I am retiring this social media account. Find me as @hal_pomeranz@infosec.exchange
Orlando, FL
Joined November 2008
- Tweets 19,311
- Following 237
- Followers 13,672
- Likes 12
Trivia Answer #8 — Look in $HOME/.local/share/recently-used.xbel for the Nautilus/Nemo file browsing history. XML formatted doc includes file name, app used to open file, and first/last visit times.
1
1
5
lost+found gets created when the file system is created. fsck may place orphaned inodes into lost+found if it finds file system damage, but it does not create the directory.
1
Hal Pomeranz retweeted
**NEW**
BHIS | Tester's Blog
Linux System Call Monitoring
by: moth
Published: 9/13/2022
blackhillsinfosec.com/linux-…
1
11
13
Have we ever had the “How Hal ended up in DFIR” talk? Remind me the next time we are drinking together.
2
6
Hal Pomeranz retweeted
Speaker tip: always make one of your presentation slides a full frame screenshot of the Windows Blue Screen of Death, and then forget which slide it is. The unexpected shot of adrenaline will help to keep you focused and alert during your presentation.
21
57
9
406
It’s hard to imagine a better brand ambassador than Lesley— exec at one of the hottest tech companies on the planet, accomplished hacker, community leader, veteran who helps other veterans, expert martial artist in multiple disciplines. Always willing to fight the good fight.
2
1
5
Daily Linux Forensics Trivia #8 — Where does the Nautilus/Nemo file browser for the Gnome desktop store browsing history?
2
1
Several folks noted, however, that the known_hosts file is just a text file and can be edited. So perhaps that entry is bogus. I recommend comparing the public host key from the remote system against the public key in the known_hosts entry as an additional level of validation.
2
You would have to check the logs on the remote system to determine if there was any kind of login and what happened from there.
1
1
Trivia Answer #7 — Shout out to @DfirNotes for the first correct response. An entry in known_hosts means the account established an SSH connection to the remote host long enough to exchange public keys. It does NOT tell you whether or not there was a successful login.
1
1
2
Hey @KirrinFinch, one of our community leaders is feeling a profound sense of grief due to the loss of their Kirrin Finch suit. Perhaps you can help Lesley out? Nobody could be more deserving, after helping so many others.
Just such a miserable situation. It was from a company called Kirrin Finch that makes suits for non gender conforming people, and it was super gender-affirming, too. I got to wear it once and I was so damn excited to get it.
2
5
1
20
I’m sorry for your loss and frustration. It sucks. Putting the cleaners aside for a moment, perhaps you could come at this another way. Reach out to the suit designers, explain the issue and your pain of loss, and see what they can do. You have enormous influencer clout. Use it.
1
3
Hal Pomeranz retweeted
Also people w/ brain fog are also good at hiding it—it’s intermittent and they just don’t see people on the worst days. Stigma also motivates them to present as normal in social situations or doctors’ appts, furthering the false idea that they’re fine. 10/ theatlantic.com/health/archi…
23
320
39
2,535
Hal Pomeranz retweeted
Facebook scam, I’m selling a desk and they’re pretending to be interested. They’re using my cell number to attempt to sign up for google voice. Remember never share your 2FA codes.
32
315
18
985
Hal Pomeranz retweeted
We wanted to make sure people who struggle with literacy and with getting assistance to vote understood their rights under federal law. So @asiakmfields created a guide in plain language and available in 11 languages. Please share with anyone who might need it.
You have the right to vote even if you don’t speak or read English. This guide will tell you about your right to ask for help, how to vote and what to do if you have problems.
Available in 11 languages
🧵👇
propublica.org/article/guide…
2
57
1
85
Hal Pomeranz retweeted
We updated our blog on the Linux trojan XorDdos with new information on initial access and payload, including details on a rootkit component that we found while investigating a XorDdos sample we saw in June 2022: msft.it/6012jvVgq
2
79
2
121