Sean Cassidy

@seancassidy.me

521 Followers 239 Following

Screenshot of a LinkedIn post which says, “While people struggle to reach $200k/yr in #cybersecurity after years of experience, folks in #bugbounty are earning $200k per bug report. Wild. Proves that skills can definitely outdo certs, formal education, and the number of years of exp. Note: The person quoted in the screenshot is Hackerone user "stealthy", not me. #bugbountytips #infosec #hacking” with a screenshot of a bug bounty payout by a user named stealth worth $200,000.
Screenshot of Bluesky celebration that says "Celebrating 10M users" I was #19,956, and it says "Bluesky Elder Certified first 1%"
The pieces then came together. Normally, these protocol messages sent from the server to the client are read and understood as data, not as code. But AOL’s client had a security bug in it, called a buffer overflow. The buffer is a place where a program temporarily stores data while running some operation. However, it’s all too easy in lower-level languages to allow in more input than the buffer can actually accommodate. In this case, very large protocol messages could flood it, overwriting the client code and arbitrarily controlling the functioning of the client program—this is why it’s called a buffer overflow, and it’s a huge security hole, since it gives the server control of the client PC. In the wrong hands, the server can choose to shut down or corrupt or do other terrible things to your computer. AOL knew about this bug in their program and now they were exploiting it! That was what all those double zeros were for—they were just filling up space in the program’s buffer until the
A password confirmation dialog with a password quality meter showing "402: Very Strong". It has a complex description of how that number is derived below separated into two sections, Additions and Deletions. Additions has items like "Number of Characters", "Symbols" and "Middle Numbers or Symbols" with types like "Flat", "Cond", and "Incr", and rates like "+((len-n)*2)"
This reminds me of when I interviewed at Stripe, a few years back. It was a surreal experience. We were in a small conference room. I sat at the table on one side, Patrick and Edwin sat on the other side. They asked me questions, I answered them. It was a good discussion. Then there was a brief pause in the conversation. Suddenly, Patrick let off the most absurdly loud fart. I chuckled in surprise. Patrick and Edwin stared back at me, in a stony silence, neither of them making any acknowledgement of Patrick's colonic eruption. I forced myself to adopt a similarly straight face. As the smell of it filled the room and my nostrils, I could only assume this was a power move, intended to dominate. I held my nerve, and continued the interview. Unfortunately, I wasn't offered the job. Now I wonder if maybe it was a cue to speak up and point out the loud, smelly elephant in the room. I suppose I'll never know. Has anyone else here who's interviewed at Stripe had a similar experience?
Initial access Volt Typhoon achieves initial access to targeted organizations through internet-facing Fortinet FortiGuard devices. Microsoft continues to investigate Volt Typhoon’s methods for gaining access to these devices. The threat actor attempts to leverage any privileges afforded by the Fortinet device, extracts credentials to an Active Directory account used by the device, and then attempts to authenticate to other devices on the network with those credentials.
Paella