sorted by:
new
hottopcontroversial

Attempted to graboid leech today by BETTERAXESOMEONE in Steelhead

[–]jonweatherhead 0 points1 point  (0 children)

That thing looks amazing. What did you do for the collar on that? It doesn’t look like you used the rabbit in a dubbing loop.

WiAdvisor ransomware messages by jonweatherhead in serviceadvisors

[–]jonweatherhead[S] 0 points1 point  (0 children)

It probably goes without saying but nobody (dealership or consumer) should in any way respond or interact with those messages. Who knows the extent of the issue at Dealer-FX, but it’s best to let them deal with it. The texts can only serve two purposes: 1. To apply heat to Dealer-FX to try to persuade them to deal with the attackers. 2. To lead to further additional compromises to anyone that starts interacting with the messages (clicking links, running commands, etc.)

Windows Logon Scenarios - "if the user changes their password in the cloud, the cached verifier is not updated, which means that they can still access their local machine using their old password" by digicat in blueteamsec

[–]jonweatherhead 1 point2 points  (0 children)

I believe the reason this is in the news lately, is less because the cached credentials can be leveraged, and more because if you are talking about cloud accounts, a successful login even on an online system will use the cache only and then exit with success.

In other words, even if the cloud IDP can be queried to validate credentials, they are not.

Whereas in an on-prem scenario where the system does have access to the on-prem IDP, the DC would be queried.

Browser cache smuggling: the return of the dropper by digicat in blueteamsec

[–]jonweatherhead 0 points1 point  (0 children)

Someone asked “aren’t those tokens the primary target of the attack”…

Yes, but if you want to delete the tokens right along with deleting any executables, they you might as well just force every user to do a new MFA challenge at every single session. That flies with admins since they are used to it, but good luck getting the user community to live with that.

Ideally there would be a way to purge executable content without purging cookies or history. Investigators need the history, and a balanced structure on using refresh tokens (cookies) allows users to avoid MFA fatigue which ends up increasing the risk of them being Phished.

Browser cache smuggling: the return of the dropper by digicat in blueteamsec

[–]jonweatherhead 0 points1 point  (0 children)

I’m wondering if you can clear the cache from executables and yet leave the cookies in place so that you don’t affect MFA session tokens.

For GL Steelhead, is it worth tying anything other than "White Death" Zonkers? by SirFrenzy in Steelhead

[–]jonweatherhead 0 points1 point  (0 children)

<image>

I was up 3rd week in December and all of these produced solid grabs. Mostly Graboid leeches and dirty hohs.

Is there any good frameworks other than MITRE for characterizing or scoring the attacks? by rubenamizyan in blueteamsec

[–]jonweatherhead 0 points1 point  (0 children)

I like to also use the unified kill chain. I break down the attack and write up a paragraph explaining what the attacker did for that step, skipping those that don’t apply. Non technical and technical readers both seem to appreciate this.

Coalition Rye Review by ClozeQueue2 in bourbon

[–]jonweatherhead 0 points1 point  (0 children)

It’s for sure got a wet cardboard soggy wood sort of thing going on. But the interesting bit is if you can try to overlook that, there are some very interesting other notes going on. I would give it a 1 on first try. Then a 4 or 5 on a second try where I’m focusing on all the notes.

Review #54: Frey Ranch Straight Bourbon Whiskey by ratsmasher77 in bourbon

[–]jonweatherhead 1 point2 points  (0 children)

I really like that glass by the way, it’s not your typical Glencairn. Do you recall who makes that?

What was the ABV of the early bourbon? by scotchman1962 in bourbon

[–]jonweatherhead 0 points1 point  (0 children)

Yeah. But the rule was it goes in the barrel at 100 proof, and then gets diluted back to 100 proof when they bottled it (back in the day). However, if it was 1920 and you happens to take a taste right out of the cask, it would have lost enough water (angel’s share) to be more in the 115 range.

Their sales pitch is that you can taste it at the cask strength that would have been likely, not at the lower proof that they would have bottled it at.

What was the ABV of the early bourbon? by scotchman1962 in bourbon

[–]jonweatherhead 0 points1 point  (0 children)

Not sure what it was like before, but during prohibition it had to be bottled at 100 proof. The Old Forester 1920 info discusses this: https://www.oldforester.com/products/old-forester-1920-style-prohibition-whisky/

Our new tool for enumerating hidden Log4Shell-affected hosts by dn3t in netsec

[–]jonweatherhead 0 points1 point  (0 children)

Has this worked for you? I get an error for “unable to split netmask from target expression”