PageinSec

Geek, researcher, teacher.
Sec+, eJPT.
Statements, etc are my own.
Follow/like != endorsement
IANAL, don't do illegal stuff, etc.

[PageinSec @pageinsec]

Great info. I would add 1) if a leet style code question comes out, really think about if that's the kind of place you want to be and 2) consider whether take home stuff has crossed into free work territory, you're interviewing not consulting.

[julie agnes 🌈 @JulieASparks]

Interested in interviewing in the Detection & Response field? I made an informational guide on how to approach interviewing to make all our lives easier ✨
https://t.co/tNq0KSZ2UI

[BrBr @bryanbrake]

@mzbat will be joining us on #brakeSecEd #twitch stream this weekend to discuss hiring... this thread is telling of the fuckery that is #infosec and #cybersecurity right now. https://t.co/GFqo37WZoO

https://t.co/LkCK7etQfy

https://t.co/wQSCqQOoAd

[PageinSec @pageinsec]

@techyteachme @KyleBailey22 @kwm Thanks for sharing @techyteachme! And @simonekrausora1's blog is awesome, great find.

[PageinSec @pageinsec]

One of many great talks at the summit

[Stef Rand @techieStef]

Hello to all the new folks! I had a blast presenting at this year's SANS Blue Team Summit & wanted to show off @MindsEyeCCF's amazing graphic of my talk!

In this thread I'll include detection opportunity pseudo-analytics I mentioned, and also link to additional resources! 🧵

[Mar_Pich @Mar_Pich]

6 months ago, I started working on a way to better map the #ransomware ecosystem and its evolution, including rebrands.🔎
I am really happy to share this handmade cartography, which is based on @orangecyberdef resources, #OSINT and reverse engineering.
➡️ https://t.co/cKK57AM07f

[PageinSec @pageinsec]

Some thoughts on #threatmodeling - https://t.co/zIx6jZfFgG

[Shoshana Weissmann, Sloth Committee Chair 🦥 @senatorshoshana]

NEW in my series on the fundamental problems with age verification legislation: If platforms are required to have your government IDs and face scans, hackers and enemy governments can access them too https://t.co/iPWpFiEgSh

[nyxgeek @nyxgeek]

Why user enumeration is important --

We can think of a login attempt like this:

username + password = [successful login]

-At a large organization, we can be pretty sure that at least one account will have a weak or common password (Spring2023, Ilovemyjob2023!, etc).
-This makes it a problem of finding the right username rather than the right password

So if we instead view the 'password' as a known value (within probably 100 passwords), we only have one variable to solve:

username + 'Spring@2023' = [successful login]

The username is the hard part to find, not the weak password, which we can assume exists in many (most?) AD environments.

If we can enumerate valid users, then we can reduce our list of attempted usernames per-spray from an order of 10,000,000+ to 1,000 or so. Password spraying 1,000 known valid accounts is much faster than 10m unknown. Enumeration is an investment on your password sprays. You invest time up front enumerating, and you are paid back with targeted, fast sprays down the line.

If we reach 100% user enum (improbable), what are the odds that at least one AD account has a bad password set, that falls in the top 100 most common passwords list?

The more time spent spraying, the more passwords an attacker can cycle through, and user enumeration is the key that allows them to do it in a timely manner. In a matter of months, an attacker could easily go through a top 500 passwords list with a targeted list of users. If user enumeration wasn't possible, it would increase the time investment of an attacker substantially, and likely render the attack unfeasible.

User enumeration doesn't have to exist. It's an unnecessary design choice.

[Keith Krueger @keithkrueger]

Hoping FCC listens to the overwhelming supportive public record on modernizing Erate firewall coverage . This is national problem 4 ALL schools. https://t.co/wJ2TS0Nnre @CoSN @JRosenworcel @SimingtonFCC @BrendanCarrFCC @GeoffreyStarks

[PageinSec @pageinsec]

@SiliconShecky It's very difficult. At some point, you can eyeball things fairly well. I switched from MFP to Lose It, and I actually like it better. Logging food is a PITA. If you aren't into specifics, I find just doing calories easier a lot of the time.

[PageinSec @pageinsec]

Should not have laughed at this, but I did.

[vx-underground @vxunderground]

Today it was reported the United States has allocated $44,000,000 for their annual cyber defense budget.

They have successfully allocated enough funding to purchase VirusTotal Enterprise, a few RecordedFuture licenses, and have installed CarbonBlack on 4 computers

[Nathan McNulty @NathanMcNulty]

Finally published my methodology for implementing Microsoft Defender ASR rules

https://t.co/EYCdwtmyYn

I wrote it down over a year ago and modified it for my blog 6 months ago thinking I'd improve it. With kids, Alaska move, etc, it never happened... so feedback appreciated! :)

[Ryan K @meansec]

Waiting on OpenSSl project like

[CYBR.SEC.Events @CybrSecEvents]

Who’s ready for day 1?

[Oklahoma Department of Wildlife Conservation @OKWildlifeDept]

The eastern hognose snake will flatten its entire head to look like a cobra or flip belly-up and pretend to be slowly dying if you're looking for pointers on how to get out of a meeting just saying

[PageinSec @pageinsec]

@KeirstenBrager There aren't adequate words. Condolences and prayers for all of you.

[PageinSec @pageinsec]

Lots of interesting talks at @HouSecCon this year (yes I did delete previous because of dang autocorrect)

[CYBR.SEC.Events @CybrSecEvents]

Catch @pageinsec from @FloQast at HOU.SEC.CON 2022! https://t.co/8quzjo980D

[Wietze @Wietze]

The #LOLBAS project's website now provides automatically updated feeds containing all entries part of the project!

🆕 .JSON file with the project's data set as data objects
🆕 .CSV file with the project's data set, broken down by command

Check it out!
👉 https://t.co/mDyGq8ECoJ