-
Sharks Are Scary but Worry About Mosquitoes
[This was originally published on RiskBasedSecurity.com and was included in the 2021 Mid Year Vulnerability QuickView Report.] It seems like every day that we hear about a new hack and read headlines that tell us that so-called advanced persistent threats (APT) are compromising major organizations. These APT and nation-state actors have incredible skill and seemingly…
-
Niki7a vs Magen – Charity Drive
Like the epic rumble in the jungle, after a quick offer to throw money to charity on behalf of their suffering, other generous souls jumped in to do the same. The result? Niki7a and Magen are now locked in a legendary contest to see who can wear their DEF CON 29 bracelet the longest. Whoever…
-
Reflections on “CVE Approach for Cloud Vulnerabilities”
At Black Hat Briefings USA this week, Ami Luttwak and Shir Tamari called for a “CVE” style approach to documenting vulnerabilities that affect cloud offerings (note: I have not seen the talk). As one of two people (the other being Jake Kouns) that may have the longest history in this specific space, I wanted to…
-
Random Movie/TV Thoughts and Reviews (August 2021)
F9: The Fast Saga (2021) Medium: Movie (Multiple) Rating: 1 / 5 From zero to trash in 9 movies Reference(s): IMDB Listing || Trailer Four score and 87 Fast & Furious movies ago, we learned to suspend disbelief primarily by ignoring physics. The problem is that with each subsequent movie they have to ignore physics more. And logic.…
-
Random Movie/TV Thoughts and Reviews (July 2021)
[A summary of my movie and TV reviews from last month, posted to Attrition.org, mixed in with other reviews.] The Tomorrow War (2021)Medium: Movie (Amazon)Rating: 0.5/5 don’t wait until tomorrow to ignore this trashReference(s): IMDB Listing || TrailerThis movie was going swimmingly when everything was just regular life in today’s time. The second the “tomorrow”…
-
Perlroth, Miller, and the First Remote iPhone Vuln
In what is sure to be my last blog (?!) born out of reading “This Is How They Tell Me The World Ends” by Nicole Perlroth, this article is basically a quick dive into a single paragraph that contains one sentence with an alleged fact pertaining to vulnerability history. As a self-described Vulnerability Historian, this…
-
Is the Kaseya Hack Actually a Supply Chain Attack?
[This was originally published on RiskBasedSecurity.com as part of a larger series on the Kaseya breach.] What is a Supply Chain Anyway? Within hours of the Kaseya breach becoming public, some critics called out that it was being incorrectly labelled as a supply chain attack. As Nick Carr pointed out, “precise language is important in…
-
Perlroth and the History of Microsoft Vulns
While reading “This Is How They Tell Me The World Ends“, early in the book I ran across a single line that made me double-take. I took a note to revisit it after a complete read since it was so early in the book. For those familiar with my blogs, I tend to write about…
-
RSA Hack Thoughts
I read the article “The Full Story of the Stunning RSA Hack Can Finally Be Told” by Andy Greenberg in Wired and several things stood out to me. So this is my commentary on the article and events that are covered. “It opened my eyes to supply chain attacks.” says Mikko Hypponen, chief research officer…
-
Squirrel Tech Support
Last year in October, I did a release of Fox squirrels for Greenwood Wildlife Rehabilitation after they had been rehabilitated. These squirrels couldn’t go back exactly where they came from because the owner of the property wasn’t available to give permission, which is required by Colorado Parks and Wildlife regulations. A wonderful lady that was…