cR0w

Analyst and professor

Public Key

npub1z3sfut2znnrtgl0qt4q6npq8zmjd9c97ck0gh0me44ua6lzaaajq6cp45m

NIP-05 Address

Profile Code

nprofile1qqspgcy794pfe3450hs96sdfssr3dexjuzlvt85thau667wa03w77eqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dszl0yfh

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1z3sfut2znnrtgl0qt4q6npq8zmjd9c97ck0gh0me44ua6lzaaajq6cp45m

Show more details

Last Notes

2024-08-02 16:07:56

I know it's the cool thing to hate on Teams, but that's because it really is hot garbage in so many ways. Now it's blocking messages that reference "potentially harmful content" even if it's all code blocked. Sure makes it hard to share any CTI-type information if your team is supposed to use Teams. :swearing:

2024-07-25 23:57:29

- reply

@npub1vcl…k6t3 And ending with a summary.

2024-07-04 00:09:15

All right y'all, it's now Happy Hour PDT. That means we're officially in the vuln freeze window until next week. Enjoy blowing up a small piece of the country. Choose that piece carefully.

2024-06-29 00:18:53

- reply

@npub1vcl…k6t3 Took it to my team but apparently we can only use threat intel if it's handcrafted, artisinal, AND organic. :-(

2024-06-28 15:18:33

- reply

@npub1vcl…k6t3 Aren't the friends just "me, myself, and I" in this case?

2024-06-27 02:53:21

🎶 I got in one little breach
And my boss got scared
And said "we're moving all our shit
To those clowns at Cloudflare🎶
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/685/845/343/325/238/original/33dac9b25d9435d9.png

2024-06-26 15:23:47

Hold up, how did I miss that the Ollama RCE ( CVE-2024-37032 ) was yet another directory traversal vuln? Someone bump the needle, 2024 is stuck.
#directorytraversalmemes
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/683/129/331/333/221/original/9de390733812b4ef.mp4

2024-06-18 15:57:07

- reply

@npub1vcl…k6t3
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/637/968/726/722/928/original/e3159e9e022476cf.png

2024-06-14 17:11:30

I don't remember who created these shirts for WiCyS support, but today is yet another perfect day for it because _reasons_.
Edit: I'm told it was @npub1q5e…6c85 🍻
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/615/602/402/122/923/original/a23448c1b431f00f.png

2024-06-13 18:35:00

Fucking Progress Software...
#MOVEit

2024-06-13 15:41:30

Has anyone seen any thoughtful blogs or articles about how orgs are reevaluating their usage of Microsoft products lately? I'm not looking for the generic knee-jerk "uSe LiNuX" stuff. I'm interested in discussions on strategic change to reduce inherent reliance on Microsoft in general. Bonus points for discussion of strategy to maintain flexibility and avoid relying on any vendor long-term.

2024-06-11 19:59:33

- reply

@npub1vcl…k6t3 Fedi? More like the entire Internet.

2024-06-11 19:41:50

Coworker: Where do you get your RUMINT / CTI besides those scary deep dark web forums?
Me: So there's this porg...
Coworker: ???
Me: And a goat...
Coworker: What?
Me: And-
Coworker: JFC. This isn't some of that furry shit, is it?
Me: I honestly don't even know.

2024-05-31 02:41:21

I know INFOSEC isn't on the top of everyone's mind right now, but if I don't ask this now I might forget.
Who here is in Chicago? There's a young woman looking to get into INFOSEC. Aside from that, she's really sharp and looking for ways to meet people and learn about the opportunities in that area.
Any meetups, local cons, WiCyS, etc. worth getting hooked up with?

2024-05-30 14:38:57

Just got my new keyboard and now I'm ready to hack literally all the VPNs.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/530/074/234/591/598/original/4a5d52d424c2559a.png

2024-05-29 18:39:29

The PoolParty process injection techniques are new to me. If they are new to you too, it might be worth reading up on them. I've seen it a few times now in the last couple weeks.
https://github.com/SafeBreach-Labs/PoolParty
https://www.safebreach.com/blog/process-injection-using-windows-thread-pools
https://youtu.be/AvBO4f7blew
#threatintel

2024-05-29 17:48:59

I don't know who ( else ) needs to hear this ( again ), but if you are not deploying in-browser ad blockers to your users, you are explicitly accepting the risk of a threat actor paying a large, greedy corporation to execute malicious code in your users' browsers.
Ad blockers are a security control. Your browser patching and EDR / XDR systems are only so effective.
Yes, this is because of offline discussions regarding the recent run of Chromium 0days.

2024-05-28 16:02:37

- reply

@npub17lg…9uux I understand that, but if they are incapable of stopping the threat, then that needs to be called out further instead of all this back-patting over what amounts to be minimal disruption.

2024-05-28 15:23:45

The Wired article on LEAs using PSYOPS tactics is cool and all, but the feds should not be lauded for transitioning to the long game while their failure to implement physical disruption has directly enabled continued #ransomware attacks on hospitals and utilities. "Trolling" while people die is not a sufficient response.
https://www.wired.com/story/cop-cybercriminal-hacker-psyops/

2024-05-28 15:12:10

- reply

@npub18c7…er9d This one?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/518/882/213/049/101/original/795fa88b086524a9.png

2024-05-14 16:59:49

Operator: Boss, can we buy 0day to use against $target ?
Boss: We have 0day in $system to use against $target at the office.
0day in $system at the office: ../

2024-05-09 15:44:45

Did you really name your daughter ../../../../../etc/passwd ?
Oh. Yes. Little Susie Slashdot, we call her.

2024-04-17 20:27:42

Way to live up to the stereotypes, nerds. PAN GlobalProtect exploit attempts using jsquery[.]sex[.]js instead of jsquery[.]max[.]js
#CVE_2024_3400

2024-04-12 21:49:11

- What's UPSTYLE?
- Not much, Style. What's up with you?
I could really use a drink today. 🤪

2024-04-11 15:54:35

- reply

@npub1vcl…k6t3 https://access.redhat.com/security/cve/CVE-2024-2905

2024-04-11 15:45:07

- reply

@npub1vcl…k6t3 WTF?

2024-04-10 18:15:45

As opposed to Stack Overflow, Reddit, or Hack Forums, I assume. 🙄
https://infosec.exchange/@BleepingComputer/112247804899879717

2024-01-10 18:08:32

- reply

To prove the point that users will continue to click links, regardless of how obvious it is that they shouldn't, I worked with the person in charge of the monthly phishing trainings at $dayjob last month. Historically, they have used the hated ruses like fake gift cards, and I wanted to try to get away from that, especially during the holidays. We ended up using something to the effect of the following:
---
Hello <first name>,
Happy Holidays. This is the monthly phishing test. Yes, really. It's not a trick. Use the <phishing reporting function> to report this as phishing. If you do not know how to use <phishing reporting function>, feel free to ask a colleague. If you still have questions, search for <phishing reporting function> on <internal docs site>.
Do not click the following link as it is there for metrics and will cause you to be assigned phishing awareness training: <phishing training 'malicious' link>
Sincerely,
IT Security Team
---
I don't know how well it was received by users, but I do know that we still had more clicks than two other months in 2023, despite being explicitly told not to click the link. Users will always click links with their link-clicking machines. Relying on their discretion is either ignorant, or I expect in some cases, malicious in that there will always be a scapegoat to blame for the inevitable breach.
#phishing #infosec

2024-01-10 17:38:11

- reply

User discretion is not a security boundary.

2024-01-10 17:07:59

I can't believe that this is still a thing, but if your risk model is noticeably impacted by the adversarial capability of _writing an email in the English language_ then I'm pretty sure your threat model is already broken.
https://www.nbcnews.com/tech/security/nsa-hacker-ai-bot-chat-chatgpt-bard-english-google-openai-rcna133086
#threatmodeling #phishing

2023-12-07 16:33:52

- reply

@npub1vcl…k6t3 I've read this post five times now and the fact I have no idea what "Firmware vulns are good actually" is referring to makes me glad I'm not more active on here. Or anywhere online, really.