Craig Rowland - Agentless Linux Security
@CraigHRowland
Followers
9K
Following
3K
Statuses
4K
Agentless Linux security. No endpoint agents and no drama. Discuss Linux malware, forensics, intrusion detection, and hacking. Founder @SandflySecurity.
Christchurch City, New Zealand
Joined October 2018
@THunter_0x0 @muddletoes It is very common for attackers to search for private keys once the compromise a host and then use those credentials to move further. I discuss this threat here:
0
0
1
@THunter_0x0 I think that short-lived SSH certs are best. Followed by pub/private key. Passwords only as a last resort if that's all you can do, but they do put credentials at risk.
0
0
1
@solardiz @Chick3nman512 In principle I'd agree here, but in practice I'd rather Linux users use yescrypt if it is an option vs. others. I should update this list with some caveats.
0
0
0
@Chick3nman512 In principle I'd agree and should update my list. The main reason I ordered it this way is there are many variants of this hashing method so how to give guidance? I think I'd rather have people move to yescrypt if it is an option on Linux vs. others.
0
0
0
Once again I say that in my nightmares I wake up after an auto accident in the hospital. I turn my head and see my morphine drip has a Wifi Enabled sticker on it and I scream out into the void.
Backdoor found in two healthcare patient monitors, linked to IP in China - @LawrenceAbrams
0
1
14
This router was way ahead of its time. Kept so much bad traffic from entering the perimeter of networks that used it.
No one: “Really, Andy, how old can your network really be?” Me: (giving @CraigHRowland and @rsnbrgr nightmares)
2
1
12
0
0
2
If you find systems with obsolete Linux password hashes, chances are high other problems are lurking. It's like finding sawdust near your house foundation. You can't see the termites, but you know the house has trouble.
0
2
5
@0xvaeed I understand. Hashes/binary search is fine for rapid triage. But I just don't think think it's a good long-term approach.
1
0
0
I suggest breaking down malware into the tactics they use and search for the tactics vs. specific malware signatures. Adding yara rules searching for binaries is never the correct answer. PS. I've never written a Yara rule in my entire career and don't intend to start.
@CraigHRowland Nice technics for by pass the IOC check but what can we do except checking hash and yara rules for finding same malware in a Network which doesn't have any log management and SOC?
1
1
17