@dantemercurio@ioc.exchange
@dantemercurio@ioc.exchange avatar

dantemercurio

@dantemercurio@ioc.exchange

Technology nerd, infosec leader, husband, dad, skeptic though not in that order. Human rights are non-negotiable. Love all things #infosec, #scifi, #motorcycles, #hiking, animals, #technology and #science related. Director for MSSP services at a security vendor though views here are solely mine. #MSSP #cybersecurity #fedi22

This profile is from a federated server and may be incomplete. Browse more on the original instance.

JoeUchill, to random
@JoeUchill@mastodon.social avatar

Does anyone have a mac cloud backup service they really like that's suitable for a casual user?

Asking for a family member.

dantemercurio,
@dantemercurio@ioc.exchange avatar

@JoeUchill If they are newer devices, iCloud? Simple, integrated, and latest releases support Advaced Data Protection.

dantemercurio, to apple
@dantemercurio@ioc.exchange avatar

Kaspersky has released details regarding the Apple iMessage attack. Apparently it involved four, yes four 0-day exploits in the 0-click exploit chain. I often say if you have to jump up and down, rub your belly, and tap your head for the exploit to work, it’s low risk as most exploits are opportunistic. This definitely looks like an exception.

https://9to5mac.com/2023/12/27/most-sophisticated-iphone-attack-chain-ever-seen/

dantemercurio,
@dantemercurio@ioc.exchange avatar

@hensley Maybe discovered independently, passed on unintentionally, or inside. That’s the problem with security through obscurity, it’s counting on being undiscovered, but the more who know about the ‘feature’ the bigger chance of use.

dantemercurio, to Ubiquiti
@dantemercurio@ioc.exchange avatar

Ubiquiti misconfigured account associations allowed random people to access private video.

https://community.ui.com/questions/Bug-Fix-Cloud-Access-Misconfiguration/fe8d4479-e187-4471-bf95-b2799183ceb7

dantemercurio, to random
@dantemercurio@ioc.exchange avatar

Pansy enjoying Charlie Brown Thanksgiving

dantemercurio, to Cybersecurity
@dantemercurio@ioc.exchange avatar

SEC going after Solarwinds and their CISO for misleading the public regarding their security controls. Like to know who the CISO reported to. In my experience, CISO’s are often constrained by the CFO who they often report to. Never met a CISO who got everything he asked for. Additionally CISO’s often don’t sit on executive executive meetings. Be interesting how this goes.

https://www.sec.gov/news/press-release/2023-227

dantemercurio, to Cats
@dantemercurio@ioc.exchange avatar

Arwen considers hibernation.

GossiTheDog, to random
@GossiTheDog@cyberplace.social avatar

deleted_by_author

    •
    dantemercurio,
    @dantemercurio@ioc.exchange avatar

    @GossiTheDog

    ErrataRob, to random

    I've been putzing around with this textbook for several years now, explaining why the OSI Model is obsolete. It's not accurate practice, it's not theory, it's not even helpful, but people don't understand it well enough to understand what's wrong with it. In over 200 pages, I explain why it needs to be completely abandonned, except as a historical footnote.

    https://docs.google.com/document/d/1iL0fYmMmariFoSvLd9U5nPVH1uFKC7bvVasUcYq78So/edit?usp=sharing

    dantemercurio,
    @dantemercurio@ioc.exchange avatar

    @ErrataRob Never found a good way to explain session and presentation layers in practice without it sounding contrived. With a new stack, we’ll need a new mnemonic phrase though.

    dantemercurio,
    @dantemercurio@ioc.exchange avatar

    @ErrataRob Not needed? Oh man, I was just going to recommend ‘Pizza Now Please!’

    Seriously though, model redo is WAY overdue.

    dantemercurio, to Cybersecurity
    @dantemercurio@ioc.exchange avatar

    NSA employee pleads guilty to attempted espionage. Why attempted? He was actually communicating with an FBI covert agent. He was there less than a month.

    https://www.justice.gov/opa/pr/former-nsa-employee-pleads-guilty-attempted-espionage

    cloudguy, to random

    deleted_by_author

    •
    dantemercurio,
    @dantemercurio@ioc.exchange avatar

    @cloudguy I’d say I’m surprised, but given the abundance of attacks on science, unfortunately I’m not.

    bitsmith, to infosec

    It's almost a year since I gave up on trusting cloud vault providers and moved back to a local KeepassXC (with LOCKSS backup strats). Very happy with that decision.

    dantemercurio, (edited )
    @dantemercurio@ioc.exchange avatar

    @bitsmith Are local password managers back in style? Then my use of Password Safe is now like my outfits from the ‘90’s!

    historyofpunkrock, to punk
    @historyofpunkrock@sfba.social avatar

    42 years ago today
    Black Flag at San Pedro High School on October 20, 1981 with new singer Henry Rollins at one of his first gig with the band.

    dantemercurio,
    @dantemercurio@ioc.exchange avatar

    @historyofpunkrock Worked with a guy that said Henry Rollins worked his Carvel store in DC and was his best employee.

    dantemercurio, to random
    @dantemercurio@ioc.exchange avatar

    Pansy and her fall gourd.

    dantemercurio, to infosec
    @dantemercurio@ioc.exchange avatar

    Very interesting findings in the latest Cisco Security Outcomes study. One quick highlight answers the question of which has more impact on security threat detection, mature people, processes, or technology. Spoiler, they’re all about equal in importance to a mature program.

    Including the best graph from one of the authors @wade

    Looking for ways to work the phrase Ravine of Reality into future discussions.

    Shout out to @wendynather and her team as well.

    dantemercurio, to animals
    @dantemercurio@ioc.exchange avatar

    Leia’s on active bunny duty.

    dantemercurio, to random
    @dantemercurio@ioc.exchange avatar

    Don’t mean to brag, but I’m somewhat of a computer wizard. Both my daughter’s game loading problem and my son’s photo sync problem were solved with me merely being present when they tried to show me the issue.

    dantemercurio, to infosec
    @dantemercurio@ioc.exchange avatar

    MGM now reporting that business systems are functional and back to normal. Seems like a quick turn around. Wonder if they paid the ransom. Even if they didn’t, given a $15M payday from Caesar’s, I expect a busy ransomware season for the immediate future.

    https://www.reviewjournal.com/business/casinos-gaming/mgm-operations-back-to-normal-employees-cite-residual-problems-2908069/

    rodhilton, to random
    @rodhilton@mastodon.social avatar

    Just added 2 pizzas to a doordash cart for pizza and movie night for my family of 4.

    Between the price of the pizzas, delivery fees, taxes, convenience fees, and dasher tip, the total was $80.

    80 bucks for 2 pizzas to be delivered. Pizza. The cheap food famous for delivery.

    This is fucking crazy, I don't understand how people are surviving this bullshit.

    dantemercurio,
    @dantemercurio@ioc.exchange avatar

    @glockenspiel @rodhilton Absolutely. I once ordered a local pizza through DoorDash pickup thinking I’d save a few bucks on delivery and tip. Got to the place and the owner said I paid $4-5 more just for using the app as opposed to calling in. Never made that mistake again.

    malwaretech, to random

    This is absolutely crazy stuff. Chinese hackers were able to get into a bunch of government email accounts by forging Microsoft access tokens, but how it happened is wild.

    Apparently an internal Microsoft system responsible for signing consumer access tokens crashed, then a bug in the crash dump generator caused the secret key to be written to the crash dump. Microsoft's secondary system for detecting sensitive data in crash dumps also failed, allowing the crash dump to be moved from an isolated network to the corporate one. The Chinese hackers compromised a Microsoft engineer's account and were able to get a hold of the crash dump. They were not only able to find the key and figure out that it's responsible for signing consumer access tokens, but were also able to exploit a software bug to use it to sign enterprise access tokens too, basically giving them the keys to the kingdom.

    So many security system had to fail for this to happen. Either the hackers were very lucky or extremely patient.

    https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/

    dantemercurio,
    @dantemercurio@ioc.exchange avatar

    @malwaretech When you lock all your doors but forgot you left your keys under your front mat. The more complex a system, the more likely something is forgotten.

    dantemercurio, to animals
    @dantemercurio@ioc.exchange avatar

    Enjoying the last days of summer.

    dantemercurio, to Cybersecurity
    @dantemercurio@ioc.exchange avatar

    Microsoft discloses details on how their signing keys were stolen. Long story short, a crash dump contained the keys and an engineer’s corporate account was compromised and they had access to the environment where those dumps were stored. I commend the transparency and details on lessons learned and improvements.

    https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/

    thomasfuchs, to random
    @thomasfuchs@hachyderm.io avatar

    I’ll block anyone tooting about the Republican debate, unless it’s 100% made up

    dantemercurio,
    @dantemercurio@ioc.exchange avatar

    @thomasfuchs Thought the use of Americas Got Talent judges as moderators and the inclusion of a singing round was interesting.

    dangillmor, to random
    @dangillmor@mastodon.social avatar

    I believe in trying to detect "AI"-generated content.

    I vehemently do NOT believe in using the products people are peddling to universities to purportedly do this for professors in grading students.

    Even if these things worked at a 99% correct-detection rate -- and they aren't even close -- that would mean potentially ruining the life of an innocent student based on a black-box algorithm.

    I won't do that. Period.

    https://dair-community.social/@timnitGebru/110930665056158940

    dantemercurio,
    @dantemercurio@ioc.exchange avatar

    @dangillmor @mjfgates Since trying to detect after the fact is too flawed, we’re going to have to develop new methods of oversight. My wife’s friend insists on submittal of early drafts with all work.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • JUstTest
  • kavyap
  • DreamBathrooms
  • cubers
  • magazineikmin
  • InstantRegret
  • GTA5RPClips
  • thenastyranch
  • Youngstown
  • rosin
  • slotface
  • osvaldo12
  • ngwrru68w68
  • ethstaker
  • provamag3
  • everett
  • Durango
  • Leos
  • cisconetworking
  • mdbf
  • khanakhh
  • normalnudes
  • tester
  • modclub
  • anitta
  • tacticalgear
  • megavids
  • lostlight
  • All magazines
    •