Jump to content

farmersnotfighting

New Members
  • Posts

    37
  • Joined

  • Last visited

Everything posted by farmersnotfighting

  1. lazy with their monitoring and didn't notice someone walking out with everything. And lazy about separating prod and dev environments. as someone who breaks in to network for a living, i can assure you this is not unique to lastpass lol. as far as i know, lastpass breach was decently done. the dev was running a plex server at home. someone threw a 0day RCE at it from the outside and used that to pivot into his network. i dont think they ever disclosed how the attacker went from network access to actually owning the dev's box. but from there, they waited until he already logged in to the vpn (after he put in his MFA), and rode the connection in that way back to the lastpass network. so far so good. lastpass did everything right and the attack took a lot of resources to carry out. but where they fucked up was the dev having access to the prod data. i'm guessing they did the right thing and had all the data in multiple accounts (separate AWS account for prod, different one for dev, different one for staging). no access to each other. cool. but the dev probably had access to both (or all?) of the accounts, so the attackers could just ride in to the prod account as the developer. again, i haven't seen any details on this part of the breach, but i've seen (and done) this exact thing (well... similar -- SE to get code execution on developer company workstations while they work from home - not attacking personal devices. that's illegal) many times. you absolutely could physically write down a long password on paper for person use at home (as long as you can keep it secure). you are infinitely more likely to get your box randomly hacked than a fucking thief breaking in to your house, finding your password paper, and getting away with it. if they did that shit, you have way more problems to worry about than losing passwords. this is basically a discussion in threat modeling. who is mostly likely to attack you? how will they do it? is writing a password on paper perfect or great? no. is it less likely to be stolen than a file on your computer? yes... or probably. as long as you have a safe place for it that your wife/kids/dog can't get to it or damage it.
  2. yeah you can use whatever service you want. lastpass had the market share since they were the first mainstream service so they got targeted. i can assure you 1pass and bitwarden will be compromised in the future if they aren't already. for any of these services, you're going to have to trust that they're doing the right thing and you wont know until it's too late. you can use a local wallet type of thing like keepass, but then you loose the synching capabilities between your computer and mobile device. and idk if they have browser addons or anything so it will make your process of getting your password out even longer. and your computer is more likely to be compromised and have your keepass file stolen that one of the larger companies focusing on keeping it safe. so now you're looking at how strong is your local master keepass file once someone takes it? and if that's the main question, then you don't really have a difference between local keepass and a cloud based one like 1P or bitwarden, or even lastpass. if you remember the lastpass breach, they stole the encrypted key vaults, not cleartext passwords inside. so you still need to crack the hash to your vault either way. lastpass uses aes-256 (good), so does 1password, so does bitwarden. keepass uses aes256 too, so now the only real difference is features in what you want in a password manager and who you trust more. and making damn sure you have a strong password to your vault no matter what since that's the master key to the kingdom.
  3. pretty sure inchworm was an aggy. can someone photoshop the furk guy with an inchworm crawling out of his britches?
  4. salting is literally to stop a rainbow attack lol. but nobody sits around with rainbow tables anymore since basically everything is salting by default now. invision community moved from md5 which is fucking awful (164,000,000,000 password guesses per second on a 4090) to blowfish (184,000,000 guesses/second) for the hashing algorithm. if you use a shit password like Summer2024! or Password1! or something that's on a common password list (check here: https://github.com/danielmiessler/SecLists/tree/master/Passwords/Leaked-Databases ) then consider your username/email address and password compromised. make sure you don't reuse that password for any other site. in general, use MFA where possible. and if you're too lazy to do that, make sure you have different passwords for every site that are randomly generated. no you aren't clever using "Password.Surly". if i see your email and "password.linkedin" or "password.gmail" or "password.facebook" in a breach, i'm damn sure gonna try "password.surly" if i'm targeting you. but use a password manager like lastpass or 1pass to generate and keep track of your passwords for different sites. they have browser addons and phone apps so you can auto fill shit too.
  5. Can you force MFA on all the admin accounts to the Admin CP? Didn't check what version of Invision this is, but there's exploit PoC for a SQLi out for versions 4.7.15 and under that involves resetting the admin account password. Let me know if you want any more details on the CVE or if you want me to test it tomorrow.
  6. Oh damn. Yeah looks like he wasn't expecting it but definitely should have caught that. I haven't seen the whole game yet. Only got to see the first quarter. I thought you were talking about the opening drive when the DL got a hand on the ball and the ball went straight to the ground by Whitt's feet and the dumbass announcers were like "and Whittington just drops that ball" lmao. I was pissed. Trash ass announcers saying he dropped it and the ball never even got to his hands. But yeah it sounds like everyone had the drops this game.
  7. What screen did Whitt drop uncontested?
  8. FYI, no those were 2 different RPO plays. AD was a solo receiver on his play. He had the luxury of lining out wider which allows you to work in space better. He only had 1 corner on him which was manned up with no outside help. Corner has to respect any outside move since he's on an island. Whit was lined up in the slot on his play with a receiver to his outside. 2 defenders. Whit's defender didn't have to respect any outside move since they were likely in inside/outside coverage, meaning he's letting an outside route go to his teammate and he really only needs to bite on inside stuff. Plus he's playing it tighter since there's less spacing due to Whit being in the slot instead of lined up wider. Also, look at the throwing lanes. Quin had to put Whit's ball up high because the LB didn't bite on the play action as much as he did for AD's. Lots of little subtle differences there that add up.
  9. True. And that was fucking hilarious to watch. More to do with an extremely dominant OL though.. basically like what JWhitt had in his state title game. It would be a great idea if our OL was Banks x 5.
  10. The problem is when you run a wildcat, that will MAKE them stack the box. a WR/RB that's a wildcat QB will run it 99 times out of 100 so teams just stack the box for it... especially if you pair a wildcat QB with a double tight end set. I think the only way a wildcat QB would work is if you actually keep spread receivers out in a normal formation and have a wildcat QB that actually can throw it and you run it enough times that you do throw it enough to make it a credible threat. I don't think wildcat QBs work unless you have someone with a body like Vince or Cam Newton where you were naturally an athletic RB that knows how to play QB damn good too. Or someone like RoJo that was formerly a QB that bulked up to play RB. But even then, Sark didn't throw it enough with RoJo back at QB to make it a credible threat, so everyone just stacked the box again.
  11. The state title game where he broke the rushing record was as a wildcat QB. I think he even did a little wildcat QB his freshman year under Herman before he got injured. I think that's the only reason they would go with Red over JWhitt this year. No reason to risk him getting injured on a gimmick play that already has a low chance of success anyway.
×
×
  • Create New...