Th3 S3cr3t Ag3nt

Improving your password game. Many companies around the world are settling into a future where most people work from home, at least for a while. Working from home comes with many benefits, but there are downsides from a security point of view. Most modern enterprises have spent significant chunks of their security budget on securing their perimeter. Sure everything is moving to the cloud and most of the workforce has been mobile for some time, but many IT departments still rely on people either physically coming into the office or using VPN. Without this patches cannot to be pushed to machines, updates cannot be applied, and perimeter IPS and IDS systems cannot pick up connections to C2 and malicious URLs that traditional AV missed. When it comes to security, most enterprises aren't set up for people to work outside the wire for sustained periods. What are the risks of working outside the wire? The chances are that when your employees are working from home, the only thing protectin...

Zip bombs aren't new. Since the days of bulletin board systems people have been highly compressing implausibly large files and transferring them to target machines to consume resources. Machines these days can handle much larger files and have ever larger amounts of RAM to process them, but zip bombs can still be very useful to an attacker in bypassing weak antivirus or filling up poorly protected servers. Some antivirus software will try to expand the zip file to scan it, using a lot of resources. Others don't try to expand huge files and simply let them through. Either of these options don't really protect us. There was a zip file going around a year or two ago called 42.zip which expands to about 4.5PB. It's good, but can we do better? The most efficient thing to compress is a string of 00000000's. So let's start with a GB of nothing. dd if=/dev/zero bs=1024 count=1048576  And less squeeze that as much as possible dd if=/dev/z...