I am retiring this social media account. Find me as @hal_pomeranz@infosec.exchange
Orlando, FL
Joined November 2008
- Tweets 19,311
- Following 237
- Followers 13,672
- Likes 12
Daily Linux Forensics Trivia #20 - Name two Volatility modules that can help to search for hidden loadable kernel module rootkits.
2
2
Trivia Answer #19 - Congrats to @lux_amalgamated for checking in with the correct answer! $HOME/.lesshst tracks search terms and shell eacape commands entered by the user in the “less” program. It DOES NOT track which files the used has viewed.
1
Hal Pomeranz retweeted
The pandemic is only "over" if you need a political talking point.
The CEO of Pfizer has caught COVID twice in two months despite being quadruple vaxxed.
The pandemic is over in the sense that we’ve decided to live with it instead of making any structural changes, the same way we live with gun violence and homelessness.
4
6
41
Daily Linux Forensics Trivia #19 - What data can you find in $HOME/.lesshst?
2
Trivia Answer #18 - @MalwareJake points out that determining attacker intent is always difficult, but known_hosts files plus SSH keys (id_* files) are useful for attempts at lateral movement. Enabling the HashKnownHosts option and using strong pass phrases on keys slows attackers
3
I find it interesting that after a period which has seen widespread labor activism, US monetary policy seems to be driving recession and unemployment. Almost as if somebody were trying to scare labor into submission.
3
1
Hal Pomeranz retweeted
Don't try to boil the ocean when it comes to cybersecurity. Nothing will ever get 100% implementation, you'll be missing coverage even if it does, and there's always work left to do.
Just ask: did I move the ball forward today? Every little bit helps.
22
86
10
584
Daily Linux Forensics Trivia #18 - During an IR you find a script used by the attackers that is gathering known_hosts and id_* files from user $HOME/.ssh directories. What would the attacker use these files for?
3
2
Trivia Answer #18 - “Members of group ‘wheel’ may, on any system, as any user, run any command.” In other words, unlimited Sudo access to all members of group wheel. Group membership may be via a user’s default group in /etc/password or via the “wheel” entry in /etc/group.
Or Tetris
Forget "Turing complete", the real question is can you write Tetris in the language? github.com/uuner/sedtris
The hope is teach Linux Forensics in Canberra and then again in Melbourne. We’re still hashing out the details though.
1
3