Recent content on Precision Computing
In Threat-Driven Software Development , we focus heavily on the nuances of Operational Security and how to secure online services from modern threat actors. There are many books on Application Security, but not on this important operational aspect. How are they different? I think this quote sums it up best: Application Security is an investment. Operational Security is a commitment. Here is the…
I recently made the mistake of asking folks to thumbs up an email if they wanted me to get back to them on something. Turns out, mail apps make it a royal pain to actually act on that data since it’s always behind a hover. You can’t select all and copy. You can’t use dev tools to inspect the element, since it changes when your mouse goes back to dev tools.
If you’re a Blue Teamer trying to write secure services or secure an organization that does, Threat Driven Software Development is the book you’ve been looking for. This was a deep collaboration between Michael Howard, Sherrod DeGrippo, Shawn Hernan and I - and I’m so excited to be able to get this expertise into the world. What excites me most about this book is that there are…
As a Canadian living in the US: whenever my family and I go back up to Canada, we always pack our luggage to bring back stuff you just can’t find easily around here. I’ve given a few friends these sage words of wisdom when they visit Canada or when their Alaska cruise takes them through Victoria, so here’s your shopping list: Ketchup chips and All-Dressed Chips. You may or may…
Once every 80 years, T Coronae Borealis - also known as the “Blaze Star” - goes nova. When it does this, it brightens from roughly magnitude 9 (likely only visible with telescopes) to magnitude 1 or 2 (roughly as bright as the North Star). NASA has a great explanation of it , as well as how to find it in the night sky. Astronomy.com also has a great and more detailed article .
If you have a Hiboy S2 Pro scooter, you might have explored whether you can increase its max speed above 20 MPH / 30 KPH. There are resources out there mentioning that you can snip a speed limiter wire, but as far as I can tell they are AI-generated make-believe. TLDR : You can’t. The top speed is limited by the scooter firmware. But the BTLE protocol that the app uses to communicate with…
Pixel Doodle is a fun little Pixel Editor for Gameboy, emulators, and retro handhelds like the Anbernic RG35XX.
APL is one of the most curious programming languages you’ll ever run across. For example, take a random problem out of Rosetta Code: “ Numbers divisible by their individual digits, but not by the product of their digits. ”. Here’s a typical implementation in C: #include <stdio.h> int divisible ( int n) { int p = 1 ; int c, d; for (c = n; c; c /= 10 ) { d = c % 10 ; if ( ! d…
I was recently interested in doing some data analysis of a Microsoft Teams transcript - specifically to understand if I was talking too much and not giving other folks the opportunity to speak. If you’ve ever wondered something similar (or wanted to do data analysis for other reasons), you might have seen the option to download meeting transcripts . The default options are docx files (Word…
Postman is an extremely popular application for developers testing remote web APIs. It lets you craft HTTP requests, interact with their responses, and go through the history of what you’ve sent and received. Many of these HTTP requests are authenticated, meaning that the application deals with API keys, login tokens, credentials, etc. In May, Postman pivoted to be a cloud-only product for many of…
Once in a while, I’ll stumble on a question online (or get an email) from a person wondering “Who the heck is leeholm16?” If you’re reading this post, you’re likely one of them :) I never know exactly what situation leads people to ask the question, but they’ve invariably started using a forensic parsing tool against Windows PowerShell.lnk or Windows PowerShell…
If you’re looking to play with the cool Desktop Mode on your shiny new Steam Deck, you might have already seen that it is Arch Linux under the hood. Time to get your favourite shell on there :) Here’s how to get PowerShell running using the community-contributed PowerShell binaries in the Arch User Repository! ## Create a password for root passwd ## Allow pacman to write to the…
Watchy is an exciting Open Source E-Paper Watch, based on Arduino and the ESP32 micro controller. I’ve been a fortunate early backer, and doubly fortunate to have been part of some of the early waves that already have their physical Watchy. The component shortage has impacted the whole industry, and SQFMI is no different. However, the great news is that supply has opened up and SQFMI is…
20 years ago, I decided to put up a “Web Log” - or “blog” for short :) I didn’t know what would become of it, but I’m happy that I started. In the years since, this site has seen a ton of change: Hosted on a FreeBSD server under my desk, blogging via Perl and Bash scripts Once I started working on Encarta (which used an XML-based pipeline), ported to XML and XSL…
I am extremely excited to announce that the 4th edition of the PowerShell Cookbook is now available! Now in its 4th edition, the PowerShell Cookbook is now available from Amazon and other major retailers. The 1st edition of the PowerShell Cookbook came out in 2007 - nearly 14 years ago! It had the single goal of making you immediately effective with PowerShell. While the Cookbook of course dives…
It’s alive! Now in its 3rd edition, the PowerShell Pocket Reference is now available from Amazon and other major retailers. The Pocket Reference series, excerpted from the references of the PowerShell Cookbook, puts concise summaries of all of the information you need about PowerShell on a day-to-day basis right at your fingertips. Want to refresh your memory about how to write a zero-width…
A class of security research out there that is a never-ending source of entertainment is “novel” communication methods. This shows up in many ways in the security industry, including: “Novel” C2 communication channels (DropBox, Telegram, DNS, Instagram comments, …) “Novel” air gap jumping techniques (HDD lights, high-frequency audio, …)…
When optimizing website performance, the performance tools that Google has built are magical. One place I started when working on my site’s revamp was Google’s PageSpeed Insights . After running an analysis on my home page, I saw this warning: Almost a second of my site’s page load time was caused by loading non-critical CSS. You can use the “Coverage” tool in…
When hosting a static website or blog, you ultimately have to tackle the question: “What about the comments?” . Statique provides a simple, self-hosted option.
When working with raw binary data (especially in security forensics), it is common to need to write parsers for this binary data. For example, extracting file contents out of the NTFS data structures on disk. For many common data structures, there are already binary parsers written for them that you can leverage, but you’ll still sometimes need to write your own. BinShred is a PowerShell module…
There are many times in security investigations where we want to quickly filter out “Known Good” and only focus on what remains. Bloom Filters are an excellent way to accomplish this.
If you’re running into the following error trying to get a device to sync with Intune: The sync could not be initiated (0x80190190) You probably have checked the Windows Event Log and also seen this error: MDM Session: OMA-DM message failed to be sent. Result: (Bad request (400).). I recently ran into this situation, and the cause was that I had opted into the Windows 10 default of signing in with…
It’s March 4, 2020. A pandemic grips the world, so you’re working from home. Can you last the month?
The mind is an incredibly complex organ. While all of us attempt to be mostly logical and rational in our day-to-day thought processes and decision making, we are hampered by an enormous number of cognitive biases. Cognitive biases are specific natural tendencies of human thought that often result in irrational decision making, and there are hundreds of them . Everybody has them them and is…
Summary When email users of several email services send mail using mechanisms other than that service’s web interface (i.e.: their phone or laptop’s email program), services commonly include the user’s IP address in message headers. This information disclosure lets recipients of these messages perform some privacy-invasive actions, such as: Approximate geographical location of the sender…
A while back, we talked about a common challenge in the security industry – searching for some known bad content (i.e.: “Invoke-WebRequest”) in content that you know has been encoded in base64 . In a really cool bout of co-discovery, others simultaneously wrote similar implementations . Since then, this approach is now in the process of being integrated into YARA . Very cool times! Another…
If you’re looking to get one of the Star Trek TOS patches (Science, Engineering, or Command) embroidered on something, they often charge a lot of money to convert the logo to the format that embroidery machines understand. Here are version I created in the Brother PES format, as well as in the native format I created it in ( EmbroideryWare STICH ). Command - [ Brother PES ] [ EmbroideryWare STICH…
If you’re looking to get the Dragon Ball Z logo embroidered on something, they often charge a lot of money to convert the logo to the format that embroidery machines understand. Here’s a version I created in the Brother PES format, as well as in the native format I created it in ( EmbroideryWare STICH ). [ Brother PES ] [ EmbroideryWare STICH ]
If you’re looking to get the PowerShell logo embroidered on something, they often charge a lot of money to convert the logo to the format that embroidery machines understand. Here’s a version I created in the Brother PES format, as well as in the native format I created it in ( EmbroideryWare STICH ). [ Brother PES ] [ EmbroideryWare STICH ]
Background In the web application world – especially single-page applications – smooth and fluid interaction is key. For many years, these applications have been doing a pretty good job of getting this fluid interaction though AJAX techniques and browser support for XMLHttpRequest. One issue, however, is that XMLHttpRequest requires that all of your communication go through an text-based HTTP…
In 2003, Crosby and Wallach wrote an excellent paper demonstrating a new form of Denial of Service vulnerability against applications by abusing algorithmic complexity in the data structures that they depend on. For example, some data structures operate quite efficiently when given everyday input, but the performance degrades precipitously in certain edge cases. If an application provides…
After posting Extracting Activity History from PowerShell Process Dumps , I got an interesting follow up question: “Is it possible to extract the content of scripts (from disk) that were executed, even if those files were not captured?” The answer is “Yes”, but it’s also complicated. And to make it even more complicated, we’re going to go down a path showing how to do some of this detective work…
Imagine that you’re investigating the compromise of a system. The system doesn’t have PowerShell Logging enabled , but you did capture a process dump while activity was happening. This memory dump is forensic gold, and the managed code debugging extension for WinDbg (“SOS” – Son of Strike) gives you all the tools you need to mine it. After using File | Open Crash Dump , this is what you see: From…
After it’s done indexing your data, Scour is blazingly fast at local content searches – far faster than Select-String, grep, or anything else that rips through files when you search. It accomplishes this through the power of the popular Lucene search engine. Similar to the way that publishers have made searching physical books fast, Lucene must first create an index of your content before you can…
If you have a large collection of documents (source code or text files), searching them with PowerShell or your favourite code editor can feel like it takes forever. Scour is a PowerShell module that surfaces the Apache Lucene project that can help.
So you’re interested in submitting a talk for a security conference? Awesome! Above all else, what keeps our industry moving forward is the free and open sharing of information. Submitting a talk can be a scary experience, and the process for how talks are evaluated can feel mysterious. So what’s the best way to create a good security conference CFP submission? It’s perhaps best to consider the…
Mandiant recently posted some research about an attack leveraging the NetSupport Remote Access tool . The first stage of this attack uses a lot of obfuscation tricks to try to make reverse engineering more difficult. David Ledbetter and I were chatting about some of the lengths the malware authors went through to obfuscate the content. One of the major sources of complication is a complicated,…
When analyzing text, a common goal is to identify the parts of speech within that text – what parts are nouns? Adjectives? Verbs in their gerund form? This PowerShell module provides an excellent interface to Stanford’s speech tagger.
K-Means clustering is a popular technique to find clusters of data based only on the data itself. This is most commonly applied to data that you can somehow describe as a series of numbers. When you can describe the data points as a series of numbers, K-Means clustering (Lloyd’s Algorithm) takes the following steps: Randomly pick a set of group representatives. Lloyd’s algorithm generally picks…
When you first get your ham radio license, the FCC gives you a random call sign based on your location and roughly your date of application. The resulting call sign is usually pretty impersonal, but the FCC lets you apply for a “vanity” call sign for free . While the rules for these vanity call signs change depending on your license class (Technician, General, Extra), most of the good (shorter)…
You might have run into situations in the past where you’re looking for some specific text or binary sequence, but that content is encoded with Base-64. Base-64 is an incredibly common encoding format in malware, and all kinds of binary obfuscation tools alike. The basic idea behind Base-64 is that it takes arbitrary binary data and encodes it into 64 (naturally) ASCII characters that can be…
Overview We’d like to introduce a new Zero-Tay technique for injecting code and maintaining persistency against common advanced attacker toolkits dubbed TripleAgent. We discovered this by ourselves in our very advanced labs, and are in the process of registering a new vanity domain as we speak. TripleAgent can exploit: Every toolkit version Every toolkit architecture (x86 and x64) Every…
If you host your website in Azure, you might be interested in adding SSL support via Let’s Encrypt . Azure doesn’t offer any functionality to automate this or make it easy, but thankfully there are plenty of useful tools in the PowerShell community to make this easy. ACMESharp - A PowerShell module to interact with Let’s Encrypt. Azure PowerShell - A set of PowerShell modules to…
We sometimes get the question: Why is the SeDebugPrivilege enabled by default in PowerShell? This is enabled by .NET when PowerShell uses the System.Diagnostics.Process class in .NET, which it does for many reasons. One example is the Get-Process cmdlet. Another example is the method it invokes to get the current process PID for the $pid variable. Any .NET application that uses the…
With the advent of PowerShell v5’s awesome new security features , old versions of PowerShell have all of the sudden become much more attractive for attackers and Red Teams. PowerShell Downgrade Attacks There are two ways to do this: Command Line Version Parameter The simplest technique is: PowerShell –Version 2 –Command <…> (or of course any of the –Version abbreviations ). PowerShell.exe itself…
If you’re interested in knowing when specific Visual Studio compiler options have been introduced, here you go. 2003 to 2005 Option Purpose ------ ------- /analyze Enable code analysis. /bigobj Increases the number of addressable sections in an .obj file. /doc Process documentation comments to an XML file. /errorReport Allows you to provide internal compiler error (ICE) information directly…
Time Journal helps you analyze where you spend your time by infrequently asking the simple question: “ What are you doing? ”
Visual Studio Code has a built-in feature to check for and install updates, but I’ve always been frustrated by having to acknowledge the update, allow the browser to restart, watch an installer, and then get back to what I was about to do anyways (which is edit some text). As a solution, here’s a quick little PowerShell script to run. It will create a background task to run every night…
In 1799, Napoleon’s explorers discovered a 4-foot tall, 700 lb stone slab in Rosetta (Rashid), Egypt. Explore its hieroglyphics and their meanings with the Rosetta Stone Explorer.
If you’ve ever been interested in having all of Wikipedia in a plain-text format, you might have been disappointed to learn that Wikipedia doesn’t actually make this format available. This PowerShell script will create a plain-text version of Wikipedia for you.