When hosting a static website or blog, you ultimately have to tackle the question: “What about the comments?”
Some popular options are:
When working with raw binary data (especially in security forensics), it is common to need to write parsers for this binary data. For example, extracting file contents out of the NTFS data structures on disk. For many common data structures, there are already binary parsers written for them that you can leverage, but you’ll still sometimes need to write your own.
BinShred is a PowerShell module that lets you do this. …
Read moreThere are many times in security investigations where we want to quickly filter out “Known Good” and only focus on what remains. When these are files shipped as part of the operating system, you can use Authenticode and Code Signing to figure this out. But what if this is something more ad-hoc, like the command lines used in Windows Scheduled Tasks?
You could possibly store all of this stuff in a database, schematize …
Read moreIf you’re running into the following error trying to get a device to sync with Intune:
The sync could not be initiated (0x80190190)
You probably have checked the Windows Event Log and also seen this error:
MDM Session: OMA-DM message failed to be sent. Result: (Bad request (400).).
I recently ran into this situation, and the cause was that I had opted into the Windows 10 default of signing in with a Microsoft Account. …
Read moreThe mind is an incredibly complex organ. While all of us attempt to be mostly logical and rational in our day-to-day thought processes and decision making, we are hampered by an enormous number of cognitive biases. Cognitive biases are specific natural tendencies of human thought that often result in irrational decision making, and there are hundreds of them. Everybody has them them and is impacted by them – it is …
Read moreWhen email users of several email services send mail using mechanisms other than that service’s web interface (i.e.: their phone or laptop’s email program), services commonly include the user’s IP address in message headers. This information disclosure lets recipients of these messages perform some privacy-invasive actions, such as:
A while back, we talked about a common challenge in the security industry – searching for some known bad content (i.e.: “Invoke-WebRequest”) in content that you know has been encoded in base64. In a really cool bout of co-discovery, others simultaneously wrote similar implementations. Since then, this approach is now in the process of being integrated into YARA. Very cool times!
Another situation you might have run …
Read moreIf you’re looking to get one of the Star Trek TOS patches (Science, Engineering, or Command) embroidered on something, they often charge a lot of money to convert the logo to the format that embroidery machines understand.
Here are version I created in the Brother PES format, as well as in the native format I created it in (EmbroideryWare STICH).
If you’re looking to get the Dragon Ball Z logo embroidered on something, they often charge a lot of money to convert the logo to the format that embroidery machines understand.
Here’s a version I created in the Brother PES format, as well as in the native format I created it in (EmbroideryWare STICH).
