Profile picture
Dino A. Dai Zovi @ BH/DC
@dinodaizovi
, 8 tweets, 4 min read Read on Twitter
There a few talks that I wanted to highlight this year at @BlackHatEvents, and they just happen to be the ones that I’m most excited about seeing.
First off, this talk by George Williams, Jonathan Saunders, and Alex Comerford on detecting deep fakes is really important and I missed it unfortunately:

blackhat.com/us-19/briefing…
I’m also excited to see some great Kubernetes pwnage from @IanColdwater and Duffey Cooley:

blackhat.com/us-19/briefing…
The iMessage vulnerabilities that @natashenka discovered (and their exploitation) are fascinating for us Apple fans:

blackhat.com/us-19/briefing…
DevOps and Security can and will play nice together, and @swagitda_ and @nicolefv will tell you how:

blackhat.com/us-19/briefing…
And to top off the first day, the @PwnieAwards are always a great time:

blackhat.com/us-19/features…
To start Thursday off, this talk by @bubblewire looks like a fascinating approach to hacking the human brain behind the attacks:

blackhat.com/us-19/briefing…
And finally, get your piping hot container escapes from @drraid and @0x7674:

blackhat.com/us-19/briefing…
Missing some Tweet in this thread?
You can try to force a refresh.

Like this thread? Get email updates or save it to PDF!

Subscribe to Dino A. Dai Zovi @ BH/DC
Profile picture

Get real-time email alerts when new unrolls are available from this author!

This content may be removed anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

More from @dinodaizovi see all

Profile picture
Dino A. Dai Zovi
@dinodaizovi
Let’s talk about security measures that didn’t seem to be in place, based on my reading of the CapitalOne case.

1) Lots of PII, SSNs, etc not individually encrypted or tokenized. At-rest encryption of these is necessary, but not sufficient.
2) Use of IAM role creds from *outside* the cloud env was not detected.

3) Access of what appear to be logging S3 buckets, also from outside the cloud env, was not detected.

CloudTrail event monitoring is your friend and should be your #1 priority for AWS security.
4) AWS Macie would have identified massive amounts of PII and other sensitive info in the S3 buckets.

5) AWS GuardDuty would have alerted on some of this too (e.g. S3 access by Tor exit node).

Turn these on, send alerts to your security team *and* team that owns the AWS asset.
Read 3 tweets
Profile picture
Dino A. Dai Zovi
@dinodaizovi
Tweeting an IRL rant from the last week, the biggest reason that many orgs are having trouble keeping up with cybersecurity IMHO is that attack surface scales with software, but their security orgs try to secure it by scaling with human toil. That's the opposite of leverage.
Until we treat securing the org as a problem that we build and maintain custom in-house software to manage, we'll fail to keep up. That means treating security experts as product owners for cross-functional agile software engineering teams that own security management systems.
The problem with toil is that it's addictive. You feel like you are making progress because you are busy fighting fires. But it doesn't scale and when you take a few steps back, you can see that you aren't keeping up. You have to measure and cap toil time to be able to engineer.
Read 4 tweets
Profile picture
Dino A. Dai Zovi
@dinodaizovi
Doug McIlroy on the Unix Philosophy:

"(i) Make each program do one thing well. To do a new job, build afresh rather than complicate old programs by adding new features."
"(ii) Expect the output of every program to become the input to another, as yet unknown, program. Don't clutter output with extraneous information. Avoid stringently columnar or binary input formats. Don't insist on interactive input."
"(iii) Design and build software, even operating systems, to be tried early, ideally within weeks. Don't hesitate to throw away the clumsy parts and rebuild them."
Read 5 tweets

Related threads

Profile picture
Elliot Alderson
@fs0c131y
Few hours ago, the account of @SrBachchan with his 37.4M followers has been hacked. There is a high probability that the hacker is @NoyanAyt2002 1/
First, he tweeted the profile of @SrBachchan without the profile picture and a 🤫
The hack has been heavily commented on Twitter. Then, he bragged about been on the top hashtags.
Read 16 tweets
Profile picture
Joestradamus IV 😺
@Joestradamus91
Wanted to highlight a story from today. bbc.com/news/world-asi…
India conducted a test to launch a rocket and destroy a satellite. They were the 4th country to conduct that test.

India's PM declared India a "Space Power!"
Debris from the test went flying all over the place and the ISS could be in danger.
Read 7 tweets
Profile picture
Elke Babiuk
@ElkeBabiuk
First let’s talk about basic Indigenous rights, then we’ll get to reconciliation

The 2 events are aspects of the same fight — "to be fairly, legally recognized in a country that spins stories about the sincerity of reconciliation...."
#cdnpoli
thestar.com/opinion/star-c…
Thread: Unist'ot'en camp awaits RCMP after injunction enforced at Gidimt'en anti-pipeline checkpoint.

Mounties enforcing court order to allow pipeline company access to northern B.C. road and bridge

#bcpoli #cdnpoli
cbc.ca/news/indigenou…
Trudeau's meeting with Indigenous leaders changed venues after First Nations pipeline protest

Trudeau addressed Indigenous forum in Ottawa as First Nations protesters marched through city
cbc.ca/news/politics/…
Read 27 tweets
Profile picture
#RenukaJain, FCA 🇮🇳
@RenukaJain6
Few world leaders have taken business regulation reforms as seriously as Prime Minister Narendra Modi.

Read the thread written by World bank group President.
1 I first met Prime Minister Modi in October 2014, just days before that year’s Doing Business report was published. India ranked 142nd among 189 countries that year.
2. One stark example of the difficulty of starting and running a business in India: an entrepreneur that wanted access to electricity had to go through 7 official procedures that took over 100 days and cost nearly 5 times the country’s per capita inco
Read 20 tweets
Profile picture
Benjamin Wittes
@benjaminwittes
Final proofs just came in of the soon-to-released Lawfare challenge coin. #Excited
Design by: @ominousrabbit
Slogan by: @DavidKris (“an oasis of rigor in a desert of nonsense”)
Translation of slogan into Latin by: @SarahEBond
Thanks all!
And yes, Lady Justice is recording a podcast and drinking Scotch, @shaneharris.
Read 3 tweets
Profile picture
Jon(JLP)
@OriginalJLP
Seeing a lot of talk of violence pushed by trolls and bots with a few resistance accounts mixed in. So let's talk why that's not smart.
First off it discredits all the hard work we have all put in if let this talk turn into something real.
Warren buffet said it takes years to build a good reputation but only minutes to destroy it.
Read 12 tweets

Trending hashtags

#9PMRoutine #ILLEGALLY #SouthKorea #disco #yoonminweek19 #KEY #CHEERS #Gimbal #KNOWINGLY #UFOs #LOL #dark #blessyourhearts #dumb #ThisIsPasco #SquadGoals #CNH #madness #son #45DaysOfElvisCostello #LIVE #Bangladesh #DIRTY #MoveToPasco #HUSH
Follow Us on Twitter!

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!