What are You Working on Wednesday
from shellsharks@infosec.pub to cybersecurity@infosec.pub on 23 Aug 2023 12:30 +0000
https://infosec.pub/post/1738239
from shellsharks@infosec.pub to cybersecurity@infosec.pub on 23 Aug 2023 12:30 +0000
https://infosec.pub/post/1738239
Weekly thread to discuss whatever you’re working on, big or small, at work or in your free time.
#cybersecurity
Mostly working on getting over covid! In the meantime, I got MacOS running in a VM which was a bit of fun. Host system is Linux Mint 21 and the VM is running through KVM/Qemu. I’ve been wanting to play with it for a while but I’m way too poor to get the hardware. Not a bad system overall, the installer is a bit hinky but users aren’t supposed to see that anyway. Haven’t dug into it much yet but I will when I find some time. Interested to see how closely the experience matches some of the Mac-aligned Linux distros.
Interesting, this is something I’ve yet to do. I’ve been seeing some interesting news about Asahi Linux for M1 macs im interested in trying out though.
At work, setting up windows server auditing in a way that doesn’t nuke the event viewer with millions of security entires. At home working on upgrading my proxmox.
A medium interaction SSH honeypot backed by a basic LLM that believes it’s bash.
I’m impressed at the ability to retain limited state, and respond ‘reasonably enough’ that it’ll probably allow first stage automated attacks to be captured… but at the moment, it’s way too easy to peer behind the curtain.
It’s quite jarring when your bash terminal starts telling you a story about a happy dragon in response to some weird command.
This sounds fun
Bravo
Yep… sigh
Instead of giving it a LLVM based shell, can you give it an actual shell in a container? Maybe backed by AppArmor or SELinux to prevent breakouts
Tempting, but in order to reduce the potential attack surface, I’m likely just to create a simple simulator instead now.
If it’s good enough to fool the first few interactions of an automated script, that’ll probably do. That’ll give me the curl/wget target they’re trying to insect me with, most likely.
It means I can potentially create a single binary docker instance that can be reset practically instantly by deleting/reimporting.
World domination.
On a more serious note… been trying to test various different tools I’ve found or read about and writing necessary scripts/programs.
Fixing other people’s crap because that’s the punishment for writing functional code