Profile picture
Rob Graham
@ErrataRob
, 3 tweets, 1 min read Read on Twitter
Them: Why do you always die on those meaningless hills?
Me: Hold my beer.
blog.erratasec.com/2019/08/hacker…
The port that Telnet is normally seen on, where it's normally available, is 21, as was correctly answered in Hacker Jeopardy last night. I know, I know: you think I'm wrong about this, but you are wrong.
Since the new Twitters sucks at threading, here is the link from the top of the thread:
blog.erratasec.com/2019/08/hacker…
Missing some Tweet in this thread?
You can try to force a refresh.

Like this thread? Get email updates or save it to PDF!

Subscribe to Rob Graham
Profile picture

Get real-time email alerts when new unrolls are available from this author!

This content may be removed anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

More from @ErrataRob see all

Profile picture
Rob Graham
@ErrataRob
Again: "defense in depth" is not a real concept. It's just a term vendors came up with to convince you that no matter what you already have, you also need to spend more to buy their product/service. It simply means "more security".
If it were a thing, it would mean "weakening perimeter defense and moving those resources into the depths". It's about moving security resources around, not adding security resources.
"More security" means more security. In other words, yes you'll be more secure if you add more security to the depths of your network -- but simply because adding more security makes you more secure.
Read 4 tweets
Profile picture
Rob Graham
@ErrataRob
There are many misconceptions in cryptography, such as "military grade encryption" (no such thing exists). This is another one: bat shit crazy things are so stupid it's not worthy anybody's time to point out how bat shit crazy it is.
What does it mean "pay you if you can crack it?" What are the rules of this contest? The answer is that the rules are written in such a confusing way, as confusing as their algorithm, that it's impossible to tell if it's been cracked.
It's like McAfee's Bitcoin wallet device that offered bounties if somebody can hack it, somebody hacked it, but they didn't pay out the bounty because it didn't meet their criteria of a hack. But it met OUR criteria of a hack.
Read 6 tweets
Profile picture
Rob Graham
@ErrataRob
This isn't so complex, many people have independently "discovered" this technique. As far as I know @dave_maynor and I were the first to have done this back in 2007, shortly after capable devices first appeared. However, Dave and I did it better.
@Dave_Maynor Using a Raspberry Pi 0 make it look cool, but $30 Android phones off Amazon are a lot cheaper and more capable. They already come with power packs and 3G modems built right into a case that looks perfectly innocent. Even if you run it through an x-ray, it'll look non-hostile.
@Dave_Maynor Send to a non-existent employee. This causes it to sit for a week in the mailroom before they get around to shipping it back to you. Our external batter pack died before we got the device back.
Read 6 tweets

Related threads

Profile picture
Thomas Rid
@RidT
Three days ago The New York Times claimed a variant of a ransomware used against city governments, including Baltimore—known as RobbinHood—was re-using EternalBlue, an old, leaked NSA exploit.

Proving that link forensically should be straightforward. So far no proof.
For there are at least two kinds of facts in infosec reporting:

1—facts that can, realistically, only be backed up through official sources, often anonymous intelligence sources.

2—facts that can easily be proven technically.

We're looking at type 2 here.
Two noteworthy reactions to the NYT's EternalBlue claim with good overviews:

@daveaitel
cybersecpolitics.blogspot.com/2019/05/baltim…

@ErrataRob blog.erratasec.com/2019/05/a-less…

Also,
Read 6 tweets
Profile picture
EverythingOppresses
@SoOppressed
The first area to focus on is diversity. This has become a dogma in the tech world, and despite the fact that tech is one of the most meritocratic industries in the world, there are constant efforts to promote diversity at the expense of fairness, merit and competency. Examples:
USC's Interactive Media & Games Division cancels all-star panel that included top-tier game developers who were invited to share their experiences with students. Why? Because there were no women on the panel.
dailytrojan.com/2016/04/25/poi…
ElectronConf is a conf which chooses presenters based on blind auditions; the identity, gender, and race of the speaker is not known to the selection team. The results of that merit-based approach was an all-male panel. So they cancelled the conference. archive.is/YGhbr
Read 38 tweets
Profile picture
Rob Russell
@www_ora_tion_ca
This is wildly disingenuous, I speak as a flight instructor and major IT incident investigator. Modern software authors have the professional discipline of a cute puppy in comparison to aviation practitioners.
Airplanes *are* under constant attack by gravity, weather, system complexity, human factors, delivery process, training consistency, traffic congestion, and even under attack now by software developers
But every time a disaster happens, we learn from it, publicly, and we share. We're still learning from crashes decades ago. Software developers? Bullshit.
Read 35 tweets
Profile picture
jack
@axre91a
1) Was the debunked Alfa Bank/Trump story a week before the election a Fusion GPS hoax?

...a few observations and links.
2) A week before the 2016, Slate published a bombshell story claiming that internet sleuths analyzing DNS data discovered a troubling connection between a Trump server and an Alfa Bank server. Alfa Bank is one of the largest banks in Russia..
3) The article, citing a Professor named Jean Camp and also the original researcher going under the moniker Tea Leaves, made headlines days before the election, and added to the growing allegations that the Trump campaign had nefarious connections with Russia.
Read 27 tweets

Trending hashtags

#KOSPI #Enough #AClockworkYellow #Canada #WARNING #G20 #DrGonzo #sheepnomore #Pride #KhashoggiMurder #Fed #People #Samba #theRealRatInWashington #MoscowMitchTreason #TeamPatriot #DaytonStrong #Taco #philosophy #Philippines #HiAP #servicejournalism #fails #repost #Portugal
Follow Us on Twitter!

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!