plug

Your atypical security enthusiast | DFIR | Threat Hunting | Detection Eng | Insider Threat | Making content at The Blue Team Village | Opinions are my own.

[plug @plugxor]

@ImposeCost Congrats, keep empowering folks and shaping TI at Google!

[plug @plugxor]

@ImposeCost Nah, I been giving coins at conferences for years. I remember sending one your way a few years back via @ItsReallyNick

I don’t get challenged that often but doesn’t matter. Ultimately, I make my coins and I get to choose how and to whom to give them!

[plug @plugxor]

There are individuals that you meet in your life that leave a mark, not just for their kindness & care, but for their humbleness & friendship. @d0ublebind is such individual and more!

Please consider donating and send him lots of love ❤️

https://t.co/8OPT1rymZW

#FuckCancer

[plug @plugxor]

@gnuowned Muchas felicidades, les deseo lo mejor del mundo!

[plug @plugxor]

@Cyb3rWard0g ¡Felicidades!, con todo y siempre para adelante , saludos Roberto!

[plug @plugxor]

@v3rbaal @JonSelman @defcon Congratulations, looking forward to meet Hunter!

[plug @plugxor]

@Cyb3rWard0g Felicidades Roberto!

Te deseo lo mejor en tu nueva aventura profesional, saludos!

[plug @plugxor]

If you are looking for very skillful, knowledgeable, and great human beings for your Red Team, please consider @Salbei_ and @Micheal_merrill

I worked with them for many years and with confidence can say that your team will greatly improve with them!

[MG @_MG_]

Some of the people who are looking include @Salbei_ & @Micheal_merrill

I’m also happy to forward leads to the team

[plug @plugxor]

@jrozner What an amazing journey, thank you for all the hacks and epic stories, you all transformed and left a mark in the org!

[plug @plugxor]

@_MG_ @MischiefGadgets Going to miss our chats, thank you for being awesome!

[plug @plugxor]

@ImposeCost Doubt it, he is about to make lots of $$ with his WLFI business aided by the new crypto regulations with the creation of DOGE. He is a businessman man first; we all know it.

[plug @plugxor]

Last year we used JuiceShop with a twist during our CTF. If you want to learn more about bug bounty and app security Juice Shop is a fun way to get started!

[OWASP Juice Shop @owasp_juiceshop]

Join the shared User Day of @owasp #DSOMM and #JuiceShop on Sep 25th, the day before @appsecusa San Francisco 2024! The agenda includes intros, demos, workshops and even a live CTF:
https://t.co/B5Od0l6jHh

Register now on https://t.co/3eaGVveR2k because seats are very limited!

[plug @plugxor]

This, get familiar with your logs and how they can help you find this much more practical and likely scenario.

Then, have a documented plan on how to respond and mitigate!

[MG @_MG_]

For anyone worrying about this, I’d like to hear how you were already handling a near identical attack that didn’t require this vuln:

- steal Yubikey
- login
- returns key WITHOUT cloning it, because 1 session is enough for most objectives

Same attack flow.

If that wasn’t already part of your threat model, why is this?

If it was part of your threat model, how do your existing defenses not already handle the vuln? (I can think of a few, but none that apply to most of the people who are concerned)

This should change very little for most people.

[plug @plugxor]

@birchb0y @stuartjash Congrats Alden, you rock dude!

[plug @plugxor]

@ImposeCost We have this type of conversations in the form of Panels at @BlueTeamVillage. If you are down, we can organize something for next year!

[plug @plugxor]

@obnoxious4n6 Congrats, keep on rocking!

[plug @plugxor]

@Cyb3rMonk Neither!

A detection needs to trigger as close as possible to real time and should be as high confidence as possible, anything else needs further review and/or tuning!

[plug @plugxor]

Just in case, not bashing on them. Things happen and we all learn from them. But it was a good opportunity to highlight the choice of words on the tweet. The report released lacks the details many us were probably expecting, but is short and on point for what it is.

[plug @plugxor]

Great use of the word likely in context of an investigation for which data may not be conclusive. When not fully sure, likely is a good word to choose.

Their 2nd tweet tells the story, it was 2FA, the lack of it, plus “likely” an easy to guess password…

Kudos for the report!

[Mandiant (part of Google Cloud) @Mandiant]

We have finished our investigation into last week's Mandiant X account takeover and determined it was likely a brute force password attack, limited to this single account.

[plug @plugxor]

@jfslowik There is a great documentary on both Concorde & TU-144 detailing the spionage that took place & the failures by the RU

Unlike the TU-144, the Concorde demise is linked to 911. On 911 the revised, post accident Concorde flew 4 the 1st time. Upon landing the crew learned of 911!