Teaching the wife Diffie-Hellman exchange tonight.

ALPRs can still be abused given the sheer volume of data collected and the lack of transparency in who can request it. “What we actually need, if we want these laws to mean something, are robust oversight measures,” EFF’s @maassive.bsky.social told Spectrum News 1. spectrumnews1.com/ca/southern...

RunDll Exporters www.hexacorn.com/blog/2025/09...

I put together a script to verify that your linux/mac install didn't get a compromised npm package. This, unlike some other checks out there, looks through your prior installed packages to make sure an update didn't obscure the compromise. gist.github.com/TechByTom/5f...

Some say write-ups are too OP. I dressage. We love seeing the work.

Way to go!

I'm one of the 37 targeted below by DNI Tulsi Gabbard. I haven't had a clearance nor worked in government since 2013. This is political theater & a dangerous example of government abusing its powers to punish private citizens for openly exercising their 1st Amendment rights. My full statement:

This is both funny and horrifying. Horrifying because people are using and trusting this tool to be reliable and wrecking careers when it's wrong.

/me cries in HIPPA

PHENOMENAL work by @censys.bsky.social w/special shout out to one of the best cyber researchers out there (Himaja, who is smartly not on social media). They discovered sophisticated proxy infra designed for long-term espionage operations, & most victims probably have no idea they're compromised.

Last thought: while I'm on a tradecraft+capability separation kick, I intend Crystal Palace as an open-ended object/PIC stitching sandbox. Keep playing with it. Try different ideas. It's really cool. This is what organic cross-inspiration and conversation looks like. I pivot when inspired too.

Oh hey, the first video is now available! Check out Steve Shelton’s keynote for #BSides312, the abstract for which had me sobbing.

Astronomers may have just discovered the third interstellar object passing through the Solar System! ESA’s Planetary Defenders are observing the object, provisionally known as #A11pl3Z, right now using telescopes around the world.

This is 100% going into my private C2 www.procustodibus.com/blog/2024/04...

Do not sleep on my blue team 💪🏻

A lot about what I’m going to say, comes back to what role you view the red team fulfilling inside of your organization. Let’s talk about assumed compromise.

Over 300 in attendance today, and more than 100GB of Internets slurped. @bsides312.org was a huge success. Lots of growth from last year. I can’t wait to see everyone again next year!

@lintile.lol TIL “hodling” is actually 4 letters?

Wedding planning and sharing the palate in hex, like any self respecting hacker would.

Good morning, @thotcon

I’m super excited to be part of a team that just earned the BHIS Honey Badger award!

🤨

I wonder what this would mean for investigation tools looking at phishing and payload delivery sites.

A rare personal post from me - my engagement photos just came in, and I’ve got a new wallpaper.

@j0hnnyxm4s.johnnyxmas.net ahem

During pentest postmortem, one of the most important things to identify what your defenders knew, and when they knew it. This should be one of the primary objectives of collecting and comparing timelines. It can help you identify opportunities to improve the effectiveness of your incident response.

Another great #BSides312 talk comin’ atcha!

Imagine how much data you can lose on this bad boy [slaps hood]

I think one of the things that is the most challenging for organizations understanding is the context of how important it is to implement particular remediation mechanism. For example, do we care more about eliminating all local admins, or blocking executable file types?

I always used this as a metaphor for orgs using Red Teams to “teach them a lesson” (whoever/whatever that person/group is). Also, I don’t endorse using a red team as a way to prove your point. Unless, that is, if your goal is to bankrupt your security team’s political capital.

Hardwire your home security cameras.

@subtee.bsky.social there IS an excel world championships. fmworldcup.com/product/mewc...

Zhuowei Zhang released POC code for CVE-2024-53104, a zero-day used by Cellebrite to unlock Android devices -patched in February -used by Serbian law enforcement to unlock the phones of anti-government protesters and journalists github.com/zhuowei/face...

What an awesome project. Debug 64bit windows binaries in your browser. github.com/momo5502/sogen

Not just driverless. Lots of modern vehicles (especially EVs) such as Tesla have always-on cameras in an almost 360 degree radius. That's a lot of data that manufacturers could decide to give away / sell to third parties.

My record length cracked password was ntlm (md4) hashed, and 47 characters long. Lyrics are a bad idea.

The border is a bit of a 4th amendment loophole on search and seizure. Especially concerning with our phones and laptops. Inspired by WIRED recently updating their guidance and put together some with some of EFFs info. www.youtube.com/watch?v=AuEi...

The case of the $20 C2 framework, and how I learned I was “vibe coding“

Probably go burn all of these domains, blue teams: orgnamehere.mail.onmicrosoft3.com (IP: 35.173.78.238) (Registered: 2023-02-17) orgnamehere.mail.onmicrosofte.com (IP: 91.195.240.94) (Registered: 2023-03-06) orgnamehere.mail.ofmicrosoft.com (IP: 13.248.169.48) (Registered: 2006-05-23) ...

Thanks @eff.org for this clear and easy to follow guide on making iOS more private and secure ssd.eff.org/module/how-t...

I just found a pic of my old 2014 closet rig… This was 3 280x and a 270 plus 15 3.5 bays crammed into an ATX tower and an HP gen 8 micro server. Yes, that says 91° on the fans (gpu air temps).

Oh my... This is the most amazingly wonderfully overproduced extra and perfectly done video ever. www.youtube.com/watch?v=me-Q... 187K views and produced practically as well as MKBHD.

Remember when we backdoored all luggage locks for security reasons? That went extremely well, didn’t it?

I know some (a lot of?) people will scoff at this, but I come from a networking/IT generalist background. LLMs are absolutely changing the game for me in terms of writing tools. I’ve always had the ability to break down complex problems and describe solutions, but I’m not a dev.

Giving access to SSNs, other data on government employees to non-employees like Musk is a violation of 5 USC 552a, and carries with it a penalty of $1000 per person whose data was accessed. We are building a case. Govt employees who want to participate should contact me directly

For those wondering: Yes, I'm uploading the entire 15 GB public-facing CDC.gov website that I downloaded a few days ago...but it's gonna take awhile to upload...

Hey, so this is a sort of handy file if you're ever looking for admin interfaces in your network. raw.githubusercontent.com/FortyNorthSe...

Meta tracks your activity across millions of websites and apps, regardless of whether you use its platforms, and profits from that data through targeted ads. Here’s what you need to know if you want to limit the company’s ability to harvest and profit from your personal data.

When you’re working to bypass an EDR rule and realize that it’s a simple string match on the file and config file names…