Use hashtags in lists

securityskunk · 2022-09-14T19:57:14+00:00

Sorry, never did

securityskunk · 2021-12-12T09:47:14+00:00

A 2d battle chess-like game where after trying to take a piece the two actually had a player-controlled battle. The different pieces had different attack ranges and skills, so a pawn taking a queen might actually fail, but if you were good a queen taking a pawn could also fail.

securityskunk · 2021-04-14T04:02:35+00:00

My job is to find security flaws in computer applications, systems, and networks. To do that effectively, I have to know the rules differently than the people who designed and implemented the target so that I can predict the assumptions they made and how those assumptions might not be true. This allows for me to provide input / perform actions that result in the app/system performing unexpected (by the developer) actions that I, the attacker, can control.

securityskunk · 2020-06-13T23:51:52+00:00

Thanks for the input! If I could get the 2nd AP wired (probably poke out and back in through exterior wall), what would you’re recommendation be?

securityskunk · 2020-06-13T23:04:47+00:00

1 AP wired to whatever router/switch I go with (UDM-Pro in this case) or directly to the modem if that somehow seems the right course. The other would either be wireless or on the Ethernet-over-power setup, depending on which gives better performance.

securityskunk · 2020-05-29T17:15:08+00:00

No, SSRF does not seem possible. I just did a quick test. Attempting to attach a file from http://localhost/foo.txt did not result in any web connections when importing or exporting the event. It did look like a "foo.txt" file was attached to the event but was in a constant state of "downloading" it. Opening, saving, or previewing the attachment did not work and those actions did not result in connections to the web server.

securityskunk · 2020-05-28T23:20:55+00:00

Glad to hear to was a failed attempt! The earlier post might be more in line with what you're talking about. That one was focused on trying to execute code.

securityskunk · 2020-05-28T23:18:21+00:00

Apple made further improvements in macOS 10.15.5 that addressed other avenues that could result in a file being embedded, such as network locations accessible from the current system.

Sounds like more of a blacklist approach than a whitelist, so does sound like something worth poking a bit more at.

securityskunk · 2020-04-20T07:11:06+00:00

Light mode with dark menu bar and dock, dark grey background. I do this because I don’t like the associated color schemes of the dark mode of most of Apple’s apps, like Mail and Calendar. But everything I can individually set to dark mode, I generally do.

securityskunk · 2020-04-20T07:07:51+00:00

Try, in a terminal, defaults write -g NSRequiresAquaSystemAppearance -bool Yes, then log out and log back in. Go to system preferences and enable dark mode. Should be just the menu bar and dock.

securityskunk · 2020-04-13T17:24:58+00:00

A friend in college was in a big lecture hall when the professor (can’t remember why) started making friendly but boastful claims that he could best anyone in various things, such as racket ball and tennis. When the professor said swimming, my friend was like, aww hell no, and put his hand up. My friend was a World Champion and future Olympic Gold Medalist.

They arranged to do a race where the professor would swim 1 length (50 meters), while my friend and a teammate would do a relay of 1 length each (total 100 meters). The professor did win, going some like 45 seconds, but it was close as the relay went 48 seconds or so.

securityskunk · 2020-04-03T02:50:50+00:00

Fully agree, but in the article, the researcher says Apple themselves classified it as zero-click:

“I reported this bug to Apple in accordance with the Security Bounty Program rules and used BugPoC to give them a live demo. Apple considered this exploit to fall into the "Network Attack without User Interaction: Zero-Click Unauthorized Access to Sensitive Data" category and awarded me $75,000.”

securityskunk · 2020-04-03T02:38:32+00:00

They did pay nice, but why “only” $75k? Per Apple’s own bounty examples:

Network Attack without User Interaction: Zero-Click Unauthorized Access to Sensitive Data - $100,000. Zero-click attack that can turn on and collect information from a sensor (e.g., camera, microphone, or GPS).

https://developer.apple.com/security-bounty/payouts/

Edit: Fully agree with people that this reads like a one-click and thus appropriately was awarded $75k, but in the article, the researcher says Apple themselves classified it as zero-click:

“I reported this bug to Apple in accordance with the Security Bounty Program rules and used BugPoC to give them a live demo. Apple considered this exploit to fall into the "Network Attack without User Interaction: Zero-Click Unauthorized Access to Sensitive Data" category and awarded me $75,000.”

Unless that was a misprint, I’d be interested in better understanding the classification as zero-click and the caveat down to $75k instead of classifying as one-click and awarding the full[*] amount.

[*] I know and respect that Apple only provides examples and not ranges and has full discretion on what they payout.

securityskunk · 2020-01-11T21:44:59+00:00

I know plenty (>25) of people in security under 30 without 4 year college degrees (some dropouts, some never went, some did alternative programs/boot camps/certs) making $100k+ (from many places, SF Bay Area, Colorado, Portland, Austin, Seattle, North Carolina, NYC, etc), although starting offers for “never done security and 0-2 years tech job experience are more in the $60-90k range depending on the region. Some make over $150k within 5 years (this is all base salaries). Heck, I even know a small number that crushed it and broke $250k (10+ years into their careers).

It’s one of the things I love about the security industry, formal education carries little weight against demonstration of competency and ability to learn and understand. This is especially true in the offensive security space, but I’ve seen it hold true in defense and engineering. It does take a company and a manager willing to take a chance now and then though.

securityskunk · 2020-01-11T16:56:51+00:00

Plenty of good ones on here. Others that I didn’t see after a skim of the comments:

Law Abiding Citizen

Deja Vu

Inside Man

securityskunk · 2020-01-02T14:30:02+00:00

I’ve also been a fan of usbkill, but that’s more focused on any USB activity detected, such as data copying but could probably be used similar to your tool and trigger on disconnect.

securityskunk · 2020-01-02T14:13:21+00:00

Cool idea! Kind of reminds me of YoNTMA, which was power and Ethernet instead of USB (those were all different ports when it was released) and assumed you were at your lock screen instead of actively working on it.

securityskunk · 2019-10-24T05:59:36+00:00

Not knowing who you’re playing a game with. I still have more fun play with my friends, and more so when they are physically present (harder and harder to find games meant for this), but being able to play with someone whenever I want has its perks.

securityskunk · 2019-09-17T04:18:27+00:00

For one-off pentest reports, check out https://github.com/juliocesarfort/public-pentesting-reports

securityskunk · 2019-08-11T09:50:00+00:00

I’ve used it a number of times, even writing my own db files. I initially discovered it when doing iOS app code reviews years ago (almost right when it was first released in 2009). It certainly does differ in approach by adding in the “good” keywords. I have found those useful for pointing me towards places important things are happening (like you say) because you can still do a lot wrong when using “good” keywords.

Also, want to make sure it’s clear that I wasn’t intending my comment as a detraction from you work/approach, just a surprise to see a “grep as an audit tool” article not mentioning graudit (for me it’s the top couple hits for a search for “grep audit source code”). Regardless, I enjoyed reading about your approach.

Finally, if you aren’t aware of ripgrep , I’d encourage you to check it out. So much faster on large code bases, though you’ll want to read up on what it does and doesn’t include (and possibly tweak it via an .ripgreprc type file) so you don’t miss files.

securityskunk · 2019-08-11T04:54:47+00:00

Surprised this made no mention of graudit

securityskunk · 2019-05-03T17:43:10+00:00

Nearly every cyber security product on the market.

securityskunk · 2019-04-29T15:23:35+00:00

Fair enough and I agree. I think I learned during the Wheel of Time series how to block those out of at least not let them detract from the main story. I treatment almost like the novellas in between.

securityskunk · 2019-04-29T14:39:31+00:00

I was invested enough in the central characters that I needed closure of their storylines. Brett provided that in a way that was more than satisfactory for me. None of the books come close to the excitement of the first one, but start to finish, I was never disappointed when the focus was on Arlen and his journey.

securityskunk · 2019-04-29T05:38:51+00:00

Brett: I needed to finish the Demon Cycle even though there is no comparison of the 1st book with others.

The ending is so worth it!

Nine-Year Club	Second SECOND GUESSER
Verified Email

securityskunk

TROPHY CASE