Blog
Findings, advisories and field notes from Threatbear engagements.
Introducing Easy Intel
Threat Intelligence has, for a long time, only been within reach of very large organisations or security teams. Often there is a lot of waving hands and huge dollar values thrown around when talking about threat intelligence. Six month timelines for deploying some technology that is inaccessible to the seething masses or 老百姓 (Mandarin for masses). If you like LOVE the practise of Cybersecurity, you might posess a burning curiosity for details about your cyber-adversaries. You’re not content for someone else to tell you what is a threat and what isn’t. You’re curious - what if we just pay attention to information we already have, like phishing attacks and other low hanging fruit, and extract value from that?
Read moreUsing Elastic Observability as a status page app
Elastic synthetics is an observability solution that we use to measure all kinds of things that we do here at Threatbear. Specifically we use it to monitor whether a service that we provide is available, and it lets us know if it isn’t available (or down in geekspeak). If a system is available, by using Elastic observability, we can know how long a service has been available for as well as the qualitative aspects of the service we provide. For example we can get answers to questions such as “what is the 95th percentile of our latency in milliseconds” or “when does our staging certificate expire”.
Read moreUncomplicated naming convention
Naming conventions are often overcomplicated. They assume you have ten thousand sites and a hundred thousand endpoints per site. Unfortunately this additional complexity means you will probably avoid a naming convention, after all, who needs the extra hassle when there are new new critical vulnerabilities to patch every week! Enter the uncomplicated naming convention - a naming convention for the 90% that strips away the complexities and does one thing well - it answers four questions :
Read moreDetecting copyfail (CVE-2026-31431) exploitation using eBPF
For years, Linux security and observability have relied on a patchwork of tools. We scraped user-space logs, parsed Auditd events, and heavily monitored network traffic. But as adversaries have grown more sophisticated, moving deeper into the system to exploit kernel-level vulnerabilities, traditional monitoring has started to show its age. It’s often too noisy, too slow, or simply blind to exactly what is happening in the dark corners of the operating system.
Read moreHow to enable the Elastic Defend system extension in macOS Sequoia
If you’re trying to install Elastic Defend on macOS Sequoia, the system extension management screen in system preferences has been moved. Previously, as documented inElastic Defend Mac Troubleshootingit was in System Preferences under the “Privacy & Security” tab. In macOS Sequoia, they are now under the General tab. Step 1 - finding the extensions page If you’re on Sequoia, it is now under System Preferences under : General > Login Items & Extensions
Read moreAg-tech Cybersecurity Partner for Darling Downs
Threatbear is a cyber security services provider based in Dalby in the Darling Downs and can provide the following services : Cyber security awareness training Scam email reduction / Email security (80% of attacks start with a scam email - this is no exception in Toowoomba and the Darling Downs) CCTV, License plate recognition and surveillance technology. We can do Ai based object detection. Ag-tech security and security reviews for your smart farm technology (Zimmatic / FieldNet / Lindsay corporation / Lorawan)
Read moreNetwork defence using RouterOS (Part 1)
When looking for threats sometimes you know exactly what you’re looking for. Sometimes — actually often — you only have a general direction in which you wish to conduct your hunt. RouterOS has an operator for a fuzzy search ~ and an operator for an exact match = . This is extremely useful for those situations in which you only have a single clue to go on! If you’re anything like me, once you have a single “high signal” indicator, this then is all the motivation you need to continue the search no matter how arduous.
Read moreIs RouterOS vulnerable to CVE-2023-48795 ?
Is RouterOS vulnerable to CVE-2023–48795 ? Update (20/12/2023) : Terrapin scanner no longer crashes and correctly identifies RouterOS as not being vulnerable to the Terrapin attack — thanks to @TrueSkrillor It was recently discovered that the SSH protocol has a weakness that enables an attacker with the ability to perform a man in the middle to affect the negotiation of protocol security features without the client or server noticing.
Read moreQuick and dirty RouterOS forensics
Here are some commands you can use to conduct a basic forensic examination of a RouterOs device or VM. Note that this it not a full fledged forensic acquisition — this is just a quick single pass look if you don’t have time to pull the data off the flash chips. Check for suspicious logins (should cover webfig and ssh methods) /log/print where topics~"system" Review recent config change history /system/history/print detail /system/history is a very powerful audit feature, especially if you are conducting incident response on an engagement that doesn’t have centralised logs (aka most sites). This is because it includes the detail of the change, the actor and a timestamp, for example :
Read moreRouterOS visibility using Elastic Security
xHaving visibility into host events gives you an insiders view to what is happening on a desktop or server. This information is the primary domain for detecting threats on endpoints, however this information isn’t always available or is not available at all for non general purpose operating systems. This article will give you a jumping off point to get logs of all kinds from RouterOS into Elastic using Elastic Agent
Read more