TheJulyPlot

@MechMK1 a better example would be Dehashed, which shows you the details of the breaches.

so up to CC data is possible..if not the set intent of the intel provider

in fact.....if someone is selling CC details on a crime forum and posts a sample that sample may be collected by a crawler.

no not CC details, but email addrs, hashed passwords, cleartext passwords

@MechMK1 is handling this data effectively handling stolen goods?

@MechMK1 yes this is what I am wondering. There a number of vendors that already do offer a service that does this.

potentially very sensitive PII

@MechMK1 yeah all of that.

@m

collecting data dumps parsing it and indexing it

I asked the question on the board: security.stackexchange.com/questions/254592/…

so who would be the owner? Linkedin lost a lot of data, this has been dumped. Linkedin is the controller. Say I collect the data as part of threat intel gathering. Do I become the controller, or am I now effectively in possession of stolen goods?

if we parse the data..even if it isn't ours would have not become processes of that data at that point anyway? "processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller."

maybe one for a question the board

Looking at this I do not think if the data is public or not impacts the definition of what is 'personal data' ico.org.uk/for-organisations/guide-to-data-protection/…

"‘[P]ersonal data’ means any information relating to an identified or identifiable natural person (‘data subject’)."

I suppose it comes down to "if PII is public is it still covered under GDPR?"

For example, systems that parse breach data so you can detect if your org has been exposed. Does GPDR make this difficult to do?

Has anyone considered how GDPR impacts the collection and indexing data breaches for the purposes of Threat Intelligence?

Hello everyone.

wait, it may have been this, and it may require SCCM...docs.microsoft.com/en-us/sccm/core/clients/manage/…

Does anyone know if windows has a RDP client that does not lock the remote machine? I am sure I used one a few years back, it looked like a native windows app (the UI was the same, when in view mode the bar would turn green.), but I cant seem to find it via searching.

@TomK. No not a student, that link looks to cover it. Thanks.

I am about to purchase the ISO27001/27002 standards, the ISO website has them catalogued as ISO/IEC 27001:2013 and ISO/IEC 27002:2013, when I go to purchase they say I can also buy them from the BSI store. The BSI have them catalogued as BS EN ISO/IEC 27001:2017 and BS EN ISO/IEC 27002:2017. Is there any substantive difference between the text of the standard between the ISO version and the BSI version?

mmm, okay that makes sense.

@forest yeah, but would it not at be consistently outdated across whois results?

mmm…Why would whois give me two different results for the same domain when called via a website? (who.is and Virus Total) Could one be down to historical information?

@Anders This is fantastic!

Security architect

to ensure that security considerations have been taken into account

no this is really to inform a change board

@TomK. It would be a checklist/Q&A that they complete in advance of a contract being signed. It is really to provide a level of due diligence and to infom decision making.

Also pen testing and sec creds.

Also I don’t think this really fits the format for a full question as it is opinion based and very broad on SE.infosec? If any of the mods/longtimers disagree I’ll ask it as a proper question.

If I was to audit a webapp plugin vendor in advance of using their service what things should I be asking about? I’ve got permission, encryption, patching process, on-going support, client side scripts, code execution, webapp server code execution. Also if they scrape any of my webapps data, who their security contact is, how they notify of a breach, etc. Have I missed anything obvious?

Does anyone have any experience dealing with the “Chinese Azure”? Specifically accessing it from outside China?

Question: Is it reasonable to expect a SaaS vendor to give an customer organisation a copy of their data on request?

Password stealing from browser PoC exploit: twitter.com/misc0110/status/948706387491786752

@M'vy Ahh I see, thanks for that. (also looks like there is a JS exploit out that can steal creds from chrome and firefox)

@M'vy I read this quote from an threat intel sharing platform “This is an information disclosure vulnerability, for example retrieving data from memory. It is NOT a remote code execution vulnerability - you cannot use this to run malware.” Im not sure how accurate that is however.

@M'vy I think it impacts some AMD and ARM processers as well. I was asked the question if internet facing servers should be patched as a matter of priority, from what I can tell you need to have some access on the target before you could exploit this vulnerability. I just wanted to confirm that assertion.

Does anyone know if there is a network based attack vector for Meltdown? from looks of it, the attack vector looks local only? kb.cert.org/vuls/id/584653

@RoryAlsop Awesome, ill do that now.

@RoryAlsop What is the best way to register interest, just keep eye on twitter and the blog?

changed mouse button mode and disabled xterm mouse reporting

fixed itr

oh never mind

Is there a way to stop putty automatically pasting/echoing all text in in the terminal when you paste it? (note im using Royal TS with putty)

Hi All, does anyone know if 2 x Windows Server Essentials can run as Multi-Master Domain Controllers? from looking at the documentation, it appears as if it doesnt? But ive seen some suggestions that it is possible under certain conditions.

Hi all I was wondering if someone could answer a quick question for me, when I run “ls -la” on particular directory all the files have a number at the start of their listing,. I.e “4 -rw-r--r--”, what does that number mean? In this example the number 4.