Blog

Findings, advisories and field notes from Threatbear engagements.

28 May 2021 · 3 MIN READ

From Zero to Visibility in record time

With Security context is critical ; to make a simple analogy there is a huge difference between your wife holding a bread-knife during the daytime is a very different situation to an intruder wielding that same knife in the dark of night. At Threatbear we help Aussie companies detect and respond to Cybersecurity threats and the workflow often goes like this : Install an Osquery fleet server ~1day Build the binaries and connect the endpoints ~1day+

27 February 2019 · 1 MIN READ

Renaming multiple files

When trying to rename multiple files in a directory tree that have the same name — such as Azure signin logs that are written to Azure storage accounts — if you are like me then your first thought would be to use the find . -name *.json -exec mv {}; pattern. The problem is that find executes only one mv here and not one for each file as you would assume. To achieve this we need the help of our venerable bash shell :

2 January 2019 · 1 MIN READ

Digital Ocean dictates what nodes you can add to their Kubernetes service

When one pays money to rent the compute resources from another it should be the customer — not the provider — that decide whether a system can run a workload or not. Simply put I signed up for the Digital Ocean Kubernetes preview and it worked well. Super easy way to get started with Kubernetes and in my case a great way to run periodic jobs in a secure (using k8s secrets) and repeatable (defining my CRON job in a YAML file and ‘applying’ it to the cluster) way.

23 July 2018 · 2 MIN READ

Using Amazon Athena to check if a password has been pawned

Ever wonder if a password you use has been used before or more importantly whether this password is widely known to hackers? Troy Hunt runs an excellent site called “Have I Been Pwned” that allows one to check if their account details have been compromised as a result of a data breach. This works well if you want to check a dozen or so accounts but what if you want to check a couple thousand or million passwords?

6 September 2017 · 1 MIN READ

FTDI drivers on OSX reap havoc with USB ports

In order to update the firmware on pycom.io’s Lopy development boards you need to install the FTDI Virtual COM port drivers (shasum b57377e10de1c8ae9ddaffa147e4cc529c3571b512bba4798b2b6054d4fabd92) for OSX. After an indeterminate amount of time my left USB port on my Macbook Air stopped working properly. If I listed the USB devices on the system : system_profiler SPUSBDataType The device would be listed yet the device details would not be present (and would not work To solve this issue you basically need to remove the driver (I will just use the serial port on my raspberry pi or something like that

29 August 2017 · 3 MIN READ

Why you should choose Hashicorp Vault to store your secrets

I have an ageing certificate authority that is stored mostly offline on a minimal Debian VM. This provides decent security when the VM is not running however there are several risks that have to be considered on the odd occasion when it is running: Integrity of my local machine is roughly proportional to the security afforded by the VM, i.e a compromise of my local machine is the weakest link in the chain of security that protects the VM and the CA within it.

16 August 2017 · 2 MIN READ

Automate your DevOps environment with hyper.sh and a Yubikey

Hyper.sh containers make a great devops workstation for a number of reasons: You can shut them down when not in use which saves money and also reduces the attack surface. Hyper.sh containers have a private Layer 2 segment which can be fire-walled using security groups and which are not shared with other customers. Hyper containers have better isolation than Docker containers (hardware isolation, just like a VM) However starting your devops workstation every time you start the day is painful, that is why I created a little python script that uses osquery to start up my workstation when I plug in my yubikey.

4 July 2017 · 2 MIN READ

Rackspace please add support for Slack notifications to Rackspace Intelligence

Rackspace Intelligence is a server / service monitoring service that allows customers to monitor their systems via remote service checks as well as using an agent. Here’s what is good about Rackspace intelligence: It’s free if you are a Rackspace customer or run Rackspace VMs! Why payPingdom$11 / month a measly 10 checks per month when you can monitor unlimited servers for gratis? Rackspace intelligence does everything you need for basic remote uptime checks and service performance monitoring. There is also an install-able agent that allows you to monitor CPU / memory / etc. which provides substantially more power to keep an eye on your infrastructure.