Viss1d ago

read this and try to tell me cloud wasnt a mistake

https://labs.watchtowr.com/8-million-requests-later-we-made-the-solarwinds-supply-chain-attack-look-amateur/

8 Million Requests Later, We Made The SolarWinds Supply Chain Attack Look Amateur

Surprise surprise, we've done it again. We've demonstrated an ability to compromise significantly sensitive networks, including governments, militaries, space agencies, cyber security companies, supply chains, software development systems and environments, and more. “Ugh, won’t they just stick to creating poor-quality memes?” we hear you moan. Maybe we should, maybe

watchTowr Labs
Show threadLightfighter1d ago
@Viss JFC. The Corp I work for is currently moving to cloud. 4k-ish servers. Why? Who the fuck knows. It's a clusterfuck doing the move, and shit will get missed and we will be compromised. But, as long as the checks clear...
Show threadViss1d ago
@Lightfighter want help?
Show threadLightfighter1d ago
@Viss I'm way too small a tail to wag a Fortune 200 dog. And we are half way through the transition. Just a very different world than I'm used to.
Show threadViss1d ago
@Lightfighter it was worth a shot :D
Show threadLightfighter1d ago
@Viss I appreciate it. Just bitching. It's a mess of on-prem, Azure Entra, GCP hosting. I'm on the AD team, but the Entra and GCP IAM teams are doing their own things. And we just recovered from a ransomware attack last year, but haven't remediated everything yet because everyone is busy with move to cloud.
Show threadViss1d ago
@Lightfighter i guess one tip would be to get all the hostnames for all your stuff and make sure none of that shit is publicly listening on 389. a couple years ago i got up on stage at hackcon in oslo and ran some ps1 that swept the entire ms .no datacenter space and tickled entra. i got usernames, groups, printers, etc.. which is 'below default security for entra', meaning people disabled default shit.
Show threadLightfighter1d ago
@Viss I'm monitoring what the cowboys in Entra are doing. Working on pulling the GCP audit logs. I'm going from contracted LogRhthm sme to IAM team member in charge of certs and pki and tech lead for the AD SysAdmins. No network diagrams, SNow as the inventory(nearly worthless), so I have my work cut out for me. On the positive side, there are some great people trying to make things right.
Show threadViss1d ago
@Lightfighter youre gonna be busy :D
Show threadLightfighter
@Viss These days, as long as I'm employed, I'm good.
Mar 21 at 12:43amWeb