John Harrison (@drdriveby) profile picture

Security dude focused on protecting users from Ransomware attacks and some of the latest threats. The opinions I express here are my own

Mountain View, California
Joined August 2008
Photo by John Harrison (@drdriveby)Photo by John Harrison (@drdriveby)Photo by John Harrison (@drdriveby)Photo by John Harrison (@drdriveby)Photo by John Harrison (@drdriveby)Photo by John Harrison (@drdriveby)Photo by John Harrison (@drdriveby)Photo by John Harrison (@drdriveby)Photo by John Harrison (@drdriveby)Photo by John Harrison (@drdriveby)
John Harrison retweeted
2024-04-15 (Monday): #ContactForms campaign pushing #SSLoad malware as early as Thursday, 2024-04-11. List of indicators available at bit.ly/49Cz1kL #Wirshark #Unit42ThreatIntel #TimelyThreatIntel #InfectionTraffic
1
49
100
15,838
We just finished processing or in other words we just "Slash & Grabbed" this amazing report from @HuntressLabs team. Made some updates and added some new Sigma rules. But fortunately a lot of it was already covered by old generic rules. Here is a quick thread on every Sigma rules from @sigma_hq you can use to catch things mentioned in this 💎report
We just published a report on EVERYTHING that @HuntressLabs SOC is seeing for post-exploitation from #ScreenConnect CVE-2024-1708/CVE-2024-1709. huntress.com/blog/slashandgr… There's A LOT of it. We're talking: - Adversaries Deploying Ransomware (LockBit and others) - Classic LOLbin enumeration and reconnaissance - Dropping cryptocurrency miners (masquerading as SentinelOne) - Installing other persistence and backdoors (SimpleHelp C2, SSH, Remote Desktop, new users, reverse shells) This includes all the technical details and tradecraft for each variety of these attacks. Please go look through this. If I may be so bold, I think this is seriously the biggest and most-comprehensive release of the active threat intel that we've seen shared publicly so far.
2
25
4
121
82,582
Cybersecurity expert here: no. The stories of teenage hacking are sensationalized. As far as we can tell, he didn't hack into the company using a FireTV stick. He accessed the company using his phone. Specifically, he connected his phone to the TV and its bluetooth keyboard, through the FireTV stick. This made things more convenient when accessing the Internet from his phone, but was by no mean such things were essential. Moreover, the story sounds like he'd hacked into the company and stolen the content weeks before. He then just logged into their Slack to taunt them while in the hotel room. Accessing Slack from you phone is not terribly difficult. As for his skills, most teenagers have no skill in general, but have been taught by other teenagers one specific skill. What makes it work isn't because the teenagers are smart but because their targets are dumb. The NSA already has all these skills. The one thing that would be valuable to the NSA is autistic obsession with tech. There are a lot of autism-spectrum people who you could just stick in a room and watch blossom with tech skills because they are obsessed with them. You don't have to 'train' them, they'll train themselves. But, their goals aren't aligned with the NSA. The NSA doesn't go romping through the Internet hacking whomever they find. NSA hackers are given specific tasks to achieve, they must play by the rules, and the paperwork involved is more arduous than the actual hacking. Such autistic kids would not do well in that environment. The kind kids the NSA wants to hire are those that are socialized enough they won't get so angry at the needless paperwork and roadblocks that they go off on a rampage (like Snowden). That's a rare enough skill to find. All the rest of the hacking skills can be taught. If you are an organization with zero skills of your own, then sure, hiring such kids will at least get you started. But you'll exhaust their value within 3 months, after which you've got a sociopath on your hands that you have to deal with.
37
276
33
2,155
417,167
Curious about the current landscape of cyber-attack detection methods in water distribution networks and the challenges faced? Watch Rosanne Aartman's talk from #WICCON2023 here: youtu.be/VxNdmzqvclw #WICCON #womenintech #womenincybersecurity #infosec #infosecurity
7
9
858
🌙🤩 IT'S ALMOST TIME, ONLY TWO MORE DAYS TO GO! 🤩🌙 Don't forget to check out all the awesome talks from @jayabaloo, @Queen_fennec, @sannemaasakkers, @TessSluijter, @0xD4ni, @OttiliaW, @GerineLodder, @evamolotow and many more! wiccon.nl/schedule #WICCON2023
1
12
3
20
3,848
Are you as excited as we are?! Only 3 days left until #WICCON2023 In the market for a last-minute ticket? There are a couple left. 🎟️Tickets: wiccon.nl/tickets #WomenInTech #DiversityInTech #WomenInCybersecurity
1
7
1
12
2,026
John Harrison retweeted
Yes this will solve ransomware
You’re unable to view this Post because this account owner limits who can view their Posts. Learn more
13
7
1
60
23,966
Whelp, wasn’t expecting this ConnectWise RCE to become public today. Guess we’ll publish on Monday how @HuntressLabs went from a researcher’s tweet to the ability to push ransomware through ~5,000 R1Soft servers that are exposed on Shodan. #staytuned connectwise.com/company/trus…
10
110
10
317
#ZeroTrust .. buzz
10
67
1
454
Happy International #DataPrivacyDay2022! This day is observed every year to raise awareness of technology and privacy rights. As this is everything we stand for, we take this day, and every other day, very seriously when it comes to #cybersecurity. Stay safe and #SecuredByPANW
7
12
I like to take random time lapse videos out my hotel window when I travel
12
1
70
We're partnering with Envision Virgin Racing and its innovative 'Race Against Climate Change' sustainability program to optimize cybersecurity solutions for a world where electric vehicles are an important part of society. Learn more! bit.ly/3ikCkWt #SecuredByPANW
1
5
20
Sad truth: Moms apply stronger security policies on their IPads than most companies apply on their user workstations No super user, sandboxed app executions, content restrictions, limited file system access, 2FA, automatic iCloud backups, no scripting engine, password manager
18
75
7
416
318
195
73
2,037
John Harrison retweeted
Awesome to talk with @bittner for @thecyberwire #researchsaturday The work never stops, but it continues to challenge! @PaloAltoNtwks @Unit42_Intel
On #ResearchSaturday: Hear @jadefh of @PaloAltoNtwks @Unit42_Intel talk about their research: Attackers Cryptojacking Docker Images to Mine for Monero. She shares how images hosted on account pulled more than 2M times. Listen to the full interview here: bit.ly/cwRS082920
7
13
Anyone hazard a guess at what these are?? If you're struggling send us a direct message for a free copy of @PaloAltoNtwks FREE Firewall Guide, you'll be surprised what you're missing!! #cybersecurity #cybercrime #nextgenerationfirewall #panwbuzz1
1
2
Looking forward to a productive buzz day with the @ABILOTT team #panwbuzz1
As companies worldwide move to a mobile workforce, Palo Alto Networks can confidently ensure your remote users are secure. Learn more about protecting your mobile workforce: bit.ly/2TL4k9w
John Harrison retweeted
DevOps teams enable businesses to stay agile and competitive in the marketplace. The downside is when the building blocks they use to build cloud infrastructure introduce new, unmitigated risks. Don't let this happen to your company. Details: buff.ly/2UUQmmx @prisma_cloud
10
3
Zero Trust segmentation through VLAN insertion for ICS/SCADA environments. This is how you do it. bit.ly/2UIuudJ
5
10