Mighty Treps

Friday, May 26, 2023

Cain And Abel

"Cain & Abel is a password recovery tool for Microsoft Operating Systems. It allows easy recovery of various kind of passwords by sniffing the network, cracking encrypted passwords using Dictionary, Brute-Force and Cryptanalysis attacks, recording VoIP conversations, decoding scrambled passwords, recovering wireless network keys, revealing password boxes, uncovering cached passwords and analyzing routing protocols. The program does not exploit any software vulnerabilities or bugs that could not be fixed with little effort. It covers some security aspects/weakness present in protocol's standards, authentication methods and caching mechanisms; its main purpose is the simplified recovery of passwords and credentials from various sources, however it also ships some "non standard" utilities for Microsoft Windows users." read more...

Website: http://www.oxid.it/cain.html

ADVANTAGE OF ETHICAL HACKING

Advantage of Ethical Hacking

Hacking is quite useful in the following purpose-

1-To recover lost information, especially in case you lost your password.

2-To perform penetration testing to strengthen computer and network security.

3-To put adequate preventative measure in place to prevent security breaches.

4-To have a computer system that prevents malicious hackers from gaining access.

5-Fighting against terrorism and national security breaches.

More info

Thursday, May 25, 2023

How To Build A "Burner Device" For DEF CON In One Easy Step

TL;DR: Don't build a burner device. Probably this is not the risk you are looking for.

Introduction

Every year before DEF CON people starts to give advice to attendees to bring "burner devices" to DEF CON. Some people also start to create long lists on how to build burner devices, especially laptops. But the deeper we look into the topic, the more confusing it gets. Why are we doing this? Why are we recommending this? Are we focusing on the right things?

What is a "burner device" used for?

For starters, the whole "burner device" concept is totally misunderstood, even within the ITSEC community. A "burner device" is used for non-attribution. You know, for example, you are a spy and you don't want the country where you live to know that you are communicating with someone else. I believe this is not the situation for most attendees at DEF CON. More info about the meaning of "burner" https://twitter.com/Viss/status/877400669669306369

Burner phone means it has a throwaway SIM card with a throwaway phone, used for one specific operation only. You don't use the "burner device" to log in to your e-mail account or to VPN to your work or home.

But let's forget this word misuse issue for a moment, and focus on the real problem.

The bad advice

The Internet is full of articles focusing on the wrong things, especially when it comes to "burner devices". Like how to build a burner laptop, without explaining why you need it or how to use it.

The problem with this approach is that people end up "burning" (lame wordplay, sorry) significant resources for building a secure "burner device". But people are not educated about how they should use these devices.

The threats

I believe the followings are some real threats which are higher when you travel:

1. The laptop getting lost or stolen.

2. The laptop getting inspected/copied at the border.

These two risks have nothing to do with DEF CON, this is true for every travel.

Some other risks which are usually mentioned when it comes to "burner devices" and DEF CON:

3. Device getting owned via physical access while in a hotel room.

4. Network traffic Man-in-the-middle attacked. Your password displayed on a Wall of Sheep. Or having fun with Shellshock with DHCP. Information leak of NTLM hashes or similar.

5. Pwning the device via some nasty things like WiFi/TCP/Bluetooth/LTE/3G/GSM stack. These are unicorn attacks.

6. Pwning your device by pwning a service on your device. Like leaving your upload.php file in the root folder you use at CTFs and Nginx is set to autostart. The author of this article cannot comment on this incident whether it happened in real life or is just an imaginary example.

How to mitigate these risks?

Laptop getting stolen/lost/inspected at the border?

1. Bring a cheap, empty device with you. Or set up a fake OS/fake account to log in if you really need your day-to-day laptop. This dummy account should not decrypt the real files in the real account.

Device getting owned while in a hotel room with physical access

1. Don't bring any device with you.

2. If you bring any, make it tamper-resistant. How to do that depends on your enemy, but you can start by using nail glitter and Full Disk Encryption. Tools like Do Not Disturb help. It also helps if your OS supports suspending DMA devices before the user logs in.

3. If you can't make the device tamper-resistant, use a device that has a good defense against physical attackers, like iOS.

4. Probably you are not that important anyway that anyone will spend time and resources on you. If they do, probably you will only make your life miserable with all the hardening, but still, get pwned.

Network traffic Man-in-the-middle attacked

1. Don't bring any device with you.

2. Use services that are protected against MiTM. Like TLS.

3. Update your OS to the latest and greatest versions. Not everyone at DEF CON has a 0dayz worth of 100K USD, and even the ones who have won't waste it on you.

4. Use fail-safe VPN. Unfortunately, not many people talk about this or have proper solutions for the most popular operating systems.

5. For specific attacks like Responder, disable LLMNR, NBT-NS, WPAD, and IPv6 and use a non-work account on the machine. If you don't have the privileges to do so on your machine, you probably should not bring this device with you. Or ask your local IT to disable these services and set up a new account for you.

Pwning the device via some nasty thing like WiFi/TCP/Bluetooth/LTE/3G/GSM stack

1. Don't bring any device with you.

2. If you bring any, do not use this device to log in to work, personal email, social media, etc.

3. Don't worry, these things don't happen very often.

Pwning your device by pwning a service on your device

Just set up a firewall profile where all services are hidden from the outside. You rarely need any service accessible on your device at a hacker conference.

Conclusion

If you are still so afraid to go there, just don't go there. Watch the talks at home. But how is the hotel WiFi at a random place different from a hacker conference? Turns out, it is not much different, so you better spend time and resources on hardening your daily work devices for 365 days, instead of building a "burner device".

You probably need a "burner device" if you are a spy for a foreign government. Or you are the head of a criminal organization. Otherwise, you don't need a burner device. Maybe you need to bring a cheap replacement device.

Continue reading

Wednesday, May 10, 2023

Greetings from Ukraine

--
Greetings,

My name is Maj. Sethia DAIGRE,I am an American, member of the U.S. ARMY
medical team in UKraine.

I discovered two (2) metal chest boxes containing American Dollars here
in UKraine. I have been able to move the chest boxes into the
neighbouring country (Poland) with the help of a brave Nato Military
minds. He's waiting for my appointed contact person to contact him for
the delivery of the valuables.

I would want you to assist in taking the delivery/custody of those
luggage chest boxes pending when I will be done here and redeployed back
to the US. Please, I want this to be highly confidential since I am
still in the service.

I look forward to your prompt response.

Regards,

Sethia DAIGRE
Ukraine

Friday, May 5, 2023

经营民营企业为什么一定要做好股权设计？

您经营企业是否还在用传统的底薪+提成的方式来驱动员工！！！

如果是，你是否发现
无法起到激励作用不说
还容易让公司培养的人才流失
成了同行竞争对手的培养槽

所以，如果你想激励员工
为公司留住核心人才
那么一定要学会“股权激励”

首先，股权激励重在“激”上
分的是美好“未来”
是基于员工能力
对于公司未来创造价值的肯定
而不是过去

否则股权激励只会变成股权奖励
其次股权激励的规则一定要
公开、透明、明确、具体
让那些拿到股权激励的小伙伴
心潮澎湃
让那些没有拿到股权激励小伙伴
心神向往

明白，该通过怎样的努力
才能拿到这些股权激励

最后，激励一定要有机制
而机制的核心，重在“考”上

给予核心员工10%的股份
要分4年授予
每年完成多少业绩目标
才能拿到多少股份

这样
我们不仅可以绑定员工4年以上
还可以让他每年努力做业绩
不做躺赚

给予实股的技术型股东
一定要让他们花钱进来
明确进入和退出机制
因为只有花了钱他才会去珍惜
拥有主人翁意识
踏踏实实的跟着公司干

敬爱的老板
关于股权激励的更多方法
是用“实股激励”
还是用“虚拟股激励”
还有如何保证股权激励后
创始人的话语权
以及股权分出去后
员工想要离职该怎么收回股权？

欢迎您参加华一世纪《公司控制权与股权激励解决方案班》 华一世纪独创股权激励四维模式＋8种激励手法＋12种激励纬度，帮助您企业解决业绩不好、员工高管上班无激情、工作效率低;员工离职、招不到人、留不住人……等问题
华一世纪《公司控制权与股权激励》两天课程现场给您系统方法和工具！

【第一天上午】

1.公司初创期、发展期、稳定期股权激励怎么做？股权激励应该分给谁？分多少？怎么分？协议怎么签？怎么管控风险？

2.如何确定激励对象的股权额度？股权激励是用注册股还是虚拟股？股权怎么作价？

3.怎么设置激励对象的绩效考核机制、进入与退出约束机制？

4.员工薪酬怎么设计？股东分红怎么分？什么时候可以分？
5.股权激励操作方法解析

【第一天下午】

对内激励系统：

(1.)核心团队——超额利润激励法

(2.)核心团队——在职分红激励法

(3.)核心团队——注册股激励法

(4.)核心团队——135渐进式励法

(5.)核心团队——创业股激励法

(6.)裂变整合——集团股激励法

(7.)昨日黄花——七员工激励法

对外激励系统：

(8.)公司控制——股权布局法

(9.)吸引资金——股权融资法

(10.)整合资源一般权众等法

(11.)行业整合——上下游激励法

(12.)行业整合——兼并重组法

(13.)商业模式重组——股权跨界整合法

(14.)特殊资源——影子股东激励法

(15.) 吸引高人——对赌股权激励法

【第二天上午】

1.如何制定股东的权、责、利？股权分配不合理怎么调整？如何设计动态股权机制？

2.创业初期注册股东实缴金额未按协议实缴怎么办？股东闹矛盾、中途退出怎么办？“毒品”股东如何处理？

3.合伙人创业股权如何合理分配？需要守住哪些底线？

4.资源型、资金型、技术型、管理型、顾问型股东以什么形式进入？给多少股份？股份如何作价？如何提前设定股东退出机制？

5.公司如何做顶层架构设计？如何设计持股平台？

6.连锁店股权如何布局？分子公司如何分股权？

【第二天下午】

7.创始人股权稀释如何牢牢把握公司控制权？控制公司的5大手段；

8.公司（溢价）估值怎么做？股权融资10大方法？股权融资渠道及与投资人谈判技巧；众筹方案设计？

9.如何整合上下游资源？如何零投入进行产业扩张？从而实现产业裂变，让企业更值钱；

10.公司盈利模式设计？商业跨界模式创新思维？商业模式案例解析；

......

更多细节地方，我们老师会在现场分享，诚挚的邀请你来参加华一世纪两天一夜【股权激励整体解决方案班】

《华一世纪股权激励整体解决方案导入班》两天一夜近期全国开课安排：

5月06-07号上海、北京

5月08-09号贵阳、乌鲁木齐

5月09-10号杭州、苏州

5月10-11号广州、成都、哈尔滨

5月11-12号深圳、合肥、南宁、莆田、武汉、嘉兴

5月12-13号北京

5月13-14号南京、济南、银川、郑州、重庆、长沙、西安

5月14-15号佛山

5月15-16号青岛

5月16-17号深圳、福州、厦门、呼和浩特

5月17-18号东莞、无锡、佳木斯

学习股权激励就找华一世纪
20年造就专业服务全国领先
可复训不满意全额退款
此次是咨询式授课：仅限50位！（席位先报名先安排！）
【参课对象】此课程仅适用于年营业额500万以上的企业最高决策人参加（董事长，总经理，法人）

【学习费用】1280元/人（包含场地，资料，茶点费用），提前报名可申请优惠价980元/人
特别提示：填写报名信息提交后于开课前提前办理费用方可预留席位

【报名咨询】华一世纪区老师WeChat：13556126750 电话同步
【课程详细请点击】：https://jinshuju.net/f/sMA2UY

今天成功报名参加学习限量赠送：10份由法务审核通过的股权协议书

❶《增资扩股协议书》

❷《创业合伙协议书》

❸《股东投资入股协议书》

❹《公司股东合作协议书》

❺《股东进入和退出机制》

❻《创业公司股权架构设计》

❼《公司内部员工入股协议》

❽ 《股权融资方案》

❾《股权分配协议书》

❿《商业模式计划书模板》

成功推荐朋友一起报名学习限时限量赠送价值29800元整套《股权实战落地宝典》：整套20本协议由华一世纪联合法务部出版，所有协议已通过审核，即保证了实用性又规避了法律风险。

本条邮箱旨在分享培训信息，如在打扰或您不需要，可直接回复邮箱告知我，接下来我会停止给您发送相关信息，避免您被打扰
感恩至上！期待与您线下见面！！

点击此处退订

Mighty Treps

Friday, May 26, 2023

Cain And Abel

Read more

ADVANTAGE OF ETHICAL HACKING

More info

Thursday, May 25, 2023

How To Build A "Burner Device" For DEF CON In One Easy Step

Introduction

What is a "burner device" used for?

The bad advice

The threats

How to mitigate these risks?

Device getting owned while in a hotel room with physical access

Network traffic Man-in-the-middle attacked

Pwning the device via some nasty thing like WiFi/TCP/Bluetooth/LTE/3G/GSM stack

Pwning your device by pwning a service on your device

Conclusion

Continue reading

Wednesday, May 10, 2023

Greetings from Ukraine

Friday, May 5, 2023

经营民营企业为什么一定要做好股权设计？

About Me

Blog Archive

L.L. = Ladies Love, Legend in Leather, Long and Lean, LINK LIST