Cybersecurity
8 posts tagged “Cybersecurity”.
Uncomplicated naming convention
Naming conventions are often overcomplicated. They assume you have ten thousand sites and a hundred thousand endpoints per site. Unfortunately this additional complexity means you will probably avoid a naming convention, after all, who needs the extra hassle when there are new new critical vulnerabilities to patch every week! Enter the uncomplicated naming convention - a naming convention for the 90% that strips away the complexities and does one thing well - it answers four questions :
Read moreDetecting copyfail (CVE-2026-31431) exploitation using eBPF
For years, Linux security and observability have relied on a patchwork of tools. We scraped user-space logs, parsed Auditd events, and heavily monitored network traffic. But as adversaries have grown more sophisticated, moving deeper into the system to exploit kernel-level vulnerabilities, traditional monitoring has started to show its age. It’s often too noisy, too slow, or simply blind to exactly what is happening in the dark corners of the operating system.
Read moreHow to enable the Elastic Defend system extension in macOS Sequoia
If you’re trying to install Elastic Defend on macOS Sequoia, the system extension management screen in system preferences has been moved. Previously, as documented inElastic Defend Mac Troubleshootingit was in System Preferences under the “Privacy & Security” tab. In macOS Sequoia, they are now under the General tab. Step 1 - finding the extensions page If you’re on Sequoia, it is now under System Preferences under : General > Login Items & Extensions
Read moreAg-tech Cybersecurity Partner for Darling Downs
Threatbear is a cyber security services provider based in Dalby in the Darling Downs and can provide the following services : Cyber security awareness training Scam email reduction / Email security (80% of attacks start with a scam email - this is no exception in Toowoomba and the Darling Downs) CCTV, License plate recognition and surveillance technology. We can do Ai based object detection. Ag-tech security and security reviews for your smart farm technology (Zimmatic / FieldNet / Lindsay corporation / Lorawan)
Read moreQuick and dirty RouterOS forensics
Here are some commands you can use to conduct a basic forensic examination of a RouterOs device or VM. Note that this it not a full fledged forensic acquisition — this is just a quick single pass look if you don’t have time to pull the data off the flash chips. Check for suspicious logins (should cover webfig and ssh methods) /log/print where topics~"system" Review recent config change history /system/history/print detail /system/history is a very powerful audit feature, especially if you are conducting incident response on an engagement that doesn’t have centralised logs (aka most sites). This is because it includes the detail of the change, the actor and a timestamp, for example :
Read moreIncreasing signal to noise ratio for Mitel systems
If you’re responsible for defending Mitel systems, specifically the Mitel MiCollab suite running on Mitel’s “Mitel Standard Linux” you have probably noticed by now that the systems are very noisy from defenders point of view, for example: Yes this is actually a legitimate process tree on a Mitel Micollab system — I was investigating an alert that detects suspicious child processes spawned by Java and this is what I found. With process parent-sibling relationships as long as these being the normal (the full tree is about 20 processes long) it is hard to detect or alert on actual malicious activity.
Read moreWhy you should choose Hashicorp Vault to store your secrets
I have an ageing certificate authority that is stored mostly offline on a minimal Debian VM. This provides decent security when the VM is not running however there are several risks that have to be considered on the odd occasion when it is running: Integrity of my local machine is roughly proportional to the security afforded by the VM, i.e a compromise of my local machine is the weakest link in the chain of security that protects the VM and the CA within it.
Read moreAutomate your DevOps environment with hyper.sh and a Yubikey
Hyper.sh containers make a great devops workstation for a number of reasons: You can shut them down when not in use which saves money and also reduces the attack surface. Hyper.sh containers have a private Layer 2 segment which can be fire-walled using security groups and which are not shared with other customers. Hyper containers have better isolation than Docker containers (hardware isolation, just like a VM) However starting your devops workstation every time you start the day is painful, that is why I created a little python script that uses osquery to start up my workstation when I plug in my yubikey.
Read more