Dave Bell retweeted
.@Volexity shares #threatintel on how #StormBamboo compromised an ISP to conduct DNS poisoning attacks on targeted organizations & abuse insecure HTTP software updates, delivering custom malware on both macOS + Windows.
Read the full analysis: volexity.com/blog/2024/08/02…
#dfir
Dave Bell retweeted
Our friends over at @redcanary are hiring! Their Intel Analyst role is a full-time #synapse enterprise user!
jobs.lever.co/redcanary/bb7a…
Dave Bell retweeted
Praetorian is hiring for another 3 red teamers at the lead+ level of experience.
Have to be lead or above for this hiring round, no junior or senior for the red team until next quarter, but there are other open positions on our website. We filled 29 reqs in Q1 and are scaling quickly but sensibly.
Our clients have mature environments, you won’t have an easy life; but if you like to be challenged, this is a good place for you.
**I am slow in DMs, best apply via our website but drop me a note
Dave Bell retweeted
Which sounds more realistic?
“If we do a few strategic things we kneecap the attackers”
“We can do all the things everywhere all at once, 365x24 forever.”
It seems like focusing our limited resources where it matters would be better.
3
Dave Bell retweeted
My friend Krypt3ia is still searching for a remote CTI role after being caught in the layoff cycle. He's got years of solid experience and technical chops - including LLM training.
If you've got leads, ping me and I can pass them along or share his resume. RT for reach pls.
Dave Bell retweeted
First, I want to compliment @Microsoft for being forthright with details. Some of the problems I see in this report, I SEE EVERYWHERE due to VULNERABLE DEFAULTS.
Let's start with creating malicious OAuth applications. By default, ANY USER can create app registrations and consent to Graph permissions as well as sharing 3rd party company data. In tenants where this is hardened, ability to create app registrations require Application Administrator or Cloud-Application Administrator and admins must consent to permissions used by the application whether local or from another tenant.
Dave Bell retweeted
My friends, the come has come once again. This holiday season, I'm giving away a golden ticket that grants free entry into ALL my training courses and tons of other amazing prizes.
Dave Bell retweeted
Bypassing Crowdstrike Falcon EDR hooks with targeted algo, decomposing agent's hooking logic.
Although extremely Falcon-specific, nevertheless good exercise for any maldev.
Great work, @inbits_sec!
#redteam
inbits-sec.com/posts/in-memo…
Dave Bell retweeted
Howdy folks! I wrote another free Trimarc whitepaper on #ActiveDirectory Object Ownership. 50+ pages of PDF goodness on how ownership can be abused, how to discover non-standard object ownership, remediate it retroactively, & how to defend against it proactively.
New Trimarc whitepaper by @JimSycurity: "Owned or Pwnd - Discovering and Remediating AD Object Ownership Issues" is available for download below.
hub.trimarcsecurity.com/post…
For more AD and Azure AD tips, join for our AMA tomorrow afternoon at 2pm ET.
attendee.gotowebinar.com/reg…
Dave Bell retweeted
Microsoft recently reached out to get my perspective of identity security (Active Directory & Azure AD).
Here's the interview:
techcommunity.microsoft.com/…
TLDR:
Many of the issues we have seen with Active Directory are in Azure AD as well from a customer perspective.
Dave Bell retweeted
I’m at @BSidesCharm and recruiting an AWS infra eng. HMU if interested :)
Dave Bell retweeted
My friends, it's my favorite time of the year. This holiday season I'm giving away a golden ticket that grants free entry into ALL my training courses along with many other fabulous prizes.
All the details are here: ruraltechfund.org/goldentick…
Dave Bell retweeted
One of my biggest regrets was not contributing to my 401K with matching employer funds starting when I was 18.
Do NOT fuck this up if you can manage it financially. I've been contributing overtime recently and I'm still in deficit.
Go to your employee portal. Fucking free money
Dave Bell retweeted
NEW: The British government is introducing a mandatory reporting obligation on managed service providers to disclose cyber incidents, alongside minimum security requirements which could see them fined up to £17 million for non-compliance.
therecord.media/uk-introduci…
Dave Bell retweeted
Do they know what this phrase means?
ALT Fortinet sign for booth: cloud security theater
Dave Bell retweeted
Thats the crazy thing us old timers know. The pen test we did 24 years ago reads exactly the same as one done today.
Dave Bell retweeted
Based on what we have seen during Active Directory security assessments, if you have Active Directory Certificate Services (ADCS) in your environment, you want to download and run Locksmith to scan for ADCS security issues.
Locksmith provides remediation as well!
New tool release!
Locksmith from @dotdotdotHorse. Jake recently gave a talk @WWHackinFest where he released a tool to identify and remediate common misconfigurations in Active Directory Certificate Services. #NCSAM
Check out his slides and blog here:
hub.trimarcsecurity.com/post…
