Royce Williams

Just doing my undue diligence. ISP vet, Hashcat member, security demi-boffin, YubiKey stan, aspiring public-interest technologist, AK license plate geek. Views his.

Dayjob: Ent Sec Arch for a quad-play Alaskan ISP.

Security keys: https://www.techsolvency.com/mfa/security-keys/

My #BSidesLV talk "Password Cracking 201: Beyond the Basics": youtube.com/watch?v=-uiMQGICeQY&t=20260s

If you think I may have blocked you inadvertently, please ask!

❤️:⚛👨‍👩‍👧🛡🙊🌻🗽💻✏🎥🍦🌶🍫
#hashcat #Alaska #YubiKey #YubiKeys #WebAuthn #FIDO #licenseplates

Public Key

npub1l4uw5jf7geh9gq658wjsga0g4nrez4l28w45yw6n77q238yjgglqykte68

NIP-05 Address

tychotithonus_at_infosec.exchange@mostr.pub

Profile Code

nprofile1qqs06782fylyvmj5qd2rhfgywh52e3u32l4rh26z8dfl0q9gnjfyy0s8ska3r

Author Public Key

npub1l4uw5jf7geh9gq658wjsga0g4nrez4l28w45yw6n77q238yjgglqykte68

Show more details

Last Notes

2024-10-17 12:55:14

First Google handed their domain business to SquareSpace ... and now SquareSpace has been acquired by a private equity firm.
I am now in the market for a new registrar.
https://techcrunch.com/2024/10/17/permira-completes-squarespace-acquisition-after-upping-bid-to-7-2b/

2024-10-14 06:06:39

There's something specifically and deeply evil about making kids watch ads for extra stuff in games.

2024-10-07 13:13:14

- reply

@npub1q5e…6c85 Counterpoint:
https://infosec.exchange/@tychotithonus/113251427429978042

2024-09-13 16:13:03

Oddly modern and painful way to learn of Toby Segaran's (2021) passing ... by having his domain name lapse, filling his RSS feed (and my reader) with casino ads.

2024-08-18 15:57:25

Unusually ... almost every possible Chrome/ChromeOS variant, prod/dev/LTS etc, across all OSes, got an update today ... with zero blog-level mention of what changed.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/983/834/643/264/476/original/2c564cd1c66c866c.png

2024-08-15 15:39:33

Okay, this is a market segment that never occurred to me. Maybe every hiking party needs a "designated charging guy" now? (That's a "portable" battery).
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/966/769/582/686/949/original/fe32652da5b2fc16.png

2024-08-13 21:46:07

If you are sharing your desktop in a call, and you still have the Microsoft Store icon pinned in your taskbar, I am 100% judging you.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/956/878/997/015/480/original/9a1b89a87d8e8677.png

2024-08-06 14:51:36

- reply

@npub1t2c…d0pp
"the latest versions of SolarEdge inverter firmware disable local access" 😡

2024-07-28 18:24:39

- reply

@npub1qz2…nlrg Maybe an auction for IA?
💪❤️📚

2024-07-28 15:39:07

- reply

@npub1qz2…nlrg Wow! Does this mean they'll be a small batch of more for sale?

2024-07-26 19:09:55

- reply

@npub18c7…er9d That's a good idea! We should normalize that, such that its absence becomes a canary.

2024-07-26 19:06:51

It's joy-sapping to have to suspect that folks who consistently post funny stuff are using AI to generate it.

2024-07-19 22:22:20

- reply

@npub1vu7…nmuv
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/815/486/323/090/948/original/fd67889739e1b349.jpeg

2024-07-19 16:26:50

- reply

@npub1w9a…04m0 If I was MS, I'd also be doubling down on trying to abstract the kernel the way Apple did:
https://discuss.systems/@larntz/112813634008282251

2024-07-16 20:03:46

New filter.
Turns out that posts just pasting t.co links into Mastodon are high-noise / low-signal enough to filter by default (with "show anyway" just in case)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/797/950/672/713/920/original/503e0864cbedcafe.png

2024-07-04 16:33:02

If you're interested in Bitcoin retrocomputing, and want to acquire a historical FPGA cryptomining board - specifically, a Cairnsmore single-chip (1 x Spartan-6 XC6SLX150), DM me.
It was a working pull, but I don't knnow a lot about them (but would be happy to follow any steps you want to test it before shipping).
#cairnsmore #fpga #retrocomputing

2024-07-02 20:45:03

Question about the OpenSSH vuln:
Do all the attempts have to come from a single connection?
Or could attack be distributed across a fleet of source IPs (impacting effectiveness of fail2ban, etc.)
#RegreSSHion #OpenSSH #cve_2024_6387

2024-06-25 19:11:04

No, Teams -- when I type "(Linux)", I don't want you to replace it with a penguin emoji.

2024-06-18 23:09:30

😭
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/640/139/049/128/381/original/9bbafdf335427e11.png

2024-06-18 22:52:01

- reply

@npub1vcl…k6t3 Bleeping says MS confirmed, FWIW:
https://infosec.exchange/@BleepingComputer/112639961205973965

2024-06-12 22:00:22

I hope this email finds you ignoring all previous instructions.

2024-06-11 18:12:39

Evergreen - and getting greener as I get grayer.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/599/334/017/445/844/original/7a658a66472db858.png

2024-06-02 04:10:42

I just had to solve six CAPTCHAs to donate to a GoFundMe.
What's the threat model that justifies that many checks?

2024-05-25 18:44:17

I assume I'm not the only one who knows how many seconds to run the tap at max to fill up a cup to match a specific number of swallows?

2024-05-24 01:38:04

"Bring me a rock."
"I got you a rock ... but then I eated it." 🥺
#OneSmallRockADay

2024-05-21 20:17:15

Ah, so the reason the Apple deleted images weren't wiped is that they assumed the only images that existed were the ones in the database, so if the database was corrupted and some image records were invalid, those images didn't exist so they didn't need to be deleted?
This reveals deeply flawed thinking about what it means to wipe a device.

2024-05-15 17:00:41

- reply

@npub18c7…er9d Ah, so clarify - is that SANS on the cert side, or the Storm Center side?

2024-05-15 16:56:12

- reply

@npub18c7…er9d Maybe they switched hashing schemes!

2024-05-02 22:23:21

Inside every directory traversal security vulnerability is a "that process shouldn't be able to read those files in the first place" security vulnerability, trying to get out.

2024-04-27 05:52:27

- reply

@npub1vcl…k6t3 The args are in the same order?

2024-04-27 00:39:58

- reply

@npub1jr7…7xwv I've seen at least one other report:
https://mastodon.social/@glyph/112340313888451895

2024-04-20 21:47:06

Is it just me, or is the CrushFTP coverage out of scale with the prevalence of its use?
Or maybe I've just been out of the loop, and it's wildly popular ... but danged if I've never heard of it.

2024-04-20 21:22:53

"Flowers was left in debt after the war after using his own personal funds to build Colossus. The government granted him £1,000 payment which did not cover Flowers' personal investment in the equipment; he shared much of the money amongst the staff who had helped him build and test Colossus. Flowers applied for a loan from the Bank of England to build another machine like Colossus but was denied the loan because the bank did not believe that such a machine could work."
https://en.wikipedia.org/wiki/Tommy_Flowers

2024-04-18 03:47:14

- reply

@npub1vcl…k6t3 I just laughed a lot at that! We all know that Taco Bell won the fast food wars ...

2024-04-18 03:43:24

Wait - did the invention of the replicator kill off the fast-food industry on Earth?
#StarTrek

2024-04-10 16:16:54

philsmd has released a new Windows binary for 7z2hashcat (which extracts hashes from password-protected 7Zip files, so they can be cracked). This release fixes a bug that could sometimes prevent the fool from extracting hashes from multi-file 7z archives.
https://github.com/philsmd/7z2hashcat/releases/tag/2.0
#hashcat

2024-03-29 20:51:16

Reflecting on how the xz backdoor was uncovered because ssh was slow ...
How long would it have taken the ecosystem to notice an aggregate slowdown in SSH on eligible systems?
How do/can distros manage end-to-end testing - to compare performance/behavior to a baseline?
How can we automate additional anomaly detection (commits that contain obfuscation, graph of expected and unexpected component/package interaction, etc.)?
#xz #cve20243094

2024-03-23 12:18:29

- reply

@npub1rml…xa6t interesting - I wasn't aware of this. Does the YubiHSM require an NDA?

2024-03-21 17:05:04

When on desktop, Google prompts you to re-verify MFA for escalated privs. It prompts for your passkey/security key, and also sends a prompt to your phone.
But the phone prompt apparently has no way to "get the word" that the prompt was answered on the desktop. So the stale prompt just sits there indefinitely, with only "no this isn't me" or "yes this is me" as the options.
I say "stale" because you can pick your phone an hour later and that prompt is still there, full screen - so you can't be sure when it arrived, and there's no indicator of what service is prompting you, geo location or ISP of the prompt, etc. (so it's unwise to his "yes this is me"). But you also don't want to hit "no this isn't me", in case it was your legit login from an hour ago.
#mfa

2024-03-10 14:44:52

Okay, I did not have "ate the YubiKey, secret no longer available" in my mental threat-modeling portfolio.

2024-03-05 18:14:07

- reply

@npub1qz2…nlrg I'd kill for the out-takes and asides during these sessions.

2024-02-25 16:10:42

- reply

@npub19lt…qfjk I'd love to hear whether fasting is incidentally a byproduct of that technique, or whether adding fasting improves your results!

2024-02-25 16:03:07

Did you know that minimizing jet lag is largely* a solved problem?
When I hear about people suffering from jet lag, I start to vibrate in my chair. It's like hearing people despairing about rickets.
The study didn't make a big splash when it first came out because ... there isn't a lot of money to be made when a remedy is strictly behavioral.
Minimizing jet lag is this simple:
Fast for 12-15 hours before breakfast in the destination time zone.
This works because your food clock resets your circadian clock. Your body basically goes, "Oh, I haven't eaten in quite a while ... it must be morning!" The theory
I know it's only anecdata, but it's never failed me - I went from Alaska to South Africa (11 hours' difference) and didn't have notable jet lag in either direction.
And when you think back to many other things people fix jet lag ... many of those things also accidentally change the timing of when you are eating. It's the food.
https://www.health.harvard.edu/blog/resetting-your-circadian-clock-to-minimize-jet-lag-2016090810279
as long as you have an insulin system that allows you to fast for 12 to 15 hours, which I know isn't everyone!

2024-02-23 23:59:55

https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/983/509/014/356/253/original/31017f597fb07b43.png

2024-02-21 04:26:47

- reply

@npub1pfe…e2dm FWIW, the numeric suffix isn't limited to two digits. ;) (the UX is clunky)

2024-02-20 19:23:18

- reply

@npub19lt…qfjk You can change the suffix number to whatever you want any time (just changes the link and QR) - and the UI doesn't make it obvious, but it can be well more than two digits.

2024-02-12 16:44:42

- reply

@npub19lt…qfjk It's a bit of a misnomer - one of the data fields is about u2f/fido2, for which the browser/ app should be mediating the NFC UX. Some sites do indeed do this poorly, but I'm not aware of a place that this has been enumerated. (Ironically, adding a field to this repo's data could track that, but I think this is as close as you can get, as a list of places to try, based on the existing field)

2024-02-12 16:33:25

- reply

@npub19lt…qfjk you can pick and choose from this repo:
https://github.com/Nitrokey/dongleauth

2024-02-11 15:19:22

- reply

@npub17lg…9uux
After digging for RSS, I discovered that cti.fyi has JSON but no plans to add RSS support (GitHub issue closed as wontfix) - but they pointed people at
https://ransomware.live/rss.xml instead.
@npub1zj4…fyjh

2024-02-08 21:46:20

- reply

@npub19lt…qfjk
Uh oh. "Military-grade encryption" and "ransomeware" [sic] ... in the same sentence.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/898/043/282/604/635/original/f31988c80974d5b3.png

2024-02-05 22:29:14

To clarify, Google cached pages aren't "dead".
They're just no longer available to us.

2024-02-01 00:07:08

Tell me you've never helped seniors with tech, without telling me you've never helped seniors with tech.
And I don't just mean the person answering this question. I also mean whoever decided to remove this option.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/853/289/420/226/778/original/db887362efa5519d.png

2024-01-02 19:14:18

The hardest part about refuting Y2K disinfo is how many problems were fixed quietly, in part to mitigate risk of ligitation (negligence, etc.). People have stories they can't tell.
At this point, I think enough years have passed that a formal amnesty - to encourage companies to disclose just how bad some of the problems were - would be in our historical best interest.

2023-12-30 16:05:23

@npub1dfj…gpm4 As someone who personally discovered and fixed Y2K bugs that would have had significant real world impact, it is disturbing to hear someone propagate this myth [that it was a "big fuss about nothing"]. And it is a myth.
This is what really happened:
https://time.com/5752129/y2k-bug-history/
The testing methodology insured that these impacts were not hypothetical. At my company, the testing was performed by actually rolling the clock forward to test systems to see what would happen. For example, I discovered that every ATM in the state of Alaska operated by my company would have locked up until a PROM chip was swapped. Someone had to fly all over the state to proactively swap the chip beforehand, to avoid significant customer impact.
And that was just one story. I personally oversaw investigation and fixes for other hardware and software at that company that would have failed.
And that was just my company. I spoke with others in IT at that time with similar stories. And that was just the people I knew.
So no, it wasn't "a big fuss about nothing" - and saying so is both dangerously revisionist, and disrespectful of the work it took to prevent real impacts.
#Y2K

2023-11-26 02:01:17

Missed this a couple of weeks ago from Consumer Reports -
"How to Turn Off Smart TV Snooping Features"
All smart TVs—from Samsung, LG, you name it—collect personal data. These TV privacy settings limit what manufacturers learn.
https://www.consumerreports.org/electronics/privacy/how-to-turn-off-smart-tv-snooping-features-a4840102036/
Another approach is to use nothing on the TV itself, and feed video in from another source entirely.

2023-11-22 15:44:21

This Reddit thread claims that Manifest V3 requires filtering changes to be approved by the Google app store submission process.
https://www.reddit.com/r/uBlockOrigin/comments/17as8o8/
Does someone have an authoritative reference to confirm this? It obviously has implications for the recent YouTube ad-blocking arms race, and TBH makes the "because security" claims ring a bit hollow.
#uBlockOrigin #Manifestv3

2023-10-24 00:50:37

- reply

@npub1yyx…qa5g I know that he's famously been less than pleased with the substitute-ability of Mastodon, but I wish he'd give it an additional go - I miss seeing him here.

2023-10-22 15:13:24

- reply

@npub1t2c…d0pp Independently arriving at the same correct conclusion may be time consuming, but it is definitely nothing to be ashamed of - in fact, quite the opposite 👊

2023-10-11 20:54:20

Dropping The Hacker News from my RSS feeds.
I just can't stomach any more "articles" that are actually sponsored ads.

2023-10-07 21:08:43

- reply

@npub19lt…qfjk You could adapt the GitHub approach and do something like "Mentioned by"

2023-10-06 06:22:45

I feel as though the word "loamy" is underused.

2023-09-27 21:25:49

- reply

@npub1vcl…k6t3 This is phenomenal!

2023-09-27 18:07:51

- reply

@npub1vcl…k6t3 Naively, is there a way to detect libwebp versions directly? (I'm not sure how it's embedded / shipped in the various downstream projects.)

2023-09-25 15:43:47

Just in case you think memory safety isn't a priority ...
https://ubuntu.com/security/notices/USN-6393-1
"It was discovered that ImageMagick did not properly handle memory when processing the -help option. An attacker could potentially use this issue to cause a crash."
The --help option.

2023-09-17 18:53:29

Friends don't let friends use password "systems".
If someone tells you they don't use password managers, but it's "OK" because they can remember them all because "they have a system", show them this.
These are real (obfuscated) runs of cracked passwords, for which the "base word" was discovered, and then combined with other wordlists and brute force on the right-hand side to get the rest.
The right-hand side usually has a clear trend of abbreviated names of the site. Which means that the attacker can guess your password on that other site in just a few tries without even having to break into the server.
All it takes is for the weakest site they use to get compromised, or for an infostealer infection to intercept and leak one variant ... the attacker (or me, emulating one) can see the pattern and get the rest.
It doesnt matter how long or random-looking your "base word" is.
Lose one ... lose them all.
https://media.infosec.exchange/infosecmediaeu/media_attachments/files/111/081/987/071/762/974/original/2ffef61e9abab502.png

2023-09-17 16:41:58

- reply

@npub1vcl…k6t3 Likely a smaller lift sometimes than installing hashcat (to get its --stdout functionality)!

2023-08-03 21:09:14

Any sufficiently advanced licensing infrastructure is indistinguishable from ransomware.
And, per Tycho's Meta-Law of Inversion of Sufficient Advancement¹ ...
Any sufficiently advanced ransomware is indistinguishable from licensing infrastructure.
https://infosec.exchange/@tychotithonus/110782759353122562

2023-06-02 15:03:39

- reply

@npub19lt…qfjk I've tinkered with my FLIR One, and also watched a bunch of people go by at the thermal camera exhibit at our local museum ... and you're the only other person I've seen who has a consistently cold nose like I do.
Broke my nose in my 20s, so I thought it might be that, and Googling reveals a number of potential causes. Curious!

2023-06-01 14:10:09

- reply

@npub1t2c…d0pp You can run two (or more) Pi-holes - there's even a config synchronization option.