Curiosity in Practice
Yesterday Randy Westergren wrote this blog post: United Airlines Bug Bounty: An experience in reporting a serious vulnerability. I do not know Randy and do not think he did anything wrong but his post is a perfect example of why companies I talk to are afraid of implementing bug bounty programs. He hit the trinity of why … Read more
I have been using censys.io a lot lately to do network reconnaissance and noticed they just released a new API that didnt have a CLI frontend so I spent sometime writing a python based one. You can grab a copy here. Usage is: python censys.py -f (search term) It is still pretty rough and I will … Read more
I spend a lot of time working in the starbucks near my office. It is a great place to slip away from the office for an hour when I need to do some heads down work but dont want to be completely anti-social. Even though I always use a VPN one thing that always bothered my … Read more
I have been using the iOS 9 Public Beta 2 and one of the things that I do not like (and has really been freaking me out) is the Frequent Location Tracking. I was getting alerts like this: This made me have the following thoughts: I am not going to Columbia right now. Am I … Read more
At work this week I needed to compare two files to see if they had the same MD5 or SHA256 hash. After spending way too long trying to get hashdeep and md5deep to work correctly and not finding anything else to easily do this I wrote compare.py today. This script is the definition of utilitarian but I … Read more
By default iOS 8 allows Siri to bypass your iphone’s lock screen and reply to messages by default. You should disable it. Here is how: Go to Settings Go to Touch ID & Passcode Turn off everything in “Allow Access When Locked”.
Twitter added a photo tagging feature today and like Facebook decided to have the default setting to allow anyone to tag you. For your own saftey you should change it to this: The steps to do this are easy: 1) Login to Twitter.com 2) Go to the Settings tab.3) Go to the Security tab.4) Under … Read more
First off I must admit one of my all time favorite movies is bloodsport. I was watching it recently and it struck me that I have seen this Dim Mak scene play out at countless infosec cons: No, I haven’t seen anyone break a brick with a secret move at an underground martial arts tournament … Read more
I have been asking my son for the last month what he wants Santa to bring him for Christmas. After many discussions and a huge list I had to tell him Santa only takes list of 5 items or less and that he would have to figure out what he really wanted. It got me … Read more
From time to time I get called by small organizations, law firms and companies in my local area to do some consulting on security issues. Yesterday afternoon <redacted organization> called me and told me they were getting this pop up on one of their computers: That pop-up is known as CryptoLocker and once your machine … Read more