BRING YOUR OWN TRUSTED BINARY (BYOTB) – BSIDES EDITION

Summary from the TLDR InfoSec newsletter

In this transcript of a talk that David Kennedy gave at BSides London 2024, Kennedy breaks down how existing binaries like Cloudflared and SSH can be used for tunneling and port forwarding in network security scenarios. He notes that the initial example relies on SSH existing on the system and also discusses how the binary can be copied into a Windows system easily. Kennedy also explores defensive measures such as monitoring for specific command line switches and DNS logging to detect potential attacks involving these binaries.