Jake Williams

Breaker of software, investigator of incidents | GSE #150 | Faculty at IANS Research | Stuff: jake at malwarejake dot com | He/him

Public Key

npub1z6m9tqurpz2m92ls4pl4mf20wf0cppquex2kvuwew3kj47kteccqp8y2qk

NIP-05 Address

[email protected]

Profile Code

nprofile1qqspddj4swps39dj40c2sl6a548hyhuqsswvn9txw8vhgmf2lt9uuvqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsmx9uu2

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1z6m9tqurpz2m92ls4pl4mf20wf0cppquex2kvuwew3kj47kteccqp8y2qk

Show more details

Last Notes

2026-06-22 20:06:40 GMT

Apple fumbled the implementation of its USB controller on A12 and A13 devices so it's possible to compromise the boot loader. Exploit code has been published. This can't be patched with a software update.
https://ps.tc/pages/blog-usbliter8.html

2026-05-26 19:21:03 GMT

Dear app developers,
I have never had the desire to review an app. Prompting me to leave a review doe not make me want to do it any more. Making me click multiple times to dismiss your "nudge" and get back to using the app just makes me want to uninstall it.
Sincerely,
Every smartphone user ever

2026-04-14 13:27:29 GMT

Most clients struggling with AI governance are struggling because they haven't fully defined their enterprise data governance requirements.
You can't code "people will use their judgment" into coherent AI governance, as much as you might want to.

2026-04-09 15:13:45 GMT

When life hands you lemons, squeeze lemon juice in the eyes of your enemies.

2026-03-06 16:40:57 GMT

That Iranian Navy ship we torpedoed had no ammunition on board because that was a requirement to participate in the MILAN 2026 exercise (organized by the Indian Navy).
The US Navy knew this because IT ALSO PARTICIPATED IN THE EXERCISE. What a national embarrassment.
https://newrepublic.com/post/207429/us-attack-iran-naval-ship

2025-12-15 01:52:08 GMT

This is unquestionably positive for security.
#nevent1q…9tn2

2025-11-26 14:09:12 GMT

The day is rapidly approaching when we're going to learn that one of the big AI companies has been taking money to align their LLMs to recommend certain brands (or criticize their competitors).
It won't be anywhere near as obvious as Grok and Elon. I'd like to see laws prevent this. I know better.

2025-11-19 13:44:32 GMT

Go home Zoom, you're drunk...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/576/659/690/655/683/original/c41f0606ee684ba1.png

2025-11-18 21:55:58 GMT

The Cloudflare outage was caused by a configuration file growing too large. Likely, they were blocking too many scrapers and caused out of memory exceptions parsing the file. Given this description, I'll be amazed if blocking AI scrapers isn't the outage catalyst.
https://www.theverge.com/news/822869/cloudflare-is-down-outage-x-twitter-downdetector
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/572/929/776/711/397/original/348cdb173e7bedd5.png

2025-10-16 14:35:35 GMT

The timelines in this CISA directive to patch F5 vulnerabilities are not grounded in the risk posed. The required remediation timelines have been artificially extended to ensure there's a possibility for compliance given staff impacted by the shutdowns.
https://www.cisa.gov/news-events/directives/ed-26-01-mitigate-vulnerabilities-f5-devices

2025-10-12 14:39:10 GMT

If productivity gains with AI use were truly so large, orgs wouldn't be regularly asking me how to audit which staff are using AI vs not.
The only tool you should need is managers telling you who is 10%+++ more effective since you deployed the new AI tooling. Unless of course those claims are... 🤔

2025-09-11 10:51:45 GMT

Live your life and conduct yourself so that if you're gunned down in public nobody feels the need to tell others that it's inappropriate to celebrate your death.

2025-08-19 10:35:20 GMT

There is no evidence that phishing simulations make your organization more secure, yet we devote significant $$ and people resources to them.
The vendors providing these services at scale wouldn't shut up about this if their data supported it. You can easily conclude it doesn't...

2025-07-23 12:32:30 GMT

It's neat to say that AI will kill entry level SOC analyst jobs, but if you're a CISO and really believe that, I have to ask where you think you'll get your next generation of "not entry level" SOC analysts from.

2025-07-14 22:58:28 GMT

Don't tie your identity to your job. Jobs are temporary, often ending unpredictably. When your identity is your work, your mental health is impacted horribly when your job security is at risk or you get let go.
I've seen multiple folks in cyber suffer from this, some barely surviving the ordeal.

2025-06-22 14:12:09 GMT

If you're an enterprise worried about your exposure to pro-Iran hacktivists, real talk: you're doing security wrong.
Hacktivists lack sophisticated tools. They employ DDoS and hack-and-leak as their primary techniques. APTs they are not.

2025-06-06 18:43:40 GMT

I will never understand who at Microsoft thought this was okay. It's a profoundly gross UX pattern.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/637/886/667/060/741/original/3b9d836567ba8c80.png

2025-05-21 13:17:01 GMT

Great reporting highlighting that TeleMessage was much more widely used in government than previously reported.
I'll say it again: every foreign intelligence service worth its salt had access to this data. This is a *monumental* security failure by the Trump admin.
https://www.reuters.com/world/us/hacker-who-breached-communications-app-used-by-trump-aide-stole-data-across-us-2025-05-21/

2025-04-22 13:59:12 GMT

Clients: I understand why you might want to record an IR tabletop exercise. The ability to review it later could be helpful. But it's almost certainly discoverable in litigation (yes, even if your internal counsel are present). The value simply isn't there given the outsized risk.

2025-04-11 18:45:07 GMT

I'm officially done pretending what happened to Oracle somehow didn't involve Oracle Cloud. Transparency from Oracle has been garbage. I literally cannot recommend OCI to any of my clients at this point.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/320/806/505/762/294/original/48a3e7134aa69e40.png

2025-04-09 18:01:49 GMT

You cannot simultaneously hold that "cybersecurity is a priority for the federal government" and "we're cutting CISA services with no replacements for federal agencies."

2025-04-08 10:59:21 GMT

If you're using Ivanti at the perimeter, I have to presume at this point that you enjoy incident repsonse. There's no other rational explanation...

2025-04-03 14:49:55 GMT

Again, Microsoft - unsolicited advertisements for games have NO PLACE in Windows 11 Professional. Please slap whoever decided this was appropriate.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/274/578/765/130/611/original/b08bbf66e58e3b48.png

2025-04-02 14:23:45 GMT

Remember the part of required federal records management training that says "it's okay to use Gmail for work as long as you cc government accounts?"
Yeah, me neither...

2025-04-02 12:56:09 GMT

It's 2025 - please stop using the terms whitelisting and blacklisting. Yes, I know many of these terms were acceptable when you were growing up.
Continuing to use them today shows you're unable to adapt to change, which particularly in high-change environments like cybersecurity, is NOT a good look.

2025-03-31 14:41:57 GMT

This is Oracle actively covering up evidence of an intrusion. This is someone executing 1990's breach playbooks in 2025.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/257/562/365/940/199/original/8a0688b6f6b9d563.png

2025-03-31 13:29:29 GMT

At this point, every statement I read from Oracle feels like one of those convos: "That looks like a nasty bruise, how'd you get it?" and they're like "I definitely wasn't having sex with a horse" and the answer leaves you with more questions than you had originally...

2025-03-29 18:07:21 GMT

I want to find the Microsoft engineer behind this and beat them with dimensional lumber...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/247/049/560/234/685/original/24b6dbc0565761f8.png

2025-03-26 16:55:23 GMT

- reply

@nprofile…r0kn For real.

2025-03-26 14:53:55 GMT

If you want to split hairs about whether we're seeing "war plans" or "strike plans," I have questions about your critical thinking ability.
But in any case, I'll assume you're acting in bad faith.

2025-03-19 23:20:56 GMT

Serious question: How many @nprofile…v8tq participants from outside the US will pull out, not willing to risk denied entry or detention?
Related question: How many actually are denied entry or detained? We'll probably never know the first number, but the second number won't be zero...

2025-03-17 21:02:32 GMT

Talked to yet another client today who asked how to solve a problem, I give them the solution, and they say "but will that work with BYOD?" (already knowing the answer was a hard no).
But folks: GET RID OF BYOD. That's the issue, plain and simple.

2025-03-10 18:06:53 GMT

With the Xitter outages today, you just know some H1B visa holders are getting deported on BS pretexts. I wish I was joking. I'm not joking.

2025-03-10 13:58:40 GMT

Fortra doing a victory lap claiming they've cut illicit Cobalt Strike usage by 80% is one thing.
CTI analysts uncritically parroting this ridiculous claim is quite another. Cobalt Strike usage is down because EDRs got better at identifying it specifically. Fortra is AT BEST a minor contributor here.

2025-03-04 19:29:56 GMT

Yet again, I remind you that if you work in cybersecurity, you will never not benefit from learning packet analysis. Yes, there are tools for that. But when they fail (and oh buddy do they fail), your ability to perform independent analysis is critical.

2025-03-02 15:00:50 GMT

I wrote an article outlining why the directive to stop tracking Russian cyber threat actors is impractical and frankly dangerous, outlining some second order effects of the directive. Enjoy.
https://www.linkedin.com/pulse/stop-tracking-russian-cyber-thats-how-anything-works-jacob-williams-ixdkc/

2025-02-26 17:54:29 GMT

Technology is inherently political. Anyone who says otherwise is either being disingenuous or is ignorant of history.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/071/467/063/645/584/original/31fc0de7503ea5bc.png

2025-02-24 13:53:06 GMT

I predict cloud providers run by US companies are going to see some transitioning off their platforms, regardless of where the datacenters are located.
I've talked to several international clients in the last two weeks asking about de-risking, accelerating after Patel was confirmed.

2025-02-23 19:03:18 GMT

Pro tip: set your logs to be all UTC. This will save your forensic analyst (who bills by the hour) the trouble of having to convert timestamps (and even figuring out which timestamps are in which TZ).
It also keeps them ordered correctly when forwarded to a SIEM, especially from multiple TZ's.

2025-02-23 15:10:35 GMT

Since I'm spending my morning reviewing a "forensics report" for a client, I'll just implore you:
* This is NOT something you can just DIY
* Call an adult
* For the love of fsck, do NOT let your IT MSP conduct the investigation
This errors on this one are easily a 7 figure mistake.

2025-02-12 16:01:00 GMT

If you're a leader in tech, take this to your stakeholders and explain the implications. Many of the AI-enabled apps your users are integrating into their workflows (or outright relying on) could literally cease to exist with a single court ruling.
https://www.wired.com/story/thomson-reuters-ai-copyright-lawsuit/

2025-02-11 20:42:43 GMT

DOGE is a bigger threat to US federal government information systems than China. If you find this statement controversial, I'm going to question your IT and cybersecurity credentials.

2025-02-11 00:39:10 GMT

Only those wanting to scam consumers are threatened by the existence of the CFPB.
I said what I said.

2024-11-07 17:15:23 GMT

The amount misogyny on display in the cybersecurity field is absolutely wild.
If you're not seeing it, ask "am I part of the problem?"
If you are seeing it, call out the offenders when you see it. Sure, it's uncomfortable. It's WAY more uncomfortable for the victims.

2024-09-15 11:20:07 GMT

We have a fundamental breakdown of the social contract in the US.
I don't have the answers for how to fix it. But I've read enough history books to know what happens if we don't - and it's not great.

2024-09-11 16:01:27 GMT

Publicly declaring "I will give you a child" to someone you have no consenting relationship with is a threat of sexual assault, full stop.

2024-09-07 20:06:00 GMT

Can we PLEASE stop with the "there's 750,000 unfilled cybersecurity jobs in the US?"
I don't care what the "official" numbers are because it's certainly not reflective of the job market.

2024-08-27 13:19:09 GMT

My favorite thing about the Telegram arrest is that "normies" are asking me if this is why I've been refusing to use it for comms and moving them to Signal instead.
Yes. Yes it is...

2024-08-03 04:12:47 GMT

Gift article, no subscription required. This is too important to be behind a paywall.
https://www.washingtonpost.com/investigations/2024/08/02/trump-campaign-egypt-investigation/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/896/138/628/678/176/original/5364e28fc3e10cb8.jpg

2024-07-30 15:54:56 GMT

So Delta Air Lines is suing CrowdStrike over the outage. Zero chance this goes to trial, it's too big a risk for CrowdStrike. They'll settle for an undisclosed amount and nothing will change in software liability.
https://www.cnbc.com/2024/07/29/delta-hires-david-boies-to-seek-damages-from-crowdstrike-microsoft-.html

2024-07-29 20:24:21 GMT

So you create an AD group "ESX Admins" and by default, VMware is just like "oh, so you're the admin now?!"
And then to make it dumber, VMware classifies this as a *moderate* severity, despite knowing ransomware TAs are actively using it?
I can only conclude Broadcom is not serious about security. I don't know how you conclude anything else. Oh also, there are no patches planned for ESXi 7.0.
https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/

2024-07-26 19:54:01 GMT

Troubleshooting something with PDF parsing only to learn that Word sometimes doesn't keep exactly the same size font in Word docs saved to PDFs, apparently because MSFT hates you...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/854/540/751/833/107/original/d352eaa124dff137.png

2024-07-25 13:01:10 GMT

If you use GitHub, this is a big wakeup call of a vulnerability where "working as designed" isn't the same as "working as expected."
I'm sure we'll see some significant breaches around this.
https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github

2024-07-21 19:19:31 GMT

If I were Biden, knowing the Supreme Court gave me immunity for anything that even looks like an official act and I'm not running again... I'd be cooking up some doozies for between November and January.

2024-07-19 13:41:32 GMT

Business stakeholders: If you talk down to your helpdesk/IT people today, you're a bad person (a piece of human excrement).
This isn't on them. Go take out your frustration somewhere else. Like on the executives who were told about these consolidation risks but didn't care.

2024-07-19 06:46:41 GMT

Security teams, I have good news and bad news.
The good news is that executives are suddenly very interested in security controls.
The bad news is, they're not interested for reasons you probably hoped when you dreamed this day might come...

2024-07-13 14:53:37 GMT

Every time someone says "Snowflake should have enforced better security" I like to remind them that if Snowflake wasn't trivially easy to use, you wouldn't know the name Snowflake.
Real talk: security is friction and friction doesn't attract customers.

2024-07-11 14:14:42 GMT

Stop trying to split hairs on MFA "factors" and look at it from the perspective of "if a threat actor has access to my logged in user context on this device, will this separation of authentication factors be effective."
That's it. Period.

2024-07-05 21:58:07 GMT

OpenAI was hacked, but didn't bother to tell anyone.
Cool, nothing to see here. Nothing at all...
https://www.nytimes.com/2024/07/04/technology/openai-hack.html

2024-06-25 22:09:16 GMT

Quick reminder: "is this technically feasible" and "is this a good idea" are often two VERY different questions.

2024-06-15 11:25:43 GMT

Gen-AI boosters love to claim AI is suitable for all sorts of use cases, but the reality is that if requirements for your use case include "provide consistently correct (or even just consistent) results" then it's not a good use case...

2024-06-13 17:46:24 GMT

Hug your infrastructure folks (with consent of course). They are unsung heroes.

2024-06-06 17:12:46 GMT

Smart people of Mastodon - what are you using to sync Google and M365 calendars? I need bidirectional sync so that when an event gets created on one calendar, it blocks the time on the other calendar saying it's blocked because of the other calendar but without event details.

2024-05-27 11:31:12 GMT

Broadcom is a cancer.

2024-05-13 14:51:13 GMT

Injecting into a legitimate process to hide from defenders...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/434/339/035/178/024/original/14e3a4524713f10e.png

2024-05-12 17:29:42 GMT

I was looking at shelving a few weeks ago and now Amazon is retargeting me on every website I visit (as one does).
But who is this guy they very clearly photoshopped into the picture? And why? Suits don't sell shelving. I'm so confused...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/429/298/114/793/897/original/5f1531c4f9612041.png

2024-05-01 11:16:02 GMT

Your AI is only as good as your data.
Most enterprise orgs can't even get asset inventory complete, so let's not talk about the quality of the unstructured data spread across your SharePoint sites...

2024-04-29 14:27:39 GMT

After doing some testing with a customer, I've created this handy flowchart for determining whether you should adopt Security Copilot...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/354/972/023/185/694/original/16712b7230e3ac46.png

2024-04-23 15:50:18 GMT

I swear I want to scream. I hope Change Healthcare executives see prison time. Not being facetious - this is negligence of the highest order. Make an example of them.
And don't @ me about "victim shaming" - all of you are the real victims here.
https://www.wsj.com/articles/change-healthcare-hackers-broke-in-nine-days-before-ransomware-attack-7119fdc6
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/321/323/858/505/667/original/50ae133f6458a172.png

2024-04-21 14:24:49 GMT

Happiness is not running out of RAM anymore on those memory intensive tasks...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/309/661/945/951/009/original/f7e4c4c803a281a9.png

2024-04-15 14:54:46 GMT

- reply

@npub1yck…ujmw Is your position actually "that's all that matters really?"

2024-04-15 09:51:11 GMT

If you support the US providing active air defense for Israel and not Ukraine, I'm interested to know why. If your answer is "Russia" please note whether you would defend other European nations (and why Ukraine is different).
Our foreign policy is inconsistent...

2024-03-31 23:59:19 GMT

If you're a vendor calling clients telling them to replace their OSS with your software because it's more secure not being open source, I hope you get hit with a ransomware attack that puts you out of business.
You'll deserve it and the industry will be better off without you.

2024-02-14 19:40:47 GMT

Calling it now re the "National Security Threat" - Russia has developed and/or deployed an orbital launch platform that is nuclear capable.

2024-02-09 15:57:20 GMT

Management "helping" with the incident response...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/902/312/000/516/320/original/20c3c853c70c6162.mp4

2024-02-01 15:19:08 GMT

As you get ready to watch the big game next weekend, here's gift link (no subscription required) to a fantastic investigation by Washington Post detailing how the NFL is routinely denying compensation to players impacted by CTE/dementia.
https://wapo.st/3Ukpdb9

2023-11-29 14:31:02 GMT

Encryption backdoor...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/494/316/759/715/206/original/33b6acdfdcce3318.png

2023-08-31 18:48:24 GMT

"Yes, I run all my software as root. Why do you ask?"
https://media.infosec.exchange/infosecmediaeu/media_attachments/files/110/985/719/940/275/897/original/23600f510e310271.png

2023-08-07 19:06:44 GMT

This feels awfully meta...
https://media.infosec.exchange/infosecmediaeu/media_attachments/files/110/849/897/136/971/306/original/0d808132d2f080a9.png

2023-08-07 02:57:15 GMT

- reply

@npub178r…qekt Excellent question. I grabbed this doozy walking back to my hotel this evening.
https://media.infosec.exchange/infosecmediaeu/media_attachments/files/110/846/081/563/381/341/original/51daa32436dd354e.jpeg

2023-08-07 02:55:04 GMT

Holy carp, the successful fusion reaction experiment at Livermore Labs has been replicated, only this time with higher yield!
Gift article, no subscription required.
https://wapo.st/3YsG23J