@oliikit

Offensive Security. Cat lover. Language nerd. Gif enthusiast. Gamer girl. previous: @Mapbox, @Arcadia

 Washington, DC
oliikit.dev
Joined March 2016
  • Tweets662
  • Following324
  • Followers292
49Media
After 8 years on the iPhone, iOS 16 has finally made me change my wallpaper. My upbringing has not prepared me for this moment.
1
The problem isn't that I have 100 tabs opened up.... The problem is those 100 tabs on each 11 desktop screens. I'm working on exponential growth here.
1
Ah yes, going to five year old code is a great way to spend the morning.
Don’t you love it when technology just works?
1
When automation goes wrong.
Daniel P. Aldrich urbanists.social/web/@dpaldrich@DanielPAldrich31 May 2022
Plane delayed for hard to understand reasons

This media is unavailable

Olivia retweeted
Tom Lee@tjl30 Mar 2022
This is genuinely outrageous. @Ubiquiti I urge you to knock off this abusive behavior. I'm a mostly-happy Unifi customer, but there's no way I can support a company with judgment this disastrously bad.
This quoted post is unavailable.
Try viewing anyway · View on X
1
1
1
New documents for the Okta breach: I have obtained copies of the Mandiant report detailing the embarrassing Sitel/SYKES breach timeline and the methodology of the LAPSUS$ group. 1/N xitter.cf/BillDemirkapi/status/1…
Bill Demirkapi
@BillDemirkapi22 Mar 2022
The LAPSUS$ ransomware group has claimed to breach Okta sharing the following images from internal systems.
64
867
250
2,458
I want to be clear... 125k log entries without any qualification means jack squat. Did you know you can make a Windows desktop system generate that many events in under an hour? There's a lot that Okta has done in this event that is sus, But for me, this is probably the worst
Jake Williams
@MalwareJake24 Mar 2022
Replying to @MalwareJake
I'll close by noting how scammy it is to cite the 125k log entries you've examined. Anyone in the field knows that could mean anything from grep to Sigma, but almost certainly not "we put human eyes on all these." I believe the number is there to mislead laypeople. Shame. 11/
3
3
33
The Cloudflare team put together a great write up of how they investigated: blog.cloudflare.com/cloudfla… investigated these events: user.account.reset_password, user.mfa.factor.update, system.mfa.factor.deactivate, user.mfa.attempt_bypass, and user.session.impersonation.initiate
1
11
36
🙌 All great advice coming from everyone. It's best to review logs since January. Okta's impersonation setting is off by default. You can review over in your account settings at [tenant].okta.com/admin/settings/account
Ben Goerz@bengoerz22 Mar 2022
Great advice from @FrankMcG. But what does "Bad" behavior look like in an SSO breach? Look for: 1. Audit logs for unusual config changes (ex. MFA policy change) 2. Unusual new account creations 3. Unusual modifications to existing users (password resets)
2
It was beginning to be too quiet lately anyway. Hopefully there's independent verification soon.
MG
@_MG_22 Mar 2022
Oh man, if this it what it looks (Okta got popped)… Blue Team everywhere is gonna be crazy busy.
1
Most people suck at managing up. They waste their boss’ time with too much (or too little) information. Here’s how to give the right amount of context:
333
3,545
892
22,641
An illustration titled, “To be able to care for others, you have to care for yourself first.” It shows a watering can watering sprouts. The water is labeled, “empathy, guidance, and kindness.” A hose is filling up the watering can and the water coming out of the hose is labeled, “rest, sleep, and alone time.”

ALT An illustration titled, “To be able to care for others, you have to care for yourself first.” It shows a watering can watering sprouts. The water is labeled, “empathy, guidance, and kindness.” A hose is filling up the watering can and the water coming out of the hose is labeled, “rest, sleep, and alone time.”

7
384
57
1,456
The best way to be productive is to have really important things to do and starting with your backlog items first.
Instead of being a SaaS engineer, can I be a sass engineer? Please?
1
2
Replying to @oliikit
Still working on my tweet thread on corporate cybersecurity and why it was so annoying when you forced me to use a password manager / stop saving passwords in my browser and post-it notes.
1
1
2
This is available now. The following are links to all IPs that are scanning/attempting to compromise *exclusively* Ukrainian IP space, as detected by @GreyNoiseIO sensors located in-country. These IPs are targeting Ukraine. api[.]greynoise[.]io/datashots/ukraine/manifest.json
Andrew Morris (afk)
@Andrew___Morris24 Feb 2022
Replying to @Andrew___Morris
2) (SHORTLY) We're publishing a free, public, unauthenticated, self-updating feed of all IPs that are exclusively targeting devices geographically located in Ukraine's IP space with scans, exploits, etc. I will post the link to this as soon as it has been pushed to production.
13
227
26
511
Don't you love it when things are documented clearly? And you don't have to go issue splunking to try to figure what's going on? ... yeah, me too.
1
2
👏👏👏 when people ask questions in issues, maybe update take a quick second to update the documentation?
1
Load more