Join devRant
Do all the things like
++ or -- rants, post your own rants, comment on others' rants and build your customized dev avatar
Sign Up
Pipeless API
From the creators of devRant, Pipeless lets you power real-time personalized recommendations and activity feeds using a simple API
Learn More
-
D: “Did the attackers exfiltrate any data?”
M: “I can’t say for sure, but most likely based on—”
D: “—but did you find any undeniable evidence of it?”
M: “Keep in mind that the absence of evidence isn’t necessarily evidence of absence. There was very limited logging to begin with and the attacker erased artifacts and logs.”
D: “If there’s no evidence, then there was no exfiltration.”
M: “If a business doesn’t have cameras on its front door and then gets robbed, it can’t claim there was no robbery just because they didn’t video-record it.”
D: “That’s a poor analogy. Nothing’s missing here. I couldn’t care less if a robber made a *copy* of my money. That isn’t robbery.”
M: “... If the Titanic really hit an iceberg, then how come no pieces of an iceberg were ever found in the wreckage?”19 -
Definitely my security teacher. He actually expected us to actively learn the stuff and put effort into our education. He guided us through malware analysis and reverse engineering, simplifying it without insulting us.
We had students who thought they knew everything and he corrected them. We had arrogant students he put in place.
He treated us like adults and expected us to act like adults.
That's the only class I enjoyed studying for, because he would tell us exactly what wasn't on the exams (it was an intro course, didn't need to know the math). There were no trick questions.
I told him about the shitty teacher and he helped me through that confidence block. He helped me realize I *can* make it through the workforce as a female in security because I will work my ass off to be the best I can be. He reminded me why I love computers and why I want to go into forensics.
He's been a great mentor and role model and hiring him is one of the few things my department did right.7 -
I'M STARTING GRAD SCHOOL!!!!! I'm so excited I can't think properly. I started screaming in Latin and German mixed with English because I couldn't remember enough words in any one language to express myself, and I'm still certain I was incoherent.
Doing cybersecurity and forensics because I hate having a social life 😎17 -
I know the hate for Facebook is strong here, but I was just approached to work on their eCrimes team... Catching online predators and the like... I'm honestly considering it, given how much evidence is posted. But it requires so much more programming knowledge than I have... I don't know where to start...27
-
Since I moved from pure dev to Code Forensics, and studying with Forensic Computing students (who do one module on security), the amount of Kali Linux wallpapers on a Windows machine is overwhelming.
It's like the entire class watched three episodes of Mr Robot and now thinks they can change the world with a goddamn semester of teaching!4 -
NCIS Logic. Type "dir" and "find . ." Into full screen cmd and full forensics investigation complete.
8 -
I was wondering how a sysadmin would know if the user sending malicious traffic is the real attacker or his account has been hacked ?
(Also probable that the attacker has faked his mac address to user's device)8 -
Someone created a 0-followers private Twitter account and posted something to try out the new views count feature.
It raked dozens of views in a couple hours.
HOW?!?
Source: https://twitter.com/briggityboppity...
It looks like a funny data reverse-engineering exercise, so let's try and figure out what is going on.
Hypothesis 1) it is the OP's own views.
Reasonable, but unlikely if what OP says about not checking it for hours is true.
H2) It's some background job in OP's device that is refreshing OP's own latest tweets, so even without human interaction technically H1 is true. It would be some really shoddy engineering to count eye-less page views, but that's also what managers would demand.
H3) it's some internal Twitter automated function like back up, replication, indexing and word count.
See H2, it would be even dumber to count that as page views.
H4) it's some internal human reviewing for a keyword that could be associated with porn (in this case, "butts"). Really? dozens of humans to review a no-impact single post? They would have to employ hundreds of thousands of reviewers.
H5) it's some page-loading shit, like thousands of similar tweets get stored in the same index hash page and end up counting as a view in all of them every time someone loads the index page. It would be like counting every hit in the namenode as a hit in every data asset in it's Hadoop partition, or every hit in a storage block as a hit in each of it's files.
Duuuumb and kinda like H3.
H6) page views are just a fraud to scam investors. Maybe it's a "most Blockchain transactions are fake" situation, maybe it's a "views get more engagement if you don't think a lot about it" situation, maybe it's a "we don't use the metric system to count page views" situation.
All of them are very dumb.
Other hypothesis or opinions?10 -
Digital Forensics !
a whole new world ...
Got the course from packt.
Any other awesome references for that ?10 -
Started working on a library to allow manipulation of bit sets. It will read in bits in 1 to 8 bit packets and tack them onto a structure that is represented by sequential bits. It will include ways to interpret the bits in 1 to 8 bits per mapping. Each mapping will be able to do logical operations on the bits. The whole point is to be able to take a stream of possibly malformed bits and try and make sense of them.
The inspiration for this is this sequence:
http://therendleshamforestincident.com/...
Yes, it is possible this data is utter bullshit, but I want the library all the same. I think it will be a fun one to write and use for digital forensics of arbitrary data.1 -
I had an interview at a forensics place. I was so nervous the interviewers told me over and over to calm down... It happens automatically to me. I do CBT but it does not help when you are in a room of five people watching you like a hawk5
-
!rant
This is fucking how you do it!
Ticketmaster UK had a "data security incident" where they don't really know if any data was actually leaked/stolen/"accessed by an unknown third-party" — their response:
1. Disable the compromised service across their platforms
2. Send a mail to any customer that may have been affected (I got one in Danish because I had only interacted with them through a Danish subsidiary)
2b. All notified customers have their passwords reset and must go through the "Forgot password" process; the _temporary_ password they sent me was even pretty nicely random looking: ";~e&+oVX1RQOA`BNe4"
3. Do forensics and security reviews to understand how the data was compromised
3b. Take contact to relevant authorities, credit card companies, and banks
4. Establish a dedicated website (https://security.ticketmaster.co.uk/...) to explain the incident and answer customer questions
5. "We are offering impacted customers a free 12 month identity monitoring service with a leading provider. To request this service please visit [this page]"
EDIT: As mentioned and sourced in the first comment, the breach was apparently noticed by a banking provider and reported to Ticketmaster on the 12th of April and later to Mastercard on the 19th of April.
Ticketmaster's internal investigation found no evidence of breach (which makes sense, as it wasn't an internal breach), but when Mastercard issued an alert to banks about it on the 21st of June, Ticketmaster followed up by finding the actual breach and disabling the breached third party service on the 23rd of June.
I still think they did the right thing in the right way...2 -
I had a splash of inspiration. I would like to develop a method for analyzing unknown bitstreams of data. The method would involve determining the format of the data by trial and error machine learning algorithms. This would allow determining data types and byte formats and meanings of streams of data. Could be useful in data forensics. I would call the method: heuristic translation machine learning. I am currently developing code that does this. It will be fun to learn about reinforcement algorithms.5
-
RECOVER MONEY FROM BITCOIN SCAM HIRE ADWARE RECOVERY SPECIALIST
Regaining Trust: My Story with ADWARE RECOVERY SPECIALIST for More Than 36,000 Ethereum
It was a harrowing experience, to say the least. After years of carefully building up my cryptocurrency portfolio, I found myself the victim of a devastating hack that wiped out my entire holdings - over 36,000 Ethereum, vanished in an instant. The sinking feeling of helplessness and betrayal was overwhelming. I had entrusted my digital assets to what I thought were secure platforms, only to have that trust shattered in the most painful way. But I refused to simply give up and accept my losses. I was determined to fight back and reclaim what was rightfully mine. That's when I discovered ADWARE RECOVERY SPECIALIST , a specialized service dedicated to tracking down and recovering stolen cryptocurrency. It was a long and arduous process, filled with dead ends and roadblocks, but the team at ADWARE RECOVERY SPECIALIST never gave up. They used their expertise in blockchain forensics, their extensive network of industry contacts, and their sheer dogged determination to painstakingly trace the movement of my stolen Ethereum. It was like watching skilled detectives slowly unravel a complex web of digital transactions, following the digital breadcrumbs until they pinpointed the perpetrators. And after months of tireless effort, they succeeded - my Ethereum was located, secured, and returned to me. The sense of relief and gratitude I felt was indescribable. ADWARE RECOVERY SPECIALIST had not only restored my financial holdings, but they had also restored my faith in the cryptocurrency ecosystem.
2 -
EXPERT IN STOLEN CRYPTOCURRENCY RECOVERY- RAPID DIGITAL RECOVERY
My all time dream was growing my savings through forex trading, drawn by the allure of high returns and the promise of financial growth. When I discovered an online platform that claimed to offer consistent returns with minimal risk, it seemed like an opportunity too good to pass up. The website was professionally designed, customer service was responsive, and the initial returns on my investments were encouraging. Lured by these assurances, I invested a significant amount—$760,000 over several months. At first, everything appeared to be going as planned. My account was credited with gains, and I was even able to withdraw some profits, which reinforced my belief in the platform's legitimacy. This initial success only fueled my confidence, making the subsequent events all the more devastating. Then, without any prior warning or explanation, the situation took a drastic turn. One day, I found myself unable to access the platform. My account balance had mysteriously vanished, and attempts to reach the company were met with silence. The website, which had once been sleek and functional, was now inaccessible. My heart sank as I realized the gravity of the situation—I had been scammed. The shock and despair that followed were overwhelming. The realization that I had lost everything I had invested was paralyzing. The sense of betrayal and helplessness was compounded by the apparent finality of the situation—no access to my funds, no way to contact the company, and no clear recourse for recovering my losses. Just when I was about to give up hope, I stumbled upon a service called Rapid Digital Recovery. Initially, I was skeptical, having been burned once already. However, Rapid Digital Recovery presented itself as a specialized firm with a track record of recovering funds lost to online scams. They offered a structured process that included an initial assessment of my case, followed by steps aimed at tracing and recovering the lost assets. I decided to reach out to them, sharing all the relevant information about the platform and my investments. The team at Rapid Digital Recovery reviewed my case thoroughly and provided me with a plan of action. They explained their process, which involved legal measures, digital forensics, and negotiations with financial institutions to track down and reclaim the lost funds. Although the recovery process was intricate and time-consuming, Rapid Digital Recovery's expertise and dedication provided a glimmer of hope. They kept me informed throughout the process, which helped restore some of my lost confidence. With their help, I began to see progress in retrieving my assets. While the journey was challenging and not without its setbacks, Rapid Digital Recovery's intervention turned my situation from one of utter despair to a path towards recovery. The experience served as a stark reminder of the importance of vigilance and due diligence in the world of online investments, and I was grateful to have found assistance that helped me navigate the complexities of recovering from a scam.
Contact Rapid Digital Recovery On :
EMAIL: support (@) rapiddigitalreco very .org
EMAIL: contact (@) rapiddigitalrecove ry. org
WHATSAPP: +1 (41 4) 80 7-14 85
Top Tags
Weekly Rant
View