Quick thread 🍸:
I’m a gen-X kid. I grew up in an age where I was told that nobody cared what you got a degree in, as long as you had a degree “they would know you can be trained.”
WTAF did that mean, anyway? Why did I need a college degree for that? 1/
But hey, I failed out of college. It was the best thing that ever happened to me. It took me out of medicine (I’d have been a practitioner, not a researcher) and put me on a track for something else. Of course it took a TBI along the way to get me here, but fate and all... 2/
Now I have degrees that are barely worth the paper they’re printed on. Lots of my friends do too. Most of them aren’t doing as well. The vast majority work in fields outside of their study.
But hey, you can still succeed. I come from food stamps, not generational wealth. 3/
I want to say “the American dream is broken, it doesn’t exist, it was all a lie.” But I’ve been privileged to travel the globe.
I can say with certainty the American dream isn’t what I was told to expect (I’m not sure it ever was). But it is still alive (and well?). 4/
As crappy as things can be (and COVID has definitely highlighted our fragility), we still have the ability to escape our upbringing.
This is one of the things that people who never leave the US fail to grasp. We have amazing freedoms and opportunities (still). 5/
We have the freedom of the press (and deity forbid you bring up press bias or Section 230 here, I’ll instablock you). We have freedom of speech. Freedom of religion.
When COVID is over, go see the world (I don’t mean Europe). These freedoms are rare (at least as we have them) 6/
I’m posting this now because I keep seeing people claiming the American dream is dead. It isn’t what it was, but I’m not sure it ever was.
I too wish things were better. I too wish we had UBI, universal healthcare, true social justice. 7/
But take a moment to reflect on how good we have it. I would love to share specific stories about how bad other areas have it, but I can’t.
I’ll likely need to travel back to some of those places, and even criticizing them on social media will threaten my safety there. 8/
But here I’m free to criticize my government and rise out of the caste of my birth. You don’t get that many places. I won the birth lottery and I’ll never forget it.
While you keep fighting for a better America, I hope you don’t either. /FIN
This thread was also brought to you by Cypher, but he wasn’t walking tonight...
• • •
Missing some Tweet in this thread? You can try to
force a refresh
This story is getting a lot of attention. Let me quickly break down for followers not in offensive security what it means.
This is not great, but *the sky isn't falling*. Anyone who says this will immediately result in {thing} is uninformed (or worse) 1/ reuters.com/article/us-glo…
First, we need to take the MSFT information at face value. MSFT says attackers could *view* some code (not sure how much/what) but specifically notes that the attackers could not modify anything.
Claiming "well there's risk they had write access" is unproductive in every way. 2/
As MSFT notes in their blog post, they have embraced an open source threat modeling approach - assume the code will become open and don't tie security to secrecy.
Twas the night before Christmas and all over the ‘net,
Not a creature was stirring except a few cyber threats
The firewalls were configured at the egress with care,
But that wouldn’t stop us from being hit by ransomware. 1/
The children were nestled all snug in their beds,
While attackers hit the web server and established a beachhead
Mama with her EDR and I with my IDS
Were ready to tackle this hot infosec mess. /2
Down in the SOC there arose such a clatter,
I logged into my dashboard to see what was the matter.
This thing had better work, it cost so much cash.
How in 2020 can this thing STILL require Flash?! 3/
Now governments have sovereign immunity in most matters under international law. Mercenaries, not so much (IANAL, talk to yours).
But certainly suppliers of weapons to a government wouldn't be held liable if they are used against another nation, right? 2/
That's what NSO is arguing - they are just a provider of weapons. The problem is that NSO went far beyond "just providing the exploit." It appears that in most (if not all) cases they delivered the exploit and managed collection from targets as well. 3/
There’s an additional aspect to this particular government shutdown: these disruptions are favorable operating conditions for cyber adversaries. I hear we’re in the middle of investigating a fairly large breach...
A shutdown now will ABSOLUTELY harm our ability to remediate. 1/
Yes, I know “essential personnel” will still report to work. But as a former fed myself (who was always considered essential), I can tell you that things obviously don’t function as normal, even for your “mission essential” activities. 2/
And some of the damage is already done. Managers are already preparing for shutdowns, distracting them from focusing on where they need to be placing effort on breach investigation and response. The damage will be so much worse if the shutdown starts though. 3/
Got this in my mail today and it’s some next level BS. Shame on these people for trying to threaten people into voting.
That’s right “Club for Growth” - I’m getting your message out there, but perhaps not in the way you hoped...
I'm not saying that you should sign up for Club For Growth's email updates, but if you had the desire to do so using, oh I don't know, any email address, here's the link to do so: clubforgrowth.org/user-registrat…
On today’s #dogWalkingThread, let’s talk about the recently disclosed abuse of SAML by attackers to “bypass” MFA.
For those not familiar with the concept, SAML allows the separation of identity providers (IDP) and service providers (SP). Why the separation? 1/
Suppose you want to access a service, and the service needs to authenticate you, but you really don’t want the service ever having your credentials (EVER). As long as the SP trusts the IDP, this is no problem. You authenticate with the IDP and the IDP tells the SP “trust them” 2/
Let’s consider passports as an analogue. I’ve traveled to many countries I wouldn’t want to have all my identity data, but the State Department serves as my identity provider. Because the country I’m entering trusts the US State Department, the passport is enough. 3/