Profile picture
Jake Williams @MalwareJake
, 3 tweets, 1 min read Read on Twitter
#GoodDefconAdvice Don't assume you can't/won't be roofied because you're a guy. I speak from experience on this one. Wasn't DEFCON, but it was another Vegas Infosec conference. I have no desire to elaborate further than what I'm posting here (so please don't ask). 1/n
I'll say that it involved me losing several hundred dollars and a phone (that was encrypted and remote wiped). Could have been much worse. Never lose sight of your drink. If you do, even for "just a second," get a new one. 2/n
That stuff comes on fast. If you "feel funny" get to safety. I felt funny and I knew something was wrong. I took some very specific actions that I have no memory of, but my error was thinking I was "still in control." I was not. Go to Vegas, but don't gamble your safety. 3/3
Missing some Tweet in this thread?
You can try to force a refresh.

Like this thread? Get email updates or save it to PDF!

Subscribe to Jake Williams
Profile picture

Get real-time email alerts when new unrolls are available from this author!

This content may be removed anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

Related hashtags

#GoodDefconAdvice

More from @MalwareJake see all

Profile picture
Twas the night before Christmas and all over the ‘net,
Not a creature was stirring except China hacking Tibet.

The IPS were strung by the egress with care,
In hopes that St WannaCry soon would be stopped there.
1/n
The children were nestled all snug in their beds,
While IoT devices mined the dreams from their heads.

Mama with her EDR and I with my IDS
Were ready to tackle an infosec mess.

Down in the SOC there arose such a clatter,
I logged into my dashboard to see what was the matter 2/
This thing had better work, it cost so much cash.
But gosh darnit, I can’t use it until I update Adobe Flash…

Pondering the alarms I thought “Oh heck no!”
That’s because the threshold for alerting was configured so low.
3/n
Read 14 tweets
Profile picture
I certainly don't agree with everything in this thread, but it is very thought provoking nonetheless. I tell clients regularly that cyber security IS warfare if APT is in your threat model. We often fight nation state hackers with nearly infinite resources by deploying a CEH. 1/n
This obviously doesn't work. When you step back and look at resources that APT groups have, it's obvious they can comrpomise almost any organization. My favorite example is the China/Bit9 example. Picture being an attacker who can't get into a top tier target. 2/n
Now imagine that you think "Bit 9 is standing in our way, so we'll 'just' go comrpomise them." Um, that's a moonshot. Ask yourself:
1. What kind of organization dedicates resources to moonshots?
2. How many moonshots do we not know about?
3. How valuable was that target?
3/n
Read 7 tweets
Profile picture
I'm writing a new blog post but I need some help. We have a problem in the tech industry with consent vs. informed consent. Problems with confusing the two are not unique to infosec. Medicine has been practiced for millennia, but informed consent is at best ~50 years old. 1/n
Legalese terms of service can't be comprehended by a large percentage of a user base. Even if you understand what is being collected, do you understand how it will be used? A patient can't give informed consent without a discussion of risk. 2/n
Doctors don't routinely downplay risk in a procedure. This comes from two sources:
1. Liability
2. In most cases (electives are a counter-example), the doctor has a product (the procedure) the patient needs

These do not hold true in the technology field. 3/n
Read 7 tweets

Related threads

Profile picture
1/ I have been running startups and out of managing IT projects for about 5 years. Dove back in last week and it is like nothing has changed except the faces and place. Security architect is a different lens, but good IT hygeine is good security hygeine.
2/ This position would have been a big step up for me and might have been out of my depth the last time I was working on similar projects. Now, it's not quite a cake walk, but I feel confident in a way I never really have running startups.
3/ So much of security comes down to doing IT right. Having a sane inventory and reliable change management processes and documented procedures is honestly at least 50% of it. It's an easy but very expensive corner to cut.
Read 4 tweets
Profile picture
We have a huge credibility problem in information security and it's time we addressed it. We #infosec experts spend too much time asking "How do we get users to care more about security?" - and not enough time asking "How do we get security to care more about users?"
We give security advice without considering the impact to users in terms of cost, time, complexity, and risk of harm. A perfect example is "Turn on #2FA everywhere". It's #2factortuesday, right? I'm a fan. We spend endless hours debating whether SMS-based 2FA should ever be used.
Meanwhile we've spent ZERO time educating users on the risks of harm with #2FA. Namely, the risk that they could lose access to their account. The recovery procedures for 2FA-protected accounts are nearly impossible for average users. How honest are we about this with users?
Read 8 tweets
Profile picture
Last view of the crime scene that was my invaded hotel room and violated space, courtesy of @CaesarsPalace who still have not told me anything, offered me anything (except to move my room - like that really would prevent their security team screaming at me again). My last #DEFCON
The reporting out of this event so far has noted "privacy" concerns. The fact of the matter is, a male's chief concern is privacy. Women's includes that, but our high order bit is that this policy designed to keep people safe from gun attacks *increases* our chance of assault.
Threat models change, & we as security professionals know that. October 1 changed the threat model for Vegas hotels. That in no way changed the threat models for women traveling alone. Only @CaesarsPalace security did that. They are sacrificing women's safety for gun inspections.
Read 19 tweets
Profile picture
According to some recent data by @conspirator0 who analyzed the Russian IRA Twitter data dump the conspiracy hashtags of #pizzagate, #pedogate, #qanon ect appear 2 have first been used by these accts in a measurable way in Nov 2016 & really ramping up in Nov 2017. #infosec #psyop
Looking at our current reverse engineered #Hamilton68 #Twitter accts which are described as Russian influencer accts here (dashboard.securingdemocracy.org) .. our domestic Hamilton68 subset pushing #qanon has diverged significantly from the top Alt-right activist accts pushing #walkaway
Here are our previous threads on the fake propaganda #walkaway campaign
and here . Its interesting that #walkaway seems 2b slowly dying in propaganda value to the Russian influencer #Hamilton68 accounts. #infosec #psyop
Read 6 tweets
Profile picture
I've been getting a lot of questions from women (and some men!) who are going to defcon for the first time this year. First off, congratulations! It's a really great environment to learn and make friends! Since I've been answering the same qs for many, here's a thread of tips:
I'm heading to #defcon @defcon and @DianaInitiative only this year because I'm finalizing a keynote and working on a super secret thing for Saturday. I don't have the capacity to also go to #BlackHat2018 and #BSidesLV so will sadly be missing those :(
With that said though, @BSidesLV is one of my favs and I've never been to Black hat. I've been to #defcon for 10 years straight. Even missed family reunions to go!
Read 23 tweets
Profile picture
#infosec moment:

1/ Met a gentleman this morning outside our agency building today. Enjoyed some small talk; turns out he just got picked up for a dream infosec job. His first actually. Had joined the USAF in aircraft maintenance, pushed himself to learn IT after hours.
2/ You could tell within the first 30 seconds how passionate he is about this field, and how his intelligence and drive would take him far. By 60 seconds, you could also see his self-doubt & tendencies towards Impostor Syndrome.
3/ Ended up spending nearly 30 minutes just mentoring. He had seen me around in cyber (new here myself), and heard my honestly undeserved nickname “MegaMind”. Turns out it wasn’t entirely a chance encounter.
Read 8 tweets

Trending hashtags

#psyop #walkaway #technology #AI #BlackHat2018 #PaperBallots #InfoSec #KeyBoy #Journalists #becauseofherwecan #infosec #DEFCON #womenintech #VoterID #BSidesLV #ThreatHunting #racism #FakeNews #holocaust #unhackthevote #software #BlueWave #LSD #right #5eyes

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member and get exclusive features!

Premium member ($3.00/month or $30.00/year)

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!