INFOSECC

A necessary component to any good cybersecurity program is physical security. Being able to monitor the physical footprint of your facility is important to the integrity of your network and hardware environment. However, some closed-source or otherwise proprietary camera monitoring programs are expensive, clunky, not user-friendly, and sometimes a mix of all three. Even worse, security camera monitoring systems might charge per camera, quickly getting out of hand in terms of cost for larger facilities or those which need a lot of camera coverage. To avoid the hassle we faced with our previous use of a closed-source, Windows-only monitoring system, we switched some time ago to ZoneMinder. Why Zoneminder? Being FOSS fanatics, Justin and I wanted a CCTV program that would run easily on Ubuntu Server. We were also switching away from a Windows-only program that charged us per camera, making it a financial hassle to cover additional sectors of our facility. With ZoneMinder , we can add as m...

One thing I've started to enjoy is picking up on scam calls and wasting as much of the scammers' time as possible. Maybe it's altruism and not wanting that time to be spent successfully scamming vulnerable/gullible people. Maybe it's my white-hattedness wanting to dig as deep as I can to keep others safe. But my desire to figure out this particular scam definitely has something to do with my distaste for people who make their living by scamming other people. The auto warranty scam calls only took me a few rounds to figure out the overall scheme. Here's what I've found out: Make/Model/Year Make and model are fairly irrelevant. As long as you match something up decently, you can keep the scammer's attention. Year is the most crucial thing to get right or wrong, depending on the point in the call. Auto warranty scammers will ask for up to three vehicles if your first two don't "qualify" for the supposed extended warranty. I start out with a modest...

 Dear Organization with a shitty password policy, The year is 2022 and you still haven't learned (from readily-available lists of 600M+ exposed passwords , other companies' breaches, and your own recent breach ) that your password policy is a dried-up, crunchy, desiccated piece of suburban-backyard dogshit. The year is 2022 and you're still using short passwords that expire soon after being set. You insist on 8-character passwords that expire every 30-90 days because you can't trust your employees and/or customers to be responsible adults. You insist on 8-character passwords that expire every 30-90 days, and your end users hate your IT department and the computing environment as a whole for this one simple reason. They have to keep changing their weaksauce passwords before they can commit them to memory. And when a botnet invariably cracks one of your user's passwords in under 24 hours, your end user has to change it again... if you even have any logging detection s...