Reverse Engineering https://t.co/WskCwPu2zF

[mandrake @hsOpenMind]

@yasminekho @xdownloaderbot download this

[Yasmine Khosrowshahi @yasminekho]

Stanford professor Judy Fan went on stage at MIT and broke down why humans are so good at making the invisible visible...

And why AI hasn't actually learned to "see" the way we do.

It completely changes how you think about Human Intelligence v/s Artificial Intelligence:

1. Nature never gave us straight lines or sharp corners. The number line, the coordinate plane, even basic geometry are all human inventions. We created tools that do not exist in nature simply because we needed a way to think more clearly.

2. The coordinate system Descartes invented solved a problem that had stumped mathematicians for centuries, doubling the volume of a cube. Once invented, this tool became so indispensable that virtually every math curriculum on Earth still depends on it.

3. Humans have been doing this for at least 30,000 to 80,000 years. The story of human progress is inseparable from the story of marking up our environment, from cave walls to Galileo's telescope to Feynman diagrams of particles we will never see with our own eyes.

4. Every major scientific breakthrough relied on a visual tool that made something invisible visible. Darwin needed side-by-side illustrations of finches to see variation that was otherwise too subtle to notice. Cajal needed detailed drawings of neurons under a microscope to map how the nervous system was wired.

5. Fan's research group studies something deceptively simple: how people decide what to put into a drawing and what to leave out. When two people played a drawing game, sketchers used far more detail when the target object had close competitors than when it stood alone, all the way down to using fewer strokes and less time when more detail was not necessary.

6. People are not just copying what they see. They are making constant judgment calls about what level of detail actually serves the goal of communication, and they do this naturally without ever being taught the theory behind it.

7. There is a real difference between drawing something so someone can identify it and drawing something so someone can understand how it works. In one study, participants drew explanatory diagrams that emphasized moving, causal parts of a machine while depictive drawings emphasized background and overall appearance, even though both were drawing the exact same object.

8. Explanatory drawings were genuinely better at helping someone figure out how to operate a machine, but worse at helping someone identify which machine it actually was. You cannot optimize a single drawing for both goals at once. Communication always involves tradeoffs.

9. AI vision models trained on photographs generalize surprisingly well to simple, sparse sketches, suggesting that resemblance based recognition is not just a story we tell ourselves. It is something modern neural networks can replicate with real accuracy.

10. But there remains a large, measurable gap between how confidently AI models recognize sketches and how confidently humans do, even when both groups answer the same questions about the same images. Humans are simply far more reliable and far more consistent in their judgments.

11. When researchers compared human-made sketches to AI-generated sketches under tight stroke budgets, both were similarly recognizable at higher budgets, but diverged sharply as the budget shrank. Humans and AI systems simplify drawings in fundamentally different ways once resources get scarce.

12. Reading a graph is not one single skill. It involves perception, knowing where to look, mapping that visual information onto the actual question being asked, and then translating that mapping into an answer. Each of these steps can independently break down, and people fail for very different underlying reasons even when they land on the same wrong answer.

13. When tested directly against humans on graph reading tasks, leading multimodal AI models, including GPT-4V, showed a meaningful performance gap. Even when a model's overall accuracy approached human levels, its pattern of mistakes looked nothing like how humans actually get things wrong.

14. People choose entirely different types of charts depending on what specific question they are trying to answer, not out of a generic preference for bar charts or scatter plots. Their chart choices closely tracked which visualization would genuinely help someone answer that specific question correctly.

15. Two of the most widely used graph literacy tests in education research turned out to correlate strongly with each other, suggesting they measure overlapping skills. But when researchers dug into the actual error patterns, the standard categories used in textbooks, like "find the maximum" or "identify a cluster," failed to explain why people got things wrong nearly as well as a more basic, underlying four-factor model did.

16. The deepest goal behind all of this research is not just academic curiosity. It is to eventually help students and everyday people develop genuine literacy with the visual tools that science and modern decision-making increasingly depend on, because every generation should be able to see further than the last by standing on the visual tools the previous generation built.

Follow @yasminekho for more ideas on thinking better, becoming clearer & building a more intentional life.

[mandrake @hsOpenMind]

@Ahmed___khaan Pentesting

[mandrake @hsOpenMind]

@OrlandoRPN El riñon:

[zSecurity @_zSecurity_]

Sick of ChatGPT and Claude refusing prompts? 🛑
Checkout my latest video to learn how to FORCE them to answer 👇
https://t.co/h7MZf3qq0M

[mandrake @hsOpenMind]

@edgarcfrancis Thank you for sharing

[Edgar C Francis @edgarcfrancis]

CCNA CCNP CCIE OSPF LAB
https://t.co/GbWSApB8oa

[mandrake @hsOpenMind]

@5min__crafts @xdownloaderbot download this

[Winston Ighodaro @Officialwhyte22]

.@segoslavia You’re the SOC analyst on duty. A user reports that their computer started behaving strangely around 21:21. Based on this Wireshark capture, what stands out to you, and what would you investigate next? Explain your reasoning.

[Philip Elder @MPECSInc]

ACTIVE DIRECTORY SECURITY SIMPLICITY

PAW - Privileged Access Workstation
Jump Server - Only for administration
DUO/2FA - Mandatory
Group Policy
- Windows Firewalls on DCs locked down
- RDP inbound only from Jump Server(s)/PAW(s)
- Software Restriction Policies
-- Yeah, we kill Chrome and all other %LocalAppData% abuses
-- Lockdown app access
- User Account Control
-- Mandatory for ALL domain users
-- On the Secure Desktop
-- Credentials Required for ALL
-- RD Session Hosts: Elevation BLOCKED

Now, here's our ADDS KISS (Keep It Simple S_______) Architecture:

In today's modern threatscape the above gets implemented in a dedicated role based ADDS Forest/Domain!
- Production: UserVille
- Infrastructure: Servers not required on UserVille
- Dev: Yeah, they don't belong anywhere near UserVille
- DMZ: IIS security is better under ADDS
- IT: Yup, support gets their own Forest/Domain
-- RemoteApps in UserVille suffice
-- One can restrict copy/paste to PAW/Jump Server

Now, one can create a trust but it should be one way and one should always keep in mind that _UserVille is a Hostile Tenant_ no matter what!

Remember, most compromises start with an errant click in UserVille. So, we can mitigate out of the box with a solid, secure, and segmented architecture.

[Martin Sohn Christensen @martinsohndk]

#TROOPERS26 afterglow: @4ndr3w6S on building a solid LDAP detection stack - why signature-based detection is failing and volume-based detection generally wins. Lots of tips for detecting SharpHound, ldapnomnom, SOAPy & more.
Detection engineering is so cool..

[✦ VISUAL AI ✦ @VisualconAI]

Ingeniero de Anthropic:

"Puedes crear 5 asistentes en una sola tarde. Cada uno se encarga de una tarea que has estado haciendo manualmente todos los días."

En 45 minutos muestra exactamente cómo hacerlo desde cero, paso a paso.

La mayoría de la gente sigue haciendo todo esto a mano.

Mira la sesión y luego guarda la guía de abajo.

[mandrake @hsOpenMind]

@VisualconAI @xdownloaderbot download this

[mandrake @hsOpenMind]

@Synacktiv Thank you for sharing