Replying to
@cR0w@infosec.exchange
@cR0w@infosec.exchange Degenerate poll idea, which threat actor did marketing draw the most fuckable fursona for
Remote
tehfishman
@tehfishman@ioc.exchange
mastodon
4.7.0-alpha.2+glitch
"professional" peanut gallery for security stuff
12
Followers
75
Following
50
Posts
Joined November 08, 2022
Posts
Replying to
@pedro_mateus@mas.to
@pedro_mateus@mas.to @wdormann@infosec.exchange This from Pedro Meatus
Replying to
@mttaggart@infosec.exchange
@mttaggart@infosec.exchange cory doctorow recently wrote about the hazards of using LLMs as a teaching aid that I think has some overlap here. The short version being that LLMs when used for learning are hazardous because an expert knows when an LLM is producing bullshit, but a novice doesn't and is more susceptible to accepting bullshit as fact. You have probably done enough malware analysis to know when an LLM based tool is way off the mark. But a novice security analyst might throw a malware sample at an LLM, get a terribly misleading result, and be completely lacking in the skills to refute it.
To some degree, that's true of many tools in the security space. That same novice analyst let loose on the full contents of an enterprise Splunk environment will easily get lost in the endless sea of scary looking log events. But many tools don't lie so... convincingly.
I guess those limits, and where they translate into added danger, are up to every individual defender to gauge for themselves though.
So many thorns.
Replying to
@mttaggart@infosec.exchange
@mttaggart@infosec.exchange it's real thorny. Additional concerns: long-term usage causes you to slowly de-skill, which means you progressively become less capable as a defender. And the LLM tools will almost certainly become more expensive over time because the industry is in the sweetheart deal phase, leading to you having to charge more for defense. Both of which are negative for the overall goals of providing defense.
Replying to
@c0coChannel@infosec.exchange
@c0coChannel@infosec.exchange These demons... do they at least have a flared base?
Replying to
@cR0w@infosec.exchange
@cR0w@infosec.exchange hmm if we're talking dumb ideas, my last idea is to split the file and delete the files containing what you don't want. I don't know if split uses intermediary files though, and re-combining them seems like it would be a problem if you don't have space to store multiple copies of your pruned data.
Replying to
@cR0w@infosec.exchange
@cR0w@infosec.exchange Yeah was just a joke. I do wonder if there's a way to make truncate operate on the head end of a file instead of the ass end. That would definitely modify the file in-place. I'm pretty sure sed -i also uses a temp file. Curious to know what your actual solution was.
Replying to
@cR0w@infosec.exchange
@cR0w@infosec.exchange If the data is very compressible and you do have disk space to store the original + the compressed version, gzip it first, delete the original, then pipe it back through gzip and pull out only the lines you want with tail or grep or something
Replying to
@GossiTheDog@cyberplace.social
@GossiTheDog@cyberplace.social at work I keep saying that we're putting way too much trust in our EDR vendor because if they get hacked we're totally fucked. And everyone thinks that's impossible and I'm crazy for suggesting it. And here's Microsoft, demonstrating the very clear possibility of an EDR vendor mishandling data security
Replying to
@neurovagrant@masto.deoan.org
@neurovagrant@masto.deoan.org Just saying, @abuse_ch@ioc.exchange has the opportunity to publish a list of the abusers here. Anyone abusing a community-based service like this should be named and shamed.
Replying to
@abuse_ch@ioc.exchange
@abuse_ch@ioc.exchange Just spitballing here, but I think you may be in a position to publish a list of abusers of your service.
Replying to
@Dio9sys@haunted.computer
@Dio9sys@haunted.computer I feel this in my bones. Recently realized that I have a habit of saying "no problem" to things that are DEFINITELY problems because I'd rather not deal with having to confront someone who has caused a problem.
Replying to
@fuzzyfuzzyfungus@cyberplace.social
@fuzzyfuzzyfungus@cyberplace.social @hrbrmstr@mastodon.social The Cow Was Not Valued
- Lorem Ipsum
Replying to
@ahltorp@mastodon.nu
@ahltorp@mastodon.nu @jackemled@furry.engineer @smn@l3ib.org oh they absolutely can still mess with you. Which is a huge problem. But in terms of ways to protect oneself during a border crossing, it's a way that doesn't invite them to mess with you further in the form of a legal proceeding. It's harm reduction.
If the conclusion for you personally is to not travel to the US ever under any circumstances, then that's a decision that you can certainly make for yourself. But it's not possible for a lot of people to opt out.
Replying to
@ahltorp@mastodon.nu
@ahltorp@mastodon.nu @jackemled@furry.engineer @smn@l3ib.org despair is certainly one interpretation. And what with all the fascism swirling around, I feel that way, too, sometimes.
But another interpretation is that it's only like this because enough people decided it should be that way. Which means it can be changed if enough people want to change it.
And yet a third interpretation is what the EFF has been recommending, which is to prepare by not having any data on your phone during border crossings. Take a backup, store it on a cloud service, wipe your device, and restore the backup when you've crossed. It's horribly inconvenient, but it avoids any legal issues.
None of these ideas are mutually exclusive.
Replying to
@neurovagrant@masto.deoan.org
@neurovagrant@masto.deoan.org I can imagine. Getting into an Internet fight with several dozen people is a rough way to spend a Friday night, even if the fight is a good cause.
Also we are all legends on this blessed day
Replying to
@neurovagrant@masto.deoan.org
@neurovagrant@masto.deoan.org usually I wish my posts would get more reach. But then I see braindead responses that posts like yours and another post by evacide got last night when they do get hundreds of boosts and it just makes me go "nah."
Replying to
@paul_ipv6@infosec.exchange
@paul_ipv6@infosec.exchange @cR0w@infosec.exchange if ever there were a group of engineers that would benefit from a co-op or heavily unionized org structure, Mozilla engineers are that group.
Replying to
@Iwillyeah@mastodon.ie
@Iwillyeah@mastodon.ie @smn@l3ib.org @evacide@hachyderm.io it doesn't matter if a crime has been committed. The act itself is a crime.
https://en.wikipedia.org/wiki/Tampering_with_evidence
A cat meowing at a bucket of corn
#CatsOfMastodon #CaturdayEveryday #CatLovers #CatsOfTheFediverse #CatContent #FediCats #FelineFriday
Replying to
@smn@l3ib.org
@smn@l3ib.org @evacide@hachyderm.io I'm hardly a legal expert, but I think it's fair to say that many things can be true at once, and they all contribute to various layers of a fucked up situation
1) if someone is planning to destroy potential evidence when faced with a search, that's planning to commit a crime regardless of circumstances and the legal system really doesn't care about your situation
2) warrantless searches are appalling
3) warrantless searches happen anyway, the legal system permits them, and pretending they don't is failure to plan ahead
4) regular people are not prepared for them because who the fuck has time to deal with that
5) goto 1
I really really doubt that deleting evidence would fly in court. It doesn't matter how fucked the circumstances are, that is still considered a crime
Also, who the fuck you think operates in a court of law? Might it be lawyers?
Replying to
@evacide@hachyderm.io
@evacide@hachyderm.io Also rephrased as "Should I engage in an action that could easily be perceived as destruction of evidence?" to the shrieks of lawyers everywhere
The nut-buster 9001 is a gun that has been designed for maximum penetration depth. During automated testing, the nut-buster fired a round that penetrated all of the back stops and obliterated a children's hospital on the other side. We believe that this incident may be prevented by installing childrens-hospital-avoidance safeties. While we are deeply sorry for the loss of life, we encourage all interested parties to apply for our early access program.
Replying to
@cR0w@infosec.exchange
@cR0w@infosec.exchange I think there's a good chance it's real, because their containment environment seems like it had basically no monitoring or strong controls in place. They did obviously write their "report" from a marketing perspective to hype it up because these people are also ghouls and think this thing should be spun into a flex, but that doesn't mean that an incident caused by their own predictable incompetence didn't happen.
Replying to
@mttaggart@infosec.exchange
@mttaggart@infosec.exchange I just finished reading their blog post and they really don't seem to be taking this seriously. Their key take-away appears to be that the "model alignment" was insufficient, when it's been proven fairly rigorously that trained-in model alignment isn't a strong deterministic control.
Replying to
@DaveMWilburn@infosec.exchange
@DaveMWilburn@infosec.exchange @jerry@infosec.exchange Hot take: it's also just kind of a mediocre con at this point. I've had more fun and gotten way more out of local events.
Replying to
@nixCraft@mastodon.social
@nixCraft@mastodon.social Doesn't matter, it all goes in ~/.bashrc. Custom environment variables? Goes in ~/.bashrc. Login scripts? They go in ~/.bashrc. Command aliases? That's right, they go in ~/.bashrc.
Replying to
@mttaggart@infosec.exchange
@mttaggart@infosec.exchange @ifin@infosec.exchange will do if I have anything interesting to share. Haven't fully confirmed exploitation yet but it sure doesn't look good
Replying to
@mttaggart@infosec.exchange
@mttaggart@infosec.exchange been doing incident response for two hours now and I'm pretty sure it was being exploited when you were writing this. I'll try to post some details when I have them.
Replying to
@pmbrandvold@techtoots.com
@pmbrandvold@techtoots.com because it's an appliance, it probably needs 120 volts to run, so this is actually "dangerous if you're a careless idiot" territory.
But to assess what you'll need, a simple kill-a-watt power meter is a good place to start. Wire up a plug to the pump, make sure it's plumbed up so it has water to circulate (could just stay in the dishwasher with water for testing), and let it rip. Check for how many amps and watts it pulls. You'll need a battery and a 120 volt inverter that can support that much power draw for as long as you'll need to run it, and a solar panel and charge controller to charge that battery
Replying to
@cR0w@infosec.exchange
@cR0w@infosec.exchange @theorangetheme@en.osm.town 💯. I think the semi informal writing style shows that a contract lawyer probably didn't even review it. Everything else in the contract is standard formal legalese so I think someone was just really pissed off at some egregious nonsense and slapped this in at the end
Replying to
@cR0w@infosec.exchange
@cR0w@infosec.exchange @theorangetheme@en.osm.town this line is in red and italicized in a legal document. Even the payment requirements weren't given that treatment
Replying to
@cR0w@infosec.exchange
@cR0w@infosec.exchange @theorangetheme@en.osm.town I recently (this month) had solar installed. In the contract was a specific line item under client responsibilities, copied here verbatim:
Solar is a 6-12 month total process from Site Survey to the customer receiving REC incentives, throughout the 12 months the customer will be installed, inspected, Net Metered, and then there will be a lull period while we wait on the State Agencies and Utilities to process the remaining paperwork. This process cannot be sped up by customer assistance/interference no matter what CHATGPT/GROK say so please refrain.
Anyone wrangle with #passkey implementation in a virtual desktop environment where you can't pass through a hardware device and software installs are limited?
Replying to
@mdc@mstdn.ca
@mdc@mstdn.ca @mttaggart@infosec.exchange They didn't even recess the screw heads. So you'll just hurt your hands on it if you use it long enough.
It's poetic.
Replying to
@mdhughes@appdot.net
re: UKpol
Hover or focus to reveal
Sensitive
@mdhughes@appdot.net @lambdacalculus@masto.hackers.town Blowing right past the fact that curfews are dumb, she's actually right. What the fuck even is the point of a curfew that you can opt out of? "Oh I'm sorry officer, I decided that the curfew didn't matter tonight"
Replying to
@cR0w@infosec.exchange
@cR0w@infosec.exchange Duped comment from what I tooted at OP:
My first question is whether any of this is even real. The EO was signed a month ago. I have a hard time believing there's anything more than a vibe-coded pile of shit outputting garbage to a dashboard in that time.
Replying to
@hrbrmstr@mastodon.social
@hrbrmstr@mastodon.social My first question is whether any of this is even real. The EO was signed a month ago. I have a hard time believing there's anything more than a vibe-coded pile of shit outputting garbage to a dashboard in that time.
Replying to
@cR0w@infosec.exchange
@cR0w@infosec.exchange this seems like it could be a link-rot event on par with the imgur purge from a few years back
Replying to
@h2onolan@infosec.exchange
@h2onolan@infosec.exchange "subjected to a security threat" like anything on the Internet is not subjected to security threats literally all of the time
Replying to
@mendingcatsshelter1@mastodon.social
@mendingcatsshelter1@mastodon.social as far as I can tell it's infinite degrees when chasing imaginary objects and the zoomies are involved
Replying to
@nuwagaba2@mastodon.social
@nuwagaba2@mastodon.social organics mostly, because I'm skeptical of how safe insecticides really are. Next year I might try growing them under cover if I can figure out a way to do it cheaply enough
Replying to
@tehfishman@ioc.exchange
Mr president a second squash vine borer has been caught in the act
Also, and this might actually be helpful for someone else fighting these, if you catch them when they're in the main stem but before they kill the plant you can pull them out with an old guitar string turned into a tiny hook. Pull them out from the frass-hole
#gardening
Replying to
@Viss@mastodon.social
@Viss@mastodon.social @Finitum@mastodon.social how does one affix the stamps to the squirrel?
deltarune chapter 5 spoilers; lewd
Hover or focus to reveal
Sensitive
Toby Fox gave nerds the chance to get absolutely fucked by a cat girl
#deltarune
Replying to
@theorangetheme@en.osm.town
@theorangetheme@en.osm.town @cR0w@infosec.exchange @ajn142@infosec.exchange This thread is indistinguishable from a Death Stranding meme
Replying to
@cR0w@infosec.exchange
@cR0w@infosec.exchange that's.... the bar is in hell THE BAR IS IN HELL
THe BAr isINFHELLarasdaha p32afgkg AhfQOY;80UJ 54UEHN 45QJ807 LU945L ;9U45JW L9 ;45WJ U;LO YRPGH .EIHN, WFPQDˇ¸˚¯É 53Q4G LU; QFPGH 90L -WPGFH 9L; '
Replying to
@cR0w@infosec.exchange
@cR0w@infosec.exchange I felt compelled to skim it because of how overwhelmingly tone-deaf it sounded, and it's "Sponsored and written by Kaseya", and the links in the article to some Kaseya security report with the URL parameter "utm_medium=Online%20Advertising".
Considering their ransomware incident was 5 years ago this month, I wonder if Kaseya is writing from direct experience here.
And BleepingCumpooper put this in the news section.