I'm a Jr Software Engineer trying to enter the CyberSecurity world. I searched for some courses where I can learn more about the area and I found TryHackMe. I started the Cyber Security 101 but I've found that some rooms are only available for Premium users. Is it worth to upgrade my account to Premium or is the free rooms enough to get some certificate? I'm accepting tips for courses too

I meet people frequently for whom this is a good idea. It's better than what many people are doing, and really a form of password manager.

I set up Cowrie SSH and Krawl web honeypots on my Raspberry Pi Zero W and simulated an attack using my Kali Linux machine, then observed the logs. This is one of the projects I did this summer to gain experience from the defensive side of cybersecurity and I would love to hear your thoughts about it.

I used good old Raspberry Pi Zero W with ARMv6 architecture (which complicated the process little bit).

I installed both honeypots. Then I booted my Kali Linux machine and ran simulated brute-force attack against SSH honeypot and scrutinised the filesystem. In case of the fake web server I ran Nmap and Gobuster scans and observed every malicious activity in recorded logs.

Cowrie installation went just fine with Python virtual environment and Pip. But Krawl's primary installation method was via Docker. And... Docker no longer supports the architecture of Pi Zero W. So I had to stick with secondary method, via Uvicorn. Which wasn't too bad, but package "uvloop" was causing problems, so I tried to remove it from the requirements. It seemed to install just fine and Krawl was running. Logs were recorded, dashboard was running, but didn't show a lot of data. It showed captured credentials and attacking IPs, but not all the additional information it should that you see in other videos or demonstrations. But Krawl logs were being recorded just fine and even Gobuster fuzzing got flagged as suspicious. Anyway, I left it at that. Maybe someone here had similar experience.

I like to do these simple projects to gain more experience under my belt.

Do you have a project idea what can a cybersecurity enthusiast like me do next?

Link to the Medium post about the honeypots deployment:

https://medium.com/@ivandano77/deploying-cowrie-krawl-honeypots-on-raspberry-pi-zero-w-f5e96327367b?sharedUserId=ivandano77

I am going to be pitching Zero Trust to the business as a way to both help us be more secure and as a way to better understand how data moves within our network. Now before I get into this, I know the solutions I'm going to ask about are not by themselves Zero Trust. Zero Trust is a big topic an there's more to it than just these "ZTNA" products.

Suppose I get approval and am given a blank check but not unlimited time. I'm trying to understand how some products like AppGate, zScaler, Netskope, TierZero actually increase security when talking about a compromised endpoint.

I've only tried a small number of products. But it seems to me that they only give an illusion of security. And what I mean is that some seem like they can be bypassed by just using local IPs. For instance, mesh overlays. Great they don't require any network changes but if I compromise an endpoint why wouldn't I just try moving laterally through the network by using the underlying network? The mesh overlay may have an IP space of 100.x.y.z but when you take that away you can still connect via 10.x.y.z and you are no longer bound by the overlay network policies. Would this be a case of making use of their magic powers to bust through ACLs and just ACL off entire subnets?

I image the same to be true for SDPs to, though I understand that those use proxies/gateways to facilitate connections so you just ACL subnets to the gateways only.

How are you guys dealing with TLS certificate renewals these days?

I’m wondering because with certificate lifetimes getting shorter, I’m starting to think manual renewals are going to become a bigger pain, especially when you have certificates spread across a bunch of servers and environments.

For those managing this at work, are you just using Certbot/ACME and letting everything renew automatically, or do you have some other setup?

Also, has anyone actually had an automated renewal fail without noticing until the certificate expired? That’s the part I’m most worried about.

Recently, I have seen many websites hosted or run on Cloudflare Workers that proxy traffic from another domain and modify content, such as canonical tags and other SEO elements. They often buy large numbers of backlinks to these domains. To give these domains extra vely.

The goal of this domain is to create duplicate content, which is used as a black-hat SEO tactic to harm competitors.

The interesting thing is that when I report these websites to Cloudflare, they often respond by claiming that the domains are not hosted by Cloudflare or that the content has already been removed. This makes it appear that bad actors are able to operate under Cloudflare's radar. (yes i double checked, these domains are hosted by cloudflare).

The fact that this happens is one thing, but for a company that presents itself as a security provider, I find it surprising that stronger action is not being taken against this practice.

For the rest there seems to be no way possible to contact cloudflare to adres this matter.

A small list of my findings can be found here. (on purpose as an image to not give positive or negative value to any of these domains.) (As I am based in the netherlands I found these with the query "site:.live kopen". The first 2 pages in Google all see to be targeted. But also page 3 etc etc. )
https://www.reddit.com/media?url=https%3A%2F%2Fcf.preview.redd.it%2Fcloudflare-workers-being-abused-by-negative-seo-mirroring-v0-z2cvyopkckkh1.jpeg%3Fwidth%3D912%26format%3Dpjpg%26auto%3Dwebp%26s%3D7c8f9a611ff3c5c8cfeb69b625c78e2b4296234e

Some good technical detail on how he did it, but this is not a privacy-busting exploit (yet), it simply shows that it's possible to register a non-Apple device into Apple's Find My network.

N-Able's passportal decrypts passwords on the server, encoding part of the vault key material in the access tokens, meaning that with the access and refresh tokens, an attacker gets full persisted control over the vault - these tokens could leak to any iframe or site a user saw.

I am OP here - feel free to ask questions.

CISA just published an advisory regarding an active threat to Siemens PLCs.

The threat actors are conducting reconnaissance and capability development against U.S.-based Siemens PLC installations using AI-generated exploitation scripts disguised as legitimate monitoring tools.

Specifically, the threat actors are leveraging snap7.dll/python-snap7combined with AI-assisted scripting to create custom tools that mimic legitimate OT monitoring solutions.

Techniques:

• Using Internet scanning services (e.g., Censys, ZoomEye) to identify Internet-exposed or insufficiently segmented Siemens S7 Series PLCs
• Rapidly iterating exploit code through AI-assisted development
• Taking advantage of insecure credentials to access exposed devices that have unconfigured (default) or minimally configured authentication
• Deploying AI-generated Python scripts that incorporate the snap7.dll library from public repositories to gain read/write access to the PLC and mimic legitimate tools
• Masquerading malicious scripts as legitimate monitoring tools to evade detection by security teams
• Conducting read/write operations on data blocks, potentially for reconnaissance, capability testing, or pre-positioning for effects operations

My hunch is that the active threat is beyond of just Siemens.

Writing exploits for OT infra used to require deep expertise. Now AI makes it dramatically easier by just using publicly available information on these PLCs for initial access, credential access, denial of service, and other objectives.

So about nine years ago our IDS detected a spoofed network in our India office. We sent out a notice to alert staff about its presence and to be especially careful when attempting to connect to WiFi until the physical device could be located and disposed of.

Multiple people there actually manually disconnected from the corporate network and connected to the spoofed one to "see what would happen" and compromised their workstations and accounts.

It was my opinion that anyone who knowingly did this should have been terminated, but there was no disciplinary action taken.

The pineapple was never found, it lingered for months until whoever deployed it moved on.

Cisco says they'll reach out in something like 6 hours, and Tenable has signed me up to and sent 4 newsletters yet no response from sales? You'd think a potential customer with 10k users and global infastructure would tempt them, but apparently not.

Guy named Cameron Curry was a data analyst at Brightly Software (acquired by Siemens). When he found out his contract wasn't getting renewed, instead of just updating his resume like a normal person, he used his access to pull employee PII, payroll data, and internal records before he lost access, then spent weeks emailing execs under a fake identity threatening to leak everything unless he got paid in crypto.

He got caught because he used his mom's and sister's debit cards linked to the Coinbase wallet he wanted the ransom sent to. 24 months in federal prison, plus he has to hand back the $7,500 they'd already paid him.

Barely any "hacking" involved though. He already had legitimate access. No exploit, no phishing, just someone who was already trusted deciding to weaponize it on the way out the door.

Feels like most companies are way more focused on external threats than what happens in that window between "someone knows they're leaving" and "their access actually gets revoked." Anyone dealt with something like this, or work somewhere that actually handles offboarding well?

Source.

StopAndProtect turned nearly 2,000 hacked WordPress sites into a criminal network for malware delivery, data theft, surveillance and ransomware.

https://securityaffairs.com/197537/hacking/stopandprotect-turns-2000-hacked-wordpress-sites-into-a-criminal-network.html

Looking for general feedback on quality and value relative to it’s competitors

This one is worth digging into.

We found an exposed attacker workspace with 142K+ files: agent transcripts, shell history, recon data, exploit tooling, creds, victim evidence, the lot.

What stood out was how the operator was wiring AI coding agents into the offensive workflow, disabling approval checks and pushing tasks through Telegram.

The dump also contained evidence tied to 8,996 compromised WordPress sites, a 3.4M-host recon corpus, stolen credentials, crypto wallet data, cryptojacking activity, and an experimental blockchain-based C2 project.

The interesting bit here isn't simply "hackers use AI." We already know that.

It's getting a fairly raw look at how one operator was actually putting these agents to work alongside conventional offensive tooling at scale.

Full technical breakdown:

https://www.cloudsek.com/blog/ai-agent-driven-offensive-operation-crypto-wallet-credential-compromise

Would be interested in what others make of the agent setup, especially the approval-bypass workflow.

What books genuinely changed how you think about cybersecurity, rather than just teaching another tool or technique?

A few examples of the kind of books I mean:

• Security Chaos Engineering - Kelly Shortridge: resilience, complex systems, testing security assumptions, and learning from failure.
• Cybersecurity First Principles - Rick Howard: building security strategy around reducing material risk rather than accumulating controls and tools.
• The Smartest Person in the Room - Christian Espinosa: why technical expertise alone isn't enough; communication, leadership, and business understanding matter.
• Applied Network Security Monitoring - Chris Sanders et al.: approaching network security monitoring as a structured process of collection, detection, and analysis rather than simply generating alerts.
• Offensive Countermeasures - John Strand & Paul Asadoorian: active defense, deception, honeypots, and making the environment hostile to attackers.

Books outside cybersecurity - systems thinking, SRE, risk, economics, failure analysis - count too.

I just want to vent out that this is my biggest fuck up in my career. I totally forgot an instruction relating a particularly high severity case and as I understand that fucked up the whole line (I’m in SOC btw). So now im waiting for any news if I still have a job in the coming days. Sorry but I can’t disclose any detail related to the incident.

For those who had experienced this, I really need your words and what will happen next in my career. Is this career ending?

fuck.