| https://twitter.com/jkamdjou | |
| Github | https://github.com/jkamdjou |
Did you know that @sublime has a FREE hosted offering for orgs with <100 mailboxes? The onboarding process for Google Workspace took less than 5 minutes 🔥
This platform is incredible and takes a unique perspective on email security using detection-as-code concepts. Its not only inspecting new emails in real-time, but also performs historical analysis to build baselines and surface missed threats.
This free tier is a no-brainer for small orgs looking to implement top-notch email security.
Less than 3 weeks until RSAC - let's meet!
Stop by booth #1167 to learn about the SecOps Cloud Platform, pick up swag, and meet the team building the future of SecOps. We are also hosting a happy hour at Kona's Street Market with our friends from @runpanther and @sublime.
Check out the link in the comments to schedule a time to meet with the team or RSVP for our after hours event.
Sublime puts email security directly into the hands of your security teams, enabling proactive defense against email threats through Detection-as-Code and behavioral AI functionalities. By seamlessly integrating Sublime Security with LimaCharlie's SecOps Cloud Platform, you consolidate your telemetry data and streamline your response to email-borne attacks.
Join @_bromiley (Lead Solutions Engineer at LimaCharlie) and @jkamdjou (Founder & CEO of @sublime) tomorrow as they delve into the dynamic features of both platforms.
Don't miss this opportunity to learn how Detection-as-Code can be a game-changer for your email security: https://limacharlie.wistia.com/live/events/xqfn2g6vnd?utm_source=organic_social&utm_medium=organic_social&utm_content=webinar&utm_campaign=sublime_security_webinar_03_2024&utm_term=&lead_source_detail=mastadon
With LimaCharlie, we believe that security capabilities should enable and empower the teams that use them. Email security is here to stay as a necessary component to the modern security stack. However, gone are the days when an organization should be chasing emails with false signatures; Detection-as-Code, a key component of LimaCharlie’s SecOps Cloud Platform, can also be a game changer for email security. For this reason, we love Sublime Security. Sublime places the power of email security in the hands of the security teams that know their environments. Preventing email attacks with Detection-as-Code and behavioral AI capabilities, Sublime is a powerful tool that allows security teams to spend less time on email-originated attacks. In this webinar, we’ll review the power of both platforms, and look at how you can integrate Sublime Security with LimaCharlie to bring all of your telemetry in one place and spend less time on email-originated attacks. Join Matt Bromiley, Lead Solutions Engineer at LimaCharlie, and Josh Kamdjou, Founder & CEO of Sublime Security, on March 14, 2024, at 10:00am PT / 1:00pm ET to learn how LimaCharlie and Sublime Security work together and why Detection-as-Code can be a game-changer for your email security.
SOC Analysts - did you know that @sublime exposes a FREE .eml analysis tool? A must-have for any analyst toolbox for analyzing suspicious emails. They even provide a free, unauthenticated API to do the same.
Sublime Platform 1.0 is officially out today!
There’s osquery/EDR for endpoints, YARA for binaries, Sigma/EQL for logs, Semgrep for code, Snort/Suricata for packets. Now, there’s Sublime for email.
It takes under 10 minutes to be fully up and running with Docker: https://github.com/sublime-security/sublime-platform
Many of you have been asking for my thoughts on the #LastPass breach, and I apologize that I'm a couple days late delivering.
Apart from all of the other commentary out there, here's what you need to know from a #password cracker's perspective!
Your vault is encrypted with #AES256 using a key that is derived from your master password, which is hashed using a minimum of 100,100 rounds of PBKDF2-HMAC-SHA256 (can be configured to use more rounds, but most people don't). #PBKDF2 is the minimum acceptable standard in key derivation functions (KDFs); it is compute-hard only and fits entirely within registers, so it is highly amenable to acceleration. However, it is the only #KDF that is FIPS/NIST approved, so it's the best (or only) KDF available to many applications. So while there are LOTS of things wrong with LastPass, key derivation isn't necessarily one of them.
Using #Hashcat with the top-of-the-line RTX 4090, you can crack PBKDF2-HMAC-SHA256 with 100,100 rounds at about 88 KH/s. At this speed an attacker could test ~7.6 billion passwords per day, which may sound like a lot, but it really isn't. By comparison, the same GPU can test Windows NT hashes at a rate of 288.5 GH/s, or ~25 quadrillion passwords per day. So while LastPass's hashing is nearly two orders of magnitude faster than the < 10 KH/s that I recommend, it's still more than 3 million times slower than cracking Windows/Active Directory passwords. In practice, it would take you about 3.25 hours to run through rockyou.txt + best64.rule, and a little under two months to exhaust rockyou.txt + rockyou-30000.rule.
Keep in mind these are the speeds for cracking a single vault; for an attacker to achieve this speed, they would have to single out your vault and dedicate their resources to cracking only your vault. If they're trying 1,000 vaults simultaneously, the speed would drop to just 88 H/s. With 1 million vaults, the speed drops to an abysmal 0.088 H/s, or 11.4 seconds to test just one password. Practically speaking, what this means is the attackers will target four groups of users:
1. users for which they have previously-compromised passwords (password reuse, credential stuffing)
2. users with laughably weak master passwords (think top20k)
3. users they can phish
4. high value targets (celebs, .gov, .mil, fortune 100)
If you are not in this list / you don't get phished, then it is highly unlikely your vault will be targeted. And due to the fairly expensive KDF, even passwords of moderate complexity should be safe.
I've seen several people recommend changing your master password as a mitigation for this breach. While changing your master password will help mitigate future breaches should you continue to use LastPass (you shouldn't), it does literally nothing to mitigate this current breach. The attacker has your vault, which was encrypted using a key derived from your master password. That's done, that's in the past. Changing your password will re-encrypt your vault with the new password, but of course it won't re-encrypt the copy of the vault the attacker has with your new password. That would be impossible unless you somehow had access to the attacker's copy of the vault, which if you do, please let me know?
A proper mitigation would be to migrate to #Bitwarden or #1Password, change the passwords for each of your accounts as you migrate over, and also review the MFA status of each of your accounts as well. The perfect way to spend your holiday vacation! Start the new year fresh with proper password hygiene.
For more password insights like this, give me a follow!
“EXCLUSIVE: TikTok Spied On Forbes Journalists”
@ebakerwhite for @Forbes
Eric Capuano
LimaCharlie
Recon InfoSec
Jason Craig
Jeremi M Gosney 
Zach Everson