Founder and CEO of Security Onion Solutions. I post mostly about Security Onion, SO-CRATES, and OhMyDebn. Believer, husband, father.
Joined February 2009
- Tweets15.4K
- Following582
- Followers6.9K
- Likes8.1K
OhMyDebn 4.14.0 is out!
Sign PDFs with your own signature, OpenCode 2 and its new desktop app, Crush from Charm, a speed and bufferbloat test, and Zorin OS 18 support.
Already running OhMyDebn? Run ohmydebn-update.
New here? Start at ohmydebn.org
Release notes: ohmydebn.org/release-notes/#…
Doug Burks retweeted
SO-CRATES 5.1 is out.
Last week brought two big issues: php2shell, a pair of PHP flaws that turn a multipart upload into a remote shell, and the eMudhra CA key compromise, where eight intermediate CAs turned out to have recoverable private keys.
Would you spot either in a packet capture?
php2shell: yes. Emerging Threats Open added rules within days, and the 5.1 image ships them, so SO-CRATES flags the exploit attempts under Network Alerts.
eMudhra: no IDS rule existed. Those eight intermediates never issued a real certificate, so any certificate from one of them on the wire is a forgery. SO-CRATES 5.1 adds a high-severity Finding that flags exactly that, on new captures and ones you've already analyzed.
Also new: right-click any value to pivot, and tighter stat cards that show more results above the fold.
SO-CRATES is free and open source from Security Onion Solutions: one container, works offline, for PCAPs, logs, email and binaries.
SO-CRATES 5.1 is out.
Last week brought two big issues: php2shell, a pair of PHP flaws that turn a multipart upload into a remote shell, and the eMudhra CA key compromise, where eight intermediate CAs turned out to have recoverable private keys.
Would you spot either in a packet capture?
php2shell: yes. Emerging Threats Open added rules within days, and the 5.1 image ships them, so SO-CRATES flags the exploit attempts under Network Alerts.
eMudhra: no IDS rule existed. Those eight intermediates never issued a real certificate, so any certificate from one of them on the wire is a forgery. SO-CRATES 5.1 adds a high-severity Finding that flags exactly that, on new captures and ones you've already analyzed.
Also new: right-click any value to pivot, and tighter stat cards that show more results above the fold.
SO-CRATES is free and open source from Security Onion Solutions: one container, works offline, for PCAPs, logs, email and binaries.
Hey @howtopam I think you might like this!
OhMyDebn 4.13.0 is out!
OhMyDebn is a debonair Linux desktop for power users. It gives you the stability of Debian or Ubuntu, the ease of use of the Cinnamon desktop, and the power of AI, containers and virtualization, with two dozen themes and a keyboard-driven menu for everything. It installs on Debian, Ubuntu, Linux Mint, LMDE, Kali, MX Linux, Pop!_OS, Devuan and LCOS.
New in this release:
- Animated theme intros. Switching themes, and logging in, now plays a short intro that fades into your new background. Seventeen of the themes from Omarchy play Omarchy's own clips; every other background gets a sunrise drawn live from the image itself. A click skips one, and Style > Theme Intros turns them off.
- Your own backgrounds now show up in the theme carousel and background cycling, and WebP backgrounds display everywhere.
- On Kali, the clock is now kept in sync.
- Updated components: Codex 0.164, Grok Build 1.0.70, Oh My Pi 18.13, OpenCode 1.19.4, Pi 1.4, T3 Code 0.1.2, SO-CRATES 5.0.1 and ttfx 0.5.1.
Doug Burks retweeted
🔥 Cool new tool for Blue Teamers and Cybersecurity Enthusiast! 👇🏻🖥️👍🏻👏🏻👏🏻👏🏻👏🏻
SO-CRATES 5.0 is out 🧅
SO-CRATES is a free, open source web app for analyzing PCAPs, logs, emails and binaries, all in one container that works offline.
New in 5.0: tshark runs alongside @Suricata_IDS and provides additional protocol support, including S7comm, IEC 104, BACnet, OPC UA, Telnet, RADIUS, IPMI, DHCPv6 and tunnels. A new Findings tab ranks what those records show.
Doug Burks retweeted
Investigation Scenario 🔎
Apache logs on one of your public facing web servers show repeated multipart POST requests returning large HTTP 500 responses.
What do you look for to investigate whether an incident occurred?
#InvestigationPath #DFIR #SOC
What should we add to the next version of SO-CRATES?
SO-CRATES 5.0 is out 🧅
SO-CRATES is a free, open source web app for analyzing PCAPs, logs, emails and binaries, all in one container that works offline.
New in 5.0: tshark runs alongside @Suricata_IDS and provides additional protocol support, including S7comm, IEC 104, BACnet, OPC UA, Telnet, RADIUS, IPMI, DHCPv6 and tunnels. A new Findings tab ranks what those records show.
Doug Burks retweeted
A heartfelt thank you to @securityonion for their $25,000 donation to the RTF! Their continued generosity helps students explore all the possibilities technology has to offer, and we are grateful to have them alongside us year after year.
ALT A background image of the sun rising over the Earth from space, with the words "Security Onion Solutions -- Thank you for your continued support."
Doug Burks retweeted
We couldn't do what we do at @RuralTechFund without the continued support of Security Onion Solutions and their team. Their support directly provides technology education opportunities for kids in schools who wouldn't otherwise get the chance. Thanks, Doug and team!
For those that couldn't make it to the Security Onion Conference or BSidesAugusta over the weekend, here are some announcements you missed:
📢 @chrissanders88 is doing great work with the @RuralTechFund and so Security Onion Solutions is donating $25K this year
📢 SO-CRATES 5.0 is now available and when you analyze a pcap with @Suricata_IDS it is now also analyzed with tshark which supports thousands of additional network protocols
📢 Security Onion 3.4 is coming soon and Pro users will be able to use its new automated alert triage @securityonion
Great to see amazing folks like David Bianco, Andrew Case, Tim Crothers, Tim Kosiba, Jason Lynch, Paul Melson, George Sandford, and others!
Special thanks to my Security Onion Solutions teammates, @BSidesAugusta organizers and volunteers, and everybody who came out to the conferences!
Doug Burks retweeted
hot take maybe even spicy take:
open source developers that are anti-AI remind me of Microsoft and other commercial companies fighting against open source in the 90s and 2000s
Coming soon to OhMyDebn!
Great work as always @iamdothash !
These days, it's so easy to create futuristic applications and TUIs. Make it look like your favorite hacker movie.
github.com/bjarneo/velo
Doug Burks retweeted
PSA: Brave blocks these annoying pop-ups by default
Doug Burks retweeted
Linux is better than Windows and most people aren't ready for this conversation
It's free, open source, highly customizable, and doesn't force you into Microsoft's ecosystem
You can revive an old laptop, control your entire system, and build almost anything on top of it
The real question is why more people still refuse to try it
Happy to support such a worthy cause!
A heartfelt thank you to @securityonion for their $25,000 donation to the RTF! Their continued generosity helps students explore all the possibilities technology has to offer, and we are grateful to have them alongside us year after year.
ALT A background image of the sun rising over the Earth from space, with the words "Security Onion Solutions -- Thank you for your continued support."
OhMyDebn 4.13.0 is out!
OhMyDebn is a debonair Linux desktop for power users. It gives you the stability of Debian or Ubuntu, the ease of use of the Cinnamon desktop, and the power of AI, containers and virtualization, with two dozen themes and a keyboard-driven menu for everything. It installs on Debian, Ubuntu, Linux Mint, LMDE, Kali, MX Linux, Pop!_OS, Devuan and LCOS.
New in this release:
- Animated theme intros. Switching themes, and logging in, now plays a short intro that fades into your new background. Seventeen of the themes from Omarchy play Omarchy's own clips; every other background gets a sunrise drawn live from the image itself. A click skips one, and Style > Theme Intros turns them off.
- Your own backgrounds now show up in the theme carousel and background cycling, and WebP backgrounds display everywhere.
- On Kali, the clock is now kept in sync.
- Updated components: Codex 0.164, Grok Build 1.0.70, Oh My Pi 18.13, OpenCode 1.19.4, Pi 1.4, T3 Code 0.1.2, SO-CRATES 5.0.1 and ttfx 0.5.1.