<?xml version="1.0" encoding="utf-8"?><feed xmlns="http://www.w3.org/2005/Atom" ><generator uri="https://jekyllrb.com/" version="3.10.0">Jekyll</generator><link href="https://decrypt.fail/feed.xml" rel="self" type="application/atom+xml" /><link href="https://decrypt.fail/" rel="alternate" type="text/html" /><updated>2026-05-30T01:17:07+00:00</updated><id>https://decrypt.fail/feed.xml</id><title type="html">decrypt.fail</title><subtitle>seb&apos;s digital garden — infosec, decentralization, and tinkering.</subtitle><author><name>seb</name></author><entry><title type="html">SOC Tales - AI war</title><link href="https://decrypt.fail/blog/soc-tales-ai-war/" rel="alternate" type="text/html" title="SOC Tales - AI war" /><published>2024-12-09T00:00:00+00:00</published><updated>2024-12-09T00:00:00+00:00</updated><id>https://decrypt.fail/blog/soc-tales-ai-war</id><content type="html" xml:base="https://decrypt.fail/blog/soc-tales-ai-war/"><![CDATA[<p><img src="/assets/img/soc-tales-ai-war.png" alt="SOC Tales — AI war" /></p>

<p>In the bustling cyber security operations center of a top-tier banking institution, two
analysts, Sergey and Ionis, were intently monitoring the network for any signs of
suspicious activity. Suddenly, they noticed a series of strange anomalies that looked
like the beginning of a massive cyber attack.</p>

<p>“This looks like a nation state attack,” said Ionis, furrowing their brow. “We need to
alert the incident response team immediately.”</p>

<p>But as they dug deeper into the attack, they discovered something even more unexpected.
The source of the attack was not a foreign government, but a group of mischievous middle
schoolers who had figured out how to use a powerful AI model to modify existing hacking
tools.</p>

<p>“I can’t believe it!” exclaimed Sergey. “These kids are smarter than we thought!”</p>

<p>The two SOC analysts quickly realized that this was no ordinary cyber attack. The middle
schoolers had used ChatGPT, a cutting-edge language model, to modify existing hacking
tools and launch a massive attack on all online banking portals in the United States.</p>

<p>“This is unprecedented,” said Sergey. “We’ve never seen anything like this before.”</p>

<p>Ionis nodded in agreement. “We need to move fast. If we don’t stop this attack, the
consequences could be devastating for the entire financial industry.”</p>

<p>The two analysts worked tirelessly to track down the source of the attack and thwart the
middle schoolers’ plans. They soon discovered that the young hackers were using a complex
network of VPNs and proxy servers to hide their true identities.</p>

<p>“These kids are clever,” said Ionis. “But we’re not going to let them get away with this.”</p>

<p>Sergey and Ionis knew they needed to act quickly to protect their institution’s online
banking system. They turned to Google Bard, another powerful AI model, to help them
improve the WAF.</p>

<p>“We need to make our system more resilient to these types of attacks,” said Sergey.
“Bard can help us identify potential vulnerabilities and suggest improvements to our
firewall.”</p>

<p>Ionis agreed. “And we need to move fast. Who knows what other tricks these middle
schoolers have up their sleeves.”</p>

<p>Using Google Bard, Sergey and Ionis were able to quickly identify several weaknesses in
their WAF and implement fixes to shore up their defenses. They also worked closely with
their incident response team to monitor the network for any additional signs of
suspicious activity.</p>

<p>“We’re making progress,” said Ionis. “But we can’t let our guard down. These kids are
persistent.”</p>

<p>Sergey nodded in agreement. “We need to stay one step ahead of them if we’re going to
prevent any further damage.”</p>

<p>Sergey and Ionis knew they couldn’t keep their defense tactics to themselves. They needed
to share their knowledge with the SOC teams of other banks to help prevent further
attacks. Luckily, they were part of a private Slack instance for cyber security
professionals, where they could easily reach out to their peers.</p>

<p>“We need to spread the word,” said Ionis. “If we can help other banks defend against
these attacks, we can minimize the damage and prevent more chaos.”</p>

<p>Sergey agreed. “Let’s draft a message to the other SOC teams and provide them with the
details of our defense tactics. Maybe we can even set up a virtual meeting to discuss how
to best collaborate on this issue.”</p>

<p>Within minutes, Sergey and Ionis had drafted a message and sent it out to their peers.
They received an overwhelming response, with many SOC teams eager to join forces and
share information.</p>

<p>“This is exactly what we need,” said Ionis. “A united front against these middle school
hackers.”</p>

<p>With the support of their peers, Sergey and Ionis worked tirelessly to defend against the
middle school hackers’ attacks. They continued to share information and collaborate with
other SOC teams, helping to prevent any further damage.</p>

<p>Eventually, the young hackers realized they were outmatched and gave up their attempts to
breach the banking institutions’ systems.</p>

<p>Sergey and Ionis breathed a sigh of relief. “We did it,” said Ionis. “We stopped them in
their tracks.”</p>

<p>Sergey nodded. “And we learned a valuable lesson in the process. Never underestimate the
ingenuity of a determined group of hackers, no matter their age.”</p>

<p>As the dust settled, Sergey and Ionis reflected on the experience and the importance of
staying vigilant in the ever-evolving world of cyber security.</p>

<p>“You can never let your guard down,” said Ionis. “Not even for a minute.”</p>

<p>And with that, they returned to their work, knowing they had made a difference in
protecting the financial industry from a potentially devastating attack.</p>]]></content><author><name>seb</name></author><category term="aigenerated" /><category term="shortstory" /><category term="infosec" /><summary type="html"><![CDATA[]]></summary></entry><entry><title type="html">Securing Mastodon Instances</title><link href="https://decrypt.fail/blog/securing-mastodon-instances/" rel="alternate" type="text/html" title="Securing Mastodon Instances" /><published>2022-11-20T00:00:00+00:00</published><updated>2022-11-20T00:00:00+00:00</updated><id>https://decrypt.fail/blog/securing-mastodon-instances</id><content type="html" xml:base="https://decrypt.fail/blog/securing-mastodon-instances/"><![CDATA[<p>This post tries to consolidate information available across multiple websites on the
topic of securing a Mastodon server. (Where available, I linked to
<a href="http://archive.org">archive.org</a>’s wayback-machine for long-term access.)</p>

<h2 id="basic-server-security">Basic Server Security</h2>

<ul>
  <li>Use an OS that is supported through frequent security updates</li>
  <li>Configure automated security updates (instructions for <a href="https://web.archive.org/web/20220715173452/https://haydenjames.io/how-to-enable-unattended-upgrades-on-ubuntu-debian/">Ubuntu/Debian</a>)</li>
  <li>Use public key authentication for SSH (<a href="https://web.archive.org/web/20220607035429/https://www.linode.com/docs/guides/use-public-key-authentication-with-ssh/">guide</a>)</li>
  <li>Disable password based authentication for SSH (instructions for <a href="https://help.ubuntu.com/community/SSH/OpenSSH/Configuring#Disable_Password_Authentication">Ubuntu</a>)</li>
  <li>Install Fail2Ban (instructions for <a href="https://web.archive.org/web/20220707210728/https://linuxize.com/post/install-configure-fail2ban-on-ubuntu-20-04/">Ubuntu</a>)</li>
  <li>Enable the host firewall and only allow incoming traffic on TCP ports 443, 80, and 22 (instructions for <a href="https://github.com/packetbiral/mastodon-documentation/blob/master/Running-Mastodon/Security-Guide.md">iptables</a>)</li>
  <li>Properly secure access to your hosting provider’s backend with strong passwords and 2FA</li>
</ul>

<h2 id="mastodon-admin-account">Mastodon Admin Account</h2>

<ul>
  <li>Don’t use the instance’s admin account as your day-to-day micro-blogging account! (Create separate accounts instead.)</li>
  <li>Use a random password with at least 16 characters for the admin account (store it in a password manager)</li>
  <li>Enable 2FA on the admin account</li>
</ul>

<h2 id="advanced-security-considerations">Advanced Security Considerations</h2>

<ul>
  <li>Use a <a href="https://en.wikipedia.org/wiki/Bastion_host">bastion host</a> (aka jump-host) to access the Mastodon server via SSH, and restrict SSH access to the bastion host on the Mastodon server’s host firewall</li>
  <li>Use a <a href="https://www.linode.com/docs/products/networking/cloud-firewall/get-started/">cloud firewall</a> from your hosting provider to only temporarily allow SSH access from your IP address</li>
  <li>Create a free account with <a href="https://www.crowdsec.net/">CrowdSec</a> and add the Mastodon server as an instance to auto-block (crowd-sourced) known bad IP addresses</li>
  <li>Test the server’s SSL/TLS configuration (<a href="https://www.ssllabs.com/ssltest/">Qualys SSL Test</a>) and disable weak ciphers (<a href="https://web.archive.org/web/20220624022129/https://geekflare.com/nginx-webserver-security-hardening-guide/">NginX hardening guide</a>)</li>
  <li>Put a WAF (Web Application Firewall) in front of the Mastodon server (FOSS example: <a href="https://github.com/SpiderLabs/ModSecurity">ModSecurity</a>; other options are WAF-as-a-service from Cloudflare or any of the hyper-scalers)</li>
  <li>Install an EDR agent on the Mastodon server (FOSS example: <a href="https://wazuh.com/">Wazuh</a>)</li>
  <li>Restrict egress traffic through a headless <a href="https://github.com/evilsocket/opensnitch">OpenSnitch</a> installation</li>
</ul>

<p><em>Some relevant links:</em></p>

<ul>
  <li><em><a href="https://docs.joinmastodon.org/admin/prerequisites/">https://docs.joinmastodon.org/admin/prerequisites/</a></em></li>
  <li><em><a href="https://haydenjames.io/how-to-enable-unattended-upgrades-on-ubuntu-debian/">https://haydenjames.io/how-to-enable-unattended-upgrades-on-ubuntu-debian/</a></em></li>
  <li><em><a href="https://www.linode.com/docs/guides/use-public-key-authentication-with-ssh/">https://www.linode.com/docs/guides/use-public-key-authentication-with-ssh/</a></em></li>
  <li><em><a href="https://linuxize.com/post/install-configure-fail2ban-on-ubuntu-20-04/">https://linuxize.com/post/install-configure-fail2ban-on-ubuntu-20-04/</a></em></li>
  <li><em><a href="https://github.com/packetbiral/mastodon-documentation/blob/master/Running-Mastodon/Security-Guide.md">https://github.com/packetbiral/mastodon-documentation/blob/master/Running-Mastodon/Security-Guide.md</a></em></li>
  <li><em><a href="https://geekflare.com/nginx-webserver-security-hardening-guide/">https://geekflare.com/nginx-webserver-security-hardening-guide/</a></em></li>
</ul>]]></content><author><name>seb</name></author><category term="decentralization" /><category term="infosec" /><category term="older" /><summary type="html"><![CDATA[This post tries to consolidate information available across multiple websites on the topic of securing a Mastodon server. (Where available, I linked to archive.org’s wayback-machine for long-term access.)]]></summary></entry><entry><title type="html">How to build your first SOC</title><link href="https://decrypt.fail/blog/how-to-build-your-first-soc/" rel="alternate" type="text/html" title="How to build your first SOC" /><published>2022-09-25T00:00:00+00:00</published><updated>2022-09-25T00:00:00+00:00</updated><id>https://decrypt.fail/blog/how-to-build-your-first-soc</id><content type="html" xml:base="https://decrypt.fail/blog/how-to-build-your-first-soc/"><![CDATA[<p>Attended <a href="https://nolacon.com/">NolaCon</a> (in New Orleans, LA) for the last three days
and had a blast. Also contributed by speaking about “How to build your first SOC” — you
can find the <a href="https://github.com/iocseb/slides/blob/main/nolacon2022_buildsoc.pdf">slides here</a>.</p>

<p><a href="https://github.com/iocseb/slides/blob/main/nolacon2022_buildsoc.pdf"><img src="/assets/img/soc-build.png" alt="Build your first SOC — NolaCon slides" /></a></p>]]></content><author><name>seb</name></author><category term="infosec" /><category term="older" /><summary type="html"><![CDATA[Attended NolaCon (in New Orleans, LA) for the last three days and had a blast. Also contributed by speaking about “How to build your first SOC” — you can find the slides here.]]></summary></entry></feed>