/cyb/ + /sec/ - Cybersecurity and Information Security General

Is cybersecurity a good career path? How likely are you to find jobs in the field? I was considering going to college for it but I can only afford a 2 year degree at my community college and some certifications. Would I be able to land a job with these qualifications?

Attached: 500_F_187062813_z99r1EzpbDsOPQljnxcEYGpUFQI8AS10.jpg (500x334, 41K)

fuck why did i repost this

Piggybacking off this: I'm currently in a software support/technical support position but I'd like to begin shifting to a security oriented career, what resources should I be studying and what certs should I persue? Currently have A+ and N+, employer reimburses certifications so price isn't an issue, I just don't know where to begin.

Thermodynamics and Steampunk General

Somebody knows what happened to cyberpunked.org?

Considering shitting up /sci/ with this now.

See

Does /sci/ do generals? Could be interesting to see the input from there.

>slow today
Yes. Wonder why.

Attached: FutureInformationWarfare.png (768x3960, 165K)

Meanwhile fishes shamelessly for traffic by posting a model in latex - who turns out to be a dude but readers do not care.

OK, how far can we go with latex?

qtbots

Hello /sec/. I don't know of a better general to ask, so sorry...
Do you know of any "virus" that can autoinstall on windows from a new plugged sata HDD?
I did that recently with one I was asked to recover, by a known person.
I did the recovery using linux, but then I logged into windows before remembering to unplug the stupid hdd.

Thing is, it didn't let me login, returning an error about the windows login service. I had to repair the registry. This is what has scared the shit out of me.

What is going on?

Attached: 29e.jpg (600x885, 35K)

unless you've enabled autoplay, there's no such thing.
bit rot on the other hand definately is - so that's probably what you were seeing

Where is the actual guide for how to learn this stuff? I need a straight up complete book list written by professionals that will tell me exactly what to read to learn wtf this stuff is, from a CS bachelor graduate's perspective

Dive into the FTP site, it has tons of books. Read all, that will take you a while.

What is that?

Lurk more, and read the OP.

Do you ever lose interest in cybersecurity? It seems that after a while, a lot of the interest in topic seems to fade. After you've secured everything and read all the documentation and know how to make everything you use secure if you so wish, it becomes a lot less interesting and fun to participate in, at least for me. Anyone else know this feel?

I tried installing OpenBSD on a laptop that was just taking up space. Sadly, however, the function keys and wifi were broken. Wifi in particular was oddly broken, I couldn't find anything in dmesg related to the card and the interface didn't show up post-install at all. I guess I'll use either hardened gentoo or devuan instead.

Practically speaking, is using a password for UAC instead just a yes or no prompt any more secure? I mean, there are ways to completely bypass it anyway.

It is if you can expect people around you to be using your machine and running executable files.

I thought about that but I'm not concerned about physical security. I'm guessing if someone can remotely access my computer or if malware gets on my system that they could already circumvent UAC, at least if they know what they're doing. I guess it wouldn't hurt, though.

Could someone help with

It always changes so it never ends.

Not really, it's really only good for enterprise stuff. You're fine with yes/no prompts.

Depends on what you are focusing on. Locking down your home shit will probably get boring fast. My work is in Certification and Accreditation and there's always a new thing to read and understand. Even just one seems endless. So learning two (FIPS 140-2 and Common Criteria) has been an endless escapade.

=== /sec/ News
... or at least a progress report on how to defeat Trojans and evil maids:
>Toward a fully reproducible Debian
lwn.net/Articles/757118/
>The three developers of the title are part of the sharpened message, each being an example of the problem that reproducible builds aim to solve. Alice, a system administrator who contributes to a Linux distribution, is building her binaries on servers that, unknown to her, have been compromised; her binaries are trojan horses, carrying malicious content into systems that run them. Bob, a privacy-oriented developer, makes a privacy-preserving browser, but is being blackmailed into secretly including vulnerabilities in the binaries he provides. Carol is a free-software user whose laptop is being attacked by an evil maid called Eve, the third developer of the title; each time Carol shares free software with her friends, it is pre-compromised by Eve. All of these attacks hurt free-software users and the reputation of free software as a whole.

it's depend on the vulnerability on your system. if attacker compromise your system an got "System" access (NT SYSTEM) the highest privileges it could bypass UAC and disable UAC permanently.

I'm about to start school for Cyber Security.

fanshawec.ca/programs/cyb1-cyber-security/next

Did I take out tons of debt to be no more educated then youtube videos can give me?
How fucked am I?

You can learn a lot over the net. There are however two important things you will miss out on that perhaps most student do not fully appreciate:
- networking: getting to know people is a huge plus that is where ivy league etc. has a lot of strength;
- certifications and exams: no matter what you know counts for little if HR immediately bins your application for lack of formal documentation of your skills.

So use the leftover student loan money to grab as many certs as possible?

Any recommendations on what cert's to start getting?

Also how2network?

I don't have enough insight to be specific other than this:
>how2network
Get a LInkedin-account and use it strictly for professional use. Keep in touch with fellow students.

As for surveillance, well, I think not having a Linkedin-account is in itself a red flag when you are a professional.

Am I the only one literally worried about this kind of thing? Risking to sound larper, that was one of the most unsettling things I felt on DE:MD. That the Picus' manipulation was dangerous close to reality.

>Am I the only one literally worried about this kind of thing?
I have read a little about propaganda in general and have been concerned about these things for years. The more you read about propaganda the more depressing views you get about people in general.

>Risking to sound larper, that was one of the most unsettling things I felt on DE:MD. That the Picus' manipulation was dangerous close to reality.
Not sure what this is.

Deus Ex: Mankind Divided. Check Picus related content or just google "Picus Vault"

Yeah this is just an automation of what was already in place. Maybe it gets easy/cheap enough for everyone to do all at once instead of specialized military/covert operations. The end result probably won't be more effective propaganda but less effective communications for everyone. Will probly need to develop more effective verification. Something simple like ML analysis of wiki edits around posting of things might be a good starting project.

I'm really tempted to apply for a pentest job but I have no education on the field. I have been playing wargames though on HTB and got a few active boxes and learned my way there with Ippsec's videos on retired boxes and the job application says that "you don't have to know everything, we will teach the rest". The thing is that they require to know how to code, I can read code and modify copy pasted programs to fit my needs but I can't write a full program myself. Do I look like a fool if I apply now, should I practise more, or am I going to just waste time trying to get further myself? Halp pls

Can someone please share that image of Elliot from Mr. Robot with the distorted face?

Makes me lmfao every time

>M-MUH GAYUMZ

Bump

anyone attack any stock router wpa2 implementations? had any luck?

Trouble is, the border between propaganda and advertising is increasingly unclear. Add to this that foreign interests are growing in elections and you might even have military grade propaganda in a setting that supposedly is civilian.

>the border between propaganda and advertising is increasingly unclear.
Is there really a difference?

Dude, always apply. What's the worst thing that could happen? I got my current job from a company I applied to, in which I had no hopes of ever making it in. But I got lucky, so yeah

This shows the list of certs most considered. Except swap CEH with OSCP.
iase.disa.mil/iawip/pages/iabaseline.aspx

What languages do you need to know to get a junior position as cybersec? I got Python, bash, basic C (I know I need to work more on this one) and now trying to pick up Go.

Attached: 1521630731669.png (735x442, 12K)

C and Python are probably the best, but that depends on what type of infosec you work in. I didn't really need any to start, although being able to read C helped. But if you do C, Bash, and Python, you'll be fine.

>Is there really a difference?
Propaganda seeks political power and then optionally financial gains.
Advertising seems financial gains and then optionally political power.

With politicians switching careers this is blurred even more.

Thanks. I know that Go is used a lot in networking and lower-level stuff, is it used in infosec at all?

I've never seen Go, so I can't provide insight. Assembly or VHDL (for fpga's) are valuable. Honestly though, if you are looking for entry, focus on the broad topics of infosec. SSCP is good cert for outlining that info. Unless you are looking purely for a software position, going more narrow limits your options.

Forgot to add: you'll be more than fine language wise with what you have. It will at least show you have a background, and if they require you to know a different language, you'll have shown you are capable of learning it.

>Cypherpunk Manifesto
>activism.net/cypherpunk/manifesto.html

He mentioned electronic money. What is the best bet here? Best way to go? Is there any nowadays?
Obviously it isnt BTC

One profits a corporation, the other profits a government
Monero for anonymous transactions or zcash or dash. Bitcoin for investment. Random popular shitcoin for day trading. Ethereum for cool apps.

>Monero
Zooko said something vague about a [possible] protocol flaw at 34c3 iirc.
but then again his whole talk was shallow

He was probably talking about this:
gizmodo.com/at-least-two-flaws-in-monero-could-make-some-transactio-1824133518
Not really a huge deal, the true amount of a transaction can sometimes be identified, but concerning for a crypto that has postured itself has being privacy centric. Monero is still the gold standard for washing crypto.

nah not really
been into reversing for years
there are boring aspects but my successes more than keep me interested

Does anyone have any good books on hacking and cyber sec? I tried pic related from the ft server and it's 300 pages of shit. All it does is teach you how to install Kali on a VM and then runs you through the basics of python.

>This chapter is kind of an introduction to the advanced concepts of Python. Since this is the final chapter, I would like to tell you about where you can go from here.
>You can either build web applications with the help of Python or you can do some security networking stuff. Finally, like me, you can choose the interesting path of ethical hacking. All these things and more you can do through Python.
>Let us see how we can apply our basic knowledge of Python in socket andnetworking. Write down this code on your IDE and see what output you get.
>The output is like this in my machine. You can test any other web site to get its address. This is the tip of the iceberg. Lots of things are inside. It is better for you to see everything that is inside than for me to tell you, as I feel you should concentrate on trying to write basic concepts of Python more and more.
>In the further study of the relationship between ethical hacking and Python 3, you’ll find these socket and networking concepts extremely useful.

Fucking kill me now...

Attached: images (2).jpg (712x1080, 87K)

no
stop asking this stupid question
reading books will not make you a good hacker
you just have to do it
teach yourself to audit code; write some exploits, play some CTF/wargames; learn about different classes of vulnerability, learn about computer architecture.
there is lots of documentation out there, but reading a book cover to cover is generally nothing but a waste of time

>play some CTF/wargames
I know of a couple of sites that host wargames. If I participate in one of them using a virtual machine I should be safe from any harm, right?

no, your computer might explode
just give up

The hacking exposed books tend to be decent. I picked up the Wireless Hacking Exposed and the Kali Wireless Hacking book by Vivek and I keep them as resources.

thx dude

Thanks senpai

New wpa3 announced. Now wireless security want be shitty, save for rf jamming.

OK, so my plans for getting a new phone has to be postponed, again:

=== /sec/ News:
>Every Android Device Launched Since 2012 Impacted By RAMpage Vulnerability
it.slashdot.org/story/18/06/28/160220/every-android-device-launched-since-2012-impacted-by-rampage-vulnerability
>The vulnerability, tracked as CVE-2018-9442, is a variation of the Rowhammer attack. Rowhammer is a hardware bug in modern memory cards. A few years back researchers discovered that when someone would send repeated write/read requests to the same row of memory cells, the write/read operations would create an electrical field that would alter data stored on nearby memory. In the following years, researchers discovered that Rowhammer-like attacks affected personal computers, virtual machines, and Android devices. Through further researcher, they also found they could execute Rowhammer attacks via JavaScript code, GPU cards, and network packets.

I just want a nice Palm Pre 5.

Implying this infographic isn't a disinformation campaign funded by traditional media outlets.

Attached: 1530036753128.jpg (668x667, 76K)

Social or traditional media have no interest in having their readers question the contents they spew out to their readers or followers.

"Hack the Spew" seems oddly relevant here.

But that book is telling you about hacking and cyber security, it literally says "Beginning" in its title.

Newsflash for all the retards here: cyber security requires solid networking knowledge. If you get stuck on the question "What port does ping use?" then you are a certified dumbass.

Is English your first language?
The infographic says not to trust any third party site without vetting it. What exactly would you use to compare third party sites except traditional media or media megacorps?

Attached: 1524823235427.jpg (400x566, 37K)

>cyber security requires solid networking knowledge

see, this is a good tip for a beginner. So now, are there any solid networking books you'd like to recommend?

The Network+ book by Mike Meyers is always a safe place to start. The CWNA book by Coleman and Westcott is good for 802.11 wireless. Rappaport also has a good book on wireless communications but it tends to be more pricey.

Where to go after reading Hacking: Art of Exploitation? I'm interested in writing exploits, so I was thinking maybe just reading a shit ton of bug bounty write ups. Do you fags have any good ideas?

Check out metasploit

>Is English your first language?
No.
>The infographic says not to trust any third party site without vetting it. What exactly would you use to compare third party sites except traditional media or media megacorps?
I compare what they write with what I have first hand knowledge of.

> that 30 years old bummer who still cannot read
Cyber(security|punk) -> There's a match

Page 7

I think the next thread will need a snazzier picture.

Attached: Tron.jpg (3948x1841, 635K)

> Cybersecurity General
> IRC
IRC is incredibly insecure. You just discredited yourself.
I stopped reading there. Have fun with your clueless group.

stop being a faggot. You don't need to use the most secure shit at all times. It's only when necessary.

>what is OTR
>what is SSL/TLS
Ok son

>that 30 year old boomer who can't use a bouncer and keep good opsec with his online identities

is it dumb to have a fear that if for some reason i became famous, that some disgruntled google employee would release all my search history, or whatever?

I'm really worried about that.

I'll make a better guide later to get into Cyber Security. I'll give an overview of our red team track:

Beginners:
>Overthewire labs and using linux in general to get used to the environment. Maybe a codecademy course on python or bash.

Intermediate
>start using Kali to target a Metasploitable VM
>use guides or whatever, just get used to being able to pop easy targets

Advanced:
>Hackthebox machines and challenges
>Vulnhub Vm's and posting your writeups
>Making security tools or giving talks at conferences on a topic you researched.

Books you should have: Hackers playbook 2, Art of exploitation, Metasploit guide

Install VMware and get to work and after a few months, you'll probably be in a good place, maybe even at a place where you could start as a junior pentester or junior security analyst responding to tickets all day.

thanks for putting in the effort. I'm already done with the beginners part, actually working as a Python dev, but I'd love to start sinking my teeth into the Intermediate part. Thanks again.

Who develops jn python? Honest question. I only see c and c++.

I've abandoned my irl identity and taken on a fake name. Maybe that will help.

Attached: 1513382404673.gif (498x342, 664K)

I just take pride in my tranny and cuckold porn searches. It was a phase.

Question for CybSec:

What do you think of Social Justice?

I ask this because it seems that the authoritarian socalistic ideology seems to have a track record of ruining cool ideas and i fear that cybsec may be its next target on the campaign to be useful idiots for B!gBr0.

lol fair question, I meant WEBdev, but yeah. We just write small internal tools for a small sales company, less than 10 of us programmers in the company.

Lol fuck that shit. My company kinda has the diversity vibe trying to start but niggers can't last the first month here so they gave up hiring them.

That's still cool. I mainly work with network device developers so that's probably why I haven't seen it. Sucks, I only really know python so I need to bs my way through source code auditing for FIPS when it's in C