211–220 of 239 posts
Earlier quoted context omitted.
[flagged]
That’s pretty shitty of him. I’m not saying anyone is a saint, only that krebs doxxes people who disagree with him, which can put their lives in direct harm. I’m not any more of a fan of wee ve than you. Also, fuck Nazis.
Earlier quoted context omitted.
Not surprised TBH. Brian Krebs has a history of questionable ethical behavior, like doxxing people who leave negative reviews on his book[0]. [0]: https://itwire.com/security/infosec-researchers-slam-ex-wapo...
ITWire is not a credible news source. The site, and especially Varghese, often writes tabloid pieces that are just character attacks.
Earlier quoted context omitted.
It was notdan, and he’s quite open about both of the things I mentioned both on Twitter and his blog. He is mentioned in this article.
[flagged]
> be platformed
> Fuck notdan
I don't think that this comment belongs on HN - it's not civil, not in the spirit of HN, and it appears to be factually incorrect.
Earlier quoted context omitted.
We have to admit the guy is consistent, at the least. He drove employer's security to ruins on purpose, and did the same to himself. I can't believe someone can literally destroy its life for BTC. Imagine his family and close friends. His parents probably thought he was a tech wizard genius. And now he destroyed his reputation, his employer's, and he'll be behind bars for quite a few years. I hope he doesn't have kid…
> And picture: he could have been the guy who did a great job "fixing" employer's lack of security This is not really a thing. It's very hard to get recognition or even a shared understanding of the risk mitigation. As everything else in the world, it's way easier to reward someone for things that happen (new functionality) than rewarding someone for preventing things happening (hack).
> Investigators say they were able to tie the downloads to Sharp and his work-issued laptop because his Internet connection briefly failed on several occasions while he was downloading the Ubiquiti data. Those outages were enough to prevent Sharp’s Surfshark VPN connection from functioning properly — thus exposing his Internet address as the source of the downloads. Not the first time I’ve read about a VPN unable to…
Presumably this is an OS-level thing, that it helpfully tries to fall back? If so, I suppose it could be mitigated either by a software control that prevents using the bare connection, or by running the VPN elsewhere, for example on your router. (I see posts elsewhere in the thread now describing how to do this with iptables.)
Earlier quoted context omitted.
> Ubiquiti does a great job of having good defaults out of the box, a straightforward UI, and remote management. Which UI? The UDM has two. Mobile devices have another. Some features are only available on one of the UIs, and when the feature is available on both, it often behaves differently. Sounds pretty straightforward to me. I ended up buying a Protectli box (FW6E) with OPNsense preinstalled. It's been fantastic,…
Thanks for the suggestion. Do you have any recommendations like Protectli, but for for the wireless AP? The fragmentation about Ubiquiti devices drives me crazy - I have the "wrong" consumer wifi AP or the "wrong" (pro)consumer router (take your pick), so half of the wifi AP functionality is disabled - but for no reasonable reason - just they have two (more?) product lines that don't work together and it's hard to re…
Nope, but I'd love a viable alternative. It seems like every company I look at has some big downside that makes me stick with Ubiquiti.
Earlier quoted context omitted.
Or he didn't screw it up and that's the FBI's standard excuse.
My first thought. They could have used some undisclosed (illegal) tools and methods to find him, and then cooked up this story to explain it.
If he did pay with paypal, that was his first mistake. Theoretically, you pay for your VPN with a gift card you bought with cash, maybe even one you got in another state and use anonymous email receiver to get your keys. Rotate accounts as project phases are completed.
Theoretically, use a purpose-built machine to keep fingerprints out of the mix, and as others have said, a killswitch using iptables/UFW to only allow traffic through the VPN gateway. Probably wouldn't have hurt to rotated the VPN egress points as well.
Theoretically, he should have been connecting this VPN over a public hotspot not his home network. I get that this wouldn't be conducive to downloading gigs and gigs of data, but if you're the one setting it up and monitoring/junking any logging on the other side, you could also afford to do this with an SBC (or several, again bought with cash) concealed at some location(s) that just pulls the information by slow drip over public connection via VPN. SBCs get tossed into Willamette as they're rotated.
The FBI cyber guys are good and creative but with a reactive situation like this I think old-fashioned gumshoeing, interviews and subpoenas would get them a long, long way. Once they had an inkling that it was an inside job, man, just relentlessly picking away at that with some face time would be really productive. Guaranteed that guy wasn't prepared for the bright light of honest incidental questioning, over and over, much less focused questioning. Not to mention, they are free to lie to your face in those interviews about what they do/don't know. Once they had a list of four people, start shoving out the subpoenas and see what clicks.
Part of their toolbox is also having an idea of what real attacks look like, knowing what those actors care about leaving behind or not concealing, and in the absence of those earmarks, they know they're looking at something "unusual". Now if I start telling you that I did find evidence of an attack of type Y where there absolutely is none, and you're all too eager to help me prove that theory, that's probably a bad sign. Did he have a plan of his own in place to frame some other ransom toolkit or plant seeds of a breach? I mean, what would you think if you walked into a company that got hit with a massive ransom demand, evidence of data theft, but no typical signs of a data breach from the usual suspects? State actor? Now this is serious. Was it their Exchange or RDP server in the closet? Oh, you're cloud-only? What platforms are we talking about? A state actor has zero-days into a major cloud platform?? MS? AWS? Now this is really serious. Or... maybe none of that is the case. Log files are all missing? Who made that decision? I mean, on and on it goes, but it seems pretty easy to see it unravelling once you start pulling on a thread.
If one was really interested, they could probably find some good information in PACER about the information that supported the indictment. Chances are he's already confessed and is attempting to plead out. They'll surely throw the book at him. Insider ransom jobs on US hardware companies are not a tolerable phenomenon.
Earlier quoted context omitted.
That’s pretty shitty of him. I’m not saying anyone is a saint, only that krebs doxxes people who disagree with him, which can put their lives in direct harm. I’m not any more of a fan of wee ve than you. Also, fuck Nazis.
Weev is blind?
Earlier quoted context omitted.
What does that even mean? Let's say you have a Wireguard configuration, wg0 which runs off ens0. If your wg0 connection dies, for whatever reason (let's say the remote server goes down), your computer falls back to ens0. What does "not having a connection to be maintained" change about this?
GP's just taking issue with the word 'connection', it's fine, I think it's clear.
Earlier quoted context omitted.
Wireguard will keep contacting the remote server. You'd have to delete the wg0 interface or delete the default route for packets to go out via ens0. Wireguard only has "connection" in a sense that it caches some runtime information about the peer's endpoint, but endpoint configuration is static. I guess, too much magic automation on top of this is not the best thing for opsec, including having some daemon that can di…
> You'd have to delete the wg0 interface or delete the default route for packets to go out via ens0 So... You'd have to do work to properly blackhole traffic when wg0 goes down. However long it takes to reconnect, you still will automatically fall back down to ens0 while it's down unless you do something to stop that.