[/blogfolio]

Web design and hosting services come to an end.

Oh yeah, i'm licensed by the Illinois State Board of Education.

    I think this year I will actually put my sub-teaching license and training to use in some form or another for 'the FREE'. Ya know, open my mouth about cybersecurity a lil more. I feel obligated to giving opportunities to others who are seldom heard correctly... if at all. Stay tuned.

    Server room electrical and ethernet completed. 2nd floor with exception of one outlet is all on the same breaker!

  • uhBuford
  • Dec, 2024

Time to level up(?!) - GSOC study weekend

    2022-2023, I obtained 37[ish] certifications, including vendor specific 'mini-certs'. It was a little too much and I wish I focused more on a specific niche within cybersecurity instead of IT ALL like I normally have done throughout my career. 2023 will be dedicated to focusing on securing my SANS GSOC and insider threat focused training including, but not limited to, threat hunting.

  • uhBuford
  • Dec, 2024

Restreamer testing

    I never thought i'd live to see the day where a PC the size of my hand could stream video LIVE to the whole world!

    RaspberryPi, it gets the job done.

  • uhBuford
  • Dec, 2024

SANS | SEC450

    Wow! A lot of information. A lot of insight. MUCH CTF!!! We were 1st, once upon a time. The team and I took 3rd overall but the way there was insanely worth it! The class felt like a long, l33t[ish], cyber bootcamp. It reinforced a good amount of what I had learned earlier in my career. Now to capture the cert after the cool-down period.

  • A Buford
  • Dec, 2024

Home Assistant, when person detected

    Currently, I have the below YAML configuration, which turns on some yard lights when Frigate detects a person. A second script turns OFF the lights automatically after 5 minutes of being ON. I am seeking assistance with modifying the script to not turn off lights when the lights were turned on manually by button 'x'. After sunset. Before sunrise.

    alias: Outside security lights rear
    description: ""
    trigger:
      - platform: mqtt
        topic: frigate/events
        payload: "on"
        value_template: >-
          {{ "on" if value_json["type"] == "new" and value_json["before"]["camera"]
          == "garage" and value_json["before"]["label"] == "person" else "off"}}
    condition:
      - condition: device
        type: is_off
        device_id: 023e51a8bea279603cb897f07d8b482b
        entity_id: 344f4126873c5e933313e1670d101c90
        domain: switch
      - condition: sun
        before: sunrise
        after: sunset
    action:
      - type: turn_on
        device_id: 023e51a8bea279603cb897f07d8b482b
        entity_id: 344f4126873c5e933313e1670d101c90
        domain: switch
    mode: single
    
    

    Off to working on it.

  • A Buford
  • Nov, 2022

A pattern of Chicago robbery crime pt.II

    "All of these robberies occured in Chicago, IL. what can be inferred about those commiting the crime and where they are coming from?"

    The Facts:
    2300 block of North Western on Aug. 5 at 6:50 p.m.
    2500 block of North Richmond on Aug. 5 at 6:50 p.m.
    2600 block of North Hamlin on Aug. 5 at 7:30 p.m.
    1700 block of North Keystone on Aug. 6 at 5:30 a.m.
    4000 block of West Armitage on Aug. 6 at 5:31 a.m.
    1300 block of North Moorman on Aug. 6 at 10:50 a.m.
    2900 block of North Albany on Aug. 6 at 11:00 a.m.
    2500 block of North Rockwell on Aug. 6 at 11:05 a.m.
    2800 block of West Diversey on Aug. 6 at 11:15 a.m.
    4300 block of West Schubert on Aug. 6 at 11:40 a.m.
    4300 block of West Schubert on Aug. 6 at 11:40 a.m.
    3200 block of West Fullerton on Aug. 6 at 11:50 a.m.
    2100 block of North Spaulding on Aug. 6 at 11:50 a.m.
    1800 block of North Spaulding on Aug. 6 at 11:50 a.m.
    3600 block of West Potomac on Aug. 6 at 12:00 p.m.
    2400 block of North Spaulding on Aug. 6 at 12:05 p.m.
    1600 block of North Drake on Aug. 6 at 12:05 p.m.
    1400 block of North Cicero on Aug. 6 at 12:10 p.m.
    

    Ask ChatGPT?!

    Timing and Locations: The robberies occurred within a relatively short time frame in various blocks around Chicago. The consistent timing and proximity of the incidents could suggest that the same group of criminals or an individual with a fast-moving vehicle was involved in these robberies.

    Geographical Concentration: The robberies are concentrated in the North and Northwest areas of Chicago, particularly in neighborhoods like Logan Square and Humboldt Park. This could imply that the criminals are familiar with these areas and may have local knowledge, which might include escape routes, hiding spots, and less patrolled streets.

    Possible Organized Crime: The fact that multiple robberies occurred within such a short time span could suggest some level of organization or coordination among the criminals. This could be a sign of a more sophisticated criminal group rather than isolated incidents committed by individuals acting independently.

    Preferential Targeting: Looking at the specific locations, it's possible that the criminals targeted commercial areas or residences that they believed to be easy targets. They might have assessed the vulnerability of these places beforehand, which could indicate some level of planning.

    Potential Vehicle Involvement: The close timing of the robberies, especially those separated by significant distances, could indicate the use of a vehicle to quickly move from one location to another. This could imply that the criminals are mobile and might have access to a means of transportation.

    Time of Day: The majority of the robberies took place during daylight hours, suggesting that the criminals might be more comfortable operating in these conditions. This could be indicative of a level of confidence in their activities.

    Possibly Repeat Offenders: The repetition of certain block addresses, like the two incidents on the 4300 block of West Schubert, could imply that these locations were specifically targeted by the same group or individual. This might suggest they have some familiarity with these spots or had prior success there.

    Potential Surveillance: The fact that the robberies happened within such a short time frame and in the same general areas might indicate that the criminals were aware of the police response time in these neighborhoods. This could mean they were monitoring law enforcement patterns.

    It's important to emphasize that these inferences are speculative and based on the information provided. To make more accurate conclusions, law enforcement agencies would need to thoroughly investigate the incidents, analyze any available evidence (such as surveillance footage, eyewitness accounts, and modus operandi), and potentially link these incidents to individuals or groups based on their methods and patterns.

  • A Buford
  • July, 2023

Pop-up notifications when users authenticate with Active Directory (AD)

    Open the Event Viewer: Press the Windows key + R, type "eventvwr.msc" (without quotes), and hit Enter.


    1)Navigate to the security log: Expand "Windows Logs" and select "Security."
    2)Create a custom view: Right-click "Security" and choose "Create Custom View."
    3) Configure the custom view: In the "Custom View" window, set the filter conditions to match successful logon events. For example, under the "Event level" section, select "Success" for the "Keywords" field. You can further customize the filter based on your requirements.
    4) Configure the action: In the "Custom View" window, click the "XML" tab and select "Edit Query Manually." Replace the existing XML code with the following:

    The code @github

    5) This XML code filters events with Event ID 4624 (successful logon events) and LogonType 2 (interactive logon) or 10 (remote interactive logon). You can adjust these values if needed.
    6) Save the custom view: Give the custom view a name, choose an appropriate folder to save it in, and click "OK" to save the view.
    7)Configure the notification action: Right-click the custom view you created, select "Attach Task to This Custom View," and follow the wizard to create a task.
    8)Configure the task settings: In the task wizard, select "Display a message" as the action. Enter the title and message for the pop-up notification. You can customize the appearance and behavior of the notification as well.
    9)Save the task: Complete the task creation wizard by specifying a name and other optional settings.

    You should start receiving pop-up notifications whenever a user successfully logs on with an interactive or remote interactive session.

  • A Buford [Post created with AI assistance]
  • July, 2023

A pattern of Chicago robbery crime

    Update [8/23]: What does chatGPT see? I'm sure if my question were worded better more information would have been provided. What was returned is helpful, right?

    From the data provided, we can observe the following information and patterns:
    
    1. Locations and Times: The data consists of a list of locations where robberies were committed, along with the corresponding dates and times of the incidents.
    
    2. Spatial Clustering: There are clusters of robberies happening in certain areas. For example, multiple incidents occurred on the same day in close proximity to each other, such as the ones on July 9 in the 2800 block of West Chicago Avenue, 4000 block of North Damen Avenue, and 4600 block of North Ravenswood Avenue. Similarly, on July 11, several incidents occurred in the early morning within the vicinity of 3800 block of West Lawrence Avenue and 4900 block of North Elston Avenue.
    
    3. Temporal Patterns: There is a pattern of robberies occurring during the late-night and early-morning hours. Many incidents took place between 1:00 a.m. and 5:00 a.m. This suggests that the perpetrators might be targeting areas during quieter and less crowded times.
    
    4. Repeated Locations: Some locations experienced multiple incidents. For instance, the 3800 block of West Lawrence Avenue had two robberies on July 11, at 4:55 a.m. and 5:00 a.m. This could indicate a potential pattern of the perpetrators revisiting familiar or vulnerable locations.
    
    5. Frequency: Robberies seem to be relatively frequent, occurring on consecutive days in some instances.
    
    6. Types of Areas: The locations mentioned are primarily streets and blocks, indicating that these incidents are happening in public areas and not within buildings or specific establishments.
    
    It is important to note that this information alone might not be sufficient to draw definitive conclusions about the motives or identities of the perpetrators. Further investigation and analysis would be needed to understand the underlying causes and develop strategies to address the issue.
    

    What do you see? With enough data multiple patterns can be identiified.

    The Facts:
    400 block of North Noble Street on July 8, at 8:45 p.m. 
    2800 block of West Chicago Avenue on July 9 at 12:15 a.m. 
    4000 block of North Damen Avenue on July 9 at 1:30 a.m. 
    4600 block of North Ravenswood Avenue July 9 at 1:39 a.m.
    600 block of West Madison Street on July 9 at 2:30 a.m.
    4500 block of North Keokuk Avenue on July 9 at 3:17 a.m.
    1900 block of West Norwood Street on July 9 at 3:30 a.m. 
    2000 block of West Peterson Avenue on July 9, 2023 at 4:02 a.m. 
    6400 block of North Oakley Avenue on July 9 at 4:19 a.m.
    6400 block of North Claremont Avenue on July 9 at 4:22 a.m. 
    1900 block of West Montrose Avenue on July 10 at 12:01 a.m.
    4400 block of North Sheridan Road on July 10 at 6:10 a.m.
    3900 block of North Lincoln Avenue on July 10 at 6:20 a.m. 
    2000 block of North Damen Avenue on July 10 at 6:25 a.m.
    3300 block of North Paulina Street on July 10 at 6:26 a.m.
    2100 block of West Devon Avenue on July 11 at 4:37 a.m.
    6000 block of North Western Avenue on July 11 at 4:40 a.m. 
    6000 block of North Paulina Street on July 11 at 4:45 a.m.
    5000 block of North Broadway on July 11 at 4:50 a.m. 
    3800 block of West Lawrence Avenue on July 11 at 4:55 a.m.
    3800 block of West Lawrence Avenue on July 11 at 5:00 a.m.
    4900 block of North Elston Avenue on July 11 at 5:04 a.m.
    5300 block of North Elston Avenue on July 11 at 5:19 a.m. 
    1900 block of North California Avenue at 1:15 a.m.
    2600 block of North Fullerton Avenue at 1:20 a.m.
    2000 block of North Milwaukee Avenue at 1:30 a.m.
    5400 block of West Gale Street at 1:55 a.m.
    2400 block of North Central Avenue at 2:11 a.m.
    3400 block of North Knox Avenue at 2:40 a.m.
    

    Most robberies occur between 12:00am and 06:30am

    As the days progressed the robberies became more frequent

    The attackers attempt to avoid the further West parts of the city until wk/of July 11th.

  • A Buford
  • July, 2023

Family Friend VPN

    I'm working on something to secure my circle.

    Update July 2023: Send me an email with device type. I send you a config for LAN resources. Easy!

  • A Buford
  • Sept, 2022

EXIF-Ooops. I'm sorry.

    As many of you have noticed the pictures in the picture galleries are now NOT automatically displayed upright. I'm sorry. Sort of. I updated my rsync script for website updating...

    exiftool -r -all= -ext jpg -ext gif -ext png [a-folder-on-my-server]/images/

    find [a-folder-on-my-server]/images/ -type f -name '*_original' -delete

    As you can see it simply strips EXIF data from images, in images galleries, prior to update and deletes the originals. This caused the issues displayed. I may or may not work on a fix and research the gallery functionality more closely.

  • A Buford
  • Aug, 2022

Thank you Pi-Hole

    You keep the ads at bay and phoning home to a minimum. Pi-Hole is one of the most beneficial, and most utilized, piece of software on my SOHO LAN.

  • A Buford
  • Aug, 2022

Home Assistant Object dectection automation update

    I decided to limit the lighting automation, on front doorway, to after sunset because it only makes more sense. I need to save electricity!

    alias: Frigate (Front doorway light on person dectect)
    description: ""
    trigger:
      - platform: mqtt
        topic: frigate/events
        payload: "on"
        value_template: >-
          {{ "on" if value_json["type"] == "new" and value_json["before"]["camera"]
          == "front_door_cam_fri" and value_json["before"]["label"] == "person" else
          "off"}}
    condition:
      - condition: sun
        after: sunset
    action:
      - type: turn_on
        device_id: 1ac8dbe1de45515de0cb274ec116b916
        entity_id: light.front_doorway_light
        domain: light
    mode: single
    

    Lights shouldn't be needed until after sunset. Right?

  • A Buford
  • Aug, 2022

Nessus {Essentials} Vulnerability Scanning

    I took some time over the weekend to once again use Nessus and see what the offerings were. Similar to my inital learning with Burp-Suite I'm currently limited to a learners/student edition of the scanner. This isn't my first Nessus Rodeo. I setup an Ubuntu Server virtual machine using qemu/kvm. Next I installed Nessus with an education license and proceeded to port 8834, at the VM IP adress, to access the Nessus web UI and configuration wizard.

    Installation is as easy as downling the most recent .deb package then; sudo dpkg -i Nessus-10.3.0-ubuntu1404_amd64.deb && sudo /bin/systemctl start nessusd.service

    The advanced scan will satisfy most individuals looking to get familar with Nessus from my experience. It is a great way to categorize and prioritize potential risks. Verify a finding as intended functionality and/or false-positive.

    May I scan you free of charge? Small businesses, I'm serious.

  • A Buford
  • Aug, 2022

Evil doesn't sleep. Knock.Knock.

    Passwordless authentication for-the-win. While we sleep, eat, work, and do everything else there may be a system knocking at your front door a hundred times a second. SSH and password authentication can easily turn into an attackers foothole with a little dedication and large enough wordlist..

    That is all. For now.

  • A Buford
  • Aug, 2022

A new page & SOQL+Apex+SFDC>CySA+

    Previous page is now indexed at #8 now.

    I have to take a break on starting with the CySA+ studying. I need to focus a little more on some Salesforce platform items for the next few weeks. I may or may not be able to post between now and then. ๐Ÿ˜”

    Also! Don't forget. New page banner added.

    The old banners can be viewed with a little URL tampering. Try it out! Be brave! Warning: Rate-limits do exist.

  • A. Buford
  • Aug, 2022