Steven Danneman
@sdanndev
Followers
184
Following
2K
Media
28
Statuses
267
You should be aware of the term "harvest now, decrypt later". At some point, the encryption we use today will be easily crackable. Don't rely too heavily on it. Better to be very protective of where your data ends up, even if it's encrypted.
26
134
729
Credit union BECU has turned off Quicken access for 2 months and counting due to cyber attacks. MANY banks still allow user:pass only access to OFX with no MFA, ripe for password spray and reuse attacks. https://t.co/vnkOvrIt3Y
becu.org
Restored service requires you to authorize for security before connecting your accounting software to your BECU accounts.
0
0
2
2
3
17
.@Grifter801 what if you make a beer cold by launching it into space? #DEFCON31
1
2
2
Thanks @paymentvillage for a fun, realistic, hacking challenge! $100,000 charged and 18 card numbers stolen. #DEFCON31
1
1
22
SSL/TLS issues come up all the time during PenTests and explaining the technical detail of all of the different TLS configuration options can be quite difficult - so I put together a handy guide! https://t.co/mCNEjDyv7H
akimbocore.com
Introduction Secure Sockets Layer (SSL) was a protocol designed to protect network traffic in transit, however it was superseded by Transport Layer Security (TLS) in 1999. These protocols are...
5
107
383
Just got laid off from Google. If anyone needs SMB 1/2/3 protocol or Open Source experience, I'm interested.
22
95
297
if you don't release an API people will build a whole selenium browser automation over it smh
23
36
923
As an industry, security needs to move away from filing a vulnerability Jira ticket and calling it a day. Business risk is only reduced when vulnerabilities are mitigated or fixed. Far too many Jira tickets stay open for months or even years. In these cases, we haven't helped. 🧵
4
2
38
The most thorough timeline and technical explanation of the incident I've read so far. A lot of good lessons learned for other companies in this post mortem.
A lot has been spoken about Uber case, but I went and purchased the trial transcripts before they were set to release in 2023: A blameless post-mortem of USA v. Joseph Sullivan https://t.co/qNyt3bqJKb
0
0
1
A lot has been spoken about Uber case, but I went and purchased the trial transcripts before they were set to release in 2023: A blameless post-mortem of USA v. Joseph Sullivan https://t.co/qNyt3bqJKb
medium.com
Our industry deserves a complete retrospective into the incidents behind the criminal case against Uber’s former Chief Security Officer.
3
21
39
If you enjoyed the Web App Hacker’s Handbook, I’d encourage you to try out our Burp Challenge on @WebSecAcademy. It’s fun and current, you’ll probably learn something new, and you might even win some exclusive @Burp_Suite swag.
#burpchallenge Complete one practitioner lab from each of these topics CSRF, Clickjacking, CORS, XXE, DOM-based vulnerabilities - by 8 Dec, to be entered into the draw. Five people will win exclusive Burp swag - winners announced on Mon 12 Dec at 3pm (GMT)
1
5
34
This is an immediately usable template for communicating unpopular change to your company. Thanks @libber.
Thoughts on how to maximize success as an infosec team that needs to roll out changes people may not like - https://t.co/QKQzulqfBv
0
0
1
Pictured: Proof that Node + NPM is madness. This pic is showing the chain of dependencies leading to a vulnerable package, but it's so big it broke our CSS. 😂 View vuln chains for your projects (for free): https://t.co/rjlsL6JssD Who can find the longest chain? Share yours 👇
1
20
76
Who? -> Whoever What? -> Whatever When? -> Whenever Where? -> Wherever Why? ->
2
0
3
From the TLS Newsletter: Coursera announced the much-delayed Cryptography II course by Dan Boneh starting in October. Boneh created the very popular Cryptography I course many years ago. https://t.co/Uognt5ji0d,
https://t.co/dZbi7gpSQc July issue: https://t.co/qnqPySoYq1
0
3
10
Continuing our series of chaotic IP facts: All of the items below are equivalent to 127.0.0.1. Don't believe us? 🤔 Ping them! 👇 127.1 2130706433 0x7F000001 You can also "overflow" digits, for example 127.0.256 is equivalent to 127.0.1.0 🤯 Follow us for more mayhem.
6
57
260
And now, a rundown of my personal (not corporate) security posture. Let's tune in...
5
86
454