devRant - A fun community for developers to connect over code, tech & life as a programmer

Search - "incident report"

23

PaperTrail

10420

8y

SM = Scrum Master

SM: "Card #130, you added a comment saying you aren't going to do update the report?"
Me:"Yea, I explained why in the comment"
SM: "Product owner wants it."
Me: "Product owner isn't the manager using it. I talked with Steve, he said the data is accurate and they have to go to the database anyway to verify the error. That report has no way of knowing the message logged could be a false positive."
SM: "That's not our job to decide. If the Product Owner wants the feature, we add the feature."
Me: "It is absolutely is our job. Steve is the user of the report. I could really care less what the product owner said. The only reason he created the card was because Steve told him a specific error logged could be a false positive, and only happens, maybe, once a month. I'm not wasting my time, Steve's time, or this project's time on wild goose chases."
SM: "I'll schedule a meeting this afternoon to discuss the issue with the product owner. Don't worry, if you can't figure out how to filter out the false positives, I'll assign the ticket to me."

fracking fracking kiss ass. I swear, if he goes behind my back again ....I... deep breath....ahhh...OK..Thanks devrant. Work place incident diverted.

undefined

6
21

Condor

31873

6y

Long rant ahead.. 5k characters pretty much completely used. So feel free to have another cup of coffee and have a seat 🙂

So.. a while back this flash drive was stolen from me, right. Well it turns out that other than me, the other guy in that incident also got to the police 😃

Now, let me explain the smiley face. At the time of the incident I was completely at fault. I had no real reason to throw a punch at this guy and my only "excuse" would be that I was drunk as fuck - I've never drank so much as I did that day. Needless to say, not a very good excuse and I don't treat it as such.

But that guy and whoever else it was that he was with, that was the guy (or at least part of the group that did) that stole that flash drive from me.
Context: https://devrant.com/rants/2049733 and https://devrant.com/rants/2088970

So that's great! I thought that I'd lost this flash drive and most importantly the data on it forever. But just this Friday evening as I was meeting with my friend to buy some illicit electronics (high voltage, low frequency arc generators if you catch my drift), a policeman came along and told me about that other guy filing a report as well, with apparently much of the blame now lying on his side due to him having punched me right into the hospital.

So I told the cop, well most of the blame is on me really, I shouldn't have started that fight to begin with, and for that matter not have drunk that much, yada yada yada.. anyway he walked away (good grief, as I was having that friend on visit to purchase those electronics at that exact time!) and he said that this case could just be classified then. Maybe just come along next week to the police office to file a proper explanation but maybe even that won't be needed.

So yeah, great. But for me there's more in it of course - that other guy knows more about that flash drive and the data on it that I care about. So I figured, let's go to the police office and arrange an appointment with this guy. And I got thinking about the technicalities for if I see that drive back and want to recover its data.

So I've got 2 phones, 1 rooted but reliant on the other one that's unrooted for a data connection to my home (because Android Q, and no bootable TWRP available for it yet). And theoretically a laptop that I can put Arch on it no problem but its display backlight is cooked. So if I want to bring that one I'd have to rely on a display from them. Good luck getting that done. No option. And then there's a flash drive that I can bake up with a portable Arch install that I can sideload from one of their machines but on that.. even more so - good luck getting that done. So my phones are my only option.

Just to be clear, the technical challenge is to read that flash drive and get as much data off of it as possible. The drive is 32GB large and has about 16GB used. So I'll need at least that much on whatever I decide to store a copy on, assuming unchanged contents (unlikely). My Nexus 6P with a VPN profile to connect to my home network has 32GB of storage. So theoretically I could use dd and pipe it to gzip to compress the zeroes. That'd give me a resulting file that's close to the actual usage on the flash drive in size. But just in case.. my OnePlus 6T has 256GB of storage but it's got no root access.. so I don't have block access to an attached flash drive from it. Worst case I'd have to open a WiFi hotspot to it and get an sshd going for the Nexus to connect to.

And there we have it! A large storage device, no root access, that nonetheless can make use of something else that doesn't have the storage but satisfies the other requirements.

And then we have things like parted to read out the partition table (and if unchanged, cryptsetup to read out LUKS). Now, I don't know if Termux has these and frankly I don't care. What I need for that is a chroot. But I can't just install Arch x86_64 on a flash drive and plug it into my phone. Linux Deploy to the rescue! 😁
It can make chrooted installations of common distributions on arm64, and it comes extremely close to actual Linux. With some Linux magic I could make that able to read the block device from Android and do all the required sorcery with it. Just a USB-C to 3x USB-A hub required (which I have), with the target flash drive and one to store my chroot on, connected to my Nexus. And fixed!

Let's see if I can get that flash drive back!

P.S.: if you're into electronics and worried about getting stuff like this stolen, customize it. I happen to know one particular property of that flash drive that I can use for verification, although it wasn't explicitly customized. But for instance in that flash drive there was a decorative LED. Those are current limited by a resistor. Factory default can be say 200 ohm - replace it with one with a higher value. That way you can without any doubt verify it to be yours. Along with other extra security additions, this is one of the things I'll be adding to my "keychain v2".

rant information security reconnaissance problem solving

10
18

ctnqhk

1122

2y

I’m LOLing at the audacity of one of our vendors.

We contract with a vendor to build and maintain a website. Our network security team noticed there was a security breach of the vendor’s website. Our team saw that malicious users gained access to our Google Search console by completing a challenge that was issued to the vendor’s site.

At first, the vendor tried to convince us that their site wasn’t comprised and it was the Google search Console that was compromised. Nah dude. Our Search Console got compromised via the website you maintain for us. Luckily our network team was able to remove the malicious users from our search console.

That vendor site accepts credit card payments and displays the user’s contact info like address, email, and phone. The vendor uses keys that are tied to our payment gateway. So now my employer is demanding a full incident report from the vendor because their dropping the ball could have compromised our users’ data and we might be responsible for PCI issues.

And the vendor tried to shit on us even more. The vendor also generates vanity urls for our users. My employer decided to temporarily redirect users to our main site (non vendor) because users already received those links and in order to not lose revenue. The vendor’s solution is to build a service that will redirect their vanity urls to our main site. And they wanted to charge us $5000 usd for this. We already pay them $1000 a month already.

WTAF we are not stupid. Our network service team said we could make the argument that they do this without extra charge because it falls in the scope of our contract with them. Our network team also said that we could terminate the contract because the security breach means they didn’t render the service they were contracted to do. Guess it’s time for us to get our lawyer’s take on this.

So now it looks like my stakeholders want me to rebuild all of this in house. I already have a lot on my plate, but I’m going to be open to their requests because we are still in the debrief phase.

rant the audacity of this vendor we’re not stupid don’t shit on us

2
13

bjorngi

3866

8y

Poor YT.

undefined incident report gitlab

4
11

gitlog

5739

6y

Git ransom attack
https://github.blog/2019-05-14-git-...

rant github bitbucket gitlab git ransom

15
5

JoshBent

25101

7y

Some interesting reads I came across yesterday:

- Github got DDOSd with 1.35Tbps via memcached
-- https://githubengineering.com/ddos-...

- Troy Hunt, the creator of https://haveibeenpwned.com/ released "Pwned Passwords" V2 and talks about his partnership with cloudflare, how he handles traffic, why he chose SHA1 for the passwords, how he together with a cloudflare engineer thought of a solution to anonymize password checks and more
-- https://troyhunt.com/ive-just-launc...

undefined ddos haveibeenpwned v2 github troy hunt

1
0

NatalieWeaver

-4

241d

Where Can I Recover My Bitcoin?
Recovering lost or stolen Bitcoin can be a challenging endeavor, but there are options available for individuals seeking assistance. One of the most reputable recovery services is Bitsquery Web Retriever, which specializes in tracing stolen assets and helping clients reclaim their funds. If you've lost Bitcoin due to a scam or hacking incident, taking immediate action and contacting a professional recovery service can significantly increase your chances of success.

When reaching out to Bitsquery Web Retriever, clients can expect a thorough assessment of their situation. The team employs advanced blockchain tracing technology to analyze transaction histories and track the movement of stolen Bitcoin. By identifying the flow of funds across various wallets and exchanges, they can develop a tailored recovery strategy that maximizes the likelihood of reclaiming lost assets.

Additionally, Bitsquery Web Retriever emphasizes the importance of timely reporting. Clients are encouraged to report the theft to exchanges and law enforcement agencies as soon as possible, as this can aid in freezing assets and initiating recovery efforts. The team's experience in navigating the complexities of cryptocurrency recovery ensures that clients receive the support they need during this challenging time.

Transparency is another hallmark of Bitsquery Web Retriever. They provide clients with clear information about the recovery process, associated fees, and potential outcomes. This level of communication fosters trust and helps clients feel more secure in their decision to pursue recovery services.

While recovering Bitcoin can be a complex process, the dedicated team at Bitsquery Web Retriever is committed to providing compassionate support and expert assistance. They understand the emotional toll that losing assets can take and strive to guide clients through the recovery journey with empathy and professionalism.

If you're looking to recover your lost Bitcoin, consider reaching out to Bitsquery Web Retriever for expert help. You can contact them at bitqueryretrieverhacker[@]bitquery[.]co[.]site or visit www{.]Bitsquerywebretriever{.]xyz to explore your recovery options.

random

1
0

edgarwarren9

0

230d

HOW DIGITAL HACK RECOVERY HELPED ME RECOVER MY STOLEN CRYPTO

I am a teacher, and I lost 13,000 CAD to fraud. Thankfully, I found help through Digital Hack Recovery, which assisted me in navigating the complex process of recovering my funds.If you find yourself in a similar situation, it’s essential to act quickly. The first step is to report the incident to the relevant authorities, including local law enforcement and consumer protection agencies. Prompt action increases your chances of recovery.Gathering supporting documentation is crucial. Collect any communication with the fraudsters, transaction records, and details about the platform. This documentation helps establish a clear timeline and context for your case. Many fraudsters try to downplay their actions, but these scams are often well-orchestrated schemes designed to exploit individuals.Digital Hack Recovery provided valuable support throughout my recovery journey. They guided me on how to approach my case and helped me understand my options for pursuing recovery.If you used a credit card or bank transfer, reach out to your financial institution to inquire about potential chargebacks or recovery options. Even if the platform was unregulated, some banks may offer avenues for recourse.Joining support groups or forums for fraud victims can also be beneficial. Sharing your experience with others who understand your situation can provide emotional support and practical advice. Remember, you are not alone, and many individuals have successfully navigated the recovery process.While facing the aftermath of fraud can be disheartening, it’s essential to remember your rights as a consumer. Taking action not only helps you potentially recover your losses such as that 13,000 CAD but also contributes to efforts to hold fraudsters accountable.if you’ve been a victim of fraud, don’t lose hope. With the right plan, prompt reporting, and the support of organizations like Digital Hack Recovery, it is possible to recover your funds and regain control over your financial well-being. Don’t let the perpetrators of these scams ruin your mental and financial health. Seek help and take the necessary steps to reclaim your funds. Contact Digital Hack Recovery via⁚

WhatsApp +19152151930
Website; https : // digital hack recovery . com
Email; digital hack recovery @ techie . com

devrant

Top Tags

rant linux code windows fuck i java c programming android dev the is javascript js a life joke python

Weekly Rant

View

Most unrealistic deadline you've had?