NGVB – International Private Security & Investigations. Discreet security solutions for individuals, families and businesses. Residential security, personal protection coordination, executive mobility, OSINT research and corporate risk awareness. International enquiries welcome, subject to local laws and operational availability.

Has anyone ever been at a site where the contract wasn't renewed or was canceled?

Our training has went to shit, they are hiring flexes left and right (I know that these people are never going to get up to speed), the quality of work and employees has significantly dropped, the Branch has pretty much went quiet, people are not disciplined hardly at all, new S/Os are showing up in partial street clothes or without propper PPE, tardies and call offs are through the roof and the ACCT. Manager has pretty much checked out. I have a really strong gut feeling that they are about to get canned. A trusted coworker is thinking the same thing and if I was the Client, I'd shit-can the contract...

So long story short I was seeing someone and they told me they’re the maintenance dude of the apt I live in after already seeing each other. Not going to give many details to many details but this whole situation has me disturbed.

The building does not allow ring cameras so I was looking for something that could discreetly record in front of my door as they told me their desires to harm others property by putting stuff under the door.

I have a camera inside my place but I wanted to see if anyone knew or recommended a sort of peephole camera that can attach to an existing one on the inside of the door so I don’t have to alert the building to a change.

If you are using dogs as your primary means of detection for explosives and firearms your facility is at risk.
For less than $500 in supplies your facility can be essentially shut down using your own dogs.

Think about applying the KISS principle.

No entity is able to control what happens when the canine’s effectiveness is used against the entity using the canines. They will become overwhelmed with no action plan.

Attacks are automated now. New endpoints get scanned within minutes, and credential stuffing and stolen sessions are routine. Firewalls and MFA are necessary, but they don't tell you when something gets through. Detection, automated response and an audit trail are a baseline defense today, not an enterprise luxury. Here's how a small company (Example Company) runs it on one VM, all deployed with Ansible.

Setup

• Hetzner VM (4 vCPU, 8 GB), Wazuh 4.14 in Docker. The public IP accepts nothing; everything goes over Tailscale.

Detect (SIEM)

• AWS: CloudTrail, WAF and app logs, e.g. "20+ denied requests within N minutes".

• Laptops: Wazuh agents with FIM on persistence paths, SSH config and sudoers.

• DNS: AdGuard as the tailnet resolver, every lookup logged.

• Network: the VM is a Tailscale exit node with Suricata, so phones get IDS coverage on mobile data too.

• MITRE ATT&CK: rules are tagged with technique IDs, so you see which tactics are being tried.

Respond (SOAR)

• SOARCA playbook: 10+ WAF blocks in 2 min → reputation lookup → AWS WAF block (24 h, 7 days if known malicious) → mail.

• Alert mail is deduped and rate-capped, and every alert type has a runbook.

Protect the SIEM itself

• Tailscale SSH with a 2FA check every 12 h, so deploys need MFA too.

• All sudo sessions are recorded and replayable.

• Sensitive switches need a TOTP code (PAM). Repeated wrong codes raise a high alert.

Mobile

• A read-only alerts API plus push to a SwiftUI app with severity, agent posture and SOAR runs.

Numbers (24 h): ~137k alerts: 2 critical, 99 high, ~5.8k medium, the rest low noise. Deduplicating repeated high alerts is next.

Lessons: private network from day one, write the lock-out runbook before enabling SSH MFA, and monitor the monitor.

Questions welcome, happy to share rules and playbooks.

Our organization is evaluating autonomous cleaning robots for use in operational facilities. While the benefits are obvious, we're currently assessing the security implications.

Modern cleaning robots often use cameras, LiDAR, microphones, SLAM mapping, cloud connectivity, remote management, and mobile apps. Depending on the vendor, they may collect or process:

* Building layouts and maps
* Video and image data
* Audio recordings
* Location and telemetry data
* Operational schedules and movement patterns

For organizations operating critical infrastructure, this raises some concerns. A detailed map of facilities, combined with cloud connectivity or remote access features, could potentially create an additional attack surface.

Has anyone here already performed a security assessment of commercial cleaning robots or similar autonomous service robots?

I'd appreciate hearing about practical experiences, lessons learned, or recommendations before we move further.

I will try to be a short as possible. My daughter, 25, lives with her husband about 7 1/2 hours from us. All of our Apple devices are basically connected through the same Apple account. There is a woman about 2 to 3 years younger than my daughter that is INFATUATED with her. The other night my wife and I were sitting watching TV and my wife's Ipad lit up. It said that the girl in question would be notified when my daughter left her apartment complex. I got upset but wife said to keep my mouth shut as she did not want my daughter to know we see some of her messages and also some of her calls. Some not all. My question is how can I go about getting the tracker off her phone, if that is possible? Can I call Verizon and see if they have the ability to block it or remove it? My daughter told her mom just this weekend that this other girl scares her because she is overly possessive and infatuated with her and just plain comes out and makes her feel very uncomfortable. Any suggestions would be appreciated. I worked in IT and IT security and retired 11 years ago so I am really not up on phone security. Thanks

Unpopular opinion: speed to alert is overrated if the escalation does not preserve the investigation.

If the next team has to reopen the same logs, rediscover the affected identity, and reconstruct the timeline from scratch, then the response clock effectively starts over.

A useful handoff should answer three things: what was observed, why it matters, and what decision the receiving team needs to make.

What information makes an escalation actionable in your environment?

October marks Cybersecurity Month, an initiative aimed at promoting greater security for digital users. One of the simplest ways to strengthen the security of our accounts is multi-factor authentication (MFA), which adds an extra step when signing in.

Passwords are still a common target for phishing, fake websites and other social engineering techniques. Adding a second authentication step can help protect your account if your credentials are stolen.

Here are a few things to keep in mind:

• Enable MFA on accounts that contain sensitive or business information.

• Use an authenticator app or another verification method whenever possible.

• Keep the device you use for authentication protected.

• Passkeys offer an alternative to traditional passwords.

• MFA does not replace other security measures, but it can help protect your account if your password is compromised.

Do you consider MFA one of the first security measures that should be implemented?

I've been working on a security-focused npm package called anti-session-hijack.

The idea came from a simple question:

What happens if an attacker gets hold of a valid authentication token?

Traditional token validation can still consider that token legitimate. The attacker doesn't need the user's password anymore — they already have a valid session credential.

I built anti-session-hijack to add another layer of protection by binding an authentication token to a browser/device fingerprint and validating that binding on protected requests.

How it works

User logs in
     ↓
Authentication token generated
     ↓
Browser/device fingerprint generated
     ↓
Token ↔ Fingerprint binding stored in Redis
     ↓
Protected request
     ↓
Current fingerprint checked
     ↓
       ┌───────────────┐
       │ Match?        │
       └───────┬───────┘
          Yes  │  No
           ↓   ↓
        Allow  🚨 Suspicious session
                   ↓
             Block / revoke /
             alert the user

The package provides:

• Session/token binding

• Stolen and reused token detection

• Browser/device fingerprinting

• Redis-backed session storage

• Upstash Redis support

• TypeScript support

• Next.js App Router support

• Security alert capability

• JWT generation with a unique nonce

Installation:

npm install anti-session-hijack

Example:

const result = await verifySession(
  hashedToken,
  currentFingerprint,
  redisClient
);

if (result.hijacked) {
  // Revoke session
  // Notify user
  // Trigger security response
}

The package has currently has 3K+ npm downloads.

I’d really appreciate it if you could star ⭐the GitHub repository and share it with developers or security communities who might be interested.

GitHub:
https://github.com/Shield-Ltd/Anti-Session-Hijack-NPM

npm:
https://www.npmjs.com/package/anti-session-hijack

I'm posting this mainly because I'd like security-focused feedback, especially from people who have worked with authentication/session security.

I'm still developing it, so security criticism is very welcome. If you see a weakness in the design, I'd rather hear about it now than after someone deploys it.

Which work schedule would offer a better work life balance?

Loomis or brinks or garda hire me with a military general under honorable discharge with 2 years of service. And 1 year of unarmed security, thoughts?

For the truck armed transport

Can they or no?

I'm trying to decide between 2 job offers. One is for Residential Estate Security (EP work), and the other is for Security 3 position at Spacex in Hawthorne California. Both pay the same.

Imagine an attacker knows my name, phone number, email address, home address, date of birth, previous addresses, and even has copies of ID documents obtained through breaches or from organizations that store them.

They call my bank and claim they've lost access to their phone and email and need help recovering their account.

This got me thinking about the tradeoff between security and recoverability.

If account recovery is too strict, legitimate customers can permanently lock themselves out after losing devices, passkeys, recovery codes, or access to old contact details.

If account recovery is too flexible, an attacker who has accumulated enough personal information may be able to convince an institution that they're the legitimate account holder.

My question is: what are the current best practices around account recovery, and what practical steps can ordinary users take to maximize their chances of recovering their own accounts while minimizing the risk of an attacker abusing the same recovery process?

Are there any good articles, talks, books, or frameworks that discuss this problem holistically and in plain language, rather than from a purely technical perspective?

Pretty crazy story.

Here's a short film made by the whistleblower: https://www.youtube.com/watch?v=OmEPNAy3RtA

Steam Workshop is being used to distribute malware disguised as Wallpaper Engine content. Attackers exploited “application wallpapers” to execute Windows code and deliver payloads such as Steam credential stealers, the DarkKomet backdoor, and cryptocurrency miners.

Treat Workshop content like any other Internet download, even when it comes from a trusted platform:

• Be cautious with application wallpapers, mods, and other executable content.

• Avoid password-protected archives or unexpected files.

• Watch for unusual processes, credential-access activity, or outbound connections.

• Keep endpoint protection enabled and up to date.

• Use MFA on Steam accounts and watch for unexpected login activity.

Have you seen trusted platforms being used as malware delivery vectors in your environment?

I track Chrome Web Store removals and today's pass picked up 15 extensions pulled with a malware classification, not the usual policy or spam category.

https://malext.io/?reason=Malware&day=2026-09-16

Important thing is that removal from the google store does not remove the extension from browsers that already have it.
Unless Google pushes it to the built-in blocklist, it keeps running with whatever permissions it was granted. They have to be removed manually !

A couple of days ago, an Amazon driver entered my home without permission, delivered a package then left, leaving my front door wide open. Proof of his illegal entry is the photograph Amazon sent me as proof of delivery. The Amazon driver had no right to enter my home. Packages are to be left outside in a place hidden from the public and if they can't deliver the package, they're supposed to contact the customer. How did the driver get inside? The front door is locked. Even if it was unlocked, he had no right to enter my home. This happened in the US, not overseas.

I have a forum I keep around but it's dead, and not really well known although it's been around since the early 2000's (currently running on more up to date software though). Been dealing with a massive DDoS, all the IPs are unique making it very hard to mitigate on my own. Gave in and setup Cloudflare and it solved it, but just curious if there's some weird widespread DDoS going on right now or what.

Hi! I'm currently looking for a beginner CTF Team to learn and compete with regularly.

The CTF categories I'm currently focused on are:

• Web Exploitation / Web Security

• OSINT

• Forensics

• General pentesting

I'm actively still learning and improving on my skills so I'm looking for a team that doesn't mind beginners and is more focused on improving and learning with each other

I'm open in joining a team or building a small team of my own.

Feel free to DM if your team is recruiting or if you're on the hunt for beginner teammates! <3

(Note: I've registered for the K17 CTF on September 11th, so I'd be down in teaming up for this event specifically as well.)