Security on Andrew Healey

The security industry is doing what it always does with CVE-2026-98432 and turning a narrow Linux kernel bug into a sales pitch

Sun, 01 Nov 2026 11:37:47 -0600

The security industry is doing what it always does with CVE-2026-98432 and turning a narrow Linux kernel bug into a sales pitch.

Anthropic showed that an internal model could produce a remote root exploit against systems listening with Multipath TCP. While it’s interesting research, it’s not evidence that every Linux box on the internet is one packet away from root. IP options have caused network stack bugs for decades. Most of the internet learned to drop them long ago. Your phone is fine. Your laptop is fine. Your web tier behind a load balancer or CDN is also fine. The internet will be fine.

Your vendors’ weaknesses are yours

Sun, 25 Oct 2026 09:08:12 -0500

Your vendors’ weaknesses are yours. That systems integrator still keeping secrets next to your vpn instructions in client-passwords.xlsx is your risk. The new flashy AI manufacturing partner cutting corners to ship and onboard your company onto their platform, dropping their systems in your facility with “military grade security” but a backdoor with admin/admin is your risk.

Their gaps, shortcuts, and weak processes become the standard in your environment and your contracts whether you want them to be or not.

Vulnzero is marketing

Thu, 22 Oct 2026 20:58:56 -0500

Vulnzero is marketing. But that doesn’t mean your board should ignore this warning. Will they hear it from Anthropic or your security leader? Or from the news coverage of the coming wave of breaches and hacks?

Models are getting better and faster at finding bugs. Most risk sits in legacy systems, vendor products, OT and embedded devices, unmaintained code, misconfigurations, poor practices, and process failures.

Discovery is not the constraint and never has been. Remediation capacity and prioritization is. We continue pushing vulnerabilities into prod at high rates. Configuration still misses quite often. The volume of findings will rise faster than most organizations can prioritize and fix them.

The SANS ICS Five Critical Controls: incident response, architecture, monitoring, remote access, vulnerability management

Wed, 14 Oct 2026 09:01:46 -0500

The SANS ICS Five Critical Controls: incident response, architecture, monitoring, remote access, vulnerability management. Pretty familiar to technology folks, but much more challenging in live production.

Isolating the wrong host can stop a line or create a safety problem. Segmentation means a new network that rarely gets a maintenance window or carving it up like swiss cheese for vendor support. Monitoring has to be passive and protocol-aware, because the active scanning we take for granted in IT can knock over a PLC. Secure remote access means tracking down every integrator and OEM who has had a standing VPN for a decade. Vulnerability management means accepting that some assets will never be patched, so you prioritize by what the process can survive.

Each attack surface deserves a defense-in-depth strategy

Sun, 11 Oct 2026 20:59:53 -0500

Each attack surface deserves a defense-in-depth strategy. For at least a decade, Cloudflare has given each domain 5 free WAF rules. I have yet to find a single business using them well. Did I mention they’re FREE?

Prompt: Configure Cloudflare WAF custom rules for a business website: block unused HTTP methods, common bot scanner paths and exploit patterns, Tor exit nodes, and traffic from non-existent or extremely low-population locations, then apply a Managed Challenge to everything that is not from the US, MX, or CA (exempt known good bots and well-known paths).

Who can clear this bar?

Wed, 07 Oct 2026 11:03:42 -0500

Who can clear this bar? Not many hospitals, school districts, cities, or mid-market companies. Those are the most targeted and least resourced orgs out there.

Anthropic’s choices here measure whether a company is big and public. They don’t measure whether the person asking is a real defender. They gatekeep around bug bounties, which many are dropping, public filings, or some public hacker persona. They assume a defender doesn’t need offensive capabilities for testing.

So good

Sat, 03 Oct 2026 13:35:42 -0500

So good. The lesson isn’t really about SonicWall, though many will breeze past and see it just as that. It’s easy to blame the brand and feel safe on Cisco or Palo Alto. At this point, I can’t name a vendor that hasn’t had some embarrassing bug. For this one, it was a hardcoded Erlang cookie and a static AES key. And on top of that, it’s just as easy to say “we’re on Entra” or “we’re on Okta” and forget that most still have some hooks back to Active Directory.

Outside regulated industries like defense, cybersecurity has always been pushing rope

Sat, 19 Sep 2026 07:58:48 -0500

Outside regulated industries like defense, cybersecurity has always been pushing rope. Around 2013, with the rise of CryptoLocker, ransomware began to change that. Once CEOs started hearing about peers who couldn’t ship product, make payroll, or get paid, budgets finally moved. That’s why the pitch is now regulatory capture and scary AI agent hackers. Fear sells.

The tools are powerful and the velocity is shocking. The controls, however, remain largely traditional. They require strategy, discipline, and meaningful investment in more than just tools. How robust those controls actually become will keep separating well-run organizations from reactive ones.

Wild watching so many businesses race to deploy AI as the answer to everything

Mon, 15 Jun 2026 21:27:14 -0500

Wild watching so many businesses race to deploy AI as the answer to everything. Open-weight models and no-guardrails frontier systems wired into agents doing who knows what.

We heard all about it with ransomware too, right up until payroll stopped running, the water company couldn’t invoice, supply chains broke, and hospitals had to drop to paper. It’s all hype, security folks always cry wolf, they’re the department of no, and they slow us down.

This hits close to home - use a password manager

Thu, 05 Feb 2026 16:06:27 -0600

This hits close to home. As a cybersecurity and tech professional, I’m often asked for similar advice, but on the digital side. Managing passwords, accounts, that entire technical footprint we all accumulate.

I’ve lost two employees: Jason Fehrs and Kevin Lee. I think about them a lot. Both times, their loved ones were locked out of accounts and struggling to find their footing after sudden loss. Ghost profiles still celebrating birthdays on Facebook. Work anniversaries on LinkedIn. It’s not just an aging issue. It hits mid-career professionals just as hard, often harder.

"I'm smart enough not to get hacked"

Tue, 30 Dec 2025 04:35:21 -0600

Oftentimes your high-ego, “I’m smart enough not to get hacked” techies are more dangerous than Randall over in Sales. They see a shiny new “PoC exploit” for a spicy CVE on GitHub and think, “I got this. I’ll just test it real quick on my machine.

Well, that’s exactly how the WebRAT malware is spreading right now. Threat actors are spinning up convincing GitHub repos that mimic proof-of-concept exploits for recently disclosed vulnerabilities (high CVSS stuff like Windows RasMan flaws). The repos look legit: AI-generated descriptions, mitigation details, code snippets, etc.

Down the Security Rabbithole Podcast - the identity crisis we've been facing

Tue, 22 Apr 2025 15:30:13 -0600

🎧 A must-listen to episode of the Down the Security Rabbithole Podcast that nails the identity crisis we’ve been facing for years. Rafal Los and his guests unpack the risks of the many idp problem, weak observability, and fragmented controls across identity providers. As usual, a great blend of technical and administrative insights.

https://dtsr.buzzsprout.com/2153215/episodes/17018052-dtsr-episode-650-executing-a-human-focused-security-approach*

62 malicious Chrome extensions

Fri, 31 Jan 2025 22:30:20 -0600

62 malicious Chrome extensions have found ways around Google’s ban on remote code execution. They’re linked to Phoenix Invicta, Technosense Media, and notably, Sweet VPN. These extensions inject ads and could compromise user data.

Phoenix Invicta, once known as Funteq Inc., has a convoluted corporate setup, with ties to the US, Hong Kong, and operations in Ukraine. They use techniques like manipulating the declarativeNetRequest API to execute remote code, despite Google’s restrictions.

Unused Domain? Add These DNS Records

Thu, 28 Dec 2023 16:17:42 -0600

Why would an unused domain even need any resources records?
#

It’s common for domains to go unused. Sometimes they’re purchased for a potential idea or project. Other times, it’s to protect a name or trademark, or maybe they’re meant for use internally on a protected and private network. But the internet does weird stuff and sometimes there are steps that should be taken even if these domains aren’t being used.

My first talk in Northwest Arkansas: simple wins for securing legacy tech

Fri, 02 Dec 2022 00:42:12 -0600

Excited to be giving my first talk here in Northwest Arkansas. Going over some simple wins when securing legacy tech in the small and medium enterprise (SME) space with the local ArkanSec group https://www.linkedin.com/groups/12068915/

krbtgt password reset - denied due to complexity

Sun, 08 May 2022 13:29:01 -0500

I was cleaning up a new directory and found the krbtgt account password hadn’t been reset for over two decades. When I tried resetting it, I could not due to complexity requirements.

Each DC in an AD domain runs a Kerberos Distribution Center (KDC) service that handles all Kerberos ticket requests. AD uses the krbtgt account for Kerberos tickets. This account is an important one and can be used in attacks, such as Golden Ticket attacks: https://techcommunity.microsoft.com/t5/security-compliance-and-identity/how-microsoft-advanced-threat-analytics-detects-golden-ticket/ba-p/250341

NSA and CISA release Kubernetes hardening guidance

Tue, 03 Aug 2021 20:31:56 -0600

The NSA and CISA have released hardening guidance for Kubernetes. The guidance describes the security challenges associated with setting up and securing a Kubernetes cluster. It includes hardening strategies to avoid common misconfigurations and guide system administrators and developers of National Security Systems on how to deploy Kubernetes with example configurations for the recommended hardening measures and mitigations. This guidance details the following mitigations:

Scan containers and Pods for vulnerabilities or misconfigurations.
Run containers and Pods with the least privileges possible.
Use network separation to control the amount of damage a compromise can cause.
Use firewalls to limit unneeded network connectivity and encryption to protect confidentiality.
Use strong authentication and authorization to limit user and administrator access as well as to limit the attack surface.
Use log auditing so that administrators can monitor activity and be alerted to potential malicious activity.
Periodically review all Kubernetes settings and use vulnerability scans to help ensure risks are appropriately accounted for and security patches are applied.

The Biden administration orders a Software Bill of Materials (SBOM)

Mon, 24 May 2021 20:11:18 -0600

The Biden administration is making a Software Bill of Materials (SBOM), an electronically readable format designed to provide an inventory of third-party components in devices, a requirement amid efforts to improve cybersecurity across the federal government and private sector.

https://www.medtechdive.com/news/biden-orders-software-bill-of-materials-to-boost-cybersecurity-advamed-wan/600594/

Security by obscurity is not enough by itself

Fri, 11 Sep 2020 21:00:51 -0600

Security by obscurity is not enough by itself. You should always enforce the best practices. However, if you can reduce the risk with zero cost, you should do that. Obscurity is a good layer of security.

https://utkusen.com/blog/security-by-obscurity-is-underrated

The IT Summit: Securing internal DNS infrastructure

Fri, 12 Oct 2018 05:09:07 -0600

On Tuesday, I’ll be discussing securing internal DNS infrastructure and some tips and tricks to effective monitoring of Windows Server DNS. It can be surprisingly challenging to get right. #conferences http://www.theitsummit.com/event/seattle-fall-2018/

Security Tips At Springwater Group at Morgan Stanley

Wed, 29 Aug 2018 15:53:14 -0600

I had a great time in Portland sharing personal and small business security tips and tricks with the Springwater Group at Morgan Stanley. The Multnomah Athletic Club has quite the view. Thanks to Doug Moshofsky and his team for the opportunity.

The Most Important Thing You Haven't Done With Your Password Manager

Sun, 11 Feb 2018 19:12:00 -0600

This afternoon, I’m attending the funeral for a coworker we lost last weekend. Over the course of the next week or two, we’ll be assisting his family gain access to the many online services he had managed. Each time I’ve experienced a tragedy like this, I’ve seen the families struggle with the digital footprint and account access of their lost loved one. Like life insurance, emergency access to online services is too often an item on our to-do list, rarely ever getting completed. Password managers help families in these situations. They act as a consolidated list of the accounts making up one’s digital footprint. However, if emergency access has not been set up, they provide no help and access becomes a major hurdle to overcome for a grieving family.

Retrieving Password from Application Pool

Thu, 06 Oct 2011 20:15:21 -0500

I came across an undocumented app the other day. For a number of reasons, we needed to restore the password but it wasn’t documented anywhere. Luckily, the service account was setup in an app pool. In IIS 7.0 or 7.5, APPCMD can be used to recover the password. In 6.0, adsutil.vbs can be used.

cscript.exe /nologo adsutil.vbs GET W3SVC/AppPools/AppPoolName/WAMUserPass

However, I wanted to write my own little script. Having a little tidbit makes it easy to reuse later for other clients. For example, I could search AD for SPNs starting with “HTTP”, loop through each of their app pools and document the username and passwords for all service accounts used in this fashion. So, here is the little tidbit I threw together.

The Power of Scripting: Finding Morto.A

Tue, 27 Sep 2011 22:58:26 -0500

Here I go on another vbScript tutorial. You might ask why I’m not doing this in powershell yet and it is simple: I still run into 2003 and XP environments. Oh yeah, and this works. I don’t care what scripting language I’m writing in if it gets the job done; you shouldn’t either. My $0.02. The original zip download is long gone, but every piece of the script is below.

Part 3: Blocking Bad Hosts - Blocking Them, Easily (CLI Edition)

Fri, 25 Dec 2009 13:13:57 -0600

In part two, I showed you how to use the Local Security Policy GUI to block the bad guys. There were a lot of pretty pictures for those that prefer the GUI. In this version, I’ll show you how to accomplish the same thing from the command line. This is my preferred method. It is much simpler to automate and explain.

By following the steps below, you will be able to create a new policy and manage the filter lists and actions. The goal here will be to put all these pieces together into a nice tidy package that is fully automated.

Part 2: Blocking Bad Hosts - Blocking Them, Easily (GUI Edition)

Wed, 23 Dec 2009 03:13:58 -0600

In part two, I want to show how you can quickly setup an ipsec policy to block the bad hosts you identified in part one. While many methods can be used to block hosts, using the Local Security Policy (secpol.msc) and ipsec is a simple method which can be fully automated.

By following the steps below, you will be able to create a new policy and manage the filter lists and actions. In part three, I will explain how this can be done from the command line for all you CLI warriors. This tutorial should be accurate for: Windows XP, Vista, 7 and Server 2003, 2008, 2008R2 (possibly even 2000).

Part 1: Blocking Bad Hosts - Finding Them, Easily

Tue, 22 Dec 2009 01:19:13 -0600

While troubleshooting some issues on an OWA Front-End server, I went over to the security log to see if the authentication attempts were getting past this box. The problem I found was the log was so full of failed logon attempts it was difficult to filter out what I was looking for. In a twelve hour period, there were thousands of 529 events in the security log. Now, I know this is nothing new, but I found a few patterns. I manually exported the log to a CSV, parsed out all the source ip addresses and opened it up in Excel. What I found was that 98.7% of failed logon attempts were made by just four different ip addresses. (I recommend using MaxMind’s GeoIP Address Locator for help in determining where the source addresses are located.)

vbScript - List All Members Of Sensitive Groups: Schema, Enterprise and Domain Admins

Fri, 13 Mar 2009 14:24:46 -0500

Update 2011.06.21: I found a missing line in this script keeping it from running. I fixed that in the code below. I also added a downloadable zip file with the script to help with the formatting issues caused when copying and pasting directly from the site.

Update 2009.04.16: At the request of a commenter, I added a couple lines to the script that will dump the output to a text file in the root of the C: drive. I also corrected a couple errors in the script.

Finding Anonymous Proxies

Fri, 23 Nov 2007 11:56:37 -0600

I ran across a great cgi:perl script for running anonymous proxies. Its called CGIProxy. I have to find creative ways of getting around the different blocking mechanisms while I’m on more locked down networks. Having a little personal proxy running in a few places helps.

If you have trouble finding it, I’ve been successful locating builds through its alias: nph-proxy. There are some unsavory types running the code out there, so be cautious with what traffic you send through somebody else’s network/proxy.