Home

Week Roundup #3: July 1st - July 7th

Quick roundup of the ~security~ stuff I’ve been working on in the past week!

Best [placeholder] of the Week

Album of the week:

• Travis Scott - Rodeo is just banger after banger, when every song can be an album’s lead single how can you lose

Article of the week:

• Security Engineering at Google: My Interview Study Notes - nolang is a great write up of some of the core technical interview questions that’ll be asked across most security engineer interviews, definitely useful if you’re trying to find areas of weakness to flesh out during interview season

Image of the week:

• Pizza mouth of Bristol
• 

Week Roundup

This was a hectic week both professionally and personally, so unfortunately the throughput for project work was limited this week. I’m hoping to pick this up a little more next week, with a focus on GCP security work to help me understand the nuances of GCP better.

Projects:

• Set up phase 2 of my purple-team home lab

  • Installed ELK stack with Filebeat to manage my Falco logs from GKE Nodes
  • Ingesting just Falco logs currently, began looking at the available GKE logs collected in GCP Log Explorer - not very obvious how to manage these and get them into self-hosted Elastic SIEM!
  • Next phase will likely be to filter security-relevant API server logs from Log Explorer and forward these to Elastic via some Pub/Sub topics
  • Issue faced that I still haven’t resolved is with setting up TLS certificates within ELK - ended up pivoting from fixing this into looking at self-signed TLS certificate attacks… rabbit holes rabbit holes

Articles and Videos

• <paper> Security Issues with Self-Signed SSL Certificates

  • Good overview of the main 2 methods of performing adversary-in-the-middle attacks in networks where self-signed TLS certificates are in use
  • Would be interesting to find similar attack methodologies for abuse in Kubernetes clusters

• <video> Attacking RDP with Seth - Adrian Vollmer

  • Interesting talk on the SETH open-source tool for RDP eavesdropping
  • Don’t really work much with Windows so was nice to understand some of the authentication methods and their vulnerabilities (e.g. pass-the-hash through NTLM and Kerberos)
  • Whole reason I watched this was to better understand attacks against self-signed TLS certificates