Tanawts

@Enigma@infosec.exchange
354 Followers
121 Following
886 Posts

Things are not always what they seem

Redfin | Rent Head of Information Security

Former Ubisoft Director of Security Operations
Microsoft Alumni | Former Director of MSRC's Cloud Incident Response | He/Him/Hrm | Philosopher & Ninja

SANS:
GCIH #16353 - Cerified Incident Handler
GWAPT #3274- Web Application Pen Tester
GXPN #164 - Exploit Researcher and Advanced Penetration Tester

A former U.S. Army soldier who hacked into AT&T and other telecom providers and extorted them over stolen data has pleaded guilty.

https://www.justice.gov/opa/pr/former-us-soldier-pleads-guilty-hacking-and-extortion-scheme-involving-telecommunications

21-y/o Cameron John Wagenius, who went by the nickname "Kiberphant0m," was arrested last year after a collaborative effort between security researchers and law enforcement helped identify him and his two co-conspirators in real life. Some of that discovery process was described in a front-page WSJ story last year, but there were a LOT of people involved in finding these guys. The DOJ press release credits Flashpoint and Unit 221B.

https://www.wsj.com/tech/cybersecurity/hacking-brian-krebs-snowflake-waifu-49b87fce?gaa_at=eafs&gaa_n=ASWzDAjeblCmO8OxOqX1B391KhkwMORjzYAAW4-Yd0qVCP2mDjNZs92o9jYEfE0xNe0%3D&gaa_ts=6877cf95&gaa_sig=4evbq_UDMdzLpsu6MuWV6YU0izSEB62WwY4TI5nzSa3OPMYkJ0oRjhj2AZjf9s1ZZSQJvmPexbXLvjRBwdLImg%3D%3D

At the end of November 2024, I published findings that Kiberphant0m was likely a U.S. Army soldier stationed in South Korea. At the time, he was still trying to extort money from victims, and telling me he'd never get caught.

https://krebsonsecurity.com/2024/11/hacker-in-snowflake-extortions-may-be-a-u-s-soldier/

A little over a month later, Wagenius was arrested in Texas.

https://krebsonsecurity.com/2024/12/u-s-army-soldier-arrested-in-att-verizon-extortions/

Oddly enough, Wagenius has been calling me quite a bit from federal prison, sometimes just to shoot the breeze apparently. He was convinced for many months that the initial guilty plea he accepted would preclude the government from piling on more charges, but they did anyway. He pleaded guilty to those, too. I never once got the impression that he was at all concerned he would be sent away for more than a few months.

TIL https://github.com/OWASP/cwe-tool (e.g. `$ npx cwe-tool --id 22`)

Turns ugly CWE XML to usable JSON

GitHub - OWASP/cwe-tool: A command line CWE discovery tool based on OWASP / CAPSEC database of Common Weakness Enumeration.

A command line CWE discovery tool based on OWASP / CAPSEC database of Common Weakness Enumeration. - OWASP/cwe-tool

GitHub

When I started work at PAPA, the games were in pretty bad condition.

PAPA had one tech, and five hundred pinball machines. Tech's name was Steve and he was a great guy and an excellent tech. You've never heard of him because he's kind of a hermit and doesn't go on the internet, but he's genuinely one of the best and most knowledgeable pinball techs in the world. The games were in generally poor condition because there were five hundred of the damn things and one tech and no matter how good the tech is, the maths just doesn't work out, so PAPA hired me. With one guy they got slowly worse over the course of years, with two guys they got slowly better over the course of years.

Five hundred filthy pinball machines, every one of them with some problem or another, and two techs. Plus Ted, but his thing was vids, the pins were left to me and Steve.

You ever seen five hundred pinball machines? If you're there to play them you think "Wow cool," if you're there to fix them then the scale is incomprehensible. The brain rebels against this problem, it says you are so small. You are one person. This is impossible.

It's the same feeling that you get the first time you ever open a pinball machine. You look inside and the brain says look at all those wires. Look at the relays and motors and coils and bulbs. Look at all that complexity. Look at all the rat shit. This is impossible.

Sometimes the brain needs to shut up and wait its turn. Be quiet, brain, you can speak again when I've got a schematic up, until then you can sit in the corner and chew on a podcast because it's the hands' turn now. Without something to gnaw, the brain will only keep reminding you of the sheer scale of insurmountable Task To Be Done.

Alright, let's back up. Until the late 70's, electrically speaking, every pinball machine was made of four things: coils, switches, wire and connectors. This is a reductive take, but you NEED reductive takes in order to fit the world into your head enough to actually do something about it. A transformer? Two coils wrapped around an iron frame. A motor? Coils again but in a circle. Lightbulb? Coil, in a glass prison with no air. A coil is just wire that goes round and round, I guess you could say "Switches, wire and connectors" but that would be TOO reductive. Here's how reductive you need to be, to fix a pinball machine:

If every coil works,

and every switch works,

and every wire is where it should be,

and every connector works,

then the machine has NO CHOICE

BUT

TO

WORK

You fix the system, by fixing all parts of the system, one part at a time, over a long time. There is no "big picture" here. The big picture is what you see when you can't focus on the nuts and bolts. If every part of it works, then it works, and all a person can actually affect is parts.

Take the single machine, and abstract it out into five hundred machines. We worked in two modes, panic-fixing and long-term improvement; around tournament seasons we'd find all the hand-written out-of-order signs and do as many quick on-the-spot fixes as we could, and outside of tournament times we'd pick the worst game, make it the best, and repeat. A helper once asked me while we were in long-termer mode, are you two really gonna fix ALL these machines like this, taking days over each one? I said well, at this rate, it'll take about five years. It did. There were three non-working pinballs when COVID killed PAPA, and every game was clean. We just, Kept Going, turning one screw at a time.

A manager once asked me, you're so nuts-and-bolts, what do you think is the big picture here - I told her, there's no big picture. The big picture is made out of thousands of interlocking nuts and bolts that all affect each other. We have a thousand machines (by then we'd added five hundred vids too) and each machine is a thousand parts and it's been a long time since any were simple enough that you could hold the whole schematic in your head.

When someone says to me, "The problem is capitalism," I remember all the times I'd be working on a game and someone would be standing around chatting with me and said something that boiled down to "Wow, that's a LOT of games, how the hell are you gonna fix all those," while I had the playfield up and my filthy scratched-up hands

turning

one

screw

I just posted the slides from my "What's my job again?" talk that I delivered at Tampa BSides in May.

This talk covered what security jobs there are to be done in an organization (we found 73 so far across security, technology, and business teams).

This talk is based on an upcoming standard from The Open Group that defines security roles, security accountabilities on business and technology teams, and what happens if any of those 'jobs to be done' isn't being done.

These roles span the Board of Directors and CEO all the way through SOC analysts and threat hunters, IT/OT engineers and operations, CIOs, CISOs, lawyers, finance, business managers, and more.

Share and enjoy!

https://www.slideshare.net/slideshow/what-s-my-job-again-slides-from-mark-simos-talk-at-2025-tampa-bsides/281214751

This should be on TV every day, possibly multiple times per day…. #AI
there are, predominantly, three types of software:
- software written by people who do not take pride in their work, due to which the software is full of bugs
- software written by people who do take pride in their work, and have thusly burnt out, due to which the software is full of unfinished and/or missing features
- software written by people who are paid big money by investors, due to which the software is full of dark patterns and antifeatures

the art of using a computer involves learning to identify which of the above types a given piece of software belongs to, and choosing the software you use based on this tradeoff.

I gave some career advice for security practitioners at a recent talk at BSides Tampa and thought I would share this one. (I will post link to full recording when available)

â—ľ Always focus on outcomes - In cybersecurity, 'how' we do our jobs is complex with a lot of details that can be distracting (especially for the neurodiverse brains among us). Despite these distractions, its critical to keep focus on outcome because what people pay you for is measured by your outcomes. What did you do that enabled your boss and their bosses to get something that they care about? (stopping/finding attackers, convincing another group to make a change, etc.) The value you have to an organization (and to your boss) is what you get done. Everyone always appreciates someone gets s--t done.

â—ľ Be a team player - Nothing you have or can accomplish is ever done solely by you and you alone. You always learned something from someone else (even if it is just an anonymous author of a technical manual). You always need the expertise, connections/visibility, credentials, etc. of teammates and colleagues to get inspiration and to execute on stuff. Nobody wants a grand standing a-hole on their team, no matter how talented they may be. Even if someone is talented enough that people to put up with that a-hole for a little while, people will be happy to replace them with another talented person (or a team of people) that works well together.

â—ľ Continuously adapt - You have to adapt to constant change because everything is always changing-- technology, business model, the people around you and their priorities, security threats, security technology, and more. Always always always be ready to adapt to whatever comes along. Every change can be a benefit or a challenge or both, every tool can be a weapon and every weapon and be a tool.

◾ Always tell your own story - you really need to tell the story of your victories. Never brag that you’re better than other people, but always make sure that people (especially your boss) knows what your accomplishments are (and how it can help them). Make sure to talk about the 'silent ones' that people would normally/naturally miss. If the script you wrote is still saving the company $##,000 per X, occasionally mention this in addition to the "what have you done for me lately“ recent outcomes.

YES

Stop trying to fix the user. It’s not the user’s fault if they click on a link and it infects their system. It’s not their fault if they plug in a strange USB drive or ignore a warning message that they can’t understand. It’s not even their fault if they get fooled by a look-alike bank website and lose their money. The problem is that we’ve designed these systems to be so insecure that regular, nontechnical people can’t use them with confidence. We’re using security awareness campaigns to cover up bad system design. Or, as security researcher Angela Sasse first said in 1999: “Users are not the enemy.”

https://www.schneier.com/blog/archives/2025/05/why-take9-wont-improve-cybersecurity.html

Why Take9 Won't Improve Cybersecurity - Schneier on Security

There’s a new cybersecurity awareness campaign: Take9. The idea is that people—you, me, everyone—should just pause for nine seconds and think more about the link they are planning to click on, the file they are planning to download, or whatever it is they are planning to share. There’s a website—of course—and a video, well-produced and scary. But the campaign won’t do much to improve cybersecurity. The advice isn’t reasonable, it won’t make either individuals or nations appreciably safer, and it deflects blame from the real causes of our cyberspace insecurities...

Schneier on Security
“How Fat Is Kim Jong Un?” Is Now a Cybersecurity Test

North Korean IT operatives are gaming the global job market. This simple question has them beat.

ZME Science
The office is starting to come together