Matt Held :clippy:

Security Solutions Architect @ bugcrowd.com
Former CTO, now CISO @ raidboxes.io
he/him

Interests:
- InfoSec
- Privacy
- Cyberpunk
- Dev/Software Engineering
- Everything Linux/Automation

Matt Held :clippy:mheld@infosec.exchange
2024-12-02

@Sempf Thoughts and prayers...

Matt Held :clippy:mheld@infosec.exchange
2024-12-02

@Sempf Yep, a while ago and it is now unusable. Switched to EchoAPI

Matt Held :clippy:mheld@infosec.exchange
2024-12-02

@koehntopp Damn, then they must have changed that.... Apple...

Matt Held :clippy:mheld@infosec.exchange
2024-12-02

@koehntopp Can't you do it via browser by logging into your iCloud account?
1. select "Find My" > "Items."
2. select the AirTags and click "Remove Item."

Has worked for company owned items for me before.

Matt Held :clippy:mheld@infosec.exchange
2024-12-01

@endingwithali I still haven't recovered from smishing an quishing, stop!

Matt Held :clippy:mheld@infosec.exchange
2024-12-01

@leune Shoot, ok looks like we might need to do the following:

1. ensure that the script has the right caps:

sudo setcap cap_net_admin,cap_net_raw=eip /usr/local/bin/tcpdump

2. (I think this already is in place, but just to make sure) Restrict direct access to /usr/sbin/tcpdump.orig.

sudo chmod 750 /usr/sbin/tcpdump.orig
sudo chown root:tcpdump-users /usr/sbin/tcpdump.orig

I can't test it at the moment, but in my head this should work.

Matt Held :clippy:mheld@infosec.exchange
2024-11-29

@tychotithonus
Probably this boosted by some people with a lot of followers mastodon.online/@mastodonmigra

Matt Held :clippy:mheld@infosec.exchange
2024-11-29

@realn2s Yeah, Mailchimp likes to block these, masked mail ftw ;)

Matt Held :clippy:mheld@infosec.exchange
2024-11-29

@realn2s Yeah, signed up with masked mail, got it, deleted masked mail. Do you want it?

Matt Held :clippy:mheld@infosec.exchange
2024-11-28

@forkDestroyer I took the 16" one, best available CPU and GPU (Graphics Module) config, brought my own RAM (128GB) and SS (2TB NVME). 4x USB-C, 1x USB-A, 1x HDMI, 1x DP.

Pretty happy.

Matt Held :clippy:mheld@infosec.exchange
2024-11-28

@forkDestroyer I can't recommend frame.work/ laptops enough. Highly upgradable and overall great performace.

Matt Held :clippy:mheld@infosec.exchange
2024-11-27

@leune They "should" inherit those caps, not 100% sure tho. Good that you are doing the right thing here ;)

Matt Held :clippy:mheld@infosec.exchange
2024-11-27

@leune
I mean you could create a wrapper script that restricts the interface tcpdump can access.

Something like:
---bash---

INTERFACE="eth0"

if [ "$1" != "$INTERFACE" ]; then
echo "NAH."
exit 1
fi

exec /usr/sbin/tcpdump "$@"
---bash---

And next set the capabilities for the wrapper instead of the original tcpdump binary:
sudo setcap cap_net_raw,cap_net_admin=eip YOURSKIPTPATH

Hacky af but could work. Might wanna set a new AppArmor profile to add some rules to restrict tcpdump to the desired interface as well

Matt Held :clippy:mheld@infosec.exchange
2024-11-27

@briankrebs @grrrr_shark If you are selling, I'm down for one. Was waiting for Black Friday but used is better anyway

Matt Held :clippy:mheld@infosec.exchange
2024-11-27

@briankrebs Is it one of those "Don't gift alcohol" things ;)

Matt Held :clippy:mheld@infosec.exchange
2024-11-27

@briankrebs I mean, you could switch to ZorinOS (Ubuntu, GNOME) and can run Halo just fine ;)

Matt Held :clippy:mheld@infosec.exchange
2024-11-27

@josephcox Rightfully so. Best read for me this year.

Client Info

Server: https://mastodon.social
Version: 2025.04
Repository: https://github.com/cyevgeniy/lmst