Lmst

Cláudio Silva boosted:

I have 2 free ticket codes for #PsDayUK

Anybody fancy some PowerShell learning in London?

Get in touch.

#Pwsh #PowerShell #learning #IT
---
RT @psdayuk
--- Your PSDayUK 2023 Speakers ---

📢@sqldbawithbeard
🎬'Sampler- Taking your Module development and deployment a step further'

⏩🎫https://synedgy.com/psdayuk 🎫⏪

#PowerShell #PSDayUK #UK #London #IT
https://twitter.com/psdayuk/status/1622867761180336130

Cláudio Silva boosted:

Many of you have been asking for my thoughts on the #LastPass breach, and I apologize that I'm a couple days late delivering.

Apart from all of the other commentary out there, here's what you need to know from a #password cracker's perspective!

Your vault is encrypted with #AES256 using a key that is derived from your master password, which is hashed using a minimum of 100,100 rounds of PBKDF2-HMAC-SHA256 (can be configured to use more rounds, but most people don't). #PBKDF2 is the minimum acceptable standard in key derivation functions (KDFs); it is compute-hard only and fits entirely within registers, so it is highly amenable to acceleration. However, it is the only #KDF that is FIPS/NIST approved, so it's the best (or only) KDF available to many applications. So while there are LOTS of things wrong with LastPass, key derivation isn't necessarily one of them.

Using #Hashcat with the top-of-the-line RTX 4090, you can crack PBKDF2-HMAC-SHA256 with 100,100 rounds at about 88 KH/s. At this speed an attacker could test ~7.6 billion passwords per day, which may sound like a lot, but it really isn't. By comparison, the same GPU can test Windows NT hashes at a rate of 288.5 GH/s, or ~25 quadrillion passwords per day. So while LastPass's hashing is nearly two orders of magnitude faster than the < 10 KH/s that I recommend, it's still more than 3 million times slower than cracking Windows/Active Directory passwords. In practice, it would take you about 3.25 hours to run through rockyou.txt + best64.rule, and a little under two months to exhaust rockyou.txt + rockyou-30000.rule.

Keep in mind these are the speeds for cracking a single vault; for an attacker to achieve this speed, they would have to single out your vault and dedicate their resources to cracking only your vault. If they're trying 1,000 vaults simultaneously, the speed would drop to just 88 H/s. With 1 million vaults, the speed drops to an abysmal 0.088 H/s, or 11.4 seconds to test just one password. Practically speaking, what this means is the attackers will target four groups of users:

1. users for which they have previously-compromised passwords (password reuse, credential stuffing)
2. users with laughably weak master passwords (think top20k)
3. users they can phish
4. high value targets (celebs, .gov, .mil, fortune 100)

If you are not in this list / you don't get phished, then it is highly unlikely your vault will be targeted. And due to the fairly expensive KDF, even passwords of moderate complexity should be safe.

I've seen several people recommend changing your master password as a mitigation for this breach. While changing your master password will help mitigate future breaches should you continue to use LastPass (you shouldn't), it does literally nothing to mitigate this current breach. The attacker has your vault, which was encrypted using a key derived from your master password. That's done, that's in the past. Changing your password will re-encrypt your vault with the new password, but of course it won't re-encrypt the copy of the vault the attacker has with your new password. That would be impossible unless you somehow had access to the attacker's copy of the vault, which if you do, please let me know?

A proper mitigation would be to migrate to #Bitwarden or #1Password, change the passwords for each of your accounts as you migrate over, and also review the MFA status of each of your accounts as well. The perfect way to spend your holiday vacation! Start the new year fresh with proper password hygiene.

For more password insights like this, give me a follow!

@Jpomfret @dhmacher @bweissman @robsewell What Ben, Daniel and Jess said!
Have a great on buddy!

@Jpomfret just another ordinary day at the office😂

Cláudio Silva boosted:

RT @sqldbawithbeard
How to create a new Data Saturdays Event
in video format
https://youtu.be/QdoZ7NNn32c
#datasaturdays #CallforPapers #sqlserver #AzureDataCommunity https://buff.ly/2RwTlSk

Cláudio Silva boosted:

Part 3 (and the final part) of my series on hacking the De'Longhi coffeemaker to brew coffee from GitHub actions is up. This time I hook up the coffeemaker to a runner that lets us file an issue and make a coffee. This project has been a lot of fun to work on and write up!

#github #rustlang #reverseengineering #hacking #hardwarehacking #bluetooth

https://grack.com/blog/2022/12/04/hacking-bluetooth-to-brew-coffee-on-github-actions-part-3/

Cláudio Silva boosted:

Need some demo data to play around with on SQL Server?

I spent a couple of hundred hours to build a database based on a public dataset from the City of Chicago with parking tickets issued between 1997 and 2017. I’ve also refined this dataset with more details from other public sources – from ZIP codes, to socioeconomic indicators, to weather information and more.

https://sqlsunday.com/2022/12/05/new-demo-database/

Cláudio Silva boosted:

I just published an article on using the #PowerShell module #BluebirdPS to find Mastodon account references for PowerShell community members on the birdsite.

I give a shout-out to the work @cl has done on 3 #GitHub actions: Exodus, Influx, and Fossilize.

https://thedavecarroll.com/powershell/powershell-people-on-mastodon/

Cláudio Silva boosted:

Part of the #SQLServer community? Don't forget to follow the hashtag! Also, here's today's follow list, now up to 276 accounts 🤩

Some people, such as myself, have disappeared because they set their tw account to private or left entirely. Looks like we'll have to add a function to allow manual entries for those interested.
https://github.com/dataplat/mastodon/blob/main/dataplat/mastodon-import.csv

Cláudio Silva boosted:

Part of the #PowerShell community? Don't forget to follow the hashtag! Also, here's today's follow list, now up to 216 accounts 🤩

Some people, such as myself, have disappeared because they set their tw account to private or left entirely. Looks like we'll have to add a function to allow manual entries for those interested (accepting PRs bc I have to work on a time-sensitive project)

https://github.com/dataplat/mastodon/blob/main/powershell/mastodon-import.csv

@Jpomfret @cl @osiris687 @dalehirt am I too late to the party?

We don't have a command but, as workaround, you can use something like:

$instance = '<SQLServer>'
$srv = Connect-DbaInstance -sqlinstance $instance
$srv.LoginMode = [Microsoft.SqlServer.Management.Smo.ServerLoginMode]::Integrated
$srv.Refresh()

Other options: https://learn.microsoft.com/en-us/dotnet/api/microsoft.sqlserver.management.smo.serverloginmode?view=sql-smo-preview

Cláudio Silva boosted:

RT @bweissman
This is happening today! #betterlatethannever #bicep #azure #postcon @sqldbawithbeard @DataScotland