AMD 'Zenbleed' Bug Leaks Data From Zen 2 Ryzen, EPYC CPUs: Most Patches Coming Q4
🗣PsyOmega

Netsec used to be ahead of the curve. This is like a 6 or 8 day old vuln now. Fall from grace.
👤Lumpzor

I wonder if the fixes drop performance like spectre? The article speculates but actual testing numbers will be interesting.
👤demunted


🎖@malwr

📍📍📍Forward posts to the other groups 📍📍📍

Russian organised crime and Ransomware as a Service: state cultivated cybercrime - masters thesis from October 22 - posted July 23
🗣digicat

Hey I just wanted to let you know your newsletters are being blocked by trellix as malicious and unreleaseable for the past few weeks.
👤R1skM4tr1x


🎖@malwr

github-actions-goat: GitHub Actions Goat: Deliberately Vulnerable GitHub Actions CI/CD Environment
🗣digicat

This is a crazy cool project. Thanks for passing along
👤RoseSec_


🎖@malwr

What's a good route to take for a end goal of a job in the federal government?
Currently in a part-time mail clerk contractor job with the IRS and doing a Bachelor degree in digital forensics. I want to gain some experience in digital forensics before I graduate college but don't know what is the better option.

Should I:

1. Stay in my current job and get an internship or volunteer in digital forensics in a police department or PI firm
2. I heard TSA is in the security space so I thought about trying to get a TCO job till I graduate and then pursue full time digital forensics government job
3. stay in my current job and find an internship in digital forensics with the federal, state or local government that may eventually turn into a permanent position when using USAJobs pathways program (if doing federal internship)
4. Do option 3 but without my current job and just the internship(s) at a government organization
5. What other options should I consider?

I am looking into a career at IRS Criminal Investigations, FBI, Secret Service, Homeland Security or other digital forensics type agency after I graduate.
🗣blandsauce203

Good thing you have a clearance - hold onto it. You'll need high-level SANS certs. Where I worked, they used EnCASE. I got a big book and a trial version, and learned as much as I could.

The clearance and the certs were very important. They let seats sit for years if people didn't have those things. They didn't care. Experience was big too. Even though I had a Masters in Cyber, and a CISSP, the fact that I had ZERO forensics experience was what I kept hearing. And I was the Sys Admin for all of the forensics guys.

So, get some experience - and learn about EnCase...
👤cabell88

Hack the Pentagon
👤pah2602

First of all, take a look at the requirements for getting any level of security clearance. If you already have a clean record, keep it that way.

There is always a shortage of people who have a security clearance, there are lots of federal jobs, including contractors, that require a security clearance.
👤bughousenut


🎖@malwr

How I discovered the underground world of credit card network exploitation
🗣jnazario

Fun fact PCI-DSS compliance is a never ending game of cat and mouse. Sometime in 2007 two employees from a mag stripe reader company in the UK, defected and took with them the encryption keys, that company made nearly all the mag stripe readers on the planet. Thus ending point of swipe protection for every mag stripe card forever.

Since then there have been various pass the buck maneuvers to try and place responsibility and blame for security flaws in the processing credit cards around the world. The visa council ultimately blames who ever is at the "point of swipe" as the man culprit and holder of liabilities for processing security. This means that a majority of retail companies are held liable for fraudulent/erroneous charges.

If a company receives an audit for such activity it is normally handed out to a vendor to check compliance. Used to be Security Metrix that handled a lot of visa's audits. The fine use to be $15,000 for the infraction and $5,000 for each actionable fault found on the network of the company in question with no cap on the amount of infractions a company could rack up.

There is a phone book sized PCI-DSS compliance manual that contains unrealistic protocols. In fact most retail businesses would never pass the entire process. Visa knows this and I have been personally told that they only look for an attempt to be compliant and punishing companies that are not capable of feigning security attempts.

The whole thing is a BS game of cat and mouse.
👤CEHParrot


🎖@malwr

Living Off the Land: Reverse Engineering Methodology + Tips & Tricks (Cmdl32 Case Study)
🗣elliotkillick

Excellent post.
👤LostInTheTrees


🎖@malwr

Reverse Engineering a Neural Network's Clever Solution to Binary Addition
🗣unireaxert

And here I was hoping for some carry lookahead solution. I guess I was still thinking in binary.
👤henke37

> It's an exciting prospect to be sure, but my excitement is somewhat dulled because I was immediately reminded of The Bitter Lesson

I tend to agree with that ending, these kinds of attempts at "interpreting" what a neural network learns in a way that makes sense to us will only get us so far.

Just accept it as a black box. All we need to do is formulate an adequate loss function, feed the network massive amounts of data, and let the model "learn" on its own how to approximate a solution. Thanks to Moore's law, it tends to eventually work even for very complex problems once we reach a level of computational resources that can handle the task.

These meta searching/optimization algorithms are good enough as a general solution, no need to waste time coming up with "special" methods that rely on field-specific human knowledge.
👤amroamroamro


🎖@malwr

x86 prefixes and escape opcodes flowchart (WIP)
🗣simon_o

REX2 has been introduced recently
👤igor_sk

REX(1-byteprefix

missing a ) there
👤zid

Perhaps this helps getting a better grasp on how x86 instructions work.

Note that it's still work-in-progress.
👤simon_o


🎖@malwr