Security Engineer, finance geek, traveler. @sdanndev@infosec.exchange
Seattle, WA
Joined January 2017
- Tweets266
- Following306
- Followers175
- Likes1.8K
Steven Danneman retweeted
You should be aware of the term "harvest now, decrypt later". At some point, the encryption we use today will be easily crackable. Don't rely too heavily on it. Better to be very protective of where your data ends up, even if it's encrypted.
Credit union BECU has turned off Quicken access for 2 months and counting due to cyber attacks. MANY banks still allow user:pass only access to OFX with no MFA, ripe for password spray and reuse attacks.
becu.org/news/online-banking…
.@Grifter801 what if you make a beer cold by launching it into space? #DEFCON31
Thanks @paymentvillage for a fun, realistic, hacking challenge! $100,000 charged and 18 card numbers stolen. #DEFCON31
Steven Danneman retweeted
SSL/TLS issues come up all the time during PenTests and explaining the technical detail of all of the different TLS configuration options can be quite difficult - so I put together a handy guide!
akimbocore.com/article/harde…
Steven Danneman retweeted
Just got laid off from Google. If anyone needs SMB 1/2/3 protocol or Open Source experience, I'm interested.
Steven Danneman retweeted
As an industry, security needs to move away from filing a vulnerability Jira ticket and calling it a day. Business risk is only reduced when vulnerabilities are mitigated or fixed. Far too many Jira tickets stay open for months or even years. In these cases, we haven't helped. 🧵
The most thorough timeline and technical explanation of the incident I've read so far. A lot of good lessons learned for other companies in this post mortem.
A lot has been spoken about Uber case, but I went and purchased the trial transcripts before they were set to release in 2023:
A blameless post-mortem of USA v. Joseph Sullivan
magoo.medium.com/a-blameless…
Steven Danneman retweeted
A lot has been spoken about Uber case, but I went and purchased the trial transcripts before they were set to release in 2023:
A blameless post-mortem of USA v. Joseph Sullivan
magoo.medium.com/a-blameless…
Steven Danneman retweeted
If you enjoyed the Web App Hacker’s Handbook, I’d encourage you to try out our Burp Challenge on @WebSecAcademy.
It’s fun and current, you’ll probably learn something new, and you might even win some exclusive @Burp_Suite swag.
#burpchallenge Complete one practitioner lab from each of these topics CSRF, Clickjacking, CORS, XXE, DOM-based vulnerabilities - by 8 Dec, to be entered into the draw. Five people will win exclusive Burp swag - winners announced on Mon 12 Dec at 3pm (GMT) portswigger.net/blog/the-bur…
This is an immediately usable template for communicating unpopular change to your company. Thanks @libber.
Thoughts on how to maximize success as an infosec team that needs to roll out changes people may not like -
collingreene.com/communicati…
Steven Danneman retweeted
Pictured: Proof that Node + NPM is madness.
This pic is showing the chain of dependencies leading to a vulnerable package, but it's so big it broke our CSS. 😂
View vuln chains for your projects (for free): github.com/marketplace/lunat…
Who can find the longest chain? Share yours 👇
Steven Danneman retweeted
From the TLS Newsletter: Coursera announced the much-delayed Cryptography II course by Dan Boneh starting in October. Boneh created the very popular Cryptography I course many years ago. buff.ly/31olhg8, buff.ly/2lJvMCF
July issue: buff.ly/3JaAvXU
Steven Danneman retweeted
Continuing our series of chaotic IP facts:
All of the items below are equivalent to 127.0.0.1. Don't believe us? 🤔 Ping them! 👇
127.1
2130706433
0x7F000001
You can also "overflow" digits, for example 127.0.256 is equivalent to 127.0.1.0 🤯
Follow us for more mayhem.
