There was an org that didn’t see
\nThe data exfil hacking spree.
\nA patch went up, our guard was down,
\nOh blow, SolarWinds, blow.<\/p>\n
\n Soon may the Vendorman come,
\n And bring us Yara rules to run.
\n One day when their huntin’ is done,
\n They’ll take their scripts and go.\n<\/p><\/blockquote>\nThere was no implant here before,
\nBut after was a sly backdoor.
\nThe C2 signals they did soar
\nAnd labored low and slow.<\/p>\nAs the attack did laterally move
\nOur foe did get into their groove;
\nStealing certs; installing ‘sploits
\nWher’er they did go.<\/p>\nThen one day in the by and by,
\nSome clever folk with a firey-eye,
\nSpotted something amiss in Orion’s belt
\nAnd a delvin’ they did go.<\/p>\nThe sunburst cleared and they did see
\nThe origin of their recent misery.
\nA blog went up; they did proclaim
\nMany other orgs were laid low.<\/p>\nAs far as I’ve heard, the fight’s still on;
\nThe C2s blocked but the attackers aren’t done.
\nThe Vendorman makes his regular call
\nTo help CISO, crew and all.<\/p>\n","protected":false},"excerpt":{"rendered":"There was an org that didn’t see The data exfil hacking spree. A patch went up, our guard was down, Oh blow, SolarWinds, blow. Soon may the Vendorman come, And bring us Yara rules to run. One day when their huntin’ is done, They’ll take their scripts and go. There was no implant here before, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"activitypub_content_warning":"","activitypub_content_visibility":"","activitypub_max_image_attachments":3,"activitypub_interaction_policy_quote":"anyone","activitypub_status":"","footnotes":""},"categories":[3,837],"tags":[],"class_list":["post-12887","post","type-post","status-publish","format-standard","hentry","category-information-security","category-sea-shanties"],"yoast_head":"\n
Soon May the Vendorman Come - rud.is<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/rud.is\/b\/2021\/01\/22\/soon-may-the-vendorman-come\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Soon May the Vendorman Come - rud.is\" \/>\n<meta property=\"og:description\" content=\"There was an org that didn’t see The data exfil hacking spree. A patch went up, our guard was down, Oh blow, SolarWinds, blow. Soon may the Vendorman come, And bring us Yara rules to run. One day when their huntin’ is done, They’ll take their scripts and go. There was no implant here before, […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/rud.is\/b\/2021\/01\/22\/soon-may-the-vendorman-come\/\" \/>\n<meta property=\"og:site_name\" content=\"rud.is\" \/>\n<meta property=\"article:published_time\" content=\"2021-01-22T11:54:35+00:00\" \/>\n<meta name=\"author\" content=\"hrbrmstr\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"hrbrmstr\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2021\\\/01\\\/22\\\/soon-may-the-vendorman-come\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2021\\\/01\\\/22\\\/soon-may-the-vendorman-come\\\/\"},\"author\":{\"name\":\"hrbrmstr\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#\\\/schema\\\/person\\\/d7cb7487ab0527447f7fda5c423ff886\"},\"headline\":\"Soon May the Vendorman Come\",\"datePublished\":\"2021-01-22T11:54:35+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2021\\\/01\\\/22\\\/soon-may-the-vendorman-come\\\/\"},\"wordCount\":187,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#\\\/schema\\\/person\\\/d7cb7487ab0527447f7fda5c423ff886\"},\"articleSection\":[\"Information Security\",\"Sea Shanties\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/rud.is\\\/b\\\/2021\\\/01\\\/22\\\/soon-may-the-vendorman-come\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2021\\\/01\\\/22\\\/soon-may-the-vendorman-come\\\/\",\"url\":\"https:\\\/\\\/rud.is\\\/b\\\/2021\\\/01\\\/22\\\/soon-may-the-vendorman-come\\\/\",\"name\":\"Soon May the Vendorman Come - rud.is\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#website\"},\"datePublished\":\"2021-01-22T11:54:35+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2021\\\/01\\\/22\\\/soon-may-the-vendorman-come\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/rud.is\\\/b\\\/2021\\\/01\\\/22\\\/soon-may-the-vendorman-come\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/2021\\\/01\\\/22\\\/soon-may-the-vendorman-come\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/rud.is\\\/b\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Soon May the Vendorman Come\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#website\",\"url\":\"https:\\\/\\\/rud.is\\\/b\\\/\",\"name\":\"rud.is\",\"description\":\""In God we trust. All others must bring data"\",\"publisher\":{\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#\\\/schema\\\/person\\\/d7cb7487ab0527447f7fda5c423ff886\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/rud.is\\\/b\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/rud.is\\\/b\\\/#\\\/schema\\\/person\\\/d7cb7487ab0527447f7fda5c423ff886\",\"name\":\"hrbrmstr\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/ukr-shield.png?fit=460%2C460&ssl=1\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/ukr-shield.png?fit=460%2C460&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/ukr-shield.png?fit=460%2C460&ssl=1\",\"width\":460,\"height\":460,\"caption\":\"hrbrmstr\"},\"logo\":{\"@id\":\"https:\\\/\\\/i0.wp.com\\\/rud.is\\\/b\\\/wp-content\\\/uploads\\\/2023\\\/10\\\/ukr-shield.png?fit=460%2C460&ssl=1\"},\"description\":\"Don't look at me\u2026I do what he does \u2014 just slower. #rstats avuncular \u2022 ?Resistance Fighter \u2022 Cook \u2022 Christian \u2022 [Master] Chef des Donn\u00e9es de S\u00e9curit\u00e9 @ @rapid7\",\"sameAs\":[\"http:\\\/\\\/rud.is\"],\"url\":\"https:\\\/\\\/rud.is\\\/b\\\/author\\\/hrbrmstr\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Soon May the Vendorman Come - rud.is","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/rud.is\/b\/2021\/01\/22\/soon-may-the-vendorman-come\/","og_locale":"en_US","og_type":"article","og_title":"Soon May the Vendorman Come - rud.is","og_description":"There was an org that didn’t see The data exfil hacking spree. A patch went up, our guard was down, Oh blow, SolarWinds, blow. Soon may the Vendorman come, And bring us Yara rules to run. One day when their huntin’ is done, They’ll take their scripts and go. There was no implant here before, […]","og_url":"https:\/\/rud.is\/b\/2021\/01\/22\/soon-may-the-vendorman-come\/","og_site_name":"rud.is","article_published_time":"2021-01-22T11:54:35+00:00","author":"hrbrmstr","twitter_card":"summary_large_image","twitter_misc":{"Written by":"hrbrmstr","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/rud.is\/b\/2021\/01\/22\/soon-may-the-vendorman-come\/#article","isPartOf":{"@id":"https:\/\/rud.is\/b\/2021\/01\/22\/soon-may-the-vendorman-come\/"},"author":{"name":"hrbrmstr","@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886"},"headline":"Soon May the Vendorman Come","datePublished":"2021-01-22T11:54:35+00:00","mainEntityOfPage":{"@id":"https:\/\/rud.is\/b\/2021\/01\/22\/soon-may-the-vendorman-come\/"},"wordCount":187,"commentCount":0,"publisher":{"@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886"},"articleSection":["Information Security","Sea Shanties"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/rud.is\/b\/2021\/01\/22\/soon-may-the-vendorman-come\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/rud.is\/b\/2021\/01\/22\/soon-may-the-vendorman-come\/","url":"https:\/\/rud.is\/b\/2021\/01\/22\/soon-may-the-vendorman-come\/","name":"Soon May the Vendorman Come - rud.is","isPartOf":{"@id":"https:\/\/rud.is\/b\/#website"},"datePublished":"2021-01-22T11:54:35+00:00","breadcrumb":{"@id":"https:\/\/rud.is\/b\/2021\/01\/22\/soon-may-the-vendorman-come\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/rud.is\/b\/2021\/01\/22\/soon-may-the-vendorman-come\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/rud.is\/b\/2021\/01\/22\/soon-may-the-vendorman-come\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/rud.is\/b\/"},{"@type":"ListItem","position":2,"name":"Soon May the Vendorman Come"}]},{"@type":"WebSite","@id":"https:\/\/rud.is\/b\/#website","url":"https:\/\/rud.is\/b\/","name":"rud.is","description":""In God we trust. All others must bring data"","publisher":{"@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/rud.is\/b\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/rud.is\/b\/#\/schema\/person\/d7cb7487ab0527447f7fda5c423ff886","name":"hrbrmstr","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1","url":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1","contentUrl":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1","width":460,"height":460,"caption":"hrbrmstr"},"logo":{"@id":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2023\/10\/ukr-shield.png?fit=460%2C460&ssl=1"},"description":"Don't look at me\u2026I do what he does \u2014 just slower. #rstats avuncular \u2022 ?Resistance Fighter \u2022 Cook \u2022 Christian \u2022 [Master] Chef des Donn\u00e9es de S\u00e9curit\u00e9 @ @rapid7","sameAs":["http:\/\/rud.is"],"url":"https:\/\/rud.is\/b\/author\/hrbrmstr\/"}]}},"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p23idr-3lR","jetpack_likes_enabled":true,"jetpack-related-posts":[{"id":2986,"url":"https:\/\/rud.is\/b\/2014\/05\/17\/new-gig\/","url_meta":{"origin":12887,"position":0},"title":"New Gig!","author":"hrbrmstr","date":"2014-05-17","format":false,"excerpt":"Well, the proverbial cat is definitely out of the bag now. I'm moving on from the current gig to take a security data scientist position at Verizon Enterprise. The esteemed Wade Baker will be my new benevolent overlord and it probably isn't a shocker that I went to the place\u2026","rel":"","context":"In "Personal"","block_context":{"text":"Personal","link":"https:\/\/rud.is\/b\/category\/personal\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":7020,"url":"https:\/\/rud.is\/b\/2017\/11\/06\/taking-a-shot-at-cdcfluview-v0-7-0-a-k-a-the-dangers-of-relying-on-hidden-apis\/","url_meta":{"origin":12887,"position":1},"title":"Taking a Shot at cdcfluview v0.7.0 (a.k.a. The Dangers of Relying on ‘Hidden’ APIs)","author":"hrbrmstr","date":"2017-11-06","format":false,"excerpt":"Unlike @noamross, I am not an epidemiologist (NOTE: Noam battles pandemics before breakfast, so be super nice to him) but I do like to find kindred methodologies in other disciplines to help foster the growth of cybersecurity into something beyond it's current Barnum & Bailey state. I also love finding\u2026","rel":"","context":"In "R"","block_context":{"text":"R","link":"https:\/\/rud.is\/b\/category\/r\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2017\/11\/unnamed-chunk-5-4.png?fit=672%2C480&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2017\/11\/unnamed-chunk-5-4.png?fit=672%2C480&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2017\/11\/unnamed-chunk-5-4.png?fit=672%2C480&ssl=1&resize=525%2C300 1.5x"},"classes":[]},{"id":12684,"url":"https:\/\/rud.is\/b\/2020\/03\/04\/catchpole-redux-and-hashing-files-websites-with-ssdeepr\/","url_meta":{"origin":12887,"position":2},"title":"{catchpole} Redux and Hashing Files & Websites with {ssdeepr}","author":"hrbrmstr","date":"2020-03-04","format":false,"excerpt":"\u00dcber Tuesday has come and almost gone (some state results will take a while to coalesce) and I'm relieved to say that {catchpole} did indeed work, with the example code from before producing this on first run: If we tweak the buffer space around the squares, I think the cartogram\u2026","rel":"","context":"In "R"","block_context":{"text":"R","link":"https:\/\/rud.is\/b\/category\/r\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2020\/03\/catchpole-white.png?fit=1200%2C855&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2020\/03\/catchpole-white.png?fit=1200%2C855&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2020\/03\/catchpole-white.png?fit=1200%2C855&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2020\/03\/catchpole-white.png?fit=1200%2C855&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/rud.is\/b\/wp-content\/uploads\/2020\/03\/catchpole-white.png?fit=1200%2C855&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":13317,"url":"https:\/\/rud.is\/b\/2022\/01\/28\/a-weatherflow-tempest-udp-broadcast-receiver-in-golang-rust-swift-and-c\/","url_meta":{"origin":12887,"position":3},"title":"A WeatherFlow Tempest UDP Broadcast Receiver in Golang, Rust, Swift, and C++","author":"hrbrmstr","date":"2022-01-28","format":false,"excerpt":"After a Twitter convo about weather stations I picked up a WeatherFlow Tempest. Setup was quick, but the sensor package died within 24 hours. I was going to give up on it but I had written an R package (for the REST API & UDP broadcast interfaces) and C++ utility\u2026","rel":"","context":"In "C++"","block_context":{"text":"C++","link":"https:\/\/rud.is\/b\/category\/c\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1890,"url":"https:\/\/rud.is\/b\/2013\/01\/12\/how-low-can-it-the-mississsippi-river-go\/","url_meta":{"origin":12887,"position":4},"title":"How Low Can It [The Mississsippi River] Go?","author":"hrbrmstr","date":"2013-01-12","format":false,"excerpt":"Good Stats, Bad Stats has a really good critique of this post that you should read after this (so you know how to avoid the mistakes I made :-) I've heard quite a bit about the current problems with the Mississippi River and wanted to see for myself (with data)\u2026","rel":"","context":"In "Charts & Graphs"","block_context":{"text":"Charts & Graphs","link":"https:\/\/rud.is\/b\/category\/charts-graphs\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":3914,"url":"https:\/\/rud.is\/b\/2016\/02\/04\/alternate-r-markdown-templates\/","url_meta":{"origin":12887,"position":5},"title":"Alternate R Markdown Templates","author":"hrbrmstr","date":"2016-02-04","format":false,"excerpt":"The `knitr`\/R markdown system is a great way to organize reports and analyses. However, the built-in ones (that come with RStudio\/the `rmarkdown` package) rely on Bootstrap and also use jQuery. There's nothing wrong with that, but the generated standalone HTML documents (which are a great way to distribute reports) don't\u2026","rel":"","context":"In "R"","block_context":{"text":"R","link":"https:\/\/rud.is\/b\/category\/r\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/posts\/12887","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/comments?post=12887"}],"version-history":[{"count":0,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/posts\/12887\/revisions"}],"wp:attachment":[{"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/media?parent=12887"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/categories?post=12887"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rud.is\/b\/wp-json\/wp\/v2\/tags?post=12887"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}