Or, “How I integrated python-secrets with Splunk’s Attack Range framework, and how you can do the same for your open source project!” — In this article, I want to do three things. (1) point out a couple of what I consider to be pervasive fundamental computer security problems, (2) provide my own proposed solution to them, and (3) show you how you can implement that solution in your own open source project (or…

Saying “PCAP, or it didn’t happen!” is all well and good but if you can’t see into the PCAP, how do you know what happened? — This article is aimed at those wanting to learn how to leverage network traffic capture and analysis tools as part of the digital forensics and incident response (DF/IR) processes. These disciplines involve analyzing the network communications associated with remotely controlled malicious software installed on your organization’s computer systems.

Looking for malware in all the right places (with the right tool!) — I’m sure at some point you’ve received a report or alert from some entity — US-CERT, DHS, someone on Twitter retweeting a security researcher or an anti-virus company, maybe even your bank or credit union? — about a specific threat actor and the malware they may wield against your organization’s…

Advancing ethical thinking regarding responses to cyber crime — It is common for professional societies and membership organizations to have a Code of Ethics intended to guide their members. …

Respect, beneficence, and justice must be universal or else they are meaningless. — I was listening to the news on August 29, 2019, when I heard the story of Maria Isabel Bueso and the demand letter she received ordering her to leave the United States by the middle of September or be deported. I heard her doctor struggling to find a way to…

The University of Minnesota was kept off-line for three days, and I was kept busy for weeks. — 20 years ago today — August 17, 1999 — started as a normal day. But that wouldn’t last very long. Little did I know the University of Washington was about to be inundated with a flood of known compromised computers that had to be remediated as quickly as possible. It…

Something is happening, but what? — 20 years ago today — August 5, 1999 — I rode my mountain bike across the University of Washington campus to work like every other workday. Early mornings in the summer in Seattle can be pretty nice. Sunny, a little cool with dew on the grass. Before there were signs…

Eradicating an Intruder from a Network — “Hacking back” doesn’t always mean going outside your own network. In fact, it is best done quietly, inside your own network where you have home field advantage, and both slowly and deliberately so as to deliver a definitive enough blow to someone’s activities that they leave your network and don’t…

Part 0: The Build Up to Distributed Denial of Service — I was inspired to start a series of articles on the early history of DDoS by a few recent events. Rik Farrow interviewed me for a forthcoming issue (Fall 2019 Vol. 44, No. 3) of Usenix ;login: magazine while I was also writing up a history of the early days…