The CFP for SO-CON 2026 closes in about 12 hours (11:59 2025-11-15)! Have a cool approach to attack path management (or awesome connector for BloodHound OpenGraph)? Submit ASAP: https://specterops.io/so-con/

The clever folks at Grumpy Goose Labs have published even more ways to identify unauthorized IP KVMs across your environment, with some great memes to boot! Be KVM, Do Fraud - https://blog.grumpygoose.io/be-kvm-do-fraud-8ab523d26c9d

Identify insecure TLS services with the enhanced runZero Certificate Inventory: https://www.runzero.com/blog/identify-insecure-tls-services/

Something that started as a small curiosity and weekend project turned into a long article with several surprises for myself (including how bad I am at time estimates). I went down quite a few rabbit holes along the way. EDNS Client Subnet in Practice: Evaluating Public Resolver Behaviors […]

Austin Hackers Anonymous (AHA) is TONIGHT (2025-10-30) https://takeonme.org/ - Have some zero-day to share? AHA is an official CNA and will issue CVEs for vulnerabilities disclosed at the meeting. I'm planning to demo more SSHamble.com findings along with BloodHound OpenGraph stuff. See yall soon!

Just like chocolate and peanut butter, runZero and BloodHound are an amazing combination. Today we are introducing runZeroHound - an open source toolkit for bringing runZero Asset Inventory data into BloodHound attack graphs, using the brand new OpenGraph […] [Original post on infosec.exchange]

SpecterOps released "DumpGuard" along with a detailed article on how they were able to bypass Windows Credential Guard in both privileged and unprivileged contexts. I learned a ton about Isolated LSA and friends. Its funny to see that DES-cracking of NTLMv1 […] [Original post on infosec.exchange]

Today's runZero Hour is up with Rob King, Tod Beardsley, and EOL expert and technology necromancer, captn3m0 (pronounced “nemo”). They will summon and explore runZero’s latest research paper, “Undead by design: Benchmarking end-of-life operating systems” […] [Original post on infosec.exchange]

JawnCon (https://jawncon.org/) 0x02 just wrapped! I wish I could make it this year, but settled for catching the talks on the live stream: Main Stage Day 1: https://www.youtube.com/live/Cvf-mAdnPl0?lc=UgwMOtdPezSwFxO8Idx4AaABAg Man Stage Day 2 […] [Original post on infosec.exchange]

Virtually every major remote access tech is under attack rn. It's gonna be a truly unpleasant Q4, isn't it…

Hello Austin Gophers! Join us tonight, Wednesday, October 8th, 2025 for two hours of lightning talks and discussion at the ATX Go meetup. This is hosted by Capital Factory and runs from 6:30 PM to 8:30 PM central (with pizza and drinks!): https://www.meetup.com/atxgolang/events/305492512/

#SectorCa 2025 is fantastic! I last attended in 2008 and holy cow has it grown. Great to see Brian and Bruce still involved. Excellent talks, really sharp crowd, zero attitude, and everyone is incredibly friendly. You can find the slides from my morning […] [Original post on infosec.exchange]

Hello #sector! 🍁 runZero’s Rob King presentation starts NOW in Room 716B: "Pay No Attention to the Device Behind the Curtain: Banned tech doesn’t always stay banned. Rob shows how to detect white-labeled and counterfeit gear using Internet-scale methods & protocol quirks." 👉 […]

Hello Austin Gophers! Join us tonight, Wednesday, September 10th, 2025 for two hours of lightning talks and discussion at the ATX Go meetup. This meetup is hosted by Capital Factory and runs from 6:30 PM to 8:30 PM CDT (with pizza and drinks!): https://www.meetup.com/atxgolang/events/305492508/

One of my favorite programs for the Mac is from a company called Objective Development -- Little Snitch -- and it's a host-based firewall that alerts you anytime something on your computer tries to reach the Internet for the first time (or you can set to always ask all the time, which I wouldn't […]

Three small announcements: 1. RFC 9839, a guide to which Unicode characters you should never use: https://www.rfc-editor.org/rfc/rfc9839.html 2. Blog piece with background and context, “RFC 9839 and Bad Unicode”: https://www.tbray.org/ongoing/When/202x/2025/08/14/RFC9839 3. A little Go library […]

I chased an intermittent DNS bug for two weeks and for once, it was not DNS: "PF states limit reached" If you use opnsense/pfsense, the default state table size of 1.6m can sneak up on you when your network is full of scans. Poking around with `pfctl -si` and setting a much healthier max with […]

Hello Austin-area software engineers (or aspiring engineers)! Join us tonight, Wednesday, August 13, 2025 for two hours of lightning talks and discussion at the ATX Go meetup. The focus tonight is on infosec/cybersecurity/hacking tools written in Go, but all Go-related talks are welcome. This […]

If you missed this talk at BH/DC last week, it's worth a read: "From Spoofing to Tunneling: New Red Team's Networking Techniques for Initial Access and Evasion". Awesome work from Shu-Hao, Tung (123ojp) covering practical attacks on GRE and VxLAN tunnels […] [Original post on infosec.exchange]

Blue Team Con (@BlueTeamCon) is only three weeks away! I'm excited to share "The Death and Rebirth of Vulnerability Management", an analysis of coverage, tradeoffs, and efficacy across vulnerability scanners, endpoint agents, and open source security tools […]

Newest OpenSSH (10.1) will now warn users if they are not utilizing post-quantum algorithms for the current session: https://www.openssh.com/pq.html #pqc

Thank you to everyone who made it out for my DEF CON 33 presentation, "Shaking Out Shells With SSHamble", you can find the materials online at https://hdm.io/decks/MOORE%20-%20Shaking%20Out%20Shells%20With%20SSHamble.pdf This deck includes some […] [Original post on infosec.exchange]

And in the time it took me to fix the typo, trixie, aka Debian 13, as stable is now available for download. Be sure to check the release notes. For example, I wouldn't be surprised if /tmp now being tmpfs catches some by surprise: "The default is to allocate up to 50% of memory to /tmp (this […]

Are you an Austin-area software engineer who writes Go (or aspires to become one)? Join us Wednesday, August 13, 2025 for two hours of lightning talks and discussion, including recaps of awesome Go work presented at the Black Hat and DEF CON conferences […] [Original post on infosec.exchange]

Hello DEF CON! Tomorrow (Saturday/August 9th) I'll be speaking with Nicole Schwartz on Forging Strong Cyber Communities in Uncertain Times at 1pm in W205 (TDI) and then shortly after on Shaking Out Shells with SSHamble at 3pm in Track 2 (LV1), with even more […] [Original post on infosec.exchange]

BSides Las Vegas 2025 is incredible. Amazing turn-out, fantastic staff, and the sheer variety of content, speakers, and activities sets the bar for what a hacker con should be. You can find the slides from my talk, Turbo Tactical Exploitation: 22 Tips for […] [Original post on infosec.exchange]

@0xabad1dea Time for everyone to start increasing the costs by deploying something like Anubis I guess. https://github.com/TecharoHQ/anubis

runZero Hour #20 is LIVE NOW - This is an amazing episode that includes Rishi & Sandeep of https://projectdiscovery.io/; here to give us the backstory on their company and the Nuclei open source vulnerability scanner (already bigger and more popular than […] [Original post on infosec.exchange]

Hello Austin Gophers! The July ATX Go Meetup is TONIGHT (July 9th). The meetup includes lightning talks, pizza, beverages, and general discussion. Have a neat idea? A quick talk related to Go? Something to show-and-tell? […] [Original post on infosec.exchange]

O_O Synology's middleware service was inadvertently exposing a master credential during every setup process, and this credential belonged to Synology's global app registration, giving attackers broad read-only access to organizational data including Teams messages, group information, and […]

I'm excited to announce our "Out-of-Band" series; these articles focus on the security risks of management devices like BMCs, serial servers, and IP-enabled KVMs. "Out-of-Band, Part 1: The new generation of IP KVMs and how to find them" is now live at: https://www.runzero.com/blog/oob-p1-ip-kvm/

Do you enjoy guzzling real-time TLS certificate allocations, but don't want to use a third-party service (crt.sh, CertStream, etc.)? Drink straight from the Certificate Transparency log firehose using ctail: $ go run github.com/hdm/ctail@latest -f -m '^autodiscover\\.' https://github.com/hdm/ctail

I talked AI slop with @joshbressers on Open Source Security: https://opensourcesecurity.io/2025/2025-05-curl_vs_ai_with_daniel_stenberg/

A PSA for why you should probably not use Postman (it can leak secrets to them): https://anonymousdata.medium.com/postman-is-logging-all-your-secrets-and-environment-variables-9c316e92d424

#Windows #RDP lets you log in using revoked passwords. #Microsoft is OK with that. Researchers say the behavior amounts to a persistent #backdoor. In response, Microsoft said the behavior is a “a design decision (...) As such, Microsoft said the behavior […] [Original post on infosec.exchange]

Hello from BSides San Francisco! I'm excited to speak at 1:30pm in the AMC IMAX today. If you'd like to catch up afterwards, I'll be at the runZero booth first and at the City View lounge later. If you couldn't make the trip, the streaming links are live at […]

A few quick notes on the Erlang OTP SSHd RCE (CVE-2025-32433): 1. Cisco confirmed that ConfD and NSO products are affected (ports 830, 2022, and 2024 versus 22) 2. Signatures looking for clear-text channel open and exec calls will miss exploits that deliver the same payloads after the key […]

Hello Austin Gophers! The ATX Go Meetup is THIS WEDNESDAY (April 9th). The meetup includes lightning talks, pizza, beverages, and general discussion. Have a neat idea? A quick talk related to Go? Something to show-and-tell? Running into a weird bug? Swing on […] [Original post on infosec.exchange]

Tired of using boring web browsers to manage your exposure with runZero? Nostalgic for the days of clean, MS-DOS terminal graphics? Ditch your modern trappings and visualize your network map using the best visualization tool of all time, ToneLoc: https://www.runzero.com/blog/subnet-grid-report/

Wondering how and why your vulnerability management tools are failing you? My talk "Your Next Incident Won't Have a CVE" is now live at https://www.runzero.com/resources/your-next-incident-wont-have-a-cve/ PS. runZero shipped coverage for Nutanix this week

Hoping this helps someone else. When setting up a Supermicro AS-1015A-MT 1U w/H13SAE-MF & Ryzen processor, trying to boot Debian 12 or Proxmox 8.3 media results in "Welcome to Grub" and the machine stalling, sometimes also showing "error: no such device: / […] [Original post on infosec.exchange]

Jacob Sandum posted a detailed and well-written PoC for the IngressNightmare (CVE-2025-1974 ) vulnerability found in the Kubernetes ingress-nginx Admission Controller by Wiz (Woogle!). If you are looking for a quick way to reproduce the issue or validate […] [Original post on infosec.exchange]

Today, Wiz (Woogle?) released an advisory detailing an attack chain they’ve dubbed IngressNightmare, which, if left exposed and unpatched, can be exploited to achieve remote code execution by unauthenticated attackers. The advisory, covering five separate […] [Original post on infosec.exchange]