Join devRant
Do all the things like
++ or -- rants, post your own rants, comment on others' rants and build your customized dev avatar
Sign Up
Pipeless API
From the creators of devRant, Pipeless lets you power real-time personalized recommendations and activity feeds using a simple API
Learn More
-
D: “Did the attackers exfiltrate any data?”
M: “I can’t say for sure, but most likely based on—”
D: “—but did you find any undeniable evidence of it?”
M: “Keep in mind that the absence of evidence isn’t necessarily evidence of absence. There was very limited logging to begin with and the attacker erased artifacts and logs.”
D: “If there’s no evidence, then there was no exfiltration.”
M: “If a business doesn’t have cameras on its front door and then gets robbed, it can’t claim there was no robbery just because they didn’t video-record it.”
D: “That’s a poor analogy. Nothing’s missing here. I couldn’t care less if a robber made a *copy* of my money. That isn’t robbery.”
M: “... If the Titanic really hit an iceberg, then how come no pieces of an iceberg were ever found in the wreckage?”19 -
Definitely my security teacher. He actually expected us to actively learn the stuff and put effort into our education. He guided us through malware analysis and reverse engineering, simplifying it without insulting us.
We had students who thought they knew everything and he corrected them. We had arrogant students he put in place.
He treated us like adults and expected us to act like adults.
That's the only class I enjoyed studying for, because he would tell us exactly what wasn't on the exams (it was an intro course, didn't need to know the math). There were no trick questions.
I told him about the shitty teacher and he helped me through that confidence block. He helped me realize I *can* make it through the workforce as a female in security because I will work my ass off to be the best I can be. He reminded me why I love computers and why I want to go into forensics.
He's been a great mentor and role model and hiring him is one of the few things my department did right.7 -
I'M STARTING GRAD SCHOOL!!!!! I'm so excited I can't think properly. I started screaming in Latin and German mixed with English because I couldn't remember enough words in any one language to express myself, and I'm still certain I was incoherent.
Doing cybersecurity and forensics because I hate having a social life 😎17 -
I know the hate for Facebook is strong here, but I was just approached to work on their eCrimes team... Catching online predators and the like... I'm honestly considering it, given how much evidence is posted. But it requires so much more programming knowledge than I have... I don't know where to start...27
-
Since I moved from pure dev to Code Forensics, and studying with Forensic Computing students (who do one module on security), the amount of Kali Linux wallpapers on a Windows machine is overwhelming.
It's like the entire class watched three episodes of Mr Robot and now thinks they can change the world with a goddamn semester of teaching!4 -
NCIS Logic. Type "dir" and "find . ." Into full screen cmd and full forensics investigation complete.
8 -
I was wondering how a sysadmin would know if the user sending malicious traffic is the real attacker or his account has been hacked ?
(Also probable that the attacker has faked his mac address to user's device)8 -
Digital Forensics !
a whole new world ...
Got the course from packt.
Any other awesome references for that ?10 -
Someone created a 0-followers private Twitter account and posted something to try out the new views count feature.
It raked dozens of views in a couple hours.
HOW?!?
Source: https://twitter.com/briggityboppity...
It looks like a funny data reverse-engineering exercise, so let's try and figure out what is going on.
Hypothesis 1) it is the OP's own views.
Reasonable, but unlikely if what OP says about not checking it for hours is true.
H2) It's some background job in OP's device that is refreshing OP's own latest tweets, so even without human interaction technically H1 is true. It would be some really shoddy engineering to count eye-less page views, but that's also what managers would demand.
H3) it's some internal Twitter automated function like back up, replication, indexing and word count.
See H2, it would be even dumber to count that as page views.
H4) it's some internal human reviewing for a keyword that could be associated with porn (in this case, "butts"). Really? dozens of humans to review a no-impact single post? They would have to employ hundreds of thousands of reviewers.
H5) it's some page-loading shit, like thousands of similar tweets get stored in the same index hash page and end up counting as a view in all of them every time someone loads the index page. It would be like counting every hit in the namenode as a hit in every data asset in it's Hadoop partition, or every hit in a storage block as a hit in each of it's files.
Duuuumb and kinda like H3.
H6) page views are just a fraud to scam investors. Maybe it's a "most Blockchain transactions are fake" situation, maybe it's a "views get more engagement if you don't think a lot about it" situation, maybe it's a "we don't use the metric system to count page views" situation.
All of them are very dumb.
Other hypothesis or opinions?10 -
Started working on a library to allow manipulation of bit sets. It will read in bits in 1 to 8 bit packets and tack them onto a structure that is represented by sequential bits. It will include ways to interpret the bits in 1 to 8 bits per mapping. Each mapping will be able to do logical operations on the bits. The whole point is to be able to take a stream of possibly malformed bits and try and make sense of them.
The inspiration for this is this sequence:
http://therendleshamforestincident.com/...
Yes, it is possible this data is utter bullshit, but I want the library all the same. I think it will be a fun one to write and use for digital forensics of arbitrary data.1 -
I had an interview at a forensics place. I was so nervous the interviewers told me over and over to calm down... It happens automatically to me. I do CBT but it does not help when you are in a room of five people watching you like a hawk5
-
I had a splash of inspiration. I would like to develop a method for analyzing unknown bitstreams of data. The method would involve determining the format of the data by trial and error machine learning algorithms. This would allow determining data types and byte formats and meanings of streams of data. Could be useful in data forensics. I would call the method: heuristic translation machine learning. I am currently developing code that does this. It will be fun to learn about reinforcement algorithms.5
-
!rant
This is fucking how you do it!
Ticketmaster UK had a "data security incident" where they don't really know if any data was actually leaked/stolen/"accessed by an unknown third-party" — their response:
1. Disable the compromised service across their platforms
2. Send a mail to any customer that may have been affected (I got one in Danish because I had only interacted with them through a Danish subsidiary)
2b. All notified customers have their passwords reset and must go through the "Forgot password" process; the _temporary_ password they sent me was even pretty nicely random looking: ";~e&+oVX1RQOA`BNe4"
3. Do forensics and security reviews to understand how the data was compromised
3b. Take contact to relevant authorities, credit card companies, and banks
4. Establish a dedicated website (https://security.ticketmaster.co.uk/...) to explain the incident and answer customer questions
5. "We are offering impacted customers a free 12 month identity monitoring service with a leading provider. To request this service please visit [this page]"
EDIT: As mentioned and sourced in the first comment, the breach was apparently noticed by a banking provider and reported to Ticketmaster on the 12th of April and later to Mastercard on the 19th of April.
Ticketmaster's internal investigation found no evidence of breach (which makes sense, as it wasn't an internal breach), but when Mastercard issued an alert to banks about it on the 21st of June, Ticketmaster followed up by finding the actual breach and disabling the breached third party service on the 23rd of June.
I still think they did the right thing in the right way...2
Top Tags
Weekly Rant
View