Ben

@[email protected]

[Ben @masterofnone02]

@ben11kehoe @benbridts @EllerbyBen The council grows, pretty soon we'll be needing an AGM!

[Ben @masterofnone02]

@notdurson @Frichette_n @ben11kehoe @fwdcloudsec @benbridts @nojonesuk @kindofathing Hallway con just got hostile

[Ben @masterofnone02]

@ben11kehoe @fwdcloudsec @benbridts Selfies taken: 1
Agenda items resolved: 0

[Ben @masterofnone02]

Not taken long to confirm that fwdcloudsec is way easier to watch in person than 3am in the morning🌛 🕒

[Ben @masterofnone02]

@__steele @iann0036 @mreferre @rchrdbyd I sense a trap...

[Ben @masterofnone02]

@Frichette_n Mirroring some of the earlier comments, I'd expect most detections to not rely on Cloudtrail event history - in which case this would likely impair defences considerably. That said, I'd consider outright deleting trails as 'loud'. Updating trail mgmt event types might be viable

[Marco Lancini @lancinimarco]

🔖 Data exfiltration with native AWS S3 features

A deep dive on different options for abuse of legitimate S3 features with the end goal of data exfiltration, so to better understand the shortcomings of native AWS logging and monitoring tooling.

https://t.co/0a2E5wpl9r

[Ben @masterofnone02]

Put some time into understanding what the implications of using certain s3 features for data exfiltration are - with a focus on how they can be detected. https://t.co/Rl3mPqygoL

[Ben @masterofnone02]

When locals post cute messages to each other at the start of the week 🥰

[Ben @masterofnone02]

The path to a world without stock hacker hoodie photos was never going to be without set backs. Classy response from Malwarebytes 👏

[Malwarebytes @Malwarebytes]

An apology

[Ben @masterofnone02]

@0xdabbad00 Can see how 50k AMIs total could easily trip up some large orgs. 5 public AMIs also seems really small for those in the business of making AMIs externally available

[Ben @masterofnone02]

@smitleu ...before you were born

[Ben @masterofnone02]

@dagrz *climbs back into box*

[leura 🧍‍♀️ @smitleu]

any girl geek mates want a free ticket to parallels? we got some to give out!!

[BSides Melbourne @BSidesMelbourne]

@BSidesMelbourne Day 1 Training has kicked off. So thrilled to have @joff_thyer, @lady_nerd, @fancy_4n6, @aussieklutz , @GyledC, @sh3r4_hax and Paul running training for over 100 people today in-person👏👏
Lunch break soon 🍕

[Ben @masterofnone02]

@Frichette_n Timezone diff is going to be rough, but the quality of talk s looks awesome

[Ben @masterofnone02]

@Frichette_n Imho resource > IAM. Do whatever you want with IAM, but resource misconfigs brings in new accs outside trust boundaries into play

[Risky Business® Media @riskydotbiz]

Risky Business News is nearing launch! @campuscodi published an example RBN newsletter yesterday. This one is just a proof of concept to see how well the format works. The plan is to publish one of these, with an accompanying podcast, three times a week.

https://t.co/a1a2rD6RQi