Tweet

https://twitter.com/sainteclectic/status/1441424515058257922

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @hackingbutlegal

Jackie 

@hackingbutlegal

25 Sep

@0xBanana

I want to share something important I learned thru the process of producing NFTs with my partner @0xBanana over the past months

I had a valuable realization stemming from the creation of new things of uncertain value & shipping them to buyers

This is for the #infosec crowd

1/8

Creating art which is then roundly enjoyed by others has helped me with perfectionism.

Intellectually, I know that ‘perfect is the enemy of good’.

Unfortunately, my standards for my own work are often far too high to encourage incremental progress & learning in public.

2/8

Part of the reason why I feel that way is because the security community is so frequently negatively judging. As this is the community I joined from a young age, it has molded my behavior to be far too constrained & limited — in direct opposition to the hacker ethos.

3/8

Read 10 tweets

Jackie 

@hackingbutlegal

2 Sep

@0xBanana

Have you ever wanted to drop out of infosec and become your own defensive consultant? Learn from us and our mistakes.

Some things @0xBanana and I learned running our first startup, a boutique cybersecurity consultancy 2018-2020.

A thread🧵

1/

Having lots of enterprise contacts will only get you so far.

Lg corps who have interesting infosec problems to solve typically won't hire a small consultancy unless they have a decent assurance the risk of doing so is low, and the value which will be gained will be high.

2/

Small to mid-size corps have much, much less interesting infosec problems to solve.

In this category, orgs who happen to have a budget with which to hire infosec mostly need product-focused security engineering support, and some nascent devsecops capability.

3/

Read 44 tweets

Jackie 

@hackingbutlegal

1 Sep

Australia just passed a nasty surveillance bill:

“When presented with such warrant […] Australian companies, system administrators etc. must comply, and actively help the police to modify, add, copy, or delete the data of a person under investigation”

tutanota.com/blog/posts/aus…

Politicians said the bill is intended to fight child exploitation (CSAM) and terrorism.

However, the bill enables law enforcement to investigate any "serious Commonwealth offence" or "serious State offence that has a federal aspect".

This wording enables the police to “investigate” any offense which is punishable by imprisonment of at least three years, including:

terrorism
sharing child abuse material
violence
acts of piracy (!!!!!)
bankruptcy
company violations
tax evasion

Read 4 tweets

Jackie 

@hackingbutlegal

31 Aug

https://twitter.com/Trillburne/status/1432829082182504448

This.

Despite all of the “intractable” problems we seem to have, for at least half of these, money gathered in service of our country and Her people, allocated carefully, is the solution.

Raising taxes on the top 1-10% helps solve this.

1/

https://twitter.com/Trillburne/status/1432829082182504448

Republicans refuse to participate in increasing taxation while claiming to be the party of limited government as justification. Excuse me, that ship sailed long ago.

For neocons, or whatever the GOP even are anymore, a small government is no longer a priority.

2/

The main priority of the GOP leadership (and a few Dem leadership as well), based solely on their actions, appears to be the acquisition & maintenance of power for power’s sake. In politics, money drives the machine, so they’ll do whatever is needed to keep it coming in.

3/

Read 7 tweets

Jackie 

@hackingbutlegal

8 Aug

Just recieved what looks a lot like a phishing email, suggesting I am now registered for a COVID test on August 12

Uses the branding of a legit medical facility (in roughly my geo area), from a gmail account with the facility’s legit info@ as the reply-to

Let’s investigate ⬇️

Here's the email. Pretty convincing, right? I have removed a couple of details for OPSEC purposes.

But is there anything particularly sinister about this email? Did it include a tracking pixel? Any bad links?

Let's download the message as an .eml file from Gmail. We do this directly from the message's context menu.

This will provide us the complete headers and allow us to further analyze the message.

Read 37 tweets