Christoffer S.

Swedish cybersecurity expert with 22+ years of experience in the domain. Managed to establish some some sort of authoritative reputation in Sweden due to blogging, quite often asked for keynotes at various conferences and I'm also teaching a CTI course.

Currently working as a Product Manager within the CTI domain for Truesec, a company providing managed cyber security services as well as consultancy and advisory assignments.

And about a million more things I couldn't fit in here.

Public Key

npub14n0ra22muzxqmfe2tvrytjr9lv4q3wva0vrwfqqluhg3xhumdvwqzf6kgf

NIP-05 Address

nopatience_at_swecyb.com@mostr.pub

Profile Code

nprofile1qqs2eh3749d7prqd5u49kpj9epjlk2sghxwhkphysq07t5gnt7dkk8qpzemhxue69uhhyetvv9ujumn0wd68ytnzv9hxgkycyxz

Publishing to

relay.nostr.band

Author Public Key

npub14n0ra22muzxqmfe2tvrytjr9lv4q3wva0vrwfqqluhg3xhumdvwqzf6kgf

Show more details

Last Notes

2024-11-14 20:22:12

If you really believe in decentralized and federated Social Media like Mastodon (and by extension ActivityPub), make sure to contribute financially to the project.
https://www.patreon.com/c/mastodon/membership
It doesn't take much, but everything helps and every dollar will ultimately contribute to the protection of all.
#Mastodon #Patreon #Support #Donate

2024-11-14 17:29:17

Reading plenty of toots about Bluesky. And I really don't get it. Why switch from one platform to another where they essentially share the same characteristics? (X for Bsky)
Genuinely interested in why that is seen as a good alternative? So "we" want a professionally developed service, but not willing to entertain the idea that money will need to be made? How about staying on Mastodon, pay 1$/month to support Mastodon and join Mastodon.social?
#Bluesky #Mastodon #Migration #Fediverse

2024-11-11 16:22:27

There is a new ransomware group in town? Helldown: https://www.truesec.com/hub/blog/helldown-ransomware-group
#Helldown #Ransomware #CyberSecurity #ThreatIntel
@npub1erv…0xs5 @npub17lg…9uux
@npub157z…2q4w
@npub1306…n04t
@npub1y0e…7sa9
@npub1wnv…899h

2024-11-10 09:17:28

Finns det några svenska #relay servrar att koppla upp mot för att öka federationen? Om inte så funderar jag på om det annars vore värt att sparka igång en ny VPS för det ändamålet.
Se till så att det finns en "bra" federation mellan svenska AP-instanser som kör t.ex. Mastodon eller Pleroma. Det ger åtminstone en administratör möjligheten att "förbättra" den federerade timelinen.
Tankar på det?

2024-11-03 13:47:56

Another thought regarding #OpenSource software. There is a pervasive mentality that such software cannot be associated with money. It appears hard to reconcile paying for something that is free.
This mentality must change. We must foster and support the idea that great software is costly to develop. How can we ensure that more people financially contribute to OSS if it supports them?
I believe that we should highlight those paying and supporting OSS. 1/x

2024-11-03 13:42:03

I have been perhaps somewhat knowingly ignorant of Amazon practices as it relates to price blackmailing regarding books and the authors producing them.
Giving up Kindle is not easy, the comfort and ease with which to buy... license books, is well smooth.
How do people read digitally without Kindle? What are the alternatives?
I credit my enlightenment to @npub13n4…3h2h when he in passing explained the reason for not selling through Amazon.
#Books #Kindle #Alternative

2024-10-29 20:06:27

For those whom have already upgraded from Fedora Server 40 to 41 AND was using Redis prior to the upgrade. Redis has been replaced with Valkey and there is a bug in the migration which will copy the redis.conf into /etc/valkey.
That unfortunately will bring over the logfile directive which will point to /var/log/redis/redis.log which will not be possible for valkey to open. Change the logfile directive and you're good to go.
#Redis #Valkey #FedoraServer #Bug

2024-10-12 09:35:29

Our AI-agent friends do have some improvements to be made. Here's a response from Claude Sonnet after having discussed it's limitations in reasoning and mathematical capabilities:
--- quote
There are 3 "o"s in the word "footloose".
This kind of simple counting or pattern recognition in words is something I can do accurately, as it doesn't require complex calculation or reasoning.
--- end quote
#LLM #ArtificialIntelligence #AI

2024-09-08 20:00:49

Guessing that the social.bbc Mastodon experiment has come to an end. Posts have been dwindling and I can only assume it will soon be terminated.
Really sad.
#Mastodon #BBC

2024-09-08 13:19:53

#SilentSunday
https://swecyb.com/system/media_attachments/files/113/102/133/222/007/160/original/956d033a39c6dde6.jpg

2024-09-03 17:14:44

It will be interesting to see if the Steam Proton (compatibility gaming layer for Linux) will lead to increased adoption of Linux Desktop.
Such adoption SHOULD give rise to increased attacks against the Linux desktop most likely through use of Information and Credential Stealers.
Then we'll see... is the Linux Desktop really more secure than Windows and macOS?
#Linux #Desktop #Malware #Gaming

2024-09-01 19:05:17

- reply

@npub14k2…ed68
Monsters of Tokyo perhaps? Or is it called Kings of Tokyo. Not sure if I'm confusing the name with what my kids call it ;)

2024-08-30 11:46:56

Truesec: https://www.truesec.com/hub/blog/dissecting-the-cicada
In June 2024 a new RaaS named Cicada3301 announced they were looking for affiliates encountered in the wild. Truesec analyzed this new Rust-based ransomware.
#ThreatIntel #CyberSecurity

2024-08-26 15:42:59

Leaving #Estonia and the very beautiful #Tallinn and some very excellent coffee. Really should come back for a longer visit, a few hours was all I could spare to visit.
Next time, at least a few days :)

2024-08-18 19:11:20

#SilentSunday
This little fella was actually sleeping on his probably favorite spot in the whole wide world :)
https://swecyb.com/system/media_attachments/files/112/984/606/645/340/131/original/ef980bbbce2c41ec.jpg

2024-08-16 13:02:16

@npub1tva…2yl5 was, or is, Graphene affected by this:
https://iverify.io/blog/iverify-discovers-android-vulnerability-impacting-millions-of-pixel-devices-around-the-world

2024-06-24 18:56:32

#Passkey authentication in RHEL 9.4.
Nice!
https://www.redhat.com/en/blog/passkey-with-rhel

2024-06-23 20:23:24

#SilentSunday #Photography
https://swecyb.com/system/media_attachments/files/112/667/800/652/194/785/original/9b7898e40c1eee8c.jpg

2024-05-29 19:56:04

Attempt at being funny.
*Fortinet, Cisco, and Palo Alto are at a party, laughing and enjoying themselves.*
Check Point: Hey guys, can I join the party?
Fortinet: Sorry Check Point, this party is only for the elite VPN providers. We may have had our fair share of embarrassing vulnerabilities, but we're still the cream of the crop.
Cisco: *chuckles* Yeah, remember when I had that path traversal vulnerability in my AnyConnect VPN? That was a doozy!
1/x

2024-05-16 18:47:06

Is it just me or is Mastodon cyber security related activity ... a lot more quiet?
Seems people have gone back to being active on X or Threads even? No, am I imagining things?
#CyberSecurity

2024-05-06 09:04:43

NoName are going bananas with DDoS-attacks against Finland since a few days ago.
Sup?
#ThreatIntel #NoName #DDoS

2024-04-22 20:19:20

I've never really fully appreciated how useful it is to read other, more experienced, developers code.
You learn so much by forcing yourself to look up particular idioms, and then try them out yourself in your own code.
For me this mean getting better at Python.
Perhaps soon it's time to give #Rust or #Golang a ... uhm... go.
#Programming #Reading #Code

2024-01-20 21:52:23

I miss the internet.. A love letter to webmasters and geocities.
https://joanwestenberg.medium.com/i-miss-the-internet-c7e41544a8b9
What a fantastic and nostalgic read. I agree. I miss the internet. To go there with Netscape Communicator and seeing the interlaced loading of images.
#Nostalgic #Internet #History #Article
https://swecyb.com/system/media_attachments/files/111/790/492/466/751/933/original/ebaf64a13d06c3c2.jpg

2024-01-19 10:33:35

In the beginnings we had electricity. Produce it yourself they said. Then there was centralization of production, buy from us they said. And then there was decentralization; let's produce some of it ourselves we said.
The same story goes for IT. Do it yourself they said. Outsource it they said, buy from us they said. And now, let's do it ourselves.
Cloud came along. Let's run our own datacenters. No, buy from us, it's cheaper they said. Expensive it got. Let's do it ourselves we said.

2023-12-30 22:30:31

- reply

@npub17lg…9uux
What Im mostly concerned about is the kind of precedent this sets.
Will the "success" of Cyber Toufan reverberate into other state actors and what will the long term consequences be?
If countries, and orgs, can be blackmailed/scared into not interacting or doing business with a particular country I can already foresee a number of countries that will find this "strategy" interesting.

2023-10-19 19:14:55

- reply

@npub17lg…9uux @npub1zj4…fyjh please note that there are some variations on the html
One using ".../webui and another ".../webui/"
Yielding different versions of the hash. I personally find the cn subject name to be better and surprisingly accurate.
ssl.cert.subject.cn:IOS-Self-Signed-Certificate

2023-10-15 13:06:17

- reply

@npub17lg…9uux 'preciate the share!

2023-10-15 13:00:56

If I wanted to read reports about APT groups, or cyber criminals, of the "west", where should I turn?
I'm almost getting upset with myself for immersing myself only in reports from the west where the narrative is always the same, and I'm getting a bit tired of it. Iran, China, Russia and North Korea - bad.
So, I want to broaden my view a bit, even if they are (for me) in a foreign language. Hit me with your best recommendations!
#ThreatIntel

2023-10-01 19:39:37

- reply

@npub17lg…9uux Follow up question. Have you also observed that they delete emails mentioning or otherwise could be connected to the now additional MFA-device?

2023-10-01 19:37:39

Question regarding AitM type attacks: When attackers are targeting a user, such as an O365-account, have you observed that they add their own MFA-devices to the account in order to ensure persistence and continuous access to the account in question?
#ThreatIntel #ATiM #ModusOperandi

2023-09-08 16:36:20

- reply

@npub1vcl…k6t3
My thinking was, and it may very well be flawed, that TAs finding and exploiting unknown vulnerabilities like in this instance was, perhaps not novel, but still not entirely common?
Sure, announced vulnerabilities have been exploited for a good while especially when PoCs have been released. Then TAs have been pretty quick to take advantage.
But again, I may be completely wrong here ans it really is business as usual. :)

2023-09-08 14:40:34

- reply

@npub1vcl…k6t3 Perhaps an obvious statement but the success cl0p experienced through MOVEit most certainly further accelerated TA development, acquisition and use of 0day vulnerabilities.
Are we now witnessing the "fruits" of this development and success?
I'm a bit tired, but how many of these cases have we had where TAs exploit 0days before they are even known?

2023-09-06 18:31:18

- reply

@npub17lg…9uux
I just saw and read this myself. I mean jesus fucking christ. The forensic hypothesis leading up to this. A crash dump, containing key materials, exfiltrated legitimately by Microsoft, engineer gets compromised, ta finds dump, looks inside it, finds sicritz, compromises huge portion of Azure/365.
Oh. My. God.

2023-08-03 17:59:08

How do you consume Mastodon? Endless scrolling and refreshing of home? Lists? Followed tags?
Perhaps a custom solution?
I find myself in the scrolling frenzy trying to keep up; futile they say. Nay I say, must not miss I say.
Would be interested to learn some tricks? :)
#Mastodon #Timelines #InformationOverload

2023-08-01 14:01:24

- reply

@npub1ehd…udlw
Correct. Consider social.bbc where you cannot create an account but I want to follow their content from all their accounts, but still not pollute my home timeline.

2023-08-01 11:59:23

@npub1ehd…udlw How hard would it be to add entire local timelines of a particular instance as a pinned item? Much like what a list is?
I have found myself more than once wanting to track an entire timeline of an another instance.

2023-08-01 11:59:23