Geo Warnagiris

Hey, Port Authority. If you want to participate in the @DARPA Subterranean Challenge, maybe you should join up with our robotic Team Explorer @CarnegieMellon bit.ly/2KN5SeK

@Kate_H_Taylor Slap on some fries and cole slaw and you're all set!

KFC will test Chicken & Donuts for a limited time only in Norfolk/Richmond, VA and Pittsburgh

dodig.mil/reports.html/A… was released yesterday. My first thought is the recommendations are off target.

According to sysadminday.com, the celebration is "all day Friday, 24 hours, your own local time-zone". This should be changed to "the last Friday in July in all timezones you administer systems, even if this is more than 24 hours" IMO. Who's with me? #SysAdminDay

Friday (7/26) is #SysAdminDay . Thanks to all my BOFHs out there!

People are so nice in Pittsburgh. They tell you exactly where you should dig

Anthem indictment unsealed: "the defendants used extremely sophisticated techniques ... included the sending of specially-tailored 'spearfishing' emails with embedded hyperlinks" Sophisticated? Maybe. Extremely sophisticated? No. justice.gov/opa/press-rele…

@eatingsecurity Reminds me of how the adoption of Windows server in the '90s/'00's was sold as making it easier to find server admins. It did, but quality and security suffered.

#AI has the power and potential to improve the future but at what cost? @PittCyber's screening of the thought-provoking documentary "Do You Trust This Computer?" is a week from today, featuring a panel discussion with SCI Associate Professor Adam J. Lee. cyber.pitt.edu/screening

@BlakeSobczak @digitalbond This quote is misleading. It says Russians are not scanning our systems. The preceding, omitted sentence is the key point. "The concern would be the destructive [as opposed to larcenous] mindset that the Russians have toward oil and gas pipelines."

@harper @cmdrtaco .@steveklabnik contends "Today’s developers have never learned about this history ... so we have a war ... for the meaning of open source."

The culture war at the heart of open source words.steveklabnik.com/the-culture-wa…

@anton_chuvakin When businesses calculate the ROI on paying a ransom, the "deters future criminals" variable is zero.

So how do we explain the trend that more organizations choose to pay ransomware ransoms? Criminals seen as better value than security vendors? :-)

This year, if anyone tells you "we skipped Spring weather and went straight from Winter to Summer", remind them of today. #SeasonChangeDenial #FirstDayOfSpring

@cnoanalysis @Peerlyst Here are the results of the report, including Event ID numbers: jpcertcc.github.io/ToolAnalysisRe… . And here is the report itself (from 2017): jpcert.or.jp/english/pub/sr… Will be useful. Thx

Call for papers is up! bsidesfc.org/cfp/ Help us get the word out about BSidesFloodCity! @cfp_time @SecureWVCon @BSidesPGH @BSidesCleveland @DerbyCon

@arekfurt @HarmJoy I think you mean @harmj0y

I do know that if you haven't started looking into making Windows machine accounts for domain controllers non-eligible for delegation (as @harmjoy described), you should probably get started looking at your near-term plausibility of implementing that. With some urgency.

So my 2 very oversimplified critical takeaways (I think) from this: An attacker can: 1. Turn existing resource-based constrained delegation (RBCD) into unconstrained delegation, enabling danger there. 2. Or, as any domain user, just create a new service that uses RBCD then do #1.