Paco Hope @paco@infosec.exchange

I disable location services most of the time and disable background app execution all the time. Is it any wonder why?

Someone actually modified our internal ticketing system to offer the option of seeing random cats or dogs instead of staff members' employee photos. It's awesome.

Oh, man. The 2000s called and they want their integer overflow bugs back.

"unprivileged users with UID > INT_MAX can successfully execute any systemctl command"

https://github.com/systemd/systemd/issues/11026

When—in 2018—I find a CV written in #LaTeX, I think "here's a geek." Only a PhD considers doing a commercial CV in LaTeX.

This documentary, entitled “How the #Internet Works”, is surprisingly accurate. https://video.twimg.com/ext_tw_video/1068883106126618624/pu/pl/S2Kg9NxpEj57b_lj.m3u8

I have to admit, once I got #kibana and #elk running in my #aws account, I just had to Log All The Things. Got some great ability to analyse #CloudTrail out of it.

I’ll be honest: the value prop on CloudWatch is really poor. I was spending more per day on it that to run just an ELK instance sufficient to my needs. But I can also see the slippery slope. Once you get a bit of facility with Kibana you want to Log All The Things! And that gets expensive

Despite my #mikrotik router being annoying, I managed to get #elastiflow running on #FreeBSD in #AWS looking at my on-prem network. https://github.com/robcowart/elastiflow

I love my miktotik router for the capabilities it has at its price point. But it’s doing something annoying that is driving me crazy.

If you’re in #infosec in #london, I hope the monthly https://dc4420.org/ meet up is in your diary. Definitely worth it when I can make it.

When I read a report like this on the deceptive design practices, the constant nagging for location access, etc. I sorta shrug. It's obvious to me. But then I have to ask WHY do we allow this? We, who know better, don't advocate on behalf of those who don't know better. How do we fight this business model? How do we fight and prevent this being the norm? https://www.forbrukerradet.no/side/google-manipulates-users-into-constant-tracking

@feld If you're interested in virtualisation and side-channel attacks and all, you're probably interested in Firecracker too. Just announced yesterday: https://aws.amazon.com/blogs/aws/firecracker-lightweight-virtualization-for-serverless-computing/

For those of you interested in #cloud #security, you no longer need to go to the FUD and magic 1U box shows on the US West Coast. #AWS has announced its own security conference "Re:Inforce". First one will be in the end of June 2019 in Boston. https://aws.amazon.com/blogs/security/announcing-the-first-aws-security-conference-aws-reinforce-2019/

If you find an #infosec absolutist who thinks dogmatic things, point them to this twitter exchange between a math prof talking about abstract cylinders in calculus, and a cat food company who has to manufacture cans of cat food and sell them

https://twitter.com/mathematicsprof/status/1066877975411462144.

So much of IT law hinges on dirt. The dirt that is under the rack that holds the hard disks determines what law applies to the data held by the hard disks and to the owner of the data held on the hard disks.

If you're trying to do digital #forensics in the #cloud on #AWS, there's a really good PDF on this web page that lays out high level principles. https://aws.amazon.com/mp/scenarios/security/forensics/. It's also worth it to go take a look at https://threatresponse.cloud/ for a lot of free tools.

Gotta admit this script was useful. I had a couple big pig memory programs on an ubuntu linux instance. This listed all the running processes and how much RAM they were using. Totally fingered the culprit and made my life easier.
https://www.zyxware.com/articles/4446/show-total-memory-usage-by-each-application-in-your-ubuntu-or-any-gnu-linux-system

If the possibility #AWS public #S3 buckets kept you awake at night (despite all the blogs and code that's been released to prevent/manage them), you finally have a single, account-wide kill switch. https://aws.amazon.com/blogs/aws/amazon-s3-block-public-access-another-layer-of-protection-for-your-accounts-and-buckets/