Supply-chain attacks on open-source packages aren’t hypothetical anymore. Every few weeks there’s another story about a malicious package sneaking onto PyPI or npm — sometimes hiding behind a name that looks just close enough to something popular, sometimes just brand new and hoping nobody looks too closely before enough people install it.

I got curious how hard it would be to keep an eye on that myself, so I put together a small automated pipeline that watches both registries for newly published or updated packages around the clock. Most of what shows up isn’t worth a second look, so before anything gets a deeper scan, it has to clear a quick filter: is this package unusually popular, does its name look like it’s impersonating something well-known, or is it brand new with basically no track record? Those are the shapes that most real incidents actually take.

Recently, I was attending a corporate event via conference call and I noticed a distinct phrase being mentioned over and over by the event speakers. “Please refrain from taking screenshots of these slides as they are not meant for public disclosure.” Sound familiar to anyone? How many people are actually going to abide by this suggestion?

For in-person events, this warning may be enough to ward off the rogue mobile phone picture taker…but let’s face it…when people are at home, in their office, not thinking that they are being “watched”, they definitely are going to take that screen capture (and potentially send it elsewhere). Don’t believe me?

WORMCON CTF occurred this weekend and I had a fun time digging through a handful of Forensics and Networking challenges.

Network At Risk (Part 2)

This challenge provided a PCAP file that contained quite a bit of FTP traffic. As I’m sure most know, FTP does not encrypt data while in transit. This provided me with a good starting point to try and gather some information.

Sure enough, one of the first things I noticed in the FTP requests is a username and password. I’ll hold onto this information for later.

Lately, I’ve been keeping my eye out for interesting CTF’s to compete in. This past weekend, the corCTF team hosted their own event and boy was it a tough one. Being primarily a forensics guy, I was definitely out of my comfort zone with many of the challenges being binary exploitation, reversing, and cryptography. I clung onto anything that looked familiar and in the end was able to crack a web challenge for a few points. Here’s to getting stronger with reversing + coding for the next go around!

It’s been a while since I had a chance to sit down and tackle a CTF. Lucky for me, GuidePoint Security recently ran their August iteration and it gave me a chance to brush off some cobwebs! I wasn’t able to solve all the challenges (damn you Python!) but had a pretty good idea on how to approach most of ’em. Below are some write-ups on ones that I had fun trying to solve.

It’s no secret that working in a Security Operations Center (SOC) can be a demanding, thankless, and tough job (with it only getting tougher). This is especially true for folks just getting started in the industry who are building the foundational skills required for career progression. Working long hours, weekends, holidays…this is the side of cyber they don’t tell you about… If you’re not prepared for it, you might start asking yourself “What the hell did I just get myself into?”. I know I did…