I am retiring this social media account. Find me as @hal_pomeranz@infosec.exchange
Orlando, FL
Joined November 2008
- Tweets 19,311
- Following 237
- Followers 13,672
- Likes 12
Looking forward to catching up with everybody @WWHackinFest Way West! It's also the debut of my new Linux Command Line course. So much Linux. Much excitement. Teach in person!
4
29
See you all in San Diego or online!
Can you believe we are only a mere 5 days away from Way West 2022?! (Only 4 days if you'll be joining us for pre-con training...😏) If you are wanting to join us, there is still a little time left to register!
Con details and registration here: wildwesthackinfest.com/way-w…
1
Somebody please help preserve this bit of history!
Still need to find somebody willing to (or has the tech, since my spouse got rid of my VHS player) transfer that very rare "History of BSD" talk Kirk gave in 1999 when we not only played a drinking game on his verbal ticks, but got him extremely drunk on Anchor Steam.
2
Somehow in my world “zero trust” has come to mean “every new client sends me their ‘trusted laptop’”. Any fellow consultants come up with a good racking solution for all this gear?
4
Let us not forget Paunch buying zero-days on the open market to further Black Hole back in the early 2010s…
This tweet is unavailable
1
Every day, across the nation and around the world, teachers save student lives quietly and without fanfare. And all we do is make their jobs harder and less rewarding.
2
3
19
Certainly eliminates Exchange as the initial breach, but it will be a juicy target after they get in with stolen VPN credentials
1
2
Even if you still have to maintain local Exchange in a hybrid environment, those machines can be completely isolated from the Internet and most of your infrastructure.
1
Definitely avoids a raft of problems, and keeps a large cache of user creds away from your home network. Pay extra for higher levels of M365 auditing to help you troubleshoot cloud issues.
1
The most common indicator we’re seeing is w3wp.exe spawning csc.exe. Look for webshells under …\Exchange Server\*\FrontEnd\HttpProxy\{owa,ecp}\*
1
8
1
52
Recent experience is teaching me that it’s impossible to securely run Exchange on prem. It’s been the initial point of entry for numerous compromises.
2
31