Everyone, including myself, is working from home now. We're using meeting apps like Zoom. Assuming the meeting app's communication is insecure (like how Zoom is lacking on E2E encryption), what would you use to make the Zoom app's communication more secured?
My 1st thought is to have the company/university host a VPN server.
I have kind of a hard time finding a good guide for securing my PC. Most of the posts I find are rather basic and/or use common sense. I wanna try doing some more hardcore blue team stuff on my PC. I've learned about Snort so far and I'm using firejail on most apps. Any tips?
I would use Tor but my WiFi is already hellishly slow...
So imagine you have a server inside your home network that is not accessible outside. You can use a VPN to connect to your home network and act as if you were home
@MechMK1 Sorry, I'm slow today. Here's the article my wife and I were talking about that made me angry. Now that I think about it though, I really wish I did have drones floating around outside my house to monitor me 24/7 and yell at me to go back inside... Letting my dog go to the bathroom inside shouldn't be a big deal at all! It's really a shame that we're not as cool as China :(
@JohnZhau I think you're off to a good start, but a bit more specificity to answer schroeder's question wouldn't hurt. Are you worried about zoom seeing your meeting contents? About external actors "hacking" your feed and jumping into your meeting? Etc...
TBH my meetings don't really involve sensitive information and usually only the lecturer talks so there's not much to worry about. However, I was considering how many have their meetings flying around unencrypted.
Well, it's still a matter of principle. I'm not doing anything sensitive right now, but if someone crawled up the wall and insisted on staring into my apartment through my windows, I'd feel creeped out
I'm usually a track of all trades type. I like learning lots of different stuff, from networking and binary exploit to lock picking and electronics. Do you often have such types on your team or is it mostly people specializing in a few things?
We have both. We have people that want to try everything, and we have people who are like "Reverse Engineering is what I do. I eat, I sleep, I reverse."
Conferences can be dope, especially if you're like 40 minutes in and the guy says a joke so incredibly offensive that your first reaction is "holy shit!" and your second reaction is to look around who is offended the most.
And then you return to listening to a guy speak about microprocessor architectures
If you start out from User reports that there is ransomware you will need to verify that they didn't just get a pop up while browsing the internet, or an extortion email
@MechMK1 that's not quite the whole picture. The reality is that NHS staff have always been able to refuse to treat non-critical patients who are aggressive or physically violent. Now harassment, bullying and discrimination are included.
This does not include critically ill patients (probably because they can't be violent, aggressive or harassing)
And it's about time - I'm very happy they have brought this in
My wife is a nurse - used to by in Cardiothoracic ITU - and even there they had patients who would try to attack staff, spitting on them, swearing at them etc
@RoryAlsop I think it's a step in the wrong direction. Sure, I think it's absolutely wrong from people to act violent or aggressive, especially if they then expect that person to help them
@RoryAlsop I've worked in a hospital. Some patients can truly be...difficult
Especially those who suffer from substance withdrawal
My wife is a nurse - she had many years in cardiothoracic intensive care wards, some in psych, some in more general wards. The number of times she and colleagues suffered attacks and bullying is horrific. If people harass her or other staff I'm more than happy they get booted out the door
@MechMK1 A service that will provide care that is free at point of need to all is great, but not if you want to attack those providing it. That, in my mind, is the attackers way of saying they don't want care
Has anyone done testing of a client app's SSL cert verification?
There's a few scenarios I'm struggling to test
e.g. I want to set up a server that returns a chain of two certs, where both are self-signed
can't figure how to get openssl s_server to return two certs
The scenario I really want to try is a chain of (1) A valid, root-signed leaf certificate and (2) A certificate for the correct CN, signed by the leaf certificate