Biggles @Biggles@social.cleverlibre.org

“Spicy autocomplete” will never not be the best brief characterization of LLMs.

Let me try to put it a little more eloquently:

In large metropolitan areas, tourists tend to give themselves away because they're far more inclined to gazing upward at the surrounding skyscrapers than local residents. Now, a growing body of evidence suggests that this same tourist dynamic is a dead giveaway in virtually all computer intrusions that lead to devastating and disruptive attacks like ransomware, and that organizations should set virtual tripwires that sound the alarm when authorized users and devices are spotted exhibiting this behavior.

Hey, that's a pretty good lede. :)

tl;dr: Only tourists look up in a new town.

"Introduction:
Many people have pointed out that there are a handful of commands that are overwhelmingly run by attackers on compromised hosts (and seldom ever by regular users/usage). Reliably alerting when a user on your code-sign server runs whoami.exe can mean the difference between catching a compromise in week-1 (before the attackers dig in) and learning about the attack on CNN.
Introducing our new Sensitive Command Canarytoken."

Some sound advice in a new blog by @TalosSecurity on defending against sophisticated attacks targeting network infrastructure:

"One of the most important things to talk about here is that in each of the cases we’ve seen, the threat actors are taking the type of “first steps” that someone who wants to understand (and control) your environment would take. Examples we have observed include threat actors performing a “show config,” “show interface,” “show route,” “show arp table” and a “show CDP neighbor.” All these actions give the attackers a picture of a router’s perspective of the network, and an understanding of what foothold they have."

https://blogs.cisco.com/security/network-resilience-defending-against-sophisticated-attacks-targeting-network-infrastructure?utm_source=country-soc

They don't mention it, but Thinkst Canary seems to fit the bill here. You can set it up to get alerts for just about anything, such as whenever an endpoint starts running basic footprinting commands to get the lay of the land, like "whoami?" "net view" etc.

https://blog.thinkst.com/2022/09/sensitive-command-token-so-much-offense.html

“Once men turned their thinking over to machines in the hope that this would set them free. But that only permitted other men with machines to enslave them.”

- "Dune" by Frank Herbert

VICE - the Versatile Commodore Emulator
https://vice-emu.sourceforge.io

#Commodore #PET #C64 #VIC20 #C128 #Retrocomputing

During the engineering work for the supersonic Concorde in England, "Thunderbirds" TV series creator Gerry Anderson was visiting the main facility one day. Someone asked him what he did for a living. Feeling massively outranked by all the engineering talent surrounding him there, he quietly replied that he made children's TV shows. Asked which ones, he mentioned Thunderbirds.

Within minutes he was surrounded by Concorde engineers who wanted to talk to him and shake his hand, many of whom told him it was his shows that had inspired them toward engineering careers, because they wanted to actually build the planes and rockets he had in his series. He was flabbergasted.

The original Star Trek had a similar affect on many career choices.

Now of course, TV mostly inspires people toward careers as lazy bums or crooks.

Go get explosive gas+monoxide detector. $50. I bumped my stove and turned on a burner one time by accident.
Mine (NO REFERRAL) https://www.amazon.com/Nighthawk-Monoxide-Explosive-Model-KN-COEG-3/dp/B0002EVNJ6/
And if you have Alexa, it can alert your phone when a siren like this is going off remotely.

(Video source : https://twitter.com/toriyorgeytv/status/1690517187084058624)