OpenSecurityTraining2

The first cut of the new gamified OST2 is available at p.ost2.fyi. Start poking around and let us know what's broken!

ost2.fyiBluetooth 2222: Bluetooth reconnaissance with Blue2thprintingBluetooth 2222: Bluetooth reconnaissance with Blue2thprinting

Bluetooth security starts with recon. Learn passive & active collection, device fingerprinting & crowdsourced intel with Blue2thprinting. Bluetooth 2222 by @xenokovah.bsky.social ost2.fyi/BT2222 (~8.5 hrs)

ost2.fyiTrusted Computing 1103: Advanced Trusted Platform Module (TPM) usageTrusted Computing 1103: Advanced Trusted Platform Module (TPM) usage

Build a disk encryption solution with TPM! Advanced policies, key attestation & importing external keys to be protected by hardware instead of software. The capstone of the TPM trilogy. Trusted Computing 1103: Advanced TPM Usage ost2.fyi/TC1103 (~12 hrs)

There was a UI error on the site which was allowing students to track their progress within a class while not being enrolled. We've fixed the UI bug, and enrolled students who had non-0% progress in unenrolled classes.

View full thread

While it was our intention to make class material fully publicly available, it was not the intention that the UI would allow signed-in-but-unenrolled users to click "Mark as complete" and get updated Progress page UI that confusingly made students think they were properly enrolled.

Hopefully now the UI is more clear. Thanks to the user who reported this!

This led to thousands of new enrollments, badges earned, and at least 57 new completion certificates being awarded!

ost2.fyiDebuggers 1101: Introductory IDADebuggers 1101: Introductory IDA

Get introduced to IDA, an industry-standard disassembler! Learn breakpoints, stepping, memory/register inspection. The essential start for any RE path. Debuggers 1101: Introductory IDA ost2.fyi/Dbg1101

Another nudge which we've added to the site is the different tiers of course completion accomplishments. If you complete a class within 2 weeks of starting it you'll get Gold (12.5k points), 4 weeks Silver (6250), 12 weeks Bronze (3125), and > 12 weeks Plain (1250).

OpenSecurityTraining2@opensectraining.bsky.social

As part of the gamification we're rolling out a few "Ignominious" badges to nudge users' behavior in the right direction. 🧵

We've also updated the certificates to match the accomplishment coloring. We hope students will finish classes ASAP after they start them going forward!

We scraped our git history to grant the Subtitle Superhero to all the awesome people who've submitted subtitle fixes over the years. If we missed you though, let us know!

And we just had an idea while posting and will add it to our TODOs to make it so that in the future the leaderboard for that badge re-orders based on who's contributed the most lines of fixes, as opposed to who has the overall most OST2 points as the default per-badge leaderboards work.

Deployed! p.ost2.fyi/gamma_dashbo...

p.ost2.fyiAuthentication

As a thank you and more public recognition, we've granted this donor badge to the folks who donated in our recent campaign. But if you donated through work or YouTube we can't correlate to your account, so please let us know at donor at ost2.fyi and we'll get that added! p.ost2.fyi/gamma_dashbo...

Also, filling in your profile is worth some points towards the leaderboard!

OpenSecurityTraining2@opensectraining.bsky.social

Also now's the time to fill in your profile information so you can show up how you want on the leaderboards! (Putting in your country will then have you show up on the per-country leaderboard.)

As part of the gamification we're rolling out a few "Ignominious" badges to nudge users' behavior in the right direction. 🧵

View full thread

We know it's a common behavior to treat the site like Netflix and to add stuff that you just think you may get around to someday. But the fix is easy, just unenroll from the classes you're not going to take any time soon.

You get a clean dashboard, and we get better statistics about who's actually working on classes!

As part of the gamification we're rolling out a few "Ignominious" badges to nudge users' behavior in the right direction. 🧵

Do you have 5 or more OST2 classes that you enrolled in but haven't started? Congrats, you've been granted the "Watchlister" accomplishment (-10k points!) Not only that, but you can't sign up for new classes!

OpenSecurityTraining2 reposted

This is “Li’l Stranger”, the new mascot for @opensectraining.bsky.social - “I’m Xeno and I approve of this message!”

OpenSecurityTraining2@opensectraining.bsky.social

Also now's the time to fill in your profile information so you can show up how you want on the leaderboards! (Putting in your country will then have you show up on the per-country leaderboard.)

Also now's the time to fill in your profile information so you can show up how you want on the leaderboards! (Putting in your country will then have you show up on the per-country leaderboard.)

And if you want to opt out of showing up on the leaderboards, you can find that option under your new profile page too

p.ost2.fyi | OpenSecurityTraining2

The production server p.ost2.fyi will be down at some point tomorrow to begin applying the first cut of the gamification platform & backfilling user accomplishments!

Xeno Kovah@xenokovah.bsky.social

Immense thanks to everyone who stepped forward to support #OST2! ❤️ Your generous donations help show that you value providing free high-quality educational material to the world.

youtube.comArchitecture 1901: From Zero To QEMU - YouTubeView the full free class with labs etc at https://ost2.fyi/Arch1901 ! This class by Antonio Nappa of Fuzz Society (https://fuzzsociety.org/) builds up your k...

We have posted the YouTube playlist for "Architecture 1901: From Zero to QEMU" by Antonio Nappa @jeppojeps.bsky.social of Fuzz Society. URLs for offline download can be found here: www.youtube.com/playlist?lis... But as always the best experience is at the full class at ost2.fyi/Arch1901.

OpenSecurityTraining2 reposted

Replying to @xenokovah.bsky.social

Now it's time for us to make good on our promise to making learning more fun on the site, and to start highlighting all the accomplishments students have achieved and can yet achieve!

OpenSecurityTraining2 reposted

Immense thanks to everyone who stepped forward to support #OST2! ❤️ Your generous donations help show that you value providing free high-quality educational material to the world.

youtube.comTrusted Computing 1103: Advanced TPM Usage - YouTubeView the full free class at https://ost2.fyi/TC1103 ! This is the epic conclusion to the 3-class TPM series (begun in https://ost2.fyi/TC1101 (~8h) and conti...

We have posted the YouTube playlist for Trusted Computing 1103: Advanced TPM Usage by Dimi Tomov in partnership with the TCG. Now anyone wishing to download the videos for offline viewing can find all their URLs here: www.youtube.com/playlist?lis... But for the full class see ost2.fyi/TC1103

youtube.comOST2 Gamification Support Fundraiser Public Playlist - YouTubeOST2 is fundraising to support the development and deployment of a gamification system on the main learning site! Donate today to help support OST2! https://...

All of the videos showing our planned gamification updates to the website are now available in this playlist: www.youtube.com/playlist?lis...

ost2.fyiSecure Development 1002: C-Family Implementation Vulnerabilities 2Secure Development 1002: C-Family Implementation Vulnerabilities 2

Part 2 for devs! UAFs, race conditions, type confusion & info leaks. Real 0day exploit walkthroughs show why "looks unexploitable" are famous last words. Secure Development 1002 ost2.fyi/SecDev1002 by @xenokovah.bsky.social

OpenSecurityTraining2@opensectraining.bsky.social

The best defense is understanding the offense. Learn to spot and prevent the C/C++ implementation bugs that attackers love to exploit. Secure Development 1001 by @xenokovah.bsky.social at ost2.fyi/SecDev1001

ost2.fyiSecure Development 1001: C-Family Implementation Vulnerabilities 1Secure Development 1001: C-Family Implementation Vulnerabilities 1

In this final video @xenokovah.bsky.social talks about how the gamification system will allow us to recognize other worthwhile achievements outside of the platform, such as speaking at security conferences!

OpenSecurityTraining2@opensectraining.bsky.social

🎮This is the last week of the OST2 gamification fundraiser! If you were waiting to be a last-minute hero, now is the time to swoop in!🕹️ www.every.org/ost2/f/lets-...

And not only will you get to show off your accomplishments, but by supporting our build-out for gamification, you'll also be helping OST2 support itself, by opening up a new type of sponsorship of OST2 by security conferences themselves!

🎮This is the last week of the OST2 gamification fundraiser! If you were waiting to be a last-minute hero, now is the time to swoop in!🕹️ www.every.org/ost2/f/lets-...

ost2.fyiSecure Development 1001: C-Family Implementation Vulnerabilities 1Secure Development 1001: C-Family Implementation Vulnerabilities 1

18 Sept

18 Sept

🎮Our gamification fundraiser ends next week but we need your support today!🕹️ www.every.org/ost2/f/lets-... In this penultimate video @xenokovah.bsky.social talks about how the gamification will allow us to recognize the ultimate volunteers, the instructors!

18 Sept

Donations don't need to be large! Many hands make light work and we'd love to see how many people support what we do!🙏 And if you've got an idea for an OST2 class, reach out at teach🌀ost2.fyi! We've got many instructors who are working on classes, and we'd love to add your class to the queue too!

OpenSecurityTraining2 reposted

I’ve been looking for a way to recognize #OST2 volunteers more publicly, and this will allow them to stand head and shoulders above other OST2 students and claim their rightful place of honor! Only the instructors and potentially hardcore class-completionists will shine brighter!

OpenSecurityTraining2@opensectraining.bsky.social

🎮Our gamification fundraiser ends soon and we need your support!🕹️ www.every.org/ost2/f/lets-... Here @xenokovah.bsky.social talks about how the gamification will allow us to recognize the volunteers who make classes better through beta testing, subtitle correction, graphics contributions, etc!

All videos to date talking about the proposed gamification system update are posted here: www.youtube.com/playlist?lis...

It's the 11th hour and we really want to know how many people support what we do, so even small donations help us by showing who are our true friends & fans!🙏

ost2.fyiDebuggers 3011: Advanced WinDbgDebuggers 3011: Advanced WinDbg

Build the ultimate Windows kernel debugging setup! Automated VMs, ret-sync with IDA/Ghidra, and source-level kernel debugging. Your exploit lab for Cedric Halbronn's classes awaits! Debuggers 3011: Advanced WinDbg ost2.fyi/Dbg3011

🎮In the 6th video in our fundraiser, @XenoKovah talks about how student profiles would become much more useful with gamification!🕹️  🧵

Traditionally Open edX didn't do much with student profiles, but now we can make them a useful hub to show off your accomplishments on and off the site.  But to make this happen we need everyone who likes OST2 to show their support at www.every.org/ost2/f/lets-... 🙏

To check out our past videos for more about gamification, see here: www.youtube.com/playlist?lis...

ost2.fyiArchitecture 2821: Windows Kernel Internals 2Architecture 2821: Windows Kernel Internals 2

Want to write kernel exploits or analyze malware? You need to understand Windows internals first. Syscalls, IRQL, pools, mitigations & more. Architecture 2821: Windows Kernel Internals 2 by Cedric Halbronn ost2.fyi/Arch2821

OpenSecurityTraining2 reposted

youtu.beOST2 Gamification Fundraiser: Video 5: LeaderboardsYouTube video by OpenSecurityTraining2

I think inter/intra-country leaderboards will drive some fun inter/intra-country competition. E.g. here’s who’s been active on OST2 in the last 30 minutes (it’s currently too-early-to-be-up-o’clock on a holiday in the US ;)). But which country has the TOP students?!

OpenSecurityTraining2@opensectraining.bsky.social

🎮In the 5th video in our gamification fundraiser, @xenokovah.bsky.social talks about how leaderboards will work!🕹️  We will have a bunch of different leaderboards: global for the entire site, per-country, per-class, per-accomplishment, and possibly more!  youtu.be/sJEFw-e1iao

youtu.beOST2 Gamification Fundraiser: Video 5: LeaderboardsYouTube video by OpenSecurityTraining2