icecap12

Nowadays, I tell developers and product owners around me that cybersecurity is basically about 'doing IT well.' There tends to be this attitude at my $BIGCORP that its a box you tick or its something you do to get done - when in actuality its a way of living.

The majority of exploits take advantage of basic mistakes in configuration or code. Most of those issues are well understood, which is why you've seen this rise of detection tools and automation. Big hacks nowadays are necessarily a daisy-chain of exploits, because we're better at security at certain layers.

But overall, we're far from perfection. Solid configuration and code takes thought and planning - two luxuries rarely afforded to product teams when the business is screaming for release.

The key difference is that it's a conscious choice on the part of the parents to invest in the child's education. But there are other factors. For example, most private education at the gradeschool level requires heavy parent involvement and even volunteerism. Private schools are generally much smaller. The school also has the ability to kick out troublemakers or those who obviously don't want to be there. Not to say there aren't problems in the private schools - there are. But you don't have to deal with people who are just there because the state law says they must attend school.

This is no shock if you are friends with any teachers or have kids of school age. My wife and I have 5 close friends who are all public school teachers (2 of the 5 are a married couple). 4 of the 5 send their kids to private schools. I think that says a lot, given that they aren't paid well and choose to sacrifice and pay the tuition.

The harsh reality is that the pay sucks, you need a masters degree to even be a teacher, parents view public schools as glorified daycare system, and shitty bureaucrats run it all into the ground. Combined with the general lack of discipline and culture of disrespect among kids (I fault the parents), it's a completely miserable experience that was worsened by COVID and remote learning.

I've heard so many ridiculous stories from our friends that I'm shocked any of them remain doing it. In fact, 1 of the 5 I mentioned had enough and threw in the towel for the 21-22 school year. She's doing something else now, like running a study abroad program in association with the local honors university. She only gets the smart, disciplined kids who want to be there. The house of cards that is public education is coming down.

Are you me? I bought mine in about 2006 or so, and in early December 2021, I had to take it apart to remove a child's sock that had been sucked into the pump. Youtube and a couple hours on a Saturday afternoon got it done, my wife was impressed. She didn't think even her mechanically inclined dad would have bothered to try that job. Honestly, the toughest part of it all was getting the main metal sheath/body back on properly. Took me 3 attempts because I was working by myself and the darn thing is so flimsy. It's been running like a tank and I've been impressed with the quality.

OpenWRT is definitely the single best option, however there is very limited support for the WiFi6 routers. If you're upgrading to 6 or 6E, as I was this last month, I found few options for OpenWRT.

However, I already operate OPNSense as my primary router, and all WiFi "routers" on the network act as Access Points and do no routing. OPNSense provides granular control over the network, and offers all the services you would expect in at least a SMB-grade edge device (arguably enterprise), including routing, firewall, DHCP, DNS, IDS/IPS, etc.

Even in AP mode (routing disabled), the new WiFi COTS routers seem to phone home. My guess is a combination of checks for patching and some telemetry. I just block those lookups at the DNS layer for that device, which was effective enough at preventing the traffic. If I have to, I'll block outbound from that device specifically, though I admittedly haven't played around with the after-effects since its sort of the gateway for that specific NIC interface.

At a minimum, I got a good solid laugh out of this, and enjoyed the read. That helped distract me from the log4shell life.

I have an acquaintance that's a mid-to-high level FBI agent. In casual conversation, he's eluded on more than one occasion that the government is able to track people using TOR. I believe his exact words were "we've gotten pretty good at it." At this point, I just assume the government knows about everything I do online.

I remember my reaction the first time I looked at some code produced by FrontPage: "what the fuck?"

Like others have mentioned, the volume of useless code produced by those visually-driven HTML editors was ridiculous. Took forever to sort through it when the same thing could be accomplished with just a few lines.

Wow - amazing link. Thanks!

> The difference is when it's an institution (private versus public schools for example), that's pretty easy to disagree over. One side does not believe the other is inherently evil and a 'lesser' person. When it's about individual rights, and an attack on you as a person, and your inherent rights as an individual, that is almost impossible to overcome.

I think you articulated it far better than me. Certain things I could hardly care what another person says or thinks on the matter. But on certain issues or rights if there's a fundamental disagreement, I find the opposing position not just in direct opposition, but in a way actively working to undermine my position. I can't be friends with someone when there's such a basic difference in values; if we don't agree on that, there might not be much else we agree on.

I'm guilty of effectively ending friendships after seeing things former-friends have posted or stated online. In most cases, their posts or social media content revealed fundamental hypocrisy in what they said versus how they lived, or a belief-system in direct contrast to my own. I really had a hard time with that, and decided that I didn't want to talk to the person anymore. In one case, it was somebody I'd known since like 4th grade.

It's hard to want to be friends with someone that might support the abolishment of something you like, or that supports something you should feel abolished (does it matter which?). It's still possible, but I've found that I eventually figure out where someone stands on something and gravitate away from them, even without social media. Ultimately one of the biggest problems is the total lack of civil discourse. If that was more prevalent, I think it would be easier to have friends with opposing views. Nowadays, people throw up their arms and accuse you of being X when they can't articulately argue a position. That gets tiring.

As the article mentions, in some cases, social media reveals the depths of someone's political positions, personal beliefs, or other that you might not have known. Is it worse to know those things, versus not know? Hard to say, but I personally like to have things in common with my friends. There are no easy answers here, so my personal solution was dumping most social media, like Facebook and Instagram. I hate Twitter, but find myself having to use it to keep up with news in the infosec community; even if the group on Twitter is an echo-chamber club that mostly uses their "status" in the community to influence on topics other than cyber (super annoying).

All I know is, my peace of mind seems to be much better without social media; I don't miss it at all.

[edit] spelling correction

A WAF is obviously not a control designed to be a full-scale replacement for good input validation and development best practices. So yes, its inherent that there are fundamental weaknesses to WAFs.

However, there are still benefits. You deploy a WAF as part of a defense in depth strategy, with one of the best use-cases being situations where you have legacy web systems that nobody is maintaining. Additionally, you can get TLS upscaling, easy HTTP rewrite capabilities, DDoS protection, and other granular controls with some SaaS offerings. So while it's true that a WAF won't stop a determined attacker, there are certainly benefits to operating them, particularly in large enterprise environments.

edit: spelling

Agreed, Terminal is pretty nice for casual use.

Huhn. My wife's Pixel 3 broke just days before the 5a was released (this happened just a few weeks ago). Her LTE radio seemed to be having problems. It wouldn't connect to the cell tower, even after a factory reset. Sometimes, removing the SIM card and reinserting it would cause the phone to magically start working, but it quickly would lose it's connection again. We tried different SIMs, and finally it was totally dead and she used my old iPhone 6 for a few days while we waited for the 5a to arrive.

Wiz is definitely trying to drum up some excitement around their new business with all these recent disclosures. Related but slightly off topic, we pay an industry analyst for high level market research and he's been screaming from the building tops about Wiz.io for the last 6 months. I'm honestly tired of hearing about it, he must get a cut of the sale. I wonder how long Wiz will keep this up; until they get sold presumably, then they'll go the way of the other big cyber firms and tone down the big hacks.

The comment on "complexity-as-a-service" resonates. IMHO, it's primarily because they want to make a product out of everything, including stuff companies build to manage their own AWS implementations. Instead of a simple list of products, its a complex list, with lots of nuances per each service offering. The other day, I was giving a high level summary of cloud technology to an intern; there was a point where I couldn't even find the AWS service I was telling her about from the product list, which annoyed me. Maybe that's more a comment about the marketing site though, but still, when your product catalog gets that big, its hard to avoid ridiculous levels of complexity.

Nice tool. Reminds me a bit of amiunique.org, which provides similar browser diversity and fingerprinting details.

Just a guess, but I think some of this is because they want to present the story at a big security conference.

Feels like a nation-state response. US Cyber Command? Either way, a chilling warning to organized hacking groups.

I guess I was hacking at a young age then. Obtaining the pak1.pak file from a friend who had the CD automatically turned the freeware version into the full version of the game. The tough part was transferring it over a 28.8 baud modem. Took all blasted night on my dads "borrowed" Pentium 90. Oof...kids with broadband these days don't know how easy they have it.

opnsense is where it's at. Alot of pfsense users have been migrating off pfsense lately because of all the Netgate shenanigans.

Agreed - there are entire industries that simply have not caught up with secure management of paperwork, PII and financial information. To be frank, I'm not sure how that's possible with all the regulation.

The mortgage industry is shockingly one of these. I just refinanced again after doing it 5 years ago. I was really curious to see if anything had changed in the 5 years. Any advances in basic tech? Was my experience going to be more secure?

Answer: Nope. Still the same old stuff, hard copies of everything, people asking me for stuff via email. Blatant disregard for privacy. Just absolutely terrible.

Multiple times the guy at the bank asked for my banking statements (which include full account number, balances, PII, etc.) and EVERY TIME I had to ask him to resend the link to their secure email portal. Worse - they never even offered secure transmission as an option...I had to ask about that option. It's clearly not the default behavior.

Interestingly, the closing company was lightyears ahead of the bank. They had contracted a SaaS vendor that provided a secure digital document management product focused on mortgage closing, and I was able to e-sign everything (even able to scan in my signature and apply to documents). I mean, this isn't earth-shattering tech, but it sure was one hell of an upgrade compared to the bank. That's what all banks should be providing today; overall it was a far better experience than the bank.

I recommend your site to my junior AppSec folks, and I used your Capital One walkthrough two years ago to explain the hack to our business. Well done, really love the site.

Nice write-up, I'm happy to hear it was only stage 2!

Colon cancer runs rampant in my family. My dad was a stage 3 survivor (it's now been 12+ years), however his younger sister (my aunt) just died about 6 weeks ago after an 18 month battle. She was a former nurse, and had basically missed getting one of her regular colonoscopies. At that time, she was supposed to go every 5 years and I think she went 10 - too long for her age. She ended up with a blockage, which by that time meant things were realistically too late. She was only 64 and in otherwise excellent health. A second, younger aunt on that side suffers from diverticulitis and has had bowel surgery.

The cancer gene also runs on my moms side; an aunt there had both colon and breast but survived both. So, I'm pretty much screwed. As a result of those risk factors and various symptoms, I've personally had two colonoscopies (one just a month ago).

I'm close to 40, and I had a 2mm polyp removed. There's a high chance that such a polyp would have developed into colon cancer within a few years. I'm now on the 3-year plan for colonoscopy checks. The good news is, in general, colon cancer is one of the most successfully treated diseases if caught early enough. Gastroenterologists will tell you that there's no excuse to die of colon cancer if you get regularly checked.

What I would tell people is to get checked by age 40. If you have any symptoms don't hesitate to call a gastro and get in for a check. For most people, it is hemorrhoids or something else - but I've got a friend (39 years old) who was diagnosed with stage 4 colon cancer - the point is this thing is hitting people in their 30s, so it needs to be taken seriously if you're symptomatic.

On the topic of prep, it's not that bad. It's basically 24 hours of suckage because you're on liquid diet for a day, and taking the prep that evening (typically split-prep, some before bed, some in the middle of the night). Try to schedule your colonoscopy for the first thing in the morning so that you don't have to go more than a day without solid food.

(edit: spelling correction)

As others have said, there are plenty of useful aspects to WAF technology. For my organization in particular, we have a lot of legacy junk floating around, and the WAF is an easy way to add a layer of protection to stuff nobody is working on anymore (keeping internet-facing systems up to date is another convo). As part of that legacy conversation, in addition to prevention of injection and other common web attacks, you get the added benefit of being able to add headers and upgrade TLS connections for old stuff to keep those pesky security scorecard reports off the CISOs desk. For most managed solutions, you can implement geo-blocking with a couple clicks. For the most part, a WAF is good for driveby stuff and zero-days. You have to look at it as just another part of a defense-in-depth strategy, and like any other control, if you put all your eggs in one basket it'll be a bad day. Definitely not snake-oil though.

I guess you never saw the superbowl ads of years past.

Kudos to BHIS for the post and detail. I've been seeing these pop into my Google Calendar randomly for the past few weeks; obvious phishing attacks. You can easily delete them of course, but definitely an annoyance.