Steven Danneman

Security Engineer, finance geek, traveler.
@[email protected]

[Steven Danneman @sdanndev]

When you go looking for bugs... you find them.

[Steven Danneman @sdanndev]

@travismcpeak @leifdreizler Mt. Gox went bankrupt in March 2014. The court has just delayed payouts for another year.

[Jack Rhysider 🏴‍☠️ @JackRhysider]

You should be aware of the term "harvest now, decrypt later". At some point, the encryption we use today will be easily crackable. Don't rely too heavily on it. Better to be very protective of where your data ends up, even if it's encrypted.

[Steven Danneman @sdanndev]

Credit union BECU has turned off Quicken access for 2 months and counting due to cyber attacks. MANY banks still allow user:pass only access to OFX with no MFA, ripe for password spray and reuse attacks.

https://t.co/vnkOvrIt3Y

[Steven Danneman @sdanndev]

@JackRhysider I'd like you to know that after listening to 100 wonderful episodes of Darknet Diaries I heard your voice in my head reading this post.

[Steven Danneman @sdanndev]

@Clarkee @paymentvillage I just posted my write-up here: https://t.co/HMnquJqYeP

[Steven Danneman @sdanndev]

My write-up for the #DEFCON31 @paymentvillage Card Hacking Challenge.

https://t.co/Nw7JwgiiIL

[Steven Danneman @sdanndev]

Thanks @paymentvillage for a fun, realistic, hacking challenge! $100,000 charged and 18 card numbers stolen. #DEFCON31

[Steven Danneman @sdanndev]

My write-up for the #DEFCON31 @paymentvillage Card Hacking Challenge.

https://t.co/Nw7JwgiiIL

[Steven Danneman @sdanndev]

.@Grifter801 what if you make a beer cold by launching it into space? #DEFCON31

[Steven Danneman @sdanndev]

@__muscles Thanks for the bourbon. Great to commiserate on AWS SSO with you.

[Holly Graceful @HollyGraceful]

SSL/TLS issues come up all the time during PenTests and explaining the technical detail of all of the different TLS configuration options can be quite difficult - so I put together a handy guide!

https://t.co/mCNEjDyv7H

[Steven Danneman @sdanndev]

@tecknicaltom Cash, in a brown paper bag, at a dead drop.

[Steven Danneman @sdanndev]

@arkadiyt * Uses authn/authz outside the supported path
* Creates a new public endpoint/API
* Involves payments/money

List the product areas that are high impact or frequently cause security bugs.

[Steven Danneman @sdanndev]

@travismcpeak Welcome!

[Jeremy Allison @jra_samba]

Just got laid off from Google. If anyone needs SMB 1/2/3 protocol or Open Source experience, I'm interested.

[kache @yacineMTB]

if you don't release an API people will build a whole selenium browser automation over it smh

[Steven Danneman @sdanndev]

@molly_struve You should put "trigger warning" on content like this. So much time spent asking WTF is this service?

[Steven Danneman @sdanndev]

@MalwareJake The fictional version is a really enjoyable yarn.

https://t.co/taA2Pn0Wf4

[Travis McPeak @travismcpeak]

As an industry, security needs to move away from filing a vulnerability Jira ticket and calling it a day. Business risk is only reduced when vulnerabilities are mitigated or fixed. Far too many Jira tickets stay open for months or even years. In these cases, we haven't helped. 🧵

[Steven Danneman @sdanndev]

The most thorough timeline and technical explanation of the incident I've read so far. A lot of good lessons learned for other companies in this post mortem.

[Ryan McGeehan @Magoo]

A lot has been spoken about Uber case, but I went and purchased the trial transcripts before they were set to release in 2023:

A blameless post-mortem of USA v. Joseph Sullivan

https://t.co/qNyt3bqJKb

[Ryan McGeehan @Magoo]

A lot has been spoken about Uber case, but I went and purchased the trial transcripts before they were set to release in 2023:

A blameless post-mortem of USA v. Joseph Sullivan

https://t.co/qNyt3bqJKb