Cybersecurity weather person and award winning shitposter. Shitposting is an anagram of Top Insights. You may be surprised to know I am not representing my employer here and these are not their opinions.
Public Key
npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw
Profile Code
nprofile1qqs0dpc2ln0yfq8vs5y02qcysk0pffgnp8ljf2elp7rzc54acjhcw3cpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsdk7w0u
Author Public Key
npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Show more details
Published at
2024-01-09T18:27:42+01:00 Event JSON
{
"id": "4a37b7018c6335d3d691e0fca403fbdd921157c681a39e892f64556dd25b7b95" ,
"pubkey": "f6870afcde4480ec8508f50304859e14a51309ff24ab3f0f862c52bdc4af8747" ,
"created_at": 1704821262 ,
"kind": 0 ,
"tags": [
[
"proxy",
"https://cyberplace.social/users/GossiTheDog",
"activitypub"
]
],
"content": "{\"name\":\"Kevin Beaumont\",\"about\":\"Cybersecurity weather person and award winning shitposter. Shitposting is an anagram of Top Insights. You may be surprised to know I am not representing my employer here and these are not their opinions.\\n\\nI have Direct Messages disabled - you can send them, but I will never receive them.\",\"picture\":\"https://cyberplace.social/system/accounts/avatars/109/387/499/752/708/037/original/ff1988cab5f341e2.png\",\"banner\":\"https://cyberplace.social/system/accounts/headers/109/387/499/752/708/037/original/f22e6e33bbef7d97.jpeg\",\"nip05\":\"[email protected] \"}" ,
"sig": "fe61c07143c47c345da54c6e47876aa5d5a2a2d150597c47e992bbcc885716508147aa1ac9fe01d151bf44d5e13186e01dca0587318eb4e66e2ee8ba9406068c"
}
Last Notes npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont @npub18w7…4wlj I think the content search may be over uploads in past 90 days, not sure though. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont @npub18w7…4wlj how long ago was the file uploaded? Do any engines flag it as malicious? npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont You can now buy Kalashnikovs, pistols, grenades and grenade-launchers on Twitter https://www.bbc.com/news/articles/c86l4pl6072o npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont @npub1g52…u50x hmmm, not sure I believe it 🤣 (that it’s customer created content) npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont @npub19ys…vr34 you may want to include where you are based, roughly npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont It’s valid research and people should apply updates as usual, ie no panic. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont LinkedIn have booted me, no reason provided. 🫡 npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont @npub1242…l2hp he’s pursuing advertisers. Who are risk adverse. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont If anybody wants the subtext of what is happening here, CrowdStrike and Microsoft both really do not want to get sued by Delta and have it go to court as it would potentially be explosive for both orgs and the wider security industry. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Twitter is closing its head office, after mandating staff return to said office and firing those who didn’t. https://www.nytimes.com/2024/08/05/technology/x-twitter-san-francisco-office.html npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont If you reported a vulnerability to Microsoft over the past few decades to January 2024, consider any writeup and proof of concept compromised. #threatintel npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Gartner Magic Quadrant for Unavailability npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Just to be explicitly clear about this, there is an ongoing DDoS attack aimed at Azure. They’re using similar language to last time this happened in 2023. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont A reminder that everything being shared online about the Southport attacker is not real, and is being reshared by media outlets in Russia to peddle anti-migrant fears (and by IT people on LinkedIn). npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Great research for Microsoft here - Black Basta and Akira ransomware deployment using a logic flaw in VMware ESXi, using a zero day (which they don't mention). npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Should Microsoft Recall ever reappear I plan to keep checking how secure it is, because the next evolution of security cannot be Microsoft pouring petrol onto the infostealer fire. https://www.wired.com/story/infostealer-malware-password-theft/ npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont She installed exactly one application, a movie player. It hijacked her entire system. This is why Recall is such a fucking bad idea btw, the idea Windows security is fixed is a joke - home users have no chance against this stuff. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Me at the Olympics after installing too many Skyrim mods npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Olympics opening in video form npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Olympics opening in GIF form npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont @npub1u9n…8kuw https://techcrunch.com/2024/07/24/crowdstrike-offers-a-10-apology-gift-card-to-say-sorry-for-outage/ npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont @npub186w…xwcc it’s a requirement to run Active Directory, every Windows running org does it. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Funniest org save so far npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont BitLocker style, CrowdStrike edition. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Head right, CrowdStrike edition npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Repairing CrowdStrike PCs npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont My mastodon server had its busiest day ever today. Also more federation failures than when Trump got shot. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Every so often some Linux guy replies to me saying ‘no critical infrastructure runs Windows’, so I just gotta say, today is education for you. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont PSA for those in threat intel circles - I know an org remediating 50k systems with CrowdStrike that won’t boot, and their reaction to ‘be careful of CrowdStrike themed phishing!!1!!’ is essentially ‘our entire business is having a heart attack, phishing emails are the least of our problems’. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Obvious point - the CrowdStrike worldwide IT incident is not the fault of one CrowdStrike staff member. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont CrowdStrike's shares are down 20% in pre-market. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont The .sys files causing the issue are channel update files, they cause the top level CS driver to crash as they're invalidly formatted. It's unclear how/why Crowdstrike delivered the files and I'd pause all Crowdstrikes updates temporarily until they can explain. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont BBC tracker (they mix up an earlier Microsoft outage, what they're actually tracking is the Crowdstrike issue) https://www.bbc.co.uk/news/live/cnk4jdwp49et npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont If anybody is wondering, the update was delivered via channel updates in Crowdstrike. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont I've obtained copies of the .sys driver files Crowdstrike customers have. They're garbage. Each customer appears to have a different one. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Favour to IT folks fixing - could you please copy the C-00000291*.sys file to somewhere and upload it to Virustotal, and reply with the Virustotal link or file hash? It's still unclear if the update was malicious or just a bug. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Sky News has gone off air in the UK. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Crowdstrike published a faulty update. Causes Windows to bluescreen. Driver is C-00000291*.sys. Will cause worldwide outages. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Something about Recall which I don’t think got enough (any?) coverage is it was marketed by Satya as using the NPU.. but it didn’t. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont @npub1fpm…zdhe yes, that is why it makes my skin crawl npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont “Rewrite with AI” makes me shudder every time I see it. It makes my skin crawl. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont The AT&T Snowflake database wasn’t a law enforcement database, that is false. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Advanced Auto Parts have confirmed 2.8 million people impacted in their Snowflake breach. https://www.helpnetsecurity.com/2024/07/12/breach-snowflake-mfa/ npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Ethics statement: npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont This is not okay. https://www.bbc.co.uk/news/articles/cger582weplo npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont France’s finance minister has quite the hot take, says far right not winning election will cause a financial crisis. https://www.bbc.co.uk/news/live/ck7gydwgvy8t?post=asset%3Ada88b562-f552-4bf2-82a9-0fa397bccecc#post npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont France's far-right National Rally (RN) has failed to win a majority in the parliamentary elections, defying many political observers' expectations npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Microsoft have started running paid adverts for Recall, apparently unaware the feature didn’t ship. https://www.tomshardware.com/software/windows/new-microsoft-ads-tout-unavailable-recall-feature-dont-mention-it-was-indefinitely-delayed-due-to-privacy-concerns npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont lol Microsoft Copilot #GeneralElection npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont The exit poll was largely right again, although it overestimated Reform (they only have 3 seats), and overestimated Conservative seats (lol). #GeneralElection npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont 6 seats left to count but basically Liz Truss, Penny Mordaunt, Grant Shapps and Jacob Rees-Mogg and 248 other Tory MPs are off to get a sad face cake at Greggs #GeneralElection npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Tory civil war has begun https://www.bbc.co.uk/news/live/cn09xn9je7lt?post=asset%3Af84506db-c4ca-4e2e-aa59-f306c775d472#post npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont People are setting off fireworks here 🤣🤣 #GeneralElection npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont If anybody wants a hobby project, map out all the open source projects in Windows OS nowadays - there's loads - and check out the versions and forks in use, and compare with vulnerabilities. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Linus Tech Tips on Copilot+ and Recall, after their embargo lifted. https://youtu.be/w5h_1Buf54I npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont @npub1x4c…ls6t stealing this npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Goldman Sachs says the return on investment for generative AI is disappointing. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Patelco, a credit union in the US with half a million members, has been hit with ransomware. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont One thing MS needs to fix in Recall, before the Insider canary build hits again, is the MSRC bug bounty. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont World’s richest company thinks it’s okay if they steal because.. well.. they can. Okay. https://www.theverge.com/2024/6/28/24188391/microsoft-ai-suleyman-social-contract-freeware npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont I have a lot of questions about the direction Microsoft is going with Copilot after this podcast. https://www.youtube.com/watch?v=cNzRviY4Ei8 npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont TeamViewer got owned (again) by Russia. https://infosec.exchange/@jtig/112689362692682679 npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Universal pulled the funding for the Browncoats site at the end of 2005 when they didn’t option the sequels (two, btw).. so I got them to redirect the domain name to me and I kept paying for it myself for years. Also Joss paid to keep the sets up after the TV show got cancelled, which was a dumb financial decision. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont When Snowflake allows orgs to easily mandate MFA across their users, I plan to answer this forum post from 2019. https://community.snowflake.com/s/question/0D50Z00008ugjwISAQ/is-there-a-way-to-force-all-users-to-use-mfa npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Things I learn, fonts support sandboxed code execution https://www.coderelay.io/fontemon.html npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont @npub1rj4…ssk8 looking good, you’ve invented the Pip-Boy Max npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont @npub1nyq…vvvs if you apply I’ll apply for Microsoft npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont On the US banning Kaspersky. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Noice npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Things I learn - at New Atlantis in #Starfield, if you don't head into the city after landing but instead head about a mile east, there's a large ship you can steal at an autonomous farm just over the river. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont I no longer have the flu so I’m back at #starfield. Just finished the final Xbox achievements, on Xbox aptly enough. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont I see Palo-Alto have decided to hire Keanu Reeves and produce a load of bollocks adverts about AI cyber attacks. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Good find by Elastic - North Korean based threat actors using an unfixed bug in Windows to execute code, undetected across all vendors until that point (and as of writing only Elastic detect still) npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont @npub1cz9…t6rc the cheek of it! npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont I still think the funniest Mastodon moment for me is when I joined, helped move over a large portion of Twitter InfoSec following to infosec.exchange, then accidentally blocked the server while walking my dog, causing everybody in infosec to automatically unfollow me. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Total Followers npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont https://cyberplace.social/system/media_attachments/files/112/654/932/084/144/189/original/e91d62c6e790d8c7.png npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont @npub1nr9…wgvq Defender for Endpoint? Crowdstrike are talking there in the context of enterprises. I'm going to guess the free Defender AV and the EDR solution are being mixed together. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont @npub13th…fzx3 oh we definitely are, that whole interview is about how much money they’re making from the CSRB report basically. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont 🤔 Crowdstrike CEO suggesting 50% of their IR cases come from Microsoft Defender customers, not sure I believe this. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont The best thing about the flu so far is I’ve lost hearing in one ear for some reason, and it completely throws me off balance - whenever anything happens I end up just turning on the spot to try to orientate myself. I’m like a glitched NPC in Skyrim. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont @npub1hzg…zc23 I don’t think that helps anyone as so many people depend on MS functioning well. I also think it’s a redundant role as Microsoft have become experts at shooting themselves in the foot. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont @npub1rf6…039u I saw a dude on YouTube who had paid for 8 devices for a comparison video. He unboxed and set them up in one uncut video.. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Also the Copilot+ PC launch appears to be a disaster, from no Amazon user reviews at all to the AI drawing ‘angry Jew’ as literally the devil, features not working etc: https://www.tomshardware.com/news/live/copilot-pc-launch-2024 npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Unfortunately I am ill with the flu. Me being me, I had to think about what I should post in case I die (you know, from the flu) and how I want to be remembered, so here it is: the best movie trailer. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont @npub12lx…jvjy email out of office npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Good. Buy Now Pay Later schemes are proven to be predatory. https://www.theverge.com/2024/6/17/24180340/apple-pay-later-shutting-down-months-after-launch npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont 65 page PDF on searching for Snowflake malicious activity: https://services.google.com/fh/files/misc/snowflake-threat-hunting-guide.pdf npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont @npub1zcm…sn55 unknown re internet archive, but Hudson Rock got legal threats npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Ah, now I've taken off I've realised the weather maybe isn't the best. #GossiAirways npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont #GossiAirways VR time! Going to learn a new bird, taking this helicopter up over the US. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont The Hudson Rock blog on Snowflake, archived elsewhere: https://archive.ph/2024.06.01-023241/https://www.hudsonrock.com/blog/snowflake-massive-breach-access-through-infostealer-infection npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont The Hudson Rock blog archive earlier in this thread on Internet Archive has also been removed. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont @npub1n2v…2u7z that was a risky click npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont STOP RIGHT THERE CRIMINAL SCUM! npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Access went on for several weeks to Medibank, and EDR alerts triggered, but their outsourced MSP and/or Medibank itself didn't triage the alerts properly. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont - The credentials they used were saved in the browser of a staff members work PC, who also signed into his home gmail account (presumably via Chrome) and synced. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont Medibank, Australia's biggest health insurer, had a data breach by REvil ransomware group that lead to the loss of 4 million customer records in 2022. npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont @npub1a8e…ywga yep. Situation crazy. (Or should I say, craze). npub176rs4lx7gjqwepgg75psfpv7zjj3xz0lyj4n7rux93ftm390sars6fkwlw Kevin Beaumont At least I’ll forget about RealPlayer.
