Grey screen starting Lightroom problem

Veröffentlicht am von
Antworten

If you see above grey screen after starting Lightroom Classic, there might be some pointers what to do.

Try to re-install

The first attempt to solve the problem should be to re-install the software.

Log file

Have a look at the following log file

~/Library/Application Support/Adobe/Lightroom CC/lrcc_console.log

In my case the following error showed up:

ERROR: Failed to create directory (/Users/foobar/Library/Application Support/Adobe/CameraRaw/), errno 2, parent directory (/Users/foobar/Library/Application Support/Adobe/) has permissions 40755
*** GPU Error: Cannot get GPU Host App directory ***
2023-07-05 09:17:39.902 Adobe Lightroom[5676:61231] initializing Camera Raw: dng_error_unknown
0: global error - C
1: [unnamed] - 1250880549:121+7
2: [unnamed] - C
3: global pcall - C

Solution was to remove the Adobe folder in „~/Library/Application Support/“ and re-install. The problem was gone.

Happy editing.

vlc.zip

Veröffentlicht am von
Antworten

You are very likely visiting that site because you typed vlc.zip somewhere. Similar to setup.zip I registered the domain to prevent harm to users.

In the ever-evolving landscape of the internet, staying ahead of malicious actors and protecting users from potential threats is of paramount importance. To combat the risks associated with hosting malicious content related to VLC media player, have taken a commendable step by launching VLC.zip—a domain specifically designed to safeguard users from potential security vulnerabilities. With the recent introduction of .zip as a new top-level domain (TLD) a potential risk was introduced.

Preventing Malicious Intent and Impersonation

The introduction of VLC.zip not only serves as a protective measure against malicious hosting but also acts as a deterrent for impersonation attempts. Cybercriminals often exploit well-known software names to deceive users into downloading harmful files or falling victim to phishing attacks. VLC.zip also redirecting to this blogpost improves awareness.

What can you do? Talk to your sysadmin and consider to block the toplevel domain .zip. Install a AV software and keep all your software up to date.

setup.zip

Veröffentlicht am von
25

The internet has seen a lot of changes in recent years, and one of the most significant changes has been the introduction of new top-level domains (TLDs). These new TLDs have opened up a whole new world of possibilities for website owners, but they have also created new challenges, particularly in terms of protecting users from malicious actors. One of the newest TLDs is .zip, and in this blog post, we’ll discuss how to register a .zip domain and set it up to protect users from malicious actors.

First, it’s important to understand what a TLD is. A top-level domain is the part of a domain name that comes after the final dot, such as „.com“ or „.org“. Traditionally, there have been a limited number of TLDs available, but in recent years, ICANN (the organization responsible for managing the internet’s domain name system) has been introducing new TLDs to increase choice and competition.

The .zip TLD is one of the newest TLDs, and it’s designed specifically for websites that deal with compressed files. The idea is that by using a .zip domain, website owners can signal to users that their site is a trustworthy source of compressed files.

In May 2023, Google wrote a blogpost about the newest toplevel domains:

  • .dad
  • .esq
  • .prof
  • .phd
  • .nexus
  • .foo
  • .zip
  • .mov

Especially the .zip can cause problems. That is why I went ahead and registered „setup.zip“ assuming it is part of many typos and pages. This blog will be the redirect destination for everyone attempting to access „setup.zip“ if you have other good research ideas what to do with the domain, reach out via twitter on @alexanderjaeger.

Recommendation: curate a list of speaking engagements

Veröffentlicht am von
Antworten

Something I learned from HalvarFlake in 2019 that it can be quite painful to remember what conference one spoke in the past.

Giving a talk at a conference, event or appearing on a podcast is a big service for the community, who can learn from your experience. At the same time it is a testament to your impact and something to be proud of. It is cool to look back where you spoke 5 years ago and what topics you found relevant back then.

Such a list can be useful when trying to get a new job or to get more attention from hiring managers. It can serve to show your expertise in a specific field. Last but not least it can help future program committees in a paper review process to see your speaking abilities (if the review is not done blindly).

It also can prevent or reduce the risk of burnout. Seeing how much you spoke in the past gives you the ability to reflect the workload, additional workload added by preparing a talk which is usually forgotten when agreeing to speak. If you felt comfortable giving 5 talks a year, you might be well off giving 6. Agreeing on 15 however might be a big step up and should be done very carefully.

Since then I capture my speaking at a page of my page. I recommend you do the same every 6 months.

Items I recommend to capture:

  • Date of talk / podcast
  • Conference title
  • Talk title
  • Link to slides if available
  • Link to a recording if available
  • Link to blogpost from others covering your talk

#FIRSTCTI22 FIRST CTI Event Berlin 2022 Review

Veröffentlicht am von
Antworten

It is November 9th 2022 and I had a few days to digest and think about the FIRST CTI event taking place in Berlin from 2022-11-01 to 2022-11-03.

You can find more direct feedback and impressions on Twitter with the hashtag #FIRSTCTI22 where I also shared stuff.

The program is published at https://www.first.org/events/symposium/berlin2022/program. So let’s dive into my thoughts.

To give some context, I participated in the first FIRST CTI, called FIRST Technical Colloquium on Threat Intelligence, hosted by Siemens in 2016. Back then the topic was very new (remember STIX/CybOX, Mantis). But some topics were relevant already back then like how to operationalize Threat Intelligence and how to evaluate information. It was great then and I was excited to see what has changed since then.

Training

As I only arrived on Tuesday, I had to skip the trainings, but I was able to talk to participants with mixed impression, which is no surprise given the different roles / background of the participants (more on that later) so I hope many of them provide feedback to the event team so they can extract the right learnings on which training is best suited for the audience.

Wednesday

I had the honor to moderate the Wednesday, so while I was able to hear all talks, I had to also focus on logistics, take time and have some questions ready for the speakers. To my surprise the audience did not take that much advantage of the fact that we were all in one room and asked very few questions. Maybe this is something which we need to re-learn after the pandemic?

I really liked the talk from James Chappell „Ten Years of Cyber Threat Intelligence: Retrospectives“. It was a perfect entry and set the stage for the two following days and for sure James is a veteran in the field, so there were several observations that stuck with me.

Next up was another highlight for me: „Crossing the Cyber Sad Gap“ from Jake Nicastro. Jake went into the risk of our jobs and how it can affect the mental health and offered some points to take home and address in your team, very eye opening and I am sad that this talk will not be made available to the public.

Another thing I want to highlight is the mixture at the event between practitioners and academia, Clemens Sauerwein from the University of Innsbruck, Department of Computer Science, AT presented on stage and there were several delegates who were really interested in conversation with industry and public sector people.

Obviously I was nervous giving my own talk together with tomchop, but I think it went really well.

Overall Wednesday was a really pleasant mixture of topics.

Audience

Overall the audience was a little over 330 delegates. From conversations I would assume around 40 % with a DFIR background, 40 % from CTI related roles and 20 % either a mixture or something else, but I guess the organizers have better stats on this.

The size of the audience felt ideal for me as well. There were enough people to run into random people to start a conversation but it was not too large to get lost, I think sub 400 is ideal.

There were delegates from all kinds of regions, with a majority coming from Europe, which is not a surprise given the event location. To build a reputation I would like to see the event happen again in Berlin, if there is demand to have something similar in other regions like AMER or APAC, I would suggest building local forks vs. Rotating over the planet like FIRST does for the annual conference. That should also make it easier for the planning team to figure out logistics, but again is my personal opinion and there are also advantages for changing locations.

Length

Personally I prefer events under three days. Longer events make me tired and come with too much social toll for me. Two days still enable follow up and enough opportunities to have conversations going a little deeper then „hey my name is John Doe, I work at XYZ, nice to meet you“ and then never see that person again.

Thursday

Started with another excellent talk about the human aspect of our industry „Why Your Security Analysts Are Leaving and What You Can Do to Retain Them“ by Thomas Kinsella, I highly recommend this talk.

I skipped one talk that was pre-recorded and instead spent my time networking with delegates, as I hope to see the talk afterwards on YouTube instead.

It is always nice to see new tools announced at events, same here, when „ORKL: Building an Archive for Threat Intelligence History“ was covered by Robert Haist. Solid talk and I recommend checking out the project web page and reaching out to Robert if you want to help the project.

The rest of the talks were all solid but I do not want to bother you with all my thoughts, I have provided feedback to the events team and I recommend you doing the same (check your mails for the survey).

The program committee did an excellent job setting up a program that catered for technical and strategic folks. Kudos: @thomasschreck_ , @adulau , @asfakian, James Chappell and Dr. Morton Swimmer.

Dinner

An important aspect of such events for me is to meet with old friends but also make new connections and introduce new people to the community. This time I tried to execute something I learned from Kate.

I made (or asked someone to make one) reservation in a restaurant nearby for 6-8 people, asked 2-4 people I already know and want to see again and added people I wanted to meet for a long time and or folks who asked to be introduced.

The result: a great combination of nice food, excellent group sizes to have different topics to talk about but not too large that it would go nowhere or someone would feel lost (at least I hope).

The absolute highlight for me was going to C-Base, if you have never heard about it, make sure to check it out, I will not spoil it here. Thanks Y.W. For your hospitality my friend.

Wish

If I had one wish for the future of that event, I would hope to have a more diverse audience and speakers. We as the community need to push more and improve.

Disclaimer

I have not been involved in the planning of the event other than setting a draft budget in November / December 2021 as part of the normal FIRST budgeting process. And above is purely my personal opinion on things.

Photocredit: Kamil Bojarski

Practical Doomsday: A User’s Guide to the End of the World

Veröffentlicht am von
Antworten

I have posted about this book a couple of times on Twitter before I realized I should just write down my thoughts.

TLDR: The book of Michael Zalwski is worth a read. It does not over hype the topic and does not try to fuel fear but bring attention to topics that are realistic to prepare a plan for.

The book starts with an introduction to risk, goes into setting boundaries to fictional scenarios and goes over some realistic cases that are more likely to happen.

Part II then goes into practical tips, especially by starting with a “rainy-day find”. While that is not possible for everyone, every following topic might be even harder to achieve. The section about “Getting in shape” greatly reminds me of the movie Zombieland rule #1 “#1: Cardio – When the virus struck, for obvious reasons, the first ones to go were the fatties.”.

Because this is not the first book about the topic, the third part, while not completely new, I would still consider it a good collection of achievable things one can do and should consider and follows an order of importance, starting with water.

The last part “Active self-defense” was the least interesting for me, but again, the author put enough disclaimer to it that there might be ways to avoid situations where you e.g. would need a firearm.

You can tell that the author has not only spent considerable time researching the topic but also applied various techniques in real life. If you only want to read one book and have already read and implemented the guidelines governments usually publish to their citizens to be prepared for emergencies, this book is good from a content perspective as well as easy to read and digest and implement.

Recommendation: If you are going to buy the book, maybe buy the hardcover, you do not want your disaster plan to be dependent on an electronic device, do you?

(The link above is an Amazon partner link)

You can also read a preview chapter at: https://lcamtuf.coredump.cx/prep/preview

API of the month: MISP

Veröffentlicht am von
Antworten

MISP is a very well known tool in the infosec community that enables individuals and teams to work and share indicators and other case relevant information.

The MISP API comes for free with every MISP installation of the free and open source software, so if you want to try it out, go for it. There are various install guides for MISP.

Once your MISP instance is up and running, you can head over to the MISP API documentation.

Search

Among all endpoints I did use the Search endpoint the most. This endpoint can be used to search all your MISP data. You can either just pass a string and search everything, or you filter by dedicates types. The query can be as complicated as you want it to be. Be careful with just value searches, depending on your data size, the requests might take a while to complete.

Get events

Another very useful thing after your searched is then pull the events that matched your search. This can be helpful to provide more context to analysts who started the search.

PyMisp

When writing about the MISP API, it is important to mention pyMISP, the Python library to access the MISP REST API. It is maintained by the same people behind MISP, so it is kind of a reference implementation of the API and is very easy to use.

Target audience

The target audience for the MISP API is researchers, students, DFIR professionals and everyone who has a need to store and query structured data around events.

More

Want to find more Security APIs? Go and visit my repository: https://github.com/jaegeral/security-apis

API of the month: api.first.org

Veröffentlicht am von
Antworten

Description

The Forum of Incident Response and Security teams (FIRST) offers an API to a subset of their database exposing teams.

„The Teams public information (available at http://www.first.org/members/teams) is available for querying using the method/data model /teams. This is the available endpoint for this data source:“

FIRST API screenshot

Pricing

The API is free and comes at no charge.

Signing up for the

Example 1

As an example, I have a script that can be a subroutine of an abuse handling process where the input is the name of the organisation an IP belongs to (based on Whois) the script is tasked to find a suitable responsible party who can deal with abuse handling.

Example 2

Second example, the input is a country, that might be revealed by using whois data for a particular IP, triaging the source to a specific country. The lookup should return a suitable national incident response team to assist in abuse handling.

Target audience

  • Incident responders who want to automate notification or lookup of peer teams
  • abuse handlers to lookup responsible CERT / CSIRTs or national Incident Response teams

Let’s talk about time – in a different blog

Veröffentlicht am von
Antworten

I wrote a blogpost, but in a different blog that I however wanted to link to. It is a blog that is maintained by a bunch of open source digital forensics incident response people some of which are my current team mates.

The blogpost is about Time. More specific on some general ideas and concepts around time. It then goes on to explain how time is relevant in IT and why it is important in digital forensics. It also contains some recommendations that everyone can (and should) apply.

Here is a except of the goal of the blog post:

Goal
This article explains the importance and challenges of time in digital forensics and incident response. You will learn how time is handled in various open source tools and get practical tips on managing time in your environment.

Are you curious: go over to: https://osdfir.blogspot.com/2021/06/lets-talk-about-time.html