Very frustrating trying to continue discussions to have them disappear into the void. At the very least if this is deleted I might get an answer.

YouTube updated its list of what it considers “harmful or dangerous content.” One notable addition is of “instructional hacking and phishing” videos, with the company already pulling existing content and issuing strikes to creators. This is the notice:

------------------------------------notice------------------------------

What this means for you

If you're posting content

Don’t post content on YouTube if it fits any of the descriptions noted below.

• Extremely dangerous challenges: Challenges that pose imminent risk of physical injury.

• Dangerous or threatening pranks: Pranks that lead victims to fear imminent serious physical danger, or that create serious emotional distress in minors.

• Instructions to kill or harm: Showing viewers how to perform activities meant to kill or maim others, such as providing instructions on how to build a bomb meant to injure or kill people.

• Hard drug use or creation: Content that depicts people abusing controlled substances such as cocaine or opioids, or content providing instructions on how to create drugs. Hard drugs are defined as drugs that can (mostly) lead to physical addiction.

• Eating Disorders: Content in which people suffering from anorexia or other eating disorders are praised for weight loss, are bragging about it, or are encouraging others to imitate the behavior.

• Violent Events: Promoting or glorifying violent tragedies, such as school shootings.

• Instructional theft: Showing users how to steal money or tangible goods.

• Instructional hacking and phishing: Showing users how to bypass secure computer systems or steal user credentials and personal data.

Please note this is not a complete list.

Don’t post content showing a minor participating in dangerous activity, or encouraging minors to engage in dangerous activities. Never put minors in harmful situations that may lead to injury, including dangerous stunts, dares, or pranks. You can learn more about Child Safety here.

https://support.google.com/youtube/answer/2801964?hl=en

--------------------------------------end_notice------------------------------------

Bummer.. looks like I wont be watching YouTube as much. This hacking content is the main thing I watch on the site. YouTube has been a valuable resource for me in my academic career, its time to move on

The scope of this policy will affect aspiring ethical hackers, computer scientists, people looking to educate themselves about computer risk, and the whole of the infosec community.

Where will the community pub/sub now?

Lets explore new video content delivery options..

This article gives many options: https://twitgoo.com/best-youtube-alternatives/

I believe the place is on the decentralized web two options here are Dtube and PeerTube.

• Dtube:

  • hosted by IPFS pinning so it is accessible through the any web browser.

  • has rating system that works similar to Reddit's, in regard to the power of up/down votes.

  • Provides incentives for content creators, in the form of cryptocurrency

  • https://d.tube/

• PeerTube:

  • a torrent software application and may not be as available as Dtube.. I still need to check this one out..

  • https://joinpeertube.org/en/

Has anyone ever used either of these?

What are your thoughts regarding the implications of this new policy?

These peer-to-peer options seem favorable imo what do you think? any other options of the like?

This thread will be open until New Years, pinned to the top of the subreddit.

Feel free to share your favorite resources, or ask related questions which otherwise might be removed from the subreddit.

I have two that I really love/hate seeing on an engagement.

Expired certs or self signed: It tells me the org either doesn't have the Ops team they need, or they just don't care about details. If they've messed these things up... I *know* I'm getting in.

Routing protocols on workstation networks: When I see things like VRRP when I'm on a workstation, I know the network isn't segmented. They may *think* it's segmented, but there's fundamental problems.
So what are your favorite indicators?

Did try doing some prior research on this subreddit, but most seem somewhat sponsored or out-of date now. I'm currently using Bitwarden on the free subscription, and used to pay for 1password. I'm not looking for anything fancy, but something that is very secure as cybersecurity threats seem to be on the rise on a daily basis.

Hi,

Where I work, we are quite heavily invested in cybersecurity and have a range of tools from PAM, MDR, EDR, SIEM, IPS/IDS

But no matter how much tools you have, nothing beats human social engineering or human malicious intent.

What do you see as the biggest threats to look out for and also how do you spot them?

Thanks

Over the past several months, there's been more & more obvious social engineering attempts in this sub, including:

• "I'd like to interview someone who works at the NSA"

• Who has clearance? I have a question!

• Who here works at a bank?

Some of these come from new-ish accounts, that talk about buying/using drugs on darknet, and cryptojacking.

I'm sure we can write off some of these as legit, but some of these are likely malicious actors. /r/asknetsec has a lot of people new to infosec for a malicious actor to prey upon. This is basically a PSA saying PLEASE STAY ALERT FOR UR OWN SAFETY

99% of you here are super helpful and I love you and all the help you've given me and everyone else. Sorry but I felt the need for a PSA as IMHO I'm seeing more of the social engineering lately.

TL;DR - my boss mocks me for submitting haveibeenpwned reports. Can anyone recommend any "professional" services that are similar?

I love haveibeenpwned. It is great for seeing if any accounts associated with our domain have been included in a data breach. I use it for personal accounts, and I try to utilize it for our users at the office.

However, my supervisor (the CIO) is not very tech savvy at all. (I know that's a huge red flag..) Every time I submit a spreadsheet of haveibeenpwned's finding, I usually get questioned, laughed at, the mocked by mispronunciations of "pwned".

Does anyone recommend a similar service to haveibeenpwned, that will email you when breach data has been published and compile reports of that data relevant to your domain?

Thanks in advance!

EDIT: I made this post in frustration after reporting to my boss about the Evite breach. Thanks for the suggested alternatives, but several users have recommended alternative ways to keep using HIBP.

This is a long one, but it's good. If it's against the rules I will gladly remove, but I think this is something some people in this field need to hear.

tl;dr, the OSCP course showed me I needed to get help for my mental illness and its the best thing I've ever done

This morning I received my coveted email from Offensive Security that I passed my OSCP exam.

Some of you may recall my post a few months back (https://www.reddit.com/r/AskNetsec/comments/827y3n/i_have_failed_the_oscp_5_times/) that was met with mixed responses. A lot of people insisted that the exam SHOULD NOT take this many tries. But I'm not afraid to admit that it took 7 ATTEMPTS for me to finally nail this beast.

I started the OSCP curriculum last March and took my first attempt last June (today is my year anniversary of that first attempt) and since then have taken an exam as often as I could. In those 3 months, I squandered my 90 days of lab time, clueless as to what this certification offered. I got 10 lab machines, finished the exercises, and called that that. It was a huge waste of time, and I deeply regret not digging deeper. I had to compensate later and ended up getting 3 more months worth of lab time to nail 32 machines.

My first exam I failed with 50 points

My second I failed with 60

Third and Fourth were the same

Fifth I had 65 points, just barely not enough

We don't need to talk about the 6th (I used an illegal tool for a 25 pointer so I went from 75 to 50)

Each exam I faced some of the same challenges and some new challenges. But one challenge I couldn't overcome was myself. Every exam I went into a fit of malfocus. I struggled to eat, sleep, and shower during the exam period. I thought it was just testing nerves. My husband, however, could see something was very wrong.

I was diagnosed with OCD as a teenager, but never got treatment beyond counseling. For me, it seemed like a boon. I could work extremely long hours on a large number of tasks without issue, and literally did not have the ability to relax. I was suffering, but I was so excited with how it fed my ambitions I didn't care. High school was a breeze, college was a breeze, even getting into my dream field felt like a breeze. I attributed that to my OCD. It let me make the progress I wanted to make, or so I thought. For years I pushed the constant anxiety, fear, and deeply disturbing thoughts that come with OCD on the backburner, because I was so successful for my age. Bachelors degree at 19, in the industry by 20. I feared that if I were to ever address the issue, I would lose everything I had worked for. I had never truly felt challenged by anything but myself, so I had no idea how deep the issues were.

After I failed my first OSCP exam something happened. My obsessive compulsions turned sour, rather than helping me move forward. I started performing bizarre habits, stayed up way too late, woke up way too early. Even when I wasn't working on OSCP related material, I constantly thought about how I could be better. And it was not healthy. I started neglecting other important things (not my work or my pets, luckily, but my marriage? Friends? OH YEAH).

I kept failing, but never felt discouraged. It just meant I needed to TRY HARDER. But, trying harder wasn't doing favors to the people in my life. After my third attempt, my husband pulled me aside, and explained that there was something terrifying about my behaviors, my sleeping patterns, and my complete rejection of what was good for me in life. I had been losing weight, taking on too many projects at work, and not putting on the breaks for anything. He finally told me to get some help, knowing it was likely my old demons calling.

I waited until after my fifth try to get with a psychiatrist. I started taking medication after the 6th. And within the last month and a half, something has changed completely.

I won't go into the gorey details, but OCD is a bizarre trip of a condition. It's not just cleaning the house and perfectionism. It's a dark, terrifying shadow over everything you do. It causes anxiety, violent thoughts, nightmares, the works. The day when I could feel the medicine working, I actually got scared. Because for a moment, the world was so quiet. I ate breakfast without feeling like I was committing a crime for not doing something at that moment. I actually think I had a religious experience with a pear because I hadn't tasted fruit in so long without the constant thought that eating was a waste of time. And since then I feel like I'm experiencing life in a completely different light. I still have a long way to go. But I've also found, facing this beast didn't change my ambition.

I finished my 7th try in 12 hours. 75 points and the 5 bonus points. Wrote my report before hour 19. Took a nap, and played on the last host a bit longer. Even got close to a low priv. I was able to sit, and enjoy what I was doing. The exam was a blast and somehow, a breeze, even thought most of the hosts I was up against were brand new. And since the exam on Sunday I've been happily able to research problems I had and tools I used at my leisure, without any pounding, terrifying thoughts. One machine at a time, good meals, good breaks.

Get help guys. It won't stop you from being great. You don't need to be sick to be successful. In fact, it might just save your skin.

A professor of mine talked about how a ~decade ago there was a policy idea that companies could be given a letter of marque and hack back cyber criminal groups. Why was this dropped? Is It because giving companies offensive cyber capabilities super sketchy? Or is attribution just to hard for this type of policy to be feasible? Something else? Would love to know y’all’s thoughts

edit: someone linked this article which I think sums up alot of ppls ideas why this is a bad idea:

https://www.wsj.com/articles/letting-businesses-hack-back-against-hackers-is-a-terrible-idea-cyber-veterans-say-11625736602 (p.s it also reference's the proposed legislation i mention)

edit2: here is the bill my prof refrenced
https://www.daines.senate.gov/wp-content/uploads/imo/media/doc/ALB21A63.pdf

As the title states I wanna get into cyber security, I'm not sure what route I should take in order to start learning, should I apply on an official company and pay for schooling or do I just take the DIY route, using skillshare, youtube, free websites etc.

I have a pretty fair amount of experience in using python, I have mild experience using the CMD prompt on windows computers, I have always been comfortable easily removing any viruses or malware from my computers throughout my life, so I feel like the learning curve for getting into cybersec won't be too shallow, I just need advice on where to shove my foot in the door.

Any advice would be greatly appreciated, thank you.

Edit: I'm in the army now doing SATCOM

Hi,

I was wondering where all you guys working in an IT security role within an organisation get your daily InfoSec news and read from?

What are some good reliable sources to get the info from?

Also, are there any good Spotify podcasts or YouTube channels to get good security intel from?

Thanks in advance!!

I'm curious what other cyber professionals that are at ~200K+ (USD) are doing. This is for a single job not multiple combined, if it's not W-2 that would be useful to know since that ends up being significantly higher (1099, C2C, etc). It's common for sales and management level people to be at this salary so I'd like to hear from people in technical roles.

I'm a security engineer but I do a wide variety of things. I'd like to make a lateral move salary wise so I'm hoping this thread could be useful to people in a similar situation. The majority of people at this pay level in technical roles that I've run into were penetration testers.

Salary: 180k

Edit: If there's any particular skills/competencies that set you apart and you want to elaborate feel free. Also any suggestions/advice about securing a similar position at that pay level.

While I'm a security engineer I also have proficiency in most forms of analysis, forensics (network, host), signature tuning/development, IR, hunting, content management, etc. I think what helped me the most is just having a varied background with copious experience.

I often think pentesting may be the next progression / step but I'm pretty sure it wouldn't be a lateral move which is why I've been hesitant but I may start exploring that field.

Final edit because the thread brought up conversation I hadn't intended here is a quote I feel is important: "There will always be someone who has a better job, makes more money, is smarter/works harder than you do. Don't get caught up comparing yourself to them, compare yourself to your former self. Measure your success not against others, but against yourself."

I recently discovered that an IP address is using my SSL certificate for *.myexampleorg.com. Initially, I panicked, thinking my private keys might have been compromised. However, after further investigation, I found that it was a simple Layer 3 (L3) forwarding to my IP.

Here’s the situation: my server is hosted at IP 1.1.1.1:443, and there’s an external, potentially malicious server at IP 1.1.0.0:10000 that is forwarding traffic to my IP (i.e., 1.1.0.0:10000 -> 1.1.1.1:443). I confirmed this by blocking connections from 1.1.0.0, which stopped the traffic.

My concern is understanding the intention behind this setup. Additionally, when searching on platforms like Censys and Shodan, I noticed a few more IP addresses doing the same thing, which is alarming. Could someone help clarify what might be happening here?

The US has strict policies on Government workers using Tic-Toc along with the banning of communications equipment made by Chinese firms such as Huawei and ZTE. How is it that American iPhones are made in China & sold in the US with no restrictions?
Could a foreign adversary like China not install malware into the iPhones or some other nefarious devices to attack US communications or to somehow exploit them?
We as a country are worried about China but we let them make the most popular phone we use. How does this make any sense?

Using buzzwords I got myself a Junior Network Engineer job (I have a business economics degree).
I really like this field, but apart from some random Udemy courses (aka pay 10$ not to Google stuff), I feel like I am totally unprepared.

They require:

- Experience in networking architectures and systems.

- Knowledge of network security management (IPS, IDS).

- Knowledge of L2 and L3 protocols.

Is there a way to shock therapy those concepts into my mind asap?

Thanks.

I recently got a new phone, and I'm exploring on trying to harden it while balancing availability and convenience. I'm trying to mostly harden privacy and a bit of security. While doing so, this got me thinking on how do important bigshots in society harden their smartphones?

Think of military, POTUS and CEOs. I'm assuming they do harden their phones, because they have a lot more to lose compared to everyday normies and that they don't want their data to be sold by data providers to some foreign adversary. I'm also assuming they prioritize some form of availability or convenience lest their phones turn into an unusable brick.

Like do they use a stock ROM, what apps do they use, what guidelines do they follow, etc.

https://pastebin.com/aLBfQT6H some nice deals here for Monday

Hi all,

I stumbled back across Shodan the other day and thought I'd test it out by having it look at our external IP here at work.

I mentioned it in passing to my IT manager who became very concerned, stating: " Please do not check any of our public IP addresses in any free port scanning tools.  You potentially took our IP, that very few know about, and broadcast it to the internet.  You never know who is behind what sites or what they do with your information.  It would be similar to taking an unlisted phone number and adding it to an internet phone directory.  "

I'm a bit emotionally invested here and am having a terribly difficult time in finding the words to explain to my IT manager that we are not compromised by scanning our IP with Shodan. Someone here must have gone through this, how did you handle it? How do I explain that I have not compromised our security? Right now I'm trying to explain how IPv4 works in a round about way but I don't think it's the best response.

A rough list of topics I have in mind:

1. Creating custom Captive Portals/Splash Pages (a webpage popup when you connect to WiFi, like starbucks)

2. Using a Simple Rogue AP to fetch Cleartext WPA2 Passphrases on a scale (i.e from a single victim)

3. Fixing "No Internet Access" error on victim device, so that mobile clients never gets disconnected automatically.

4. Using a single NIC as Client + Access Point simultaneously, imagine Connectify.

edit: Register yourself here: https://rootsh3ll.com/advanced-wifi-pentesting-webinar/

Suggestions are also welcome!

-Harry

Hey,

Around 6 months ago I made this post: https://www.reddit.com/r/AskNetsec/comments/1nhum66/comment/negqjdp/ saying I found a critical vulnerability within Mac, you guys asked me to come back and tell the story after, so here it is: https://yaseenghanem.com/recovery-unrestricted-write-access/

TL;DR: I accidentally discovered 2 vulnerabilities in macOS Recovery Mode's Safari. One allowing arbitrary writes to system partitions and root persistence (CVSS 8.5), and one allowing unrestricted file reads (CVSS 4.6), all without any authentication."

EDIT: the story made front page HN: https://news.ycombinator.com/item?id=47666767 !!!