chort ↙️↙️↙️

Skills/interests: Listening, understanding, privacy, DFIR, guitars, motorcycles, working out, whisky, anti-fascist action. Opinions NOT those of my employer.

Public Key

npub1h0er8h4ag5eghz76908rg89lykx37gehume3qpkscxe09yygh56srtceen

NIP-05 Address

chort@infosec-exchange.mostr.pub

Profile Code

nprofile1qqsthu3nm6752v5t30dzhn35rjljtrglyvm7ducsqmgvrvhjjzyt6dgpzemhxue69uhhyetvv9ujumn0wd68ytnzv9hxgf5h66r

Publishing to

relay.nostr.band

Author Public Key

npub1h0er8h4ag5eghz76908rg89lykx37gehume3qpkscxe09yygh56srtceen

Show more details

Last Notes

2025-03-28 15:39:30

- reply

@nprofile…36ma and he was around 40 when he met the 17 year olds. Oh well.

2025-03-28 15:29:39

- reply

@nprofile…36ma oh my

2025-03-27 22:36:11

I guess some threat actor has figured out how to abuse forms on various platforms, like Hubspot and Microsoft(!?!) to send invoice phishing.
On Hubspot the real destination URL seems to be hidden until you click submit. At least on Microsoft (customervoice.microsoft.com) it's visible in the form code (although the actor has whited-out the warning not to enter credentials, lmao).
Just absolutely blows my mind that Microsoft allows any way at all to put user-supplied content on a microsoft.com sub-domain. What absolute brain-genius built that site?

2025-03-14 21:05:19

I heard there have been some InfoSec layoffs lately. First of all, my condolences. Capitalism sucks.
Second, if you know of experienced Detection & Response folks, please send them my way. I might have a position opening soon.

2025-01-14 18:18:28

- reply

@nprofile…d2rl lol, lmao even

2025-01-03 23:59:39

- reply

@nprofile…36ma lol, lmao

2024-12-17 21:02:57

Has anyone heard of iPhone composing gibberish text messages on its own?
Someone sent me screenshots of SMS drafts that seem to be potential AI hallucinations in mixed up repeating patterns. The messages seem closely related to previous conversations with those recipients.
Their hardware and/or OS don’t have Apple Intelligence.

2024-12-12 00:45:40

Apparently classified military documents have once again been leaked on Warthunder forums. Lol.
(Italian Eurofighter)

2024-12-09 21:12:50

- reply

@nprofile…36ma definitely could be. It was all over Reddit though, and Bluesky, and who knows where else.
But ultimately, their fail for pulling the mask down at the hostel.

2024-12-09 20:33:40

I really wonder if the “person of interest” would have been found if literally the whole Internet hadn’t been posting (supportive) memes with their photo.
The first rule of photographing protests is: DON’T!
The second rule is, if you’re going to do it anyway: DON’T SHOW FACES or other uniquely identifiable aspects.

2024-12-06 18:31:13

- reply

@nprofile…xutp haha, reminds me of when I was working at an email security company and one of the architects sent me an email header and asked "do you see what's funny about this?"
It was targeted phishing, and the original Received: header showed it was sent from an IP in Russia... that was owned by a tech services company, that exclusively provided service to the SVR. They forgot to connect to a VPN or proxy before sending out their massive phishing campaign, from their desk at the SVR.
LMAO.

2024-12-05 16:16:07

- reply

@nprofile…f9kf @nprofile…d2rl I’ve seen other CEOs do similar (although less egregious) stuff. As a group, CEOs are way more afraid of upsetting extremely conservative employees than dehumanizing minorities, or even endangering employee health (COVID).

2024-11-20 02:21:11

LMAO, does OkCupid run on Excel now???
This just happened recently. I bet this was a botched database migration. Maybe that explains why chat messages are showing out of order too.
LOL, what a dumpster fire.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/512/876/656/719/273/original/36cd86d3f2afe11f.jpeg

2024-09-09 19:25:07

The cheapest new iPhone costs more than 2x what I paid for my first car.

2024-09-07 20:57:54

A Cybertruck rolled up outside my house and this total dork knocked on my door to ask “if there’s an event here today.” I pointedly looked at his truck and said “no, definitely not.”
Then he confusedly looked at his phone and at my house, and eventually shuffled off the porch. This confirms all my existing biases about Incelmobile owners.

2024-09-07 20:57:54

2024-06-25 17:32:27

It's super-frustrating to me that, in the world of containers, just because you *run* something doesn't mean you *have* that thing, in any meaningful way.
If I want to inspect a container image I have to jump through tons of hoops and special incantations, despite it having run on the very same machine.
Seems like the future of software will prevent you from inspecting anything at all.

2024-06-13 22:21:13

Recall feels like someone's hackathon project that got massively overhyped.

2024-06-09 16:16:29

- reply

@npub17lg…9uux ok, but that’s just SaaS.

2024-06-09 15:33:18

- reply

@npub17lg…9uux The MFA criticism is totally valid, but what SaaS provider DOESN’T put their customers on a sub-domain? What a weird thing to fixate on.

2024-05-20 19:12:13

- reply

@npub17lg…9uux 🤨 🤨 🤨 🤨 🤨 🤨

2024-05-06 19:20:48

So a "fun" thing I learned about Outlook recently is that there's an option to "sync to the cloud," which apparently syphons all the emails, calendar invites, etc from your email account (regardless of the platform) into Azure.
This obviously results in a lot of user activity coming not from the user's device, but from Azure IPs. OK, that's how it goes... but then sometimes, for reasons that are completely opaque, the Azure access will come from a completely different continent. Good luck trying to do impossible travel alerts on that!
Yet again, WTF, Microsoft?!?

2024-04-16 16:13:07

You have GOT to be shitting me.
/me flings belongings out the window
/me walks into the sea
https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/281/773/336/117/844/original/a13e945c755ce36c.png

2024-04-12 18:24:43

It's 2024, security vendors are still running services as root that can be reached without authentication and are susceptible to command injection.
:blobcattableflip:

2024-03-22 21:44:48

The probability any random phishing site lands on Cloudflare sure feels like 50%.
What a cesspool.

2024-03-08 23:40:28

- reply

@npub17lg…9uux I am extremely confident that security staff working for non-security vendors would be paid the same regardless of ransomware.
The last place I worked didn't have Active Directory and didn't have a ransomware playbook until 3-years into my employment there. The salaries were pretty comparable to tech industry.
If ransomware went away, some flashy security companies that specialize in that space would disappear, but everything else would be largely the same.
There are other ways to monetize stolen data (or access), it's just that ransomware is the most lucrative. There are other motives for stealing/leaking than monetization and those motives are going away.

2024-03-08 23:19:19

- reply

@npub17lg…9uux BTW forgot to mention that kind of money is not unique to security. Senior SREs and Architects make that at big tech companies.
These companies wouldn't be paying SREs that kind of money if it wasn't worth it to keep things running.

2024-03-08 20:12:29

- reply

@npub17lg…9uux OK, but are those people billable or otherwise generating revenue? I could definitely see CTI people at say, Microsoft making bank if they are not only helping to defense internal systems, but publishing blog posts externally. Credibility is extremely important when you're that size. Customers have to believe you know what you're doing.
The CTI person I hired at my last gig is worth more than me (a Director) IMO. They built a tool to detect phishing infrastructure that is helping keep the entire customer base safe, as well as the corporate environment. Invaluable to that company in terms of credibility with their customers.

2024-03-08 20:05:45

- reply

@npub17lg…9uux I don't think security salaries are inflated at all. If anything, security professionals are grossly underpaid considering the stress of incredible levels of responsibility, with barely any authority.
The issue is that a lot of security spend is going to ineffective and self-defeating areas, like ransomware negotiators, darkweb monitoring, etc.
Orgs are spending big on ransomware symptoms, and little on ransomware causes.

2024-02-29 21:11:47

Companies really out here bolting AI onto every visible surface of their products, meanwhile their software doesn't even run on February 29th.
Technology is a deeply unserious industry, filled with extremely mediocre people making massively consequential decisions. Absolute clownshoes stuff.

2024-02-29 21:00:05

I want to know how any software company shipping products doesn't have *ANYONE* in their approval process with more than 4 years software experience.
How the FUCK do you have leapyear bugs in prod? HOW?

2024-02-02 23:19:56

- reply

@npub17lg…9uux LOL, production thoroughly owned, code signing certificate presumed stolen, TLS certificates presumed stolen, login portal passwords presumed stolen, but "the situation is under control and it is safe to use AnyDesk."
Riiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiight.

2024-01-24 19:55:50

This is why digital ad-financed services are inherently immoral. This is no way to do it without this being the end result https://www.404media.co/inside-global-phone-spy-tool-patternz-nuviad-real-time-bidding/
There needs to be extremely strong global laws against this kind of collection. Society needs to be disabused of the notion that they can have any app on a whim for free, because "free" has an absolutely staggering societal cost that is borne extremely unevenly and unpredictably.

2024-01-24 16:52:32

Thinking about how many major media outlets just publish Russian government claims at face value, despite decades of obvious lies and deception. Really MH-17 and all the blatant lies that followed should have ended any credibility at all in Russian statements, yet here we are after Putin's Russia started an unprovoked war and invasion in Ukraine, where his soldiers have committed thousands of war crimes, and media is STILL publishing Russian statements.
But then I think about how many OTHER governments blatantly lie and media publishes THOSE statements too. It's really pathetic how the institution that is supposed to hold the powerful to account is so often just a willing mouthpiece of their lies. Corporate "journalism" is a disgrace.

2024-01-10 21:51:32

- reply

@npub17lg…9uux They did that with the recent MDM agent SQLi -> RCE vuln too.

2023-12-20 16:18:56

- reply

@npub17lg…9uux Just in terms of how quickly they got hit. Not everything that's vulnerable gets hit right away. Even if attackers scripted the harvesting, they don't have the bandwidth to use all the sessions simultaneously.
On the other hand... Comcast should have known to invalidate the sessions, so that would be a fail.

2023-12-20 16:11:36

- reply

@npub17lg…9uux That's really interesting. I was wondering how Comcast got popped, since it seems like they definitely should have known better given their relative competence with infrastructure.
I really, really hate their customer-facing side, but they seem to know infra.
So I guess the answer is: Unlucky.

2023-10-02 16:00:51

- reply

@npub17lg…9uux they did WHAT now?!?

2023-09-28 15:39:13

- reply

@npub17lg…9uux I don’t have all the context, but session token theft doesn’t necessarily mean they interacted with a phishing website. Could have been endpoint malware that stole it from browser.

2023-08-16 17:25:53

- reply

@npub1psd…9sr7 @npub1eys…6x02 Haha, no way that was you?!? You’re probably aware that Githyanki are a huge part of the plot in BG3.

2023-03-21 18:21:17

- reply

#[0] The FUCK? Guess I have to actually go to school board meetings now.