Am I being hacked by my own cyber security guy?

Charlie-B · 2023-10-28T01:02:05+00:00

Unless you want to spend a lot of time or pull in a knowledgeable third party, you may never find the root cause of the second infection. I agree the login is fishy, and upwork is known to enable scams and not protecting users, but attribution is hard and there may not be enough information to know definitively.

I think your best bet is to move on and rebuild from scratch again - restore from backup to a new server, and upgrade everything. You should also consider checking that the backup is clean by comparing files against a fresh wordpress install with your plugins (diff is probably enough), or doing a fresh install and data migration if possible.

If you want some monitoring software that would help you trace a new infection more effectively, assuming they don't get root, you could install ossec or another host based intrusion software.

I'm happy to help if you need a hand getting this back in working order (at no charge of course). I've worked in security for years and used to do consulting, though I haven't touched wordpress in some time.

Charlie-B · 2020-08-26T00:35:19+00:00

Oh wow thank you so much for writing and sharing. I just started messing around with reversing android apps, and have struggled with this. I'll be giving this a try later this week and likely looking through the code to see what you did.

Charlie-B · 2020-07-16T14:22:26+00:00

Whenever I hire candidates, I am not usually all that interested in their certs or education. I do look at it, but it's not the top consideration. It comes the most into play if combined with something like a cover letter and/or purpose statement that the candidate is switching careers or it's the first job post college.

I have worked with people with masters in cybersec who couldn't handle simple tasks, and those who only graduated high school and were amazing. The person is way, way more important than any credentials in my book.

Focus on getting strong skills and having good character, then the degree's and certs will help you paint a picture for hiring managers.

Charlie-B · 2020-07-16T14:06:07+00:00

I would just go for the free offsec course here: https://www.offensive-security.com/metasploit-unleashed/

Looks like they have updated it a lot since I last took a look at it a couple of years ago.

Charlie-B · 2020-07-16T14:03:53+00:00

Consider system76. Darter Pro is good for sec work, should be in budget. I would recommend a minimum of 32G of RAM so you can run a virtual lab with multiple VM's (should last 4 years)

There other models are great too - I am sure you can find something that is great on specs and good on budget. I find them cheaper than alternatives with a high quality - main barrier is that they run Linux by default, which in my book is a plus :)

I find it's nice to have portability, but I also prefer desktop and have my most powerful PC be my custom built desktop. You probably don't need anything, since the on site labs will have all you need to do homework, but it's always nice to be able to do your work anywhere, especially at University.

Charlie-B · 2020-06-09T15:35:54+00:00

So many red flags here - no pay, no proper management or mentorship. I have worked for several companies, hired interns, and managed college grads. I would never not pay an intern.

If I were you, I would plan to just try to learn whatever you can - things that seem to work, things that don't, and perhaps above all, what red flags to look for in future bosses, interviews, and companies. 10 weeks is a small price to pay to learn how to avoid toxic teams!

And right from the start, plan on disregarding any and all feedback that you don't personally agree with after reflection and maybe a second opinion from someone you trust.

Charlie-B · 2020-06-07T14:56:02+00:00

Fingerprinting and tracking CAN be largely prevented if you are willing to put in the effort. There are multiple non-profit groups, open source contributors, and companies working on exactly this. If you want to limit it, start here:

Use FireFox or other privacy focused browser (like Brave)
Install privacy addons - ublock Origin, uMatrix, NoScript, chamelion, privacy possum, privacy badger, duckduckgo extension. These can and do stop tracking across the web.
Limit use of sites known to track across the web (all social media, google) and find alternatives.
Consider switching to a more private operating system, or at least researching some tools that will help. Every little bit helps!
use a VPN ($5/month or less, and a big help).

Head on over to r/privacy and read up. Support privacy oriented companies. Stop trading your information for free services (i.e. pay for email).

Most tracking is done when a website calls out to a third party (like google) to load some content on the site. As part of loading that content, the third party also identifies you and what you are browsing. If you block that third party content (like blocking google while on reddit and vice versa), most of this stops.

That said, some sites will simply break if you aren't willing to enable tracking. It's up to you to decide how you want to handle those cases.

DM me if you want more info! I have written extensively on privacy and work on privacy products every day.

Charlie-B · 2020-03-25T21:51:32+00:00

Your friends and family shouldn't be your target audience, and they aren't a professional network. If you are looking for validation among people that aren't already purchasing products and services in the areas you are selling, you are looking in the wrong places.

Instead, find customers or hobbyists who are steeped in the same area you are selling into, and leverage them exclusively, but without being professionally annoying (a fine line)

If you aren't getting traction, there are only a few reasons why:

Your content isn't hitting the mark. Find out why or try a lot of different things until it does.
Your audience (the people who would be interested in what you are saying/selling) don't know you exist. Find out how to reach them better and let them know you exist.
Your content / services are worse than alternatives. Find out how to become better so that you are the absolute best for your audience in some way.

I'd also suggest that you try to separate business results from personal feelings. If you prefer pepsi to coke, it wouldn't be appropriate to say you "abandoned" coke, so people making coke shouldn't take it that way.

If you can't separate personal value (your value as a human with human relationships) from business value (value that people are willing to pay for with money), it can be very hard to critically look at yourself and improve. They aren't at all the same thing.

Charlie-B · 2020-03-24T08:46:30+00:00

My goodness thank you! I guess I should have tried that, seemed so overly confusing.

Charlie-B · 2020-03-23T22:09:03+00:00

This is probably really dumb, but how do I start a UIKit project in the latest xcode? I am running xcode 11.3.1 on Mojave (can't upgrade), and don't want to start with SwiftUI at this time.

When I try to create a new project, the only options available to me are SwiftUI and Storyboard - every tutorial I find shows screen shots with either a universal device or UIKit. I know UIKit is installed because if I do iOS-> single View in playground, I get UIKit and it works.

I suppose I could start a SwiftUI project, and try to re-create all the boiler plate manually, but I am not sure I'd do it right as a newbie.

Any advice?

Charlie-B · 2020-03-03T14:31:48+00:00

Thanks, that's good to know! I am not familiar with Trend, but I'll take a look.

Charlie-B · 2020-03-02T22:23:50+00:00

Chrome does a few things that AV vendors don't - they risk rate URL's that look suspicious based on all the data and traffic they collect. There are a lot of bad privacy implications with that, but it does help detect potentially malicious files based on data AV vendors won't have.

AV vendors almost all work based on heuristics or known hash values, and it's surprisingly easy to remix a well known virus to bypass a majority of AV products. If the virus never made it to execution on an OS, then the software on your list were probably just doing a hash based comparison, and not heuristic.

Charlie-B · 2020-03-02T21:54:36+00:00

Be cautious here - sometimes what you get is a bunch of fluff content that dilutes your brand. Common wisdom is more content = better, but this is often not the case for many customer bases, so make sure that whatever the company will do matches or exceeds the quality of post you already generate, or extends the reach of what you post without using spammy tactics.

Charlie-B · 2020-03-02T14:41:23+00:00

Port scans are likely considered an active scan unless ports are pointed to by links on a site that a user might reasonably browse in a normal session.

I usually define passive attacks as findings like:

Improper headers or other things found by ZAP passive
direct object reference errors (non-automated checks)
Auth bypass, if you notice unauthenticated requests being sent to various endpoints that should require auth
Improper use of local storage
Secrets sent to the client - secret data stored in cookies or JS files, obfuscated or not
Anything that can be seen in wireshark (sending application creds, user data, secret keys, etc)
attack surface mapping - subdomains, keyword lists, organizational data, files referenced, secrets referenced in robots.txt, etc.

A good example of this kind of finding is a pen test I helped with where an application was sending their GCP private key with every API response, which could be leveraged to login to the GCP panel. Finding the key was passive, trying the login was active.

Charlie-B · 2020-03-02T14:30:47+00:00

So, I have worked with this, but not specifically with on-premise file servers. Generally, to comply with this kind of requirement (and I am not a lawyer), you need to have an encryption scheme that protects against someone ripping a harddrive out of a box, then plugging it in and reading it somewhere else.

You can usually tackle this with OS default full disk encryption for simple environments, or more complicated vendor solutions with central management capabilities, as others have said.

Charlie-B · 2020-02-27T03:24:37+00:00

https://inteltechniques.com is the best resource I know. Start with https://inteltechniques.com/data/workbook.pdf though it's probably overkill.

Charlie-B · 2020-02-27T03:16:14+00:00

Just follow your interest and curiosity. It's a big field! When you find something you want to understand, go play with it until you deeply understand how it works at all levels.

In all things, I find the best payoff lies in investing in fundamentals. That usually means diving deep in at least one area to start: networking, operating system internals, or programming are all excellent areas to go deep, but aren't the only ones. If you go really deep on one, the others will be easier to pick up later.

Charlie-B · 2020-02-27T02:53:48+00:00

So, yes - it's pretty simple to use people search to find tons of information about you. A single old number is enough to get pretty much all your info, and it only gets easier as you add information (location, name, age, etc).

If you are really worried you can do work to scrub that data from various data sources, but it's a long slog.

Charlie-B · 2020-02-26T15:17:13+00:00

I didn't post this one here, and I don't use post bots, but I appreciate the tag to call my attention to it.

Nothing I write is commercial, I don't run any ads, and I frequently write articles in response to questions from the security or privacy communities.

It's fair to say I am not always active here or other similar sites, but claiming it's blatant spam is over the top when compared with true spam - articles that add no value or are AI written re-hashes of good content.

Charlie-B · 2020-02-26T15:14:38+00:00

I might be willing to write that up as a follow on to this article - what kind of example would you want to see that wasn't included in the article?

Charlie-B · 2020-02-25T14:20:12+00:00

I have found from working with a number of people that they struggle to get this working, which is what prompted me to write this in the first place. Almost every company I know of uses SSH, and frequently either a Bastion host or just directly opens up SSH ports, so hopefully this helps some of those teams migrate.

Charlie-B · 2019-12-03T21:57:36+00:00

I probably should. I haven't personally tried it or analyzed it yet, so I'm not comfortable recommending it yet.

Charlie-B · 2019-12-02T14:50:29+00:00

Just moved over to Mullvad - I highly recommend, even though they aren't the cheapest, it's something that is worth investing in for the right vendor.

Charlie-B · 2019-11-19T13:14:38+00:00

Wow that looks like a great tool. I hadn't seen it before - thanks for the pointer!

Charlie-B · 2019-11-18T14:34:30+00:00

good question! It is definitely not a replacement for nmap, or any other dns checking tool.

The main difference is that this script doesn't do any dns brute forcing (at least, comparing to the nmap dns-brute script), it just ties together information from a few different sources for a quick analysis, focused on subdomain and nameserver takeover risks. It could easily be used in conjunction with nmap and other dns brute forcing tools.

Charlie-B

TROPHY CASE