Not Simon the Goat

This is not Simon. Username was changed just in case. Opinions are made by a screaming goat and do not express the views or opinions of his goatherder.

Public Key

npub1cetfz9z5qtn3lly58p3t4hmxxqhy0vml22z5g8rve3vjesg5gzxs6mclln

NIP-05 Address

screaminggoat_at_infosec.exchange@mostr.pub

Profile Code

nprofile1qqsvv453z32q9ecllj2rsc46manrqtj8kdl49p2yr3kvckfvcy2yprgpzemhxue69uhhyetvv9ujumn0wd68ytnzv9hxgqg4waehxw309aex2mrp0yhx6mmnw3ezuur4vgzygs44

Publishing to

relay.nostr.band

relay.mostr.pub

Author Public Key

npub1cetfz9z5qtn3lly58p3t4hmxxqhy0vml22z5g8rve3vjesg5gzxs6mclln

Show more details

Last Notes

2024-09-20 16:09:11

- reply

@npub1vcl…k6t3 because the victim was from the crypto sector and no one likes crypto bros /s
Honest question: How does one read Rapid7's severity levels? What make it different from a CVSS score?

2024-09-19 01:01:23

Stolen (and modified) from the Bad Place.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/161/500/023/275/904/original/89ce5ea5d954bfa3.png

2024-09-17 19:34:59

- reply

@npub18c7…er9d WoRkS oN mY MaChInE 🤷‍♂️
I can copypasta the contents of the security advisory when I get home

2024-09-16 23:13:33

WIRED: Elon Musk Is a National Security Risk
Musk’s now-deleted post questioning why no one has attempted to assassinate Joe Biden and Kamala Harris renews concerns over his work for the US government—and potential to inspire extremist violence.
#news #trump #elonmusk #uspol

2024-09-13 16:54:17

- reply

@npub18c7…er9d Fortinet's was exposed Azure SharePoint: https://www.bleepingcomputer.com/news/security/fortinet-confirms-data-breach-after-hacker-claims-to-steal-440gb-of-files/

2024-09-11 14:00:11

watchTowr: We Spent $20 To Achieve RCE And Accidentally Became The Admins Of .MOBI
Yo what the fuck. watchTowr had inadvertently undermined the CA process for the entire .mobi TLD:
we took control of a chunk of the Internet’s infrastructure, opened up a big slab of juicy attack surface, and found a neat way of undermining TLS/SSL - the fundamental protocol that allows for secure communication on the web.
No spoilers, this is a must-read.
#mobi #tls #ssl #vulnerability

2024-09-09 15:04:32

- reply

@npub18c7…er9d I should mention that your PIE stack vuln CVE-2017-1000253 was marked "Known To Be Used in Ransomware Campaigns"

2024-09-08 20:53:24

- reply

@npub1vcl…k6t3 We're going to have to regress back to Web 2.0, have a curated research library (with a triple peer-review process), and ban everyone who mentions AI or uses ✨ emoji.

2024-09-07 16:43:19

NSA's No Such Podcast: How We Found Bin Laden: The Basics of Foreign Signals Intelligence
Current and former senior NSA officials, who were involved in the search for Osama bin Laden after the September 11, 2001 terrorist attacks, describe NSA's role in the foreign signals intelligence to help find him. You can read the transcript as a 15 page PDF
#nsa #september11 #sigint #intelligence #osamabinladen

2024-08-29 19:13:17

- reply

@npub1vcl…k6t3 my immediate concern would be about security features and stress testing the system. Are there anti-fraud or dispute resolution features?

2024-08-13 17:04:29

Microsoft taking their sweet time to release their scurity advisories for Patch Tuesday. It's been 4 minutes, cmon Bill Gates.

2024-08-13 17:04:29

Microsoft taking their sweet time to release their scurity advisories for Patch Tuesday. It's been 4 minutes, cmon Bill Gates.

2024-08-12 18:34:43

- reply

@npub1vcl…k6t3 It sounds plausible. Fortra should provide a proof of concept and detailed write-up since Microsoft won't accept that the vulnerability exists.

2024-08-05 22:54:45

Elastic: Kibana 8.14.2 / 7.17.23 Security Update (ESA-2024-22)
CVE-2024-37287 (9.9 critical) Kibana arbitrary code execution via prototype pollution (ESA-2024-22) An attacker with access to ML and Alerting connector features, as well as write access to internal ML indices can trigger a prototype pollution vulnerability, ultimately leading to arbitrary code execution.
No mention of exploitation.
#CVE_2024_37287 #Elastic #vulnerability #Kibana #CVE

2024-08-05 18:42:46

I don't know who's the social media manager over at CISA but they just posted a tweet on the bad place with a URL linking to edit[.]cisa[.]gov, revealing how they publish on their content management system.

2024-07-25 16:12:33

- reply

@npub1vcl…k6t3 that's not the only vulnerability https://infosec.exchange/@screaminggoat/112847608413410966

2024-07-19 17:21:58

Leaving the ocean was a mistake
#crowdstrike #outage
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/814/306/495/574/745/original/47de1f0fbddd920e.png

2024-07-18 19:57:21

- reply

@npub1zj4…fyjh paywall on the intelligenceonline.com article. Do you have a list of what Chengdu 404 is hiring for?

2024-07-18 19:57:21

- reply

@npub1zj4…fyjh paywall on the intelligenceonline.com article. Do you have a list of what Chengdu 404 is hiring for?

2024-07-18 18:58:56

- reply

@npub18c7…er9d I unfollowed him after this toot: https://journa.host/@w7voa/112770462320699429

2024-07-18 16:17:54

- reply

@npub1zj4…fyjh I prefer CERT-UA's link: https://cert.gov.ua/article/6280099
This one contains IOC and a more detailed analysis of the infection chain.

2024-07-18 16:17:54

- reply

@npub1zj4…fyjh I prefer CERT-UA's link: https://cert.gov.ua/article/6280099
This one contains IOC and a more detailed analysis of the infection chain.

2024-07-18 15:23:35

Does Mitel understand what a security vulnerability is? None of their 17 July 2024 advisories contain a CVE ID. Replace your Mitel IP phones with Cisco.

2024-07-17 17:33:35

- reply

@npub1vcl…k6t3 Ransomware groups are just pre-payment pentesters.

2024-07-17 17:29:58

- reply

@npub1vcl…k6t3 IT can outsource the password resets to threat actors.

2024-07-17 15:28:18

At 1100 followers, I will delete my Mastodon account.

2024-07-17 15:08:08

- reply

@npub1vcl…k6t3 I wouldn't say it's "we screwed up." I don't put myself at the same level of responsibility as oil and gas industries, cruise liners, auto industry, chemical and manufacturing.

2024-07-12 15:42:04

- reply

@npub1vcl…k6t3 Insurance companies hate this one weird trick! How else are they supposed to raise your premiums without getting to know your pre-existing conditions or driving habits?

2024-07-10 20:27:27

Unit 42: DarkGate: Dancing the Samba With Alluring Excel Files
Unit 42 provides a technical analysis for a DarkGate malware campaign from March-April 2024 that uses Microsoft Excel files to download a malicious software package from public-facing SMB file shares. "Threat actors can creatively abuse legitimate tools and services to distribute their malware." IOC provided.
#threatintel #DarkGate #malwareanalysis #IOC

2024-07-09 12:24:32

BlackBerry: Coyote Banking Trojan Targets LATAM with a Focus on Brazilian Financial Institutions
Coyote is a .NET banking Trojan that has been observed targeting Brazilian financial institutions, primarily banks. BlackBerry provides a technical analysis of the infection vector and execution chain. IOC provided.
#bankingtrojan #coyote #brazil #cybercrime #threatintel #IOC

2024-07-08 11:28:44

Kaspersky: CloudSorcerer – A new APT targeting Russian government entities
Kaspersky writes a somewhat confusing article referring to CloudSorcerer as both malware and an Advanced Persistent Threat (APT). Keeping that in mind, CloudSorcerer performs stealth monitoring, data collection, and exfiltration via Microsoft Graph, Yandex Cloud, and Dropbox cloud infrastructure. It also uses GitHub as its initial C2 server. IOC provided.
#threatintel #CloudSorcerer #cyberespionage #IOC

2024-07-05 12:33:18

Unit 42: Dissecting GootLoader With Node.js
Unit 42 demonstrates how to circumvent anti-analysis techniques from GootLoader malware while using Node.js debugging in Visual Studio Code. IOC provided.
Sandboxes with limited computing resources can struggle to analyze a large volume of binaries. Malware often takes advantage of this to evade analysis by delaying its malicious actions, which is commonly described as “sleeping.”
#gootloader #malwareanalysis #threatintel #ioc

2024-07-02 16:47:43

- reply

@npub12lx…jvjy nooo my timely and actionable goat information!

2024-06-28 14:40:42

- reply

@npub18c7…er9d build up your caffeine tolerance little by little until you're mainlining espresso shots directly into your veins.
Otherwise you can delegate where possible. and leave the cyber to me 🐐

2024-06-28 13:56:56

At 1000 followers (my second time around), I will quit cybersecurity and join the Adélie penguins in Antarctica.

2024-06-26 17:11:08

Tenable: Fortra FileCatalyst Workflow Unauthenticated SQLi
Tenable decided to drop a same-day proof of concept for Fortra FileCatalyst Workflow SQL injection vulnerability CVE-2024-5276 (9.8 critical, disclosed 25 June 2024, see Fortra security advisory).
See Bleeping Computer reporting: Exploit for critical Fortra FileCatalyst Workflow SQLi flaw released
#CVE_2024_5276 #Fortra #vulnerability #CVE #ProofofConcept #POC

2024-06-22 01:39:28

- reply

@npub17lg…9uux Genians (Korean company) first reported Kimsuky APT using the MSC attack vector on 05 June 2024: https://www.genians.co.kr/blog/threat_intelligence/facebook (Korean language)

2024-06-19 04:38:53

- reply

@npub1vcl…k6t3
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/641/433/413/706/304/original/eaabe600c9078018.mp4

2024-06-19 04:25:40

- reply

@npub1vcl…k6t3 I can source you the RSS for most of the listed ones, dunno who maintains the feeds. Unfortunately I'm hotspotting my phone so it's a little difficult for me right now.

2024-06-19 02:53:58

- reply

@npub1vcl…k6t3 I've got slow internet atm but your TTI Intel Feed looks great. Do you have Broadcom's VMware security advisories in there?

2024-06-05 16:08:02

SANS ISC: Brute Force Attacks Against Watchguard VPN Endpoints
@npub1xk3…vxw8 of SANS ISC identified 185.122.204[.]102 attempting to brute force a Watchguard firewall VPN. Curiously only using two usernames: jason and robert.
#IOC #threatintel

2024-06-03 22:40:09

In case any Chinese threat actors are monitoring my Mastodon, it's already June 4th and the 35th anniversary of the Tiananmen Square Massacre: https://en.wikipedia.org/wiki/1989_Tiananmen_Square_protests_and_massacre
#tiananmensquare #china #tiananmen

2024-05-27 23:30:16

- reply

@npub1vcl…k6t3 FBI’s Encrypted Phone Platform Infiltrated Hundreds of Criminal Syndicates; Result is Massive Worldwide Takedown

2024-05-27 23:05:01

- reply

@npub1zj4…fyjh top trending toot on Mastodon actually: https://mastodon.archive.org/@internetarchive/112513905401989149

2024-05-23 00:03:32

- reply

@npub1zj4…fyjh
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/487/458/393/759/318/original/68100fb245a61ade.png

2024-05-06 15:24:34

- reply

@npub1zj4…fyjh Great job finding all of the government links on APT28. I only just discovered the European Council and NATO statements this morning and was going to share them with you.

2024-05-01 16:03:40

- reply

@npub1vcl…k6t3 Artificial Intelligence

2024-04-29 15:03:49

Zscaler: Zloader Learns Old Tricks
Zloader (a.k.a. Terdot, DELoader, or Silent Night) is a modular trojan based on leaked ZeuS source code. The latest version of Zloader 2.4.1.0 has reintroduced an anti-analysis feature that was abandoned by many malware variants derived from the leaked source code. Zscaler provides a technical analysis of the anti-analysis feature, and lists IOC.
#Zloader #malware #threatintel #IOC #Zeus #trojan

2024-04-27 13:25:08

ESET: Gripped by Python: 5 reasons why Python is popular among cybersecurity professionals
If you know Python, you already know why. The TL;DR is:
Ease of use and conciseness
Versatility
Adaptability and integration
Task automation
Extensive libraries and active community
#Python #cybersecurity

2024-04-26 15:53:22

Sysdig: Meet the Research behind our Threat Research Team – RSA 2024
I thought the title was a typo but Sysdig showcases various threats and vulnerabilities that their threat research team worked on: such as SSH-Snake, Romanian threat actor RUBYCARP, Operation SCARLETEEL, cryptojacking Operation AMBERSQUID, Meson Network, Operation LABRAT, CVE-2024-3094 (XZ Utils), and the Leaky Vessels vulnerabilities. You can meet the threat research team at booth S-742 at RSA Conference 2024, May 6 – 9 in San Francisco.

2024-04-25 18:53:06

Changing my username on Monday had an unintended consequence: 600 followers were removed today! I don't remember every single* person who used to follow me, but baby come back! Any kind of fool could see 🎵

2024-04-25 18:53:06

2024-04-24 16:48:06

- reply

@npub1vcl…k6t3 How do you know that this is a Chinese APT? I searched for the keywords "China" "Chinese" and even "Asia", then scanned the blog post line by line and I don't see any explicit reference to China.

2024-04-23 01:21:10

FYSA: My username was changed to @npub157z…2q4w. Please update your RSS feed.
EDIT: I will continue to provide high quality photos and facts about goats.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/317/902/020/738/180/original/9e36a1d785470f54.mp4