@__steele I drive past where it’s made at least monthly, it’s good stuff!
English
Ben Potter
320 posts
Ben Potter
@benji_potter
Founder of FIRCY. ex AWS security leader. Ambassador for #NoMoreRansom. Tweeting cyber and cloud.
Adelaide, South Australia Katılım Ağustos 2015
218 Takip Edilen405 Takipçiler
I brought this chicken salt on my latest trip around the world. It travelled 39,700km with me and now it’s home because I completely forgot to share it with (in order) my cousins, colleagues and fellow conference-goers. I also learned it sets off X-ray machines 100% of the time.
English
Call it social media threat intelligence gathering 😎
If you can only search for single IP's then start with 52.27.191[.]181, 52.27.190[.]67, 52.27.190[.]9, 52.27.190[.]10, 52.27.191[.]179, 52.27.191[.]164, 52.27.190[.]82, 52.27.190[.]78, 52.27.190[.]90.
Yes AWS are aware.
English
Thought I'd ask the cloud community to DM me or reply if you've seen activity in your AWS logs (S3 / VPC / web application) for IP addresses in the range of 52.27.190[.]0 > 52.27.191[.]255 between July 2022 and April 2024. We've seen billions of requests, are we alone?
English
@QuinnyPig The real real horror is if the requests were “accidentally” generated by AWS themselves doing security scans billions of times a month.
English
The real horror here is that when OP enabled CloudTrail for S3 data events each of those $1300 worth of S3 requests started charging them 20x more. Or, y'know. $26K for the month.
Laura Wendel@Lauramaywendel
So apparently if someone knows / guesses the name of your S3 bucket - even if it's private (!) - they can just bankrupt you by sending infinite PUT requests and there is nothing you can do about it. > requests get rejected > but AWS still counts it as a write operation against your account for which you have to pay at a rate of $0.005 per 1000 requests This seems insane to me. Especially because a lot of services rely on presigned URLs for uploads / downloads which exposes your bucket name to the client. In this case the author got their bill waved, but AWS support made it clear it's an exception not the rule.
English
Ben Potter retweetledi
As someone involved in the AWS offsec space, I want to share why I strongly do NOT recommend the HackTricks AWS Red Team Expert course. The author of it is a plagiarist, stealing content from other creators and is directly profiting off of it through sponsorships. A 🧵
English
@crbholdings @ericpullen @Ford This meant my Powerwall never charged and had to buy a generator to get through another 48h outage. AC coupled batteries are not good in backup or off grid situations!
English
And with that, the power is back on and Luna is drinking from the grid again. She did a great job helping us through the outage and deserves a nite off! Total time off was 1hr shy of a full 5 days. @Ford #F150Lightning
English
@crbholdings @ericpullen @Ford I have a powerwall and would love to sell it, last big outage where I live lasted 12h powering single fridge and lights and was fully charged. Next day it wouldn’t charge because utility increased grid voltage to 265v to force grid feed solar to turn off.
English
Ben Potter retweetledi
Full house this morning at @stoneandchalk @AustCyber breakfast ft @benji_potter @YSGovRiskSec @duariv @Fivecast @CyberCX @ISACA_Adelaide @CyberOpsAU @DIIS_SA exploring the #growth of the Australian #Cyber Industry
#STARTUPWEEK #SOUTHSTART
English
English
@0xdabbad00 Add to this AWS encourage “small” businesses and partners to use distributors, which means the distributors own root access and their email and phone systems become responsible and therefore targets for literally thousands of accounts.
English
Given Twilio's recent breach[1] due to TOTP phishing, and Cloudflare's thwarting of the attempt due to their FIDO enforcement[2], I wish AWS had a better story around root account authentication and recovery.
1. twilio.com/blog/august-20…
2. blog.cloudflare.com/2022-07-sms-ph…
(ARCHIVED) Bob Lord@boblord
Anyone from Amazon able to provide a roadmap for supporting multiple FIDO security keys? Seems super important.
English
@0xdabbad00 My (non) favourite feature is the S3 server access logs are configured to log to itself, circular logging is definitely not cost optimised!
English
I should discuss CT more constructively. So in 2019, when CT was released at re:Inforce, the *concept* of a managed service to provide a "landing zone" was strongly needed, because running multiple accounts was difficult. 🧵 1/
Scott Piper@0xdabbad00
Lol, in the fullness of time, Control Tower will eventually align with best practices on AWS.
English
AWS IAM Identity Center replaces the old Single Sign-On console, looks much better thank you @AWSIdentity !
English
This is not a drill for Jenkins users that choose to expose their instances / servers to the internet. Long list of plugins vulnerable with no patches: bleepingcomputer.com/news/security/… Time to remove them from being publicly exposed!
English
@0xdabbad00 Nice! I taught myself tig as it’s so precise and similar to soldering (done lots over the years).
English
Weekend project, built a lumber rack by cutting and welding steel stock. My gasless flux core mig welds are really bad, but “a grinder and paint makes me the welder I ain’t”, and it holds! (Though the bottom rack has the concrete probably doing most of the work)
English
Found my first working #IoT project in storage… Nokia 6110 with SMS microcontroller for digital I/O! 15+ years ago it was pretty sophisticated for a home alarm system compared to what we have now. Little circuit board on the right is actually a remote doorbell receiver.
English
Ben Potter retweetledi
New: underground trade of bots that steal your 2FA codes. Bot places convincing automated call to target. Victim enters code, gets fed to hacker instantly. Dramatically lowers the barrier of entry for bypassing 2FA, no social engineering skills needed vice.com/en/article/y3v…
English
I will always prefer working virtually. Today was Clare in South Australia amongst nature with a beautiful creek. Bees got a bit close a few times!
English