Building @nzyme_defense // Leichtes Wirkmittel 30+
Houston, TX
Joined January 2008
- Tweets53K
- Following2.2K
- Followers4.4K
- Likes44.3K
Pinned Tweet
I spent a lot of time thinking about where I want to take @nzyme_defense and what kind of company to build. I wrote it up here and shot a whole video with it:
0x58ed.com/blog/left-graylog…
Lennart Koopmann retweeted
Over the next few days, we will be taking steps to erase and lock this account.
We are recommending to follow us on B*Sky or our LinkedIn page (which is actually not annoying and cringe) instead. There is also a RSS feed on the website.
Lennart Koopmann retweeted
There are two nzyme hardware projects in progress.
@_lennart just finished this design and gave it into prototype production.
The other one is more complex and in earlier design stages in Europe.
It does have GPS. 👀
Lennart Koopmann retweeted
We are not in the business of scaring regular people into monitoring their home networks, but always ready to point out the requirement for active WiFi security monitoring in high value target environments.
Here is an incredible story from Washington, DC that just broke this morning.
wired.com/story/russia-gru-a…
Lennart Koopmann retweeted
You will see us roll out our new brand identity over the next few days.
Thanks to our friends at @MiscreantsHQ! They never miss.
Lennart Koopmann retweeted
We are also on the platform with the Blue Skies now. Just search for nzyme . org
And @_lennart is there, too!
PSA: Ubuntu Server will likely have additional `sshd` configs in `/etc/ssh/sshd_config.d/` and those will have priority over `/etc/ssh/sshd.conf`. Mine had `PasswordAuthentication` enabled even though I disabled it in the main config file.
You can print the effective configuration with `sshd -T`. I suggest checking that against your hardening guidelines continuously using your endpoint management software.
I'm adding a @limacharlieio detection to make sure all my hosts are correctly configured.
Lennart Koopmann retweeted
Have you ever wondered what browser extensions your users have installed and what impact they might have to your organization? If you have, I'd bet it wasn't easy to figure out if you tried. I've launched @secureannex to help. Check out my quick tour of the tool.
Here we go! Full @nzyme_defense traffic capture and parsing on a Tailscale interface.
This should work with any "Raw IP" interface like Wireguard, OpenVPN, tun etc
Sunday Funday: RAW IP support for @nzyme_defense Ethernet captures to support direct capture from @Tailscale and similar interface types.
(I am forcing all traffic through Tailscale exit nodes for centralized monitoring, no matter where my endpoints are)
This was easier than expected: (Thanks OSI model) github.com/nzymedefense/nzym…
Next up, I can automatically/transparently enrich Tailscale IP addresses with information from the Tailscale API. I'm thinking hostname, tags, maybe some ACL stuff.
Sunday Funday: RAW IP support for @nzyme_defense Ethernet captures to support direct capture from @Tailscale and similar interface types.
(I am forcing all traffic through Tailscale exit nodes for centralized monitoring, no matter where my endpoints are)
A RAW IP interface is almost the same as a normal Ethernet interface, except that the traffic starts with the IP layer and has no Ethernet information like MAC addresses, 802.1Q/VLAN, EtherType etc.
Tunnel interfaces are usually RAW IP, because there is no switching and the tunnel technology takes care of routing.
Stopped this morning for some bike maintenance and general dillydally but just picked it back up and here is Tailscale traffic flowing through @nzyme_defense
