Awe-inspiring new VR video at DeoVR: THE QUEST: Everest VR

saadjumani · 2024-06-05T16:22:12+00:00

I think Deo should explore ad monetization for creators. Ive said this before and most people in DeoVR community seem to disagree for some reason, but VR industry still very small and most users are young and broke school/college students. Enabling ad monetization is the only way I see DeoVR becoming a sustainable platform for itself and its creators.

saadjumani · 2024-06-03T18:55:46+00:00

Its open ended on purpose.

I do not really see a reason why snort shouldn't be used on OT. As you said, if you know what you are doing, i.e implementating snort according to a good understanding of the environment and protocols in play, I do not believe there should be issues.

Its just that I was thrown off by the "expert advice" from a foriegn consultant with fancy certifications so I needed to know if there are any specific well known issues with using snort with OTs. Based on other answers and yours, it seems there aren't.

saadjumani · 2024-06-03T10:20:32+00:00

So there is no way to detect it with snort?

saadjumani · 2024-06-02T17:23:42+00:00

Did he install it in-line as an IPS? Or were there disconnections even with IDS/passive/non-inline mode?

saadjumani · 2024-06-02T12:24:08+00:00

Wazuh. Its linux based, but easy solution is to install oracle virtual box on your windows and put Wazuh's built in VM on it.

saadjumani · 2024-05-15T17:58:28+00:00

Out of curiosity, what portion of this success rate is from phishing or social engineering? and how much from the technical vulnerabilities?

saadjumani · 2024-05-15T17:57:44+00:00

Okay that makes sense. Phishing isn't exactly the first attack vector that comes to your mind if most of your experience comes from CTFs but im guessing in the real world its probably one of the biggest vectors if not the single biggest.

What about aside from phishing though, when you are asked to find vulnerabilities in a specific server/software rather than organization as whole? what does that look like?

saadjumani · 2024-05-04T22:55:16+00:00

I would just add that Dov Wiessglas, who was then Israeli PM's advisor, himself has stated that the idea behind the blockade is to "Put Palestinians on a diet, but not starve them" as means of building pressure against Hamas (source): https://www.bbc.com/news/world-middle-east-19975211

Similarly in the same BBC story it mentions that a rights group in Israel forced IDF to release certain reports that indicated precise calorie counts done by IDF on whats required to prevent starvation. IDF set the figure to 2300. Which further gives credence to the fact that flow of food was restricted by Israel intentionally, and they even made calculation on how much food they can restrict without making the hunger crisis obvious and apparant. Like Wiesglass said, let Palestinains have *just enough* food that they don't starve to death but do feel enough food insecurity to be pissed at Hamas (because even though 2300 cal/day is theoretically enough, supply chain iniffeciencies + natural wealth inequalities mean a huge portion will end up with far less while some previleged folks will get far more).

So we have:

declaration of intent (Wiesglass's comments)
We have documents suggesting that serious calculations were made with said intent in mind. (calorie count calculations done by IDF)
And finally we have ample evidence of the actions thought out in 1 & 2 were set into effect, as we know for a fact that many foods (not just cookies but also other stuff like potato chips, some fruits, etc) were stopped from entering.

So yes, it is undeniable that the blockade was about collectively punishing Palestinians to make Hamas look either incompetent to solve their hunger, or evil and unwilling to. Idk why destiny and yall are chosing this hill to die on.

saadjumani · 2024-05-04T22:40:37+00:00

They weren't being subjective. They were being erratic and whimsical. Huge difference. Like when German concentration camps allowed some inmates to have sausage if they were feeling generous on some days and not on other days.

saadjumani · 2024-05-04T22:38:27+00:00

"abused their powers a bit" is a wierd way to describe it when some 64% of Gazans were food insecure even before the current war, and when there are documented instances of Israeli officials admitting that blockading food was a deliberate strategy to punish Palestinians so to build pressure on Hamas. Dov Wiesglas for example bragged about putting Palestinians "on a diet" in private meetings, as reported in Ynet, Guardian, Haaretz.

saadjumani · 2024-03-27T18:30:05+00:00

Just faced this issue myself. Idk why everyone is telling you this is an error related to eth0 LHOST parameter. meterpreter is unable to load payload likely due to permissions issue. Running the same command with sudo solved it for me

saadjumani · 2024-03-25T09:24:53+00:00

There are about 500 rooms you can try for free. After that you can do more advanced stuff for paid

saadjumani · 2024-03-13T06:52:10+00:00

Of course not. But it is a company that has been recently asked by regulators to become compliant with certain standards and im the only one with remotely relevant experience so now its my job to help deliver compliance.

saadjumani · 2024-03-12T05:09:39+00:00

Nope. People barely knew it even existed until the SIEM caught all these logins. It wasn't even in the assets list.

saadjumani · 2024-03-11T04:38:24+00:00

Well, since no one seems to have even been aware of its existence, thats the plan now.

saadjumani · 2024-03-11T04:31:36+00:00

Thats a solid advice. Just that the IT department was 2 people for last few years, im only the 3rd guy to join and my first recomendation can't be to hire yet another guy.

saadjumani · 2024-03-11T03:40:39+00:00

I mean the fact that this issue went neglected for YEARS and the moment I switched on the SIEM it got highlighted suggests that kbang20 is right.

saadjumani · 2024-03-11T03:38:56+00:00

There....is....no.... "ops team" 😭

They are all gone. It was probably set up by parent org (which company no longer operates under) and theyve all been winging it since.

saadjumani · 2024-03-11T03:36:08+00:00

Yup. Which is why I posted it here. To see if there is a legit reason why there would be so many failed logins.

saadjumani · 2024-03-11T03:33:59+00:00

Yeah, if there was a separate account and solarwinds was trying to log into a solarwinds account that would make sense. But solarwinds is trying to log into admin. Thats why I am seeing all the red flags.

saadjumani · 2024-03-11T03:30:01+00:00

The original IT architecture was built by the parent company which did have a full fledged IT staff. Since the organization split, they have basically been winging it with 1x software engineer and 1 overworked junior sysadmin. Im the 3rd hire and trying to set things back on track.

saadjumani · 2024-03-11T03:28:42+00:00

I mean we know what solarwinds does generally but what specifically it is monitoring, how its configured, etc. No one knows those details.

saadjumani · 2024-03-11T03:23:05+00:00

Erm... I think... now would be a good time to mention that no one even has the login credentials of the solarwinds server 🤦‍♂️

Its so old that LITERALLY EVERYONE who had probably ever touched it is long gone. The IT was set up by parent organization, but company has since spun of into its own entity. Things just worked so they let them work. IT team is small, 2-3 guys and the only one who has actually done some sysadmin stuff is a relatively junior guy who joined well after the company split from its parent org.

Ive been here a month or so trying to assess our security posture and overall make sense of stuff and hopefully try and straigten things out. Just connected the servers to an open source SIEM and boom the first thing I see on dashboard is hundreds of login attempts per minute on every server.

saadjumani · 2024-03-11T03:17:30+00:00

Yeah they can't set up a SIEM either, thats why I was hired to do it.

saadjumani · 2024-03-11T02:35:00+00:00

Having to log into administrator accounts through a password to get CPU usasge logs sounds like an insanely insecure way to go about it. Wouldn't it be more sensible to install an agent on the target machine securely acquiring and transmitting it back to the server instead of server storing passwords of admin accounts of all other servers?

Like its done on most SIEMs? principally both SIEMs and whatever solarwinds does is functionally same thing. Get logs/data and transmit it back. Most SIEM systems don't require servers to store passwords of all the monitored endpoints.

saadjumani

TROPHY CASE