TCC

Cybersecurity Executive @███████ By Day. Husband/Dad/Geek by night. @MayoClinic IT Leader Alumni. Views, Opinions & Random Brilliant Thoughts Are My Own.

[TCC @iTodd_]

Where Can I Do The Most Good Today?

Wherever You Are - Be There.

#Leadership #LetsDoThis

[JS0N Haddix @Jhaddix]

https://t.co/MUsOCCTjfS

[MG @_MG_]

I’m a bit concerned about the non-inquisitive celebration from infosec on this.

Where is the “what does keystroke latency even mean?” Without that, you can’t implement it for yourself, nor can you identify weaknesses.

~3yrs I was privately proposing similar options. So, AS SOMEWHAT OF A KEYBOARD EXPERT MYSELF 🤔💅, let’s look…

First, this is most likely NOT a direct measure of network latency. This machine was physically located in Arizona. DPRK started off with shipping corp laptops overseas, but the network latency was a dead giveaway. So they started colocating them in the USA and remotely controlling them. First with remote control software, which is easy to identify if the company has security software on the machine. And then with hardware like IP-KVMs. There are sometimes a few tells that an IP-KVM is in use, but a well tuned one will identify exactly like a normal external keyboard/mouse/monitor. Unless…

This is where you have to start looking beyond device identity and instead look at input anomalies. Keyboard/mouse input being sent halfway across the world via network packets to an IP-KVM can look… weird. Think bursts of input. This looks very weird with mouse data that is normally smooth. But even keystrokes start to stand out when you have a big enough dataset to compare against. So, of course, you could improve the IP-KVM to smooth out and “humanize” the inputs before relaying them to the host. But…

You can also present some real time control surfaces. I don’t want to blow anyone’s defense tradecraft here. So let’s just imagine the employee needs to play a 5sec game of flappybird each day. Or maybe it’s an overt “DPRK Detector” step during login. The visual input has to travel halfway across the globe, then the input has to come all the way back. That’s a massive delay for response to visual stimulus. Certainly anomalous enough to warrant investigation. How do you beat that? Maybe an AI process running on the IP-KVM that plays DPRK Detector for you?

The arms race will continue. And it’s mostly because HR and Hiring Managers don’t want to do deeper background checks needed to identify fake/stolen identities. 🤷‍♂️

And for anyone not familiar with these hunts, the detection techniques are NOT definitive proof of wrong doing. They are simply turning a mountainous hay stack into a fistful of hay that a human can quickly sift through to look for other indicators.

Note: there are environment-specific detections as well. But I tried to stay in territory that’s applicable to everyone who has this risk in their threat model.

[Tom's Hardware @tomshardware]

North Korean infiltrator caught working in Amazon IT department thanks to lag — 110ms keystroke input raises red flags over true location https://t.co/R5H441vDWn

[TCC @iTodd_]

@gabsmashh

[TCC @iTodd_]

AI is doing great. (At some things)

[sui @birdabo]

LMAOOO an AI detector just flagged the 1776 Declaration of Independence as 99.99% ai-written.

> millions of professors use this tool 💀

[gabsmashh @gabsmashh]

https://t.co/nU5ftKmQtl

[BleepingComputer @BleepinComputer]

CrowdStrike says it caught an insider sharing screenshots taken on internal systems with unnamed threat actors.
https://t.co/eBjDCk391y

[Hackmanac @H4ckmanac]

🚨Cyber Alert‼️

🇺🇸USA - Crowdstrike

CrowdStrike has identified and terminated a malicious insider who leaked internal screenshots to hackers.

The incident came to light when screenshots of CrowdStrike’s systems appeared on Telegram, shared by threat actors from groups including ShinyHunters, Scattered Spider, and Lapsus$.

According to ShinyHunters, they paid the insider $25,000 to gain access to CrowdStrike's network and received SSO authentication cookies.

Status: Confirmed

Source: https://t.co/2Op2WexKap

[TCC @iTodd_]

@rootsecdev Can’t. We all need one.

[rootsecdev @rootsecdev]

Someone talk me out of getting this shirt

[sudox @kmcnam1]

Now everyone follow her with your sock accounts so winter feels some extra love :P

[TCC @iTodd_]

https://t.co/ycHRVxStL5

CISO Docuseries this fall:

[TCC @iTodd_]

Uber needs a better on-ramp. It needs to be purposeful. And organizations need to develop talent not try to hoard or acquire it.

[Mike Miller @mikemillercyber]

HR be like:

"Entry Level Cyber Security Job Available!"

Requirements:

→ 17 years experience
→ CISSP, CISM, CISA, OSCP, PMP
→ Must have Doctorate

Pay is $7.25 an hour plus a monthly pizza day.

Would you apply?

[TCC @iTodd_]

Security theater- and they confiscate all your mini keychain pocket knives and sell on eBay.

[Rothmus 🏴 @Rothmus]

🤔

[TCC @iTodd_]

Security theater- and they confiscate all your mini keychain pocket knives and sell on eBay. Profiting on your loss.

[Rothmus 🏴 @Rothmus]

🤔

[gabsmashh @gabsmashh]

Cyber Command 2.0 is getting fast-tracked—180 days down to 45. this signals a shift in U.S. cyber warfare strategy, with a push for expanded operational authority. will be very interesting to see how this plays out. https://t.co/n7SjmkLMY5

[The Hacker News @TheHackersNews]

OpenAI has taken action against a network using ChatGPT to develop an AI-powered surveillance tool targeting anti-China protests.

The tool, believed to be linked to Chinese authorities, analyzes social media content from platforms like X, Facebook, and Reddit to gather real-time data.

Read the full article: https://t.co/LcBHTqmcNk