Another green day for Indian ADR/GDRs good opening https://t.co/zY8W2akVtD

Singing the Blues:
Taking Down an Insider Threat

"I had all of the advantages. I was already inside the network. No one suspected me. But they found my hack, kicked me off the network...

...and physically hunted me down."

Many pentests start from the outside, wanting to see how the perimeter might be breached.

This pentest started from the inside. My client wanted to assume they had already been breached, and, if breached, how far could an attacker go.

Could they stop me once I was inside?

So they snuck me in. Disguised me as a new employee. Gave me a work computer, an ID badge, an account in their system... hell, I even had a cubicle w/my assumed name on it.

The only person who knew who I really was was their CISO. Everyone else thought I was Jeremy in Marketing.

During most of the first morning, I completed onboarding, made introductions, and completed menial tasks.

But I had to act quick. I only had a week onsite. I had to hack their network while not raising suspicion.

So I set about it.

You have to understand... most "Internal Pentests" are straight forward. The hard part is breaching the network, but once you're inside, it's a target rich environment. End of Life computers, default passwords, everyone a Local Administrator...

Met a Brazilian-American Lyft driver from San Diego who passionately attacked the racism of Republicans, then switched to passionately defending Bolsonaro.

If I were Thomas Friedman, I could tell you what this means.

Met a Haitian-American in a restaurant who said he'd always vote for Democrats because of the immigration issue, but that he has conservative beliefs too. "I don't want to pay for someone's abortion!", he declared.

Met a Latino Lyft driver from San Jose who said that while he was liberal, California was getting too liberal for him and he was considering moving to San Antonio.

Again, not being Tom Friedman, I am unable to offer any commentary on the political and policy implications of these conversations.

I guess my only thought is that political opinions are pretty complex and multidimensional, out there in the real world.

(end)

Okay look - I didn’t grow up with comic books. But I read stacks of science fiction digests and I kit-bashed model cars into fantasy rods, and just tried to maintain a low profile until I could get out of the house. So you could say I’m a distant cousin of the comic book fan. /1

And sometimes one’s childhood passion follows them into adulthood, sometimes not, sometimes as an adult one finds a passion they never had as a child and embraces it. For me, that must include getting involved with a puppet show at the age of thirty. /2

So who’s to say whose passion’s legitimate and whose is bogus? Nobody. Someone might indict your passion but they have no ground to stand on and should be dismissed out of hand. /3

Maybe they’re envious that you have a passion, maybe they think that their passion is cooler than yours, or maybe they’re just insecure, who knows. Doesn’t matter. /4

What matters is that if something gives you joy, and in the process doesn’t hurt others, then by all means follow it. It’s how we explore our secret hopes, our shadow sides, our inner character. /5