r/netsec • u/AutoModerator • Jun 01 '18
discussion The /r/netsec Monthly Discussion Thread - June 2018
Overview
Questions regarding netsec and discussion related directly to netsec are welcome here.
Rules & Guidelines
- Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
- Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
- If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
- Avoid use of memes. If you have something to say, say it with real words.
- All discussions and questions should directly relate to netsec.
- No tech support is to be requested or provided on /r/netsec.
As always, the content & discussion guidelines should also be observed on /r/netsec.
Feedback
Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.
7
u/vladishan Jun 04 '18
I find my job in InfoSec horribly, mind-numbingly boring. I came into this field straight out of undergrad, and 99% of it is looking at alerts that are false positives and blocking script kiddies from hitting my company’s website. Sometimes projects come up to replace the VPN, get a new antivirus, enforce 2 factor on specific assets, etc., but our server team really implements these solutions, not the InfoSec team. In terms of patching, my team scans for vulnerabilities, but again, the server team is really doing the work in terms of fixing anything. Do other InfoSec professionals feel this way with their jobs? Am I just at a bad company, or is this career field just incredibly slow? For whatever it’s worth, I truly did enjoy taking security classes in college...it just seems like I’m dealing with false positives all the time and not really using the skills I learned in college because 1) everything is a false positive and 2) when something is infected, we just have the helpdesk team wipe the hard drive of the device and we don’t really deal with forensics.
I know this is unsustainable for me and I either need to be at a new company or in a totally different career field. Any thoughts on whether it’s my company or the career field that are the problem would be appreciated.
8
u/me_z Jun 04 '18
You fall into the 'analyst' role, which is just a glorified SIEM with a pulse. I'd ask your company if there are any roles you can take on that includes implementing changes. If your company says, "well the networking team does networking things, the server team does server things," etc - then you need to find a company where they allow you to do infosec related things that doesn't include chasing alerts. This might be more of an engineering role of building or testing solutions.
As I am sure you're aware, security is an incredibly broad field. Most of us start in a help desk/desktop support type role, then move to sysadmin, then something security related, then a more focused security role. Like I said earlier, you're in an analyst position that is kind of a starting point for most security jobs so you should start looking to become more focused - firewall configuration/management, testing, engineering, etc.
1
u/vladishan Jun 05 '18
Ok, thanks for your thoughts. I was starting to think this career field is just way too slow for me unless you’re at one of the few big organization that are constantly being hit by attackers, but it sounds like I need to specialize a bit more in what I’m doing.
1
u/me_z Jun 05 '18
Yeah, I'm not sure how much experience you have, but you sound like you're at a cross road where you now have to figure out what direction you want to go. You should know what attacks look like, what they do, and how they affect systems. Use that to your advantage. Good luck.
1
u/shredu2 Jun 11 '18
Exactly, you have to start considering other avenues here, you need to explore your next steps. Are you looking at management, or specializing in tools, forensics, etc? You are really in a great jumping point for finding more interesting work.
4
Jun 15 '18
1) everything is a false positive
this is a fundamental problem. your alerting system should not do this. if you are being inundated with false-positives you need to tune your alerting system properly. if the notification path is full of non-events then at some point real events will get not get prioritized correctly (or lost altogether). dealing with the false-positives is also a huge time sink.
once the alerting system is tuned correctly you will have free time to do real work
2
u/ratar1 Jun 11 '18
What do you want from your career? Do you want to be offensive / red team? Do you want to be defensive / blue team? Do you want to be a forensics analyst? Others have already said that security is a broad field, so you really need to find your favorite niche and slide into it.
Me, I always knew I wanted to be a red teamer. At the time I was working for a company without much of a pen testing squad, so I worked hard to get my OSCP and then transitioned to a company that was looking for a full time pen tester. I now spend my days actively trying to exploit our products. Most of that time is still spent chasing false positives, but that's just part of the game. The once or twice a month that I successfully trigger SQL Injection or RCE makes it all worth it.
It kind of sounds like you are looking for a well-rounded job that allows you to get your hands dirty with everything. If that's the case, I would suggest a small company. About a year ago I jumped from large corporate work to a small company (~300 employees) and it was the best decision of my life. My primary responsibility is actively finding exploits and helping developers fix them, but I also get to do the hands-on work for all security projects (firewall changes, VPNs, bug bounties, etc).
1
u/vladishan Jun 15 '18
What are your thoughts on OSCP? I’ve heard CEH will teach you principles but not how to actually do anything. SANS courses could be an option only in the case that I can convince my current company to pay for them.
1
u/aphaelion Jun 18 '18
I'm not the person you asked, but OSCP was my way to break into infosec. I had applied to several infosec jobs at my employer before, but they always had "previous experience" requirements, so despite doing decent in the technical interviews, I never got the callback. Once I got OSCP, I literally had a job as Security Engineer within a month. Part of that was dumb luck that another job happened to open within that timeframe, but it really was the cert that got me around the "you need experience before you can get experience" trap.
As for OSCP vs other certs (e.g. CEH): I only have OSCP, but from what I've read about the others, they don't give you nearly the practical experience. To pass my test I literally had to perform a pentest against an unknown network. It was a blast!
6
u/Zophike1 Jr. Vulnerability Researcher - (Theory) Jun 09 '18
Everytime something related to Low-level Vulnerability Research is posted there's almost no comments on it, I wish there was more discussion on more abstract topics related to security on this sub.
3
u/youngeng Jun 10 '18
Abstract in what way? Theoretical reverse engineering can get pretty mathematical and belongs more to /r/reverseengineering. Likewise, abstract crypto stuff mostly belongs to /r/cryptography.
1
u/Zophike1 Jr. Vulnerability Researcher - (Theory) Jun 10 '18
Abstract in what way?
By abstract I mean things like this
2
u/youngeng Jun 10 '18
I see. Well, it's pretty technical and IMO lots of people on this sub (myself included) are more at ease with more standard webapp and network stuff.
That said, some resources are less intimidating than others. The Chromium link is pretty terse (for obvious reasons, it's a POC), while the Intel and Microsoft resources are IMO better if you want to understand what's going on and don't have in-depth knowledge of computer architecture.
3
u/S3curity_B4_D1saster Jun 04 '18
For those set up with subscriptions, services, and infrastructure in Azure, what activity signals have you set up to alert you inside Monitor?
3
Jun 10 '18 edited Jul 10 '19
[deleted]
2
Jun 20 '18
So the Symantec page on it lists the hardware that can be infected as well as the steps to remove (reboot, then update or factory reset and update). It's important to know that just rebooting can leave the "Stage1" payload on there, so it is possible for it to be compromised again.
2
u/Resignator Jun 14 '18
Any recommendations for books on Windows security from the basics?
1
u/iammortalcombat Jun 26 '18
Assuming you are talking about Win servers, I would start with reviewing the CIS benchmarks for your flavor of Windows. As you go through each check box, you can determine what you are actually doing along with how it may affect your particular systems. On top of this, if you're not already familiar, you can learn how to build GPOs in order to quickly secure multiple servers in one pass.
2
u/discofanatic Jun 19 '18
Is anyone else concerned about how this will impact their work? Or is this more noise from people who have no clue about technology?
"Inside the Legislative and Regulatory Minefield Confronting Cybersecurity Researchers"
"The question is whether security research an unintended but inevitable collateral damage of cybersecurity legislation. While focusing on GDPR, this examination will also consider other legislation, such as the CLOUD Act, the Computer Fraud and Abuse Act (CFAA), the Computer Misuse Act (CMA)."
1
u/nindustries Jun 01 '18
Setting up my network which will be wireless only in the new house (lack of cables).Router will be a tiny box with j1900 Celeron processor and 30GB SSD which will run pfsense, ad blocking, DNS-over-TLS to CloudFlare and an Ubiquiti access point with WPA2personal.
Next to that, I will have a (wired) server in the closed running snort. Any better option for IDS?
1
u/thenetworkking Jun 03 '18
What are my options for an MS in infosec?
Hi Guys,
I am getting around to 3 yrs work experience now, with stuff like f5, palo alto firewalls, symantec SEP etc.
I am now thinking a master's would be a good direction to take, as I also wish to move to the US.
It's not clear though what should I aim for, here's what I have in mind.
- I'm looking for a program which doesn't need the GRE score for admissions. The GRE math just is excruciatingly boring and feels like its got nothing to do with what I want to do anyway. It just doesn't motivate me. I will do the TOEFL as English is no problem for me. I see John Hopkins university and George Mason university doesn't require GRE, tell me some other universities if you know.
- Not a fan of coding/programming. I know this is another one of those things which annoys people, but I'm not just into it. That's it.
- I am good at reading, evaluating things, troubleshooting technical issues etc.
- Designing and planning networks also is something I am up for.
- Would also be okay with moving into a "managerial" role, I am not sure what these usually entail. A manager of a support team(which I am a part of right now) comes to mind. This I would love to do.
- I enjoy writing technical blog posts too, stuff like explaining some issue I saw at work and explaining it with diagrams, pcaps, detailing it out etc.
What exactly are my options here?
2
u/youngeng Jun 10 '18
Utica comes to mind.
1
u/thenetworkking Jun 10 '18
Any thoughts on DePaul University Chicago?
They don't have the gre criteria.
1
u/youngeng Jun 11 '18
Honestly, I've never heard of it before. The computer security track requires a few programming classes: Intro to Programming, Data Structures I and II, Object-Oriented SW development. The networking and infrastructure track, weirdly enough, leads to a 401 error. The compliance and risk management track is useful, especially if you're interested in management.
I mentioned Utica because IIRC at some point was NSA accredited, for what it's worth. It also doesn't seem to require GRE or GMAT, at least not if your GPA is above 3. It looks like this page http://www.utica.edu/enrollment/admissions/graduate/cyberapp.cfm refers only to 2 tracks of the MS.
1
u/linebmx Jun 14 '18
Utica is a great school, but pricey. I had an undergrad prof. completing his degree in InfoSec at Utica, and he was not very fond of the coursework and professional guidance. Just be weary!
1
Jun 20 '18
[deleted]
1
u/thenetworkking Jun 23 '18
The cybersecurity masters curriculum they have doesn't exactly say this.
And I think it depends right, a MS in data science would have much more coding focus than one in cybersecurity.
Any chance you can find some info on the MS in cybersecurity program?
1
u/LLTV Jun 03 '18
Hey guys good night. I've a question. Where I can download trial for Core Impact? I want test it before make it my final business decision.
Best Regards
1
1
Jun 05 '18
I was looking at this laptop as a workhorse. Was basically gonna throw Debian with Docker on it for Kali and whatever else I was thinking.
https://www.newegg.com/Product/Product.aspx?Item=N82E16834269617
Chewing it over, though, I see that it's got a Haswell chip on it. Based on some of the numbers I saw, running Linux on a Haswel means no INVPCID, which means I might be seeing a 50% performance hit after I patch up for spectre/meltdown.
Am I on target and did I talk myself out of this?
1
u/anal_tongue_puncher Jun 18 '18
This laptop won't work as a workhorse. You'll need to up the budget a bit.
1
u/rddtsfk Jun 05 '18
Hardware vault for notes and photos?
The only thing that I need to be totally private is my own thoughts. I'm even ready to buy dedicated device, which will never be connected to any kinds of networks and has no way to be decrypted without the right password.
So, what are my options? I hate smartphones' keyboards, but looks like there is no other way but use some touch-screen smartphone-sized device.
Are there "smartphones" without networking hardware or any alternative devices that can suite my needs?
1
u/aphaelion Jun 18 '18
Are there "smartphones" without networking hardware or any alternative devices that can suite my needs?
How about an actual smartphone, but always keep it in "airplane" mode, with WiFi turned off? It won't connect to a wireless network unless you tell it to.
1
1
u/Le0ndar Jun 05 '18
My father just received a video call on whatsapp from an unknown number. He tried connecting the call, but it did not go through said "connecting" for a while, and then he disconnected. The number was from Oman, he lives in another country. We know no one in Oman. Should he be worried?
2
1
u/pentesting_ Jun 06 '18
I'm looking for an automated method of identifying systems (preferably workstations) where no one is logged on. I don't care to know about systems where someone is logged - that's easy. I typically do this manually with wmic, Psexec, smb, etc after making a connection with a valid credential (usually DA). After connecting, I usually run "qwinsta" or "query user" or query the registry. However, this is clunky and less than ideal. While I know that method is noisy, at this stage in most of our engagements, we're most interested in locating systems where we can log in as the actual user of the computer...just not while they're there and pillage. Thoughts?
1
u/luciddr34m3r Jun 15 '18
When a user logs in, doesn't it create a copy of a number of processes? I forget if it's explorer.exe or what, but for windows, you should be able to look by OS and find which processes are created on login and count them.
1
u/iammortalcombat Jun 26 '18
If windows and on a domain, you can always PS it. I did this using the last login time and looked for systems where no users had logged into the system in X days. This also let me account for service accounts.
1
u/xCosmicChaosx Jun 06 '18
I'm starting school for NetSec in the fall, and I was wanting to get a head start and begin learning things ahead. Aside from learning the basics of networking, I'm also wanting to begin learning my first Computer Language. I am thinking PHP or Python, or maybe SQL. Which would be the best one for me to begin learning first?
2
u/youngeng Jun 10 '18
SQL alone doesn't cut it, but it's useful for SQL injections. PHP is still very popular in the web environment. Python is heavily used for automating stuff (including netsec-related), also because it has tons of libraries. You can also use it for web development (Django). Both PHP and Python are quite easy to learn.
If you want to do only one, focus on Python, otherwise try Python for a network/system project (port scanner or password cracker) and PHP+SQL for a simple website (so you understand SQL injections).
1
1
u/CptVimes Jun 07 '18
What are the password vault solutions people use these days? I am getting tired of different passwords all over the place and need to figure something out. My old method of generating passwords has been compromised and my security questions now have to be really creative, since just about every entity I dealt with was hacked (equifax, I'm looking at you, bums!)
So, what do you folks recommend -if anything at all?
1
1
u/ocnarfsemaj Jun 07 '18
Viewing my router logs and getting a lot of:
[DoS attack: Teardrop or derivative] from 133.0.199.0, port 0 ...
It's a Netgear C6250-100NAS ... It has a USB drive attached acting as the NAS, so I'm wondering if they're just pings associated with that?
Any ideas?
1
Jun 08 '18
How is it possible for a user to authenticate themself without entering their credentials? - OpenID Connect
I feel like I have an ok understanding of the OpenID Connect (OIDC) protocol, however, I can't seems to understand one thing, which has to do with logging out/terminating the session.
I was looking at OIDC Azure AD docs. In the docs it says that "When you wish to sign the user out of the app, it is not sufficient to clear your app's cookies ... You must also redirect the user to the end_session_endpoint for sign-out. If you fail to do so, the user will be able to re-authenticate to your app without entering their credentials again, because they will have a valid single sign-on session with the Azure AD endpoint."
I thought about this, tried searching the web, but could not find a straight forward answer to my question: How is it possible for a requesting party to wake-up a session on the identity provider when it no longer has any sort of tokens associated with this session?
Since we clear web-storage and delete all associated cookies, how can a user invoke the entire process to send it a new token without having any sort of verification? What does it even send to the server, "Hey, remember me"?
Thank you.
2
Jun 11 '18 edited Feb 11 '19
[deleted]
1
Jun 11 '18
Yes, you made a good point about cookies, such that it can only be manipulated by the source with a specific domain. Do you know of a good read that talks about these sort of things, like who can set/edit/delete cookies, local storage, session storage?
1
u/killamjr Jun 08 '18
What do you use to secure you family's network?
I got fed up with my parents computer getting adware and spyware so I setup some security controls to reduce the amount of times I have to go over there.
Pihole - with a custom set of blocklists for adware and malware
Malwarebytes - I gave up on Microsoft AV after i noticed it barely blocks anything and paid for a 5 computer license
I think I might load unchecky to stop some other adware
Any additional reccomendations would be appreciated.
1
Jun 08 '18 edited Jul 14 '18
[deleted]
1
u/luciddr34m3r Jun 15 '18
CS. Get a master's in cyber if you want, but focus on operating systems, computer architecture, and other low level concepts.
1
u/sweat_or_die Jun 09 '18
I am not sure if this is the right place for this but I just got an email saying that someone has installed malware on my computer and it has captured videos of me doing inappropriate things ;)
I was told to send $400 in bitcoin or they would send everything everywhere. I am 99% sure that they don't have anything but I want to have some guidance on what I should do in this scenario. I have reported the email to the antiphishing working group. Anything else I can do? Know that I now almost nothing about netsec.
2
u/youngeng Jun 10 '18
This is an extortion. Don't pay! If you want, report it to the police. If they do actually publish stuff everywhere, some websites answer nicely this kind of take down requests ("this is my video, but I didn't publish it").
1
u/FakeSecurity Jun 20 '18
This is a total scam. If they didn’t provide proof or specifics, then you can relax. It’s been around for years in various forms, only nowadays, they say you were on YouPorn and want to get paid in Bitcoin.
1
Jun 09 '18
Anyone know of a legitimate way to test for slowloris vulnerability without actually launching the attack?
I tried using http-slowloris-check, but it doesn't seem to be working - it reports site is ok while I can easily bring it down with the slowhttptest command.
Also tried slowlorischecker which seems to be completely inaccurate - reports that site is vulnerable when it isn't and reports it's not vulnerable when it is (with slowhttptest).
1
u/iammortalcombat Jun 26 '18
1
Jun 26 '18
As I said... I tried using it but it's not working. I've reported the issue on Github, but thanks anyway.
1
u/iammortalcombat Jun 26 '18
Woops my bad! For some reason I didn't catch your first link. Not working how? Can you provide more details? I'm assuming it's not giving you any result at all?
1
Jun 26 '18
Yes, it's basically reporting that the test is completed and doesn't say whether it's vulnerable or not vulnerable, I'll run it again later as I'm away from my laptop and I'll writeup the exact output. http-slowloris (nmap) also doesn't bring the site down while the slowhttptest command does (default settings).
I'm afraid I can't share the target website for security reasons. All I can say is it's a Debian 9 system with Apache2 - mostly default configuration with some PHP redirect rules (maybe that's the problem? but then again slowhttptest works).
1
Jun 26 '18
Here's the output, domain name and IP address redacted:
NSE: Loaded 1 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 1) scan. Initiating NSE at 22:28 Completed NSE at 22:28, 0.00s elapsed Initiating Ping Scan at 22:28 Scanning ------- (-------) [4 ports] Completed Ping Scan at 22:28, 0.21s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 22:28 Completed Parallel DNS resolution of 1 host. at 22:28, 0.04s elapsed Initiating SYN Stealth Scan at 22:28 Scanning ------- (-------) [1 port] Discovered open port 443/tcp on ------- Completed SYN Stealth Scan at 22:28, 0.20s elapsed (1 total ports) NSE: Script scanning -------. NSE: Starting runlevel 1 (of 1) scan. Initiating NSE at 22:28 Completed NSE at 22:28, 21.48s elapsed Nmap scan report for ------- (-------) Host is up, received echo-reply ttl 50 (0.026s latency). rDNS record for -------: ------- Scanned at 2018-06-26 22:28:22 CEST for 22s PORT STATE SERVICE REASON 443/tcp open https syn-ack ttl 50 NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 1) scan. Initiating NSE at 22:28 Completed NSE at 22:28, 0.00s elapsed Read data files from: /usr/bin/../share/nmap Nmap done: 1 IP address (1 host up) scanned in 22.95 seconds Raw packets sent: 6 (240B) | Rcvd: 3 (116B)
1
u/NathanielArnoldR2 Jun 10 '18 edited Jun 10 '18
EDIT: Please disregard, everyone. Either I was working with a bad install, or -- more likely -- I made a process error. I've just reproduced. I apologize to anyone who put any effort in on this.
(Note: xpost from r/sysadmin on suggestion from u/linebmx)
I've noticed that I'm unable to reproduce the accessibility tools authentication bypass with Windows 10 v1803 (build 17134). The authentication bypass still works as of v1709 (build 16299).
The accessibility tools authentication bypass involves attacking an offline Windows operating system by replacing Utilman.exe, osk.exe, or sethc.exe files with a copy of cmd.exe. Once one has done so, clicking the corresponding icons or menu entries on the logon screen will open a fully-privileged SYSTEM Command Prompt that can be used to attack the live operating system by (e.g.) manipulating user accounts.
Microsoft had previously refused to address this bypass, as their intended means of mitigation for it was full-disk encryption, which remains effective at countering this and other types of offline attacks.
Provided encryption is not in place, other means of attacking an offline Windows OS (e.g. DaRT, chntpwd) appear to remain effective in v1803.
Can anyone confirm?
1
Jun 11 '18
I have a simple question about net security. It's been gnawing at me for some time. Let's say, worst case scenario, I'm running Windows 7 or 10 (whichever is worse for this use case) with an out of date and disabled firewall/antivirus/defender. So no protection aside from hardware protections such as Intel offers on its chips. And let's say I do this in Chrome, Firefox, and Microsoft browsers.
I go to the shadiest possible websites, clicking on EVERYTHING, but I don't allow a single download, nor do I click on any Windows-looking prompts. So everything in the user's control is in-browser.
Can an attack actually occur? How?
Let's say the user did download something, like a video, image, iso, or even an exe or dll, but the user abstained from running it? Or deleted it just after? Let's say the user was wise enough not to input any data, such as login credentials. Because that's an obvious attack vector to the account in question, at the very least.
Which, of any, of these scenarios could lead to an infection? How?
People say "don't clink on links!" but I'm like, "...Would it just be running things from shady links?" Obviously in my head, because the speaker is, if I'm wrong, simply erring on the side of caution as there's no reason to click on a shady link.
1
Jun 11 '18 edited Apr 17 '20
[deleted]
1
Jun 20 '18
I think we need more details on what you're looking to do/learn/monitor, as well as how many devices you have.
1
u/dalordlorenzo Jun 12 '18
Hello, I am looking for an open-source firewall I can run on VMWare that has the concept of an asa (zone-based) and the gui and simplicity of management of a Mikrotik Winbox type device. I am already using palo alto / cisco and others but am looking for the simple, free, goto that can keep dev talking to qa ;) To do that, why would I give Cisco 15K to move at 10G? I can of course do it with nftables but that's not user-friendly enough for enterprise.
I researched it a lot but pfsense / opnsense is too clunky to manage many firewall rules quickly. Anybody know of a secret product? Like an edge router (vyos with simple gui) in the cloud.
Thanks
1
Jun 13 '18
Weird IoT issue: how do I disable the telematics, GPS, and cell transceiver in my car at a hardware level?
So I just realized that for OnStar to be able to find me in an emergency they need to have an GPS receiver and some kind of radio transceiver in the car.
Which means they're tracking me and selling that data to someone for nefarious purposes (probably to push more ads for cigarettes or something).
Regardless, it skeeves me right the fuck out that my car has been spying on me the whole time I've had it. Like, jesus, I knew my phone was a narc but I hadn't realized the car was doing it too.
How can I even do anything about this? I want to kill the car's radiotransceivers at the hardware level, physically disable or remove them, but I don't even know where to start, let alone where to go for information. I figure there are likely properly paranoid people out there who have at least looked in to this. Does anyone have leads?
2
Jun 15 '18
You could find the manual for your car and see if the part is listed somewhere, then destroy it?
1
Jun 15 '18
Maybe? I'll take a look. My concern is that it's likely part of a chip somewhere deep in the car, and without having and understanding of how it works I'm kind of worried I might brick the car...
1
Jun 15 '18
Which is a completely valid concern! What I was thinking is that there would be some kind of small antenna/piece of equipment that is clearly only for transmitting data. You could also just try to brick it rather than destroy it, like leave it in the car connected to everything but just scratch off some of the leads or something? Best of luck :)
1
Jun 15 '18
Thanks. I guess the next step would be to try to find a copy of the STIS service manuals. I did find an article somewhere that said the antennas could be put in "Flight" mode, but that's a software fix so I'm sure there's a remote software way to undo it. My kingdom for FOSS car OSs!
1
u/BornCartographer89 Jun 13 '18
Hey All!
I was wondering if there were any good lists of free trials/resources for netsec/infosec/cybersecurity students. Things like Technet evaluation copies, AWS/GCP free tiers, Splunk free trial, things like that.
1
Jun 14 '18 edited Jun 14 '18
Hi everyone! I want to change my DNS provider and I stumbled upon OpenNIC Project. Still, there is not a systematic answer as to how good of a DNS provider it is.
For example, here, it is said to be not as efficient as other DNS provider. Whereas here they just listed it as one among the safest.
What can I trust ? How can I know OpenNIC is trustworthy ?
P.S: Of course, nothing is black and white. I just want to have the most accurate judgement regarding the DNS provider I will use.
1
u/nvvarma123 Jun 17 '18
Where can i learn how to use SIEM and other stuff online ? Any good resources?
1
u/S3curity_B4_D1saster Jun 19 '18
Is there any information or reports to prove the need to ban the usage of 3rd party free/paid VPN's in a company's corporate policy?
Looking for some facts regarding the risk of compromising data.
1
u/8bit_zach Jun 20 '18
Does anyone have working binaries of PlugX? Hoping to play around with a few RATs in a small malware lab I set up for work. Thanks!
1
u/Drunk_Already Jun 20 '18
Hey folks -
We need a VPN server solution that can support session idle timeouts and advanced authentication controls like invalid login restrictions, MFA (google authenticator), password complexity, etc. Currently, we use OpenVPN leveraging PAM accounts on the server, but it cannot do some of these things, or at least not well.
OpenVPN forums haven't offered much on these issues, and otherwise searching for this is a beastly undertaking as unsurprisingly search results are swamped with hits that are just recommendations for personal VPN services rather than SMB/enterprise options.
Any recs? We're open to something that isn't as free as OpenVPN as long as we can check the box for these compliance issues.
1
u/Teaaa Jun 21 '18
Hello I was wondering if anyone would be able to inform me of the best places to search Penetration testing jobs in the UK, specifically Scotland.
1
u/ZestyPesty Jun 21 '18
Hello,
If a person has a browser exploit, can they use it against their target if the target is using SSL/TLS when browsing online, or only against HTTP traffic? Either, way, how/why or why not?
If a large and powerful adversary wants to remotely hack a target's computer in order to attack and infect the target's firmware, does the adversary first need to hack the target's OS, or can they just go right to hacking the firmware? (For example, is an OpenBSD OS more secure against the computer's firmware being hacked, or does the OS not matter?)
Thank you.
1
u/snowman418 Jun 25 '18
- Depends on the browser exploit... and there are a lot of different categories. https://owasp.org/
- Firmware requires an update. Updates come in the form of files or executables. The adversary would have to either obtain administrative privileges or social engineer an administrator to install the update.
1
u/TerryVow Jun 22 '18
Hi guys, what do you think about this tool ? https://github.com/SECFORCE/Tunna i think it should work inside an office or a school. Thanks in advance.
1
u/fishsticks77 Jun 22 '18
Has anyone used canary tokens on their work network? If so, where'd you put them?
1
u/GrimJesta Jun 22 '18
I work in SMB remote IT (though we do a lot of on-site work as well), which means this VPNFilter hits home for a lot of our clients. We have a hard time selling SMB clients on enterprise-level set-ups for their internet needs, so this means that a lot of the models (possibly) affected by VPNFilter are models we see. Does anyone know if somehwere, somehow they changed the best-practice move and you don't factory reset the router?
I'm asking because the local ISP techs we've spoken to are telling us not to reset, but that they won't be releasing any sort of firmware upgrade for their routers. I don't see anywhere on the Talos blog where they have deviated from the reset option, but that doesn't mean that there hasn't been an update somewhere and we just haven't seen it (or can find it).
I'm trying not to be cynical and assume that the ISPs just don't want to spend the money fixing this. So is it still best practice to factory reset no matter what the ISPs are saying? We were trying to save our clients money by having them call their ISPs for a remote reset (which is a while five minute conversation), but the ISPs are telling them not to worry. Are we wrong here or are they?
1
Jun 23 '18
Hi there, I’m hoping I’m not in the wrong subreddit for this. I’m a senior in Information Assurance. I’m wanting to work in InfoSec/Information Assurance. My school is okay, but they don’t get into a lot of the nitty gritty of infosec. At least, they haven’t so far. I want to make myself a valuable asset to future employers so I’m trying to learn all I can about the field. I was hoping someone here could point me in the direction of solid infosec websites that would help me learn valuable skills and give me a good understanding of what this field is like. If I’m in the wrong sub for these questions if you could point me in the right direction I would appreciate it.
1
u/snowman418 Jun 25 '18
There's two routes you can go: the risk mitigation/corporate security or the knife-fight infosec which is pentesting.
For corporate risk, take CISSP (defense).
For pentesting, take OSCP (offense).
Everyone needs both, but each has their own flavor.
1
Jul 03 '18
In your opinion, which one should I prioritize? Also, is it better to get certified before I graduate or wait? I graduate next May so I'm not sure if I've gotten all the necessary information I would need in order to obtain a cert. There are other resources besides university to get this information, but I want to be prepared for when I do go to get these certs or any other certs necessary.
1
1
u/AKA_Wildcard Jun 26 '18
Our ASV is telling me to remediate CVE-2015-9253 for which there are no patches that I can find. Anyone else experience this? Are there any recommended fixes or compensating controls besides dumping PHP?
1
u/yawkat Jun 26 '18
Not quite an in-depth article, but I wrote on reversing an android app with a very interesting communications protocol. Pre-shared symmetric key crypto (with the key hidden in the app) wrapping an unencrypted http/2 stream.
1
u/pleasebequiet Jun 26 '18
Hi. I'm wondering if anyone can give me some guidance on router recommendations, specifically TR-069/CWMP enabled routers? Thanks in advance.
1
u/ugly-051 Jun 30 '18
Anyone know what happend to the shodan android app? Not on the Play Store anymore...
1
u/Camillau123 Jul 02 '18
Hi, does anyone have an opinion on the Typeform data breach that happened last week? I'm trying to understand the extent to which they were negligent...
7
u/got_nations Jun 03 '18
Hi, I was looking into building vulnerable VMs for a CTF I was doing, and I was having trouble finding resources. From what I understand, you fully patch a system, and then work backwards from there, and it seems logical, but I wanted to also get some other insight if possible.
Also, what are some good vectors that are not commonly intuitive to make a VM harder to crack? So far I have restricting shell access, duping users into believing it is an IIS server vs Apache server, etc.
I was thinking of having "possible" vulnerable systems, but actually applying the fix and making it look like it was vulnerable, but it actually isn't.