github-actions-goat: GitHub Actions Goat: Deliberately Vulnerable GitHub Actions CI/CD Environment
🗣digicat

This is a crazy cool project. Thanks for passing along
👤RoseSec_


🎖@malwr

What's a good route to take for a end goal of a job in the federal government?
Currently in a part-time mail clerk contractor job with the IRS and doing a Bachelor degree in digital forensics. I want to gain some experience in digital forensics before I graduate college but don't know what is the better option.

Should I:

1. Stay in my current job and get an internship or volunteer in digital forensics in a police department or PI firm
2. I heard TSA is in the security space so I thought about trying to get a TCO job till I graduate and then pursue full time digital forensics government job
3. stay in my current job and find an internship in digital forensics with the federal, state or local government that may eventually turn into a permanent position when using USAJobs pathways program (if doing federal internship)
4. Do option 3 but without my current job and just the internship(s) at a government organization
5. What other options should I consider?

I am looking into a career at IRS Criminal Investigations, FBI, Secret Service, Homeland Security or other digital forensics type agency after I graduate.
🗣blandsauce203

Good thing you have a clearance - hold onto it. You'll need high-level SANS certs. Where I worked, they used EnCASE. I got a big book and a trial version, and learned as much as I could.

The clearance and the certs were very important. They let seats sit for years if people didn't have those things. They didn't care. Experience was big too. Even though I had a Masters in Cyber, and a CISSP, the fact that I had ZERO forensics experience was what I kept hearing. And I was the Sys Admin for all of the forensics guys.

So, get some experience - and learn about EnCase...
👤cabell88

Hack the Pentagon
👤pah2602

First of all, take a look at the requirements for getting any level of security clearance. If you already have a clean record, keep it that way.

There is always a shortage of people who have a security clearance, there are lots of federal jobs, including contractors, that require a security clearance.
👤bughousenut


🎖@malwr

How I discovered the underground world of credit card network exploitation
🗣jnazario

Fun fact PCI-DSS compliance is a never ending game of cat and mouse. Sometime in 2007 two employees from a mag stripe reader company in the UK, defected and took with them the encryption keys, that company made nearly all the mag stripe readers on the planet. Thus ending point of swipe protection for every mag stripe card forever.

Since then there have been various pass the buck maneuvers to try and place responsibility and blame for security flaws in the processing credit cards around the world. The visa council ultimately blames who ever is at the "point of swipe" as the man culprit and holder of liabilities for processing security. This means that a majority of retail companies are held liable for fraudulent/erroneous charges.

If a company receives an audit for such activity it is normally handed out to a vendor to check compliance. Used to be Security Metrix that handled a lot of visa's audits. The fine use to be $15,000 for the infraction and $5,000 for each actionable fault found on the network of the company in question with no cap on the amount of infractions a company could rack up.

There is a phone book sized PCI-DSS compliance manual that contains unrealistic protocols. In fact most retail businesses would never pass the entire process. Visa knows this and I have been personally told that they only look for an attempt to be compliant and punishing companies that are not capable of feigning security attempts.

The whole thing is a BS game of cat and mouse.
👤CEHParrot


🎖@malwr

Living Off the Land: Reverse Engineering Methodology + Tips & Tricks (Cmdl32 Case Study)
🗣elliotkillick

Excellent post.
👤LostInTheTrees


🎖@malwr

Reverse Engineering a Neural Network's Clever Solution to Binary Addition
🗣unireaxert

And here I was hoping for some carry lookahead solution. I guess I was still thinking in binary.
👤henke37

> It's an exciting prospect to be sure, but my excitement is somewhat dulled because I was immediately reminded of The Bitter Lesson

I tend to agree with that ending, these kinds of attempts at "interpreting" what a neural network learns in a way that makes sense to us will only get us so far.

Just accept it as a black box. All we need to do is formulate an adequate loss function, feed the network massive amounts of data, and let the model "learn" on its own how to approximate a solution. Thanks to Moore's law, it tends to eventually work even for very complex problems once we reach a level of computational resources that can handle the task.

These meta searching/optimization algorithms are good enough as a general solution, no need to waste time coming up with "special" methods that rely on field-specific human knowledge.
👤amroamroamro


🎖@malwr

x86 prefixes and escape opcodes flowchart (WIP)
🗣simon_o

REX2 has been introduced recently
👤igor_sk

REX(1-byteprefix

missing a ) there
👤zid

Perhaps this helps getting a better grasp on how x86 instructions work.

Note that it's still work-in-progress.
👤simon_o


🎖@malwr

ModelScan: Open Source Protection Against Model Serialization Attacks - Support for Pickle, H5, and SavedModel formats.
🗣wolfticketsai

I lead product at Protect AI and we just released ModelScan. It is open source project that scans models to determine if they contain unsafe code. It is the first model scanning tool to support multiple model formats. ModelScan currently supports: H5, Pickle, and SavedModel formats. This protects you when using PyTorch, TensorFlow, Keras, Sklearn, XGBoost, with more on the way.

This attack surface is incredibly easy to target and this tool can be loaded locally and scans your models quickly to check for any unsafe code before you use them.


Happy to answer any questions!
👤wolfticketsai


🎖@malwr

[Article] Some university researchers trained a machine learning model that can predict your password with an accuracy of 95% based on the sound of your keyboard strokes.
I've always noticed that my full name has a unique pattern of sound when clicking the keyboard strokes while typing it. I could also recognize which of my passwords I typed judging only by the sound of the keystrokes. This might be very dangerous!

Here's the article.
🗣_iamhamza_

Cool hax, bro
👤dnc_1981

Not with new "Infinitely Variable Click" keyboards that randomly cycle from Gateron Greens to Cherry Reds to MX Blacks and everything in between! Confuse the FUCK out of your fingers but protect against this very specific edge case! DOD approved. $10,000 per unit.
👤zyzzogeton

Trained on MacBook Pro, good luck with thousands of various mechanical keys and keyboards!
👤boopboopboopers


🎖@malwr