Kevin Beaumont

Cybersecurity weather person and award winning shitposter. Shitposting is an anagram of Top Insights. You may be surprised to know I am not representing my employer here and these are not their opinions.

I have Direct Messages disabled - you can send them, but I will never receive them.

My website: https://doublepulsar.com
Github: https://github.com/GossiTheDog
Signal: GossiTheDog.1337
Threads: https://threads.net/@GossiTheDog

Public Key

npub1lcc6wn885u6k395x5j5tmdm94r6dh9zajxm8gyk82pv2s2j3el7sc6lcye

NIP-05 Address

gossithedog_at_cyberplace.social@momostr.pink

Profile Code

nprofile1qqs0uvd8fnn6wdtgj6r2f29akaj63axmj3werdn5ztr4qk9g9fgullgqz02ha

Author Public Key

npub1lcc6wn885u6k395x5j5tmdm94r6dh9zajxm8gyk82pv2s2j3el7sc6lcye

Show more details

Last Notes

2024-11-06 15:39:56

- reply

mobile carriers reacting to the FBI notice
https://cyberplace.social/system/media_attachments/files/113/436/759/455/309/691/original/88a17628f8e1b9f7.mp4

2024-10-28 23:02:09

First screenshot, NY Times story from October 14th this month about how Washington Post is losing $100m a year and they’re very happy to have added 4000 subscribers.
Second screenshot, a few weeks later after Jeff Bezo set fire to his own company.
https://cyberplace.social/system/media_attachments/files/113/387/537/689/786/094/original/3d4df6849f589b1d.jpeg
https://cyberplace.social/system/media_attachments/files/113/387/538/071/269/106/original/50b2975759fdc62a.jpeg

2024-10-17 12:18:12

Globe Life has filed an 8-K with the SEC for a cyber incident at their company, American Income Life Insurance.
It involves data exfiltration and extortion. https://www.sec.gov/ix?doc=/Archives/edgar/data/320335/000032033524000056/gl-20241017.htm
#threatintel
https://cyberplace.social/system/media_attachments/files/113/322/720/408/721/284/original/d7b6f00169065cea.jpeg

2024-10-01 10:29:47

- reply

https://cyberplace.social/system/media_attachments/files/113/231/696/884/460/938/original/06d44ef459b78b6e.png

2024-09-27 07:47:07

- reply

The train station WiFi captive portal defacement incident has lead to the arrest of somebody who works at the provider of the service. https://news.stv.tv/scotland/man-arrested-after-wifi-at-scotlands-busiest-train-stations-displays-islamophobic-messages

2024-09-14 16:56:56

Just saw a post on Mastodon via Threads federation that was a screenshot of a BlueSky post which had a screenshot of an X post.
https://cyberplace.social/system/media_attachments/files/113/136/960/326/537/563/original/ccfcdb72ee5c1be4.mp4

2024-09-14 16:42:30

- reply

Message from head of Transport for London to staff about their cyber incident, sent out to staff via WhatsApp. #tfl #threatintel
https://cyberplace.social/system/media_attachments/files/113/136/902/449/862/761/original/ef34bf5b4a233f65.mp4

2024-09-14 16:15:34

- reply

a few weeks ago 😅

2024-09-14 15:40:50

23 hours into #StarWarsOutlaws now. I did some naughty things.
https://cyberplace.social/system/media_attachments/files/113/136/656/481/111/350/original/69946cff171a264f.png
https://cyberplace.social/system/media_attachments/files/113/136/657/646/724/650/original/b9d720abbfdbb35c.png
https://cyberplace.social/system/media_attachments/files/113/136/658/990/266/910/original/bbf8dfec7cabb30e.png

2024-09-13 16:43:04

- reply

Btw, I think Transport for London have done a really good job containing this. It would have been much worse, one suspects, had they not.
It sucks for staff but they prioritised customer service (i.e. transport) and safety over short term recovery, and that is very likely the correct pivot. I've seen these things go the opposite direct when orgs under react and it often ends really poorly.

2024-09-13 13:42:17

- reply

FWIW I’ve heard the TfL incident is Scattered Spider again, in a surprise to nobody. #TfL #threatintel

2024-09-13 12:07:48

- reply

The #TfL queue to get account access back #threatintel
https://cyberplace.social/system/media_attachments/files/113/130/160/738/487/043/original/62e6653564615a47.jpeg
https://cyberplace.social/system/media_attachments/files/113/130/161/056/222/213/original/fc26dcecbb803374.jpeg

2024-09-13 11:56:47

- reply

if they use outlook, save the email as an attachment and then zip the attachment file with a password

2024-09-13 11:55:38

- reply

If you’re wondering what they’re targeting their “DDoS missiles”at, it’s some tram and ferry information websites #threatintel #noname

2024-09-13 11:34:14

NoName057(16) are targeting their DDoS infrastructure at the UK and will announce shortly.
So far none of the attacks are successful as they’re being defended against.
They may do a cheesy video to go with it. #threatintel

2024-09-13 09:57:13

- reply

Transport for London latest - they are resetting the login and MFA details for 30,000 employees in person, accounts are locked. #TfL #threatintel
https://cyberplace.social/system/media_attachments/files/113/129/647/036/833/703/original/16f792ba0cc8569d.jpeg
https://cyberplace.social/system/media_attachments/files/113/129/647/329/406/254/original/07be997fcf30bef1.jpeg
https://cyberplace.social/system/media_attachments/files/113/129/647/657/732/295/original/714e28b70faf1cb8.jpeg

2024-09-12 12:09:54

- reply

As the US wakes up, the First Data payment merchant outage impacts will spread. #clover #fiserv #FirstData

2024-09-12 10:54:25

- reply

The #clover outage is caused by problems at First Data, a card merchant owned by Fiserv - will impact other regions. #fiserv #FirstData

2024-09-12 10:47:53

- reply

#clover
https://cyberplace.social/system/media_attachments/files/113/124/184/561/403/535/original/59611f7b028fd18a.jpeg

2024-09-12 10:46:14

Point of sale merchant Clover has been offline for several hours
https://cyberplace.social/system/media_attachments/files/113/124/178/097/783/847/original/70230af9317b04ff.jpeg

2024-09-10 15:59:16

- reply

PS5 Pro announced: https://www.youtube.com/watch?v=6HaRMiTfvks
$700. $30 for the vertical stand this time and $80 for a disc drive as they removed it (and angled the pictures so you can't see it that XD)

2024-09-09 18:38:33

- reply

I am wondering what Xbox are doing, btw, when it comes to hardware.
I ponder if they'll do what they did with Copilot+ PCs, and offload Xbox as a brand to different hardware OEMs. E.g. Dell etc can make an Xbox or Xbox portable, as long as it runs XboxOS, meets the hardware requirements etc.
That way they de-risk the hardware manufacturing flopping but retain the brand and digital sales cut, as they're the only storefront on the devices.
I hope not as it will ruin Xbox.

2024-09-09 18:30:56

- reply

PS5 Pro gets announced tomorrow afternoon.

2024-09-07 20:47:54

If anybody runs a Mastodon server and wants some unsolicited advice - alter Content retention -> Media cache retention period to a small number.
At Cyberplace we run it at 2 days. Do you not need it to be unlimited, or a high number.
If a user requests an old toot, they automatically download the original media - it's transparent to user.
If you cache media it's very very expensive as it consumes vast amount of data - around 40gb a day with ~10k users, from experience.
https://cyberplace.social/system/media_attachments/files/113/098/223/094/211/346/original/53e42508d7ae0622.png

2024-09-06 11:40:04

- reply

contain = you try to evict attacker from your infrastructure by containing important and risky systems, and try to figure out how they got in and what they touched.

2024-09-05 11:54:52

You may have read yesterday about the DoJ taking action against a Russian media outlet.
If you wonder how the outlet’s propaganda spread online, Elon’s tweets:
https://cyberplace.social/system/media_attachments/files/113/084/811/618/032/344/original/38d00729834dbd96.jpeg

2024-08-25 08:41:18

You can now buy Kalashnikovs, pistols, grenades and grenade-launchers on Twitter https://www.bbc.com/news/articles/c86l4pl6072o

2024-08-06 08:15:34

ONS salary data for 2024 is out
https://www.forbes.com/uk/advisor/business/average-uk-salary-by-age/
Average UK salary is £35.8k

2024-08-06 07:20:54

I’ve noticed a significant uptick of scanning for webshells on Microsoft Exchange Server boxes in the past 24 hours in my honeypots. #threatintel

2024-08-06 06:52:24

- reply

BMW set upon and Asian men inside attacked - how violence surged in one city https://www.bbc.com/news/articles/cj622z0w7n0o

2024-08-06 06:42:49

- reply

yeah 24 years ago

2024-08-05 22:45:00

- reply

it’s really tacky IMHO, capitalism is the worst

2024-08-05 22:43:52

- reply

good!

2024-08-05 22:11:05

- reply

Elon Musk's UK 'civil war' post criticised by No 10 https://www.bbc.com/news/articles/c5ydddy3qzgo

2024-08-05 22:04:25

- reply

The funny thing about that one btw is I didn’t leak the MSPAC call transcript.. but I sure as shit tweeted that article while working there.
At the time they were paying anti-trans candidates and election result deniers.. while saying they did it for access to lobby. I’d never worked for an org like that before.

2024-08-05 21:51:47

- reply

Microsoft President Brad Smith explains how political contributions really work https://www.cnbc.com/2021/01/22/microsoft-president-brad-smith-defends-mspac-to-employees.html
https://cyberplace.social/system/media_attachments/files/112/911/626/914/395/870/original/7e5975fd7a781ffb.jpeg

2024-08-05 21:45:11

- reply

One thing I don’t understand is how Microsoft is completely absent from discussion about antitrust.
I mean I do, they spend very significant amounts of money lobbying.

2024-08-05 21:36:34

- reply

yes

2024-08-05 21:31:06

Good.
Google's online search monopoly is illegal, US judge rules https://www.bbc.com/news/articles/c0k44x6mge3o

2024-08-05 21:20:30

In case you missed it - CrowdStrike are attempting to use legal threats to suppress criticism and parody. https://doublepulsar.com/crowdstrike-trying-to-use-legal-threats-to-suppress-criticism-and-parody-of-global-it-outage-49320e922120

2024-08-05 20:31:15

- reply

Well done to Elon for purchasing and mostly sinking a company in under two years.
https://cyberplace.social/system/media_attachments/files/112/911/310/490/461/585/original/96aaf61959f116f5.jpeg

2024-08-05 20:29:11

One thing to know about security mastodon - lots of people are just posting to Twitter and replicating their posts here automatically.

2024-08-05 20:23:21

Twitter is closing its head office, after mandating staff return to said office and firing those who didn’t. https://www.nytimes.com/2024/08/05/technology/x-twitter-san-francisco-office.html

2024-08-05 19:47:28

If you reported a vulnerability to Microsoft over the past few decades to January 2024, consider any writeup and proof of concept compromised. #threatintel

2024-08-05 18:34:53

- reply

If anybody has any CATCHDNS samples I’d love to see them uploaded to VirusTotal 🙏

2024-08-05 18:23:49

Challenge - investigate how Windows silent calls to msftconnecttest.com to check internet connectivity is exploitable. https://www.volexity.com/blog/2024/08/02/stormbamboo-compromises-isp-to-abuse-insecure-software-update-mechanisms/

2024-08-05 16:57:53

- reply

Update: https://www.bleepingcomputer.com/news/security/keytronic-reports-losses-of-over-17-million-after-ransomware-attack/
#threatintel

2024-08-05 14:21:17

The AI stock market crash is some time away, I think. Majority of orgs are still drinking the marketing, and will be pissed for a few years.

2024-08-05 13:28:45

- reply

I don’t know, I’m not a business expert. However there are lots of orgs who operate at very heavy losses for a long period of time - I guess they are propped up by investors.

2024-08-05 12:15:17

- reply

I've written up a bit about CrowdStrike's latest bold strategy.
https://doublepulsar.com/crowdstrike-trying-to-use-legal-threats-to-suppress-criticism-and-parody-of-global-it-outage-49320e922120

2024-08-05 11:19:37

- reply

CrowdStrike are publicly threatening their customer, Delta. https://www.theverge.com/2024/8/5/24213521/crowdstrike-refutes-blame-delta-outage-litigation
https://cyberplace.social/system/media_attachments/files/112/909/141/486/505/098/original/ad4d68cb28daf721.jpeg

2024-08-05 09:47:27

- reply

Bloomberg report a vast majority of the CrowdStrike losses reported by customers will be judged by insurance as not covered by policies. https://www.bloomberg.com/news/articles/2024-08-02/billions-in-damages-from-crowdstrike-outage-to-go-uninsured

2024-08-04 20:24:40

- reply

EFF are calling for antitrust action after the CrowdStrike incident https://www.eff.org/deeplinks/2024/07/crowdstrike-antitrust-and-digital-monoculture

2024-08-04 19:39:38

- reply

yeah I limited it off the back of this, he basically told on his own instance

2024-08-04 19:12:09

My LinkedIn profile views are basically every org I’ve annoyed at any given moment.
https://cyberplace.social/system/media_attachments/files/112/905/337/283/685/338/original/67e5225fa2349f40.jpeg

2024-08-04 19:08:28

- reply

I got stung by a snake and died as I didn’t know how to fix the poison in time, so in many years Red Dead Redemption 2 is the most real role playing game I’ve played.

2024-08-04 19:04:34

- reply

Lads on tour etc
https://cyberplace.social/system/media_attachments/files/112/905/307/443/617/590/original/4c61c5f8c3260b1f.png

2024-08-04 18:09:22

- reply

oh shit 😬

2024-08-04 17:48:55

- reply

🐴
https://cyberplace.social/system/media_attachments/files/112/904/919/231/097/395/original/957e0c824b0e4689.png
https://cyberplace.social/system/media_attachments/files/112/904/993/669/707/189/original/d83f7a1c4e0d7964.png
https://cyberplace.social/system/media_attachments/files/112/904/996/113/853/372/original/c76426120db6d1dd.png
https://cyberplace.social/system/media_attachments/files/112/905/003/069/248/433/original/322ddb681e9642b9.png

2024-08-04 16:40:03

- reply

I am terribly surprised this guy turned out to be a moron.
https://cyberplace.social/system/media_attachments/files/112/904/738/632/023/410/original/1dd59dae442bcf2e.jpeg
https://cyberplace.social/system/media_attachments/files/112/904/738/899/777/672/original/d6fb67f0337f31f5.jpeg
https://cyberplace.social/system/media_attachments/files/112/904/739/214/393/179/original/27fb11c9835f343c.jpeg

2024-08-04 16:08:12

https://www.snopes.com/news/2024/08/02/imane-khelif-olympics-boxing/

2024-08-04 15:46:34

lol
https://cyberplace.social/system/media_attachments/files/112/904/528/860/255/123/original/ae58966dce33b43a.jpeg

2024-08-04 15:04:09

- reply

After burning down libraries and attacking mosques, the mob have now moved onto Holiday Inns.
Somebody is going to end getting killed if this continues.
It is blatant racism and those involved and those who enable it - including Elon after unbanning Tommy and engaging with this stuff on his own platform - should feel ashamed of themselves.
https://cyberplace.social/system/media_attachments/files/112/904/360/697/414/878/original/076d99a203d2e425.png
https://cyberplace.social/system/media_attachments/files/112/904/361/560/556/235/original/7179c3ae4f82330c.png
https://cyberplace.social/system/media_attachments/files/112/904/362/020/990/466/original/d45cd99fb7bc6ba6.png

2024-08-04 14:51:05

- reply

he’s rich is the sad truth. When you’re rich, you have the best lawyers. Plus he literally owns Twitter, which all the politicians gleefully use.

2024-08-04 14:19:05

- reply

Oh good, Elon’s jumped on the “stop the boats” bandwagon now.. for a killer who was born and raised in the UK.
https://cyberplace.social/system/media_attachments/files/112/904/184/925/206/647/original/bcdd1a6b05fb6f07.jpeg

2024-08-04 11:58:28

- reply

🐴
https://cyberplace.social/system/media_attachments/files/112/903/631/996/758/062/original/fcd7c25af0d38d2f.png
https://cyberplace.social/system/media_attachments/files/112/903/623/512/730/877/original/75135f2c2c6995db.png
https://cyberplace.social/system/media_attachments/files/112/903/626/430/410/198/original/5bdde54cb11c379c.png

2024-08-04 09:43:37

- reply

Twitter unbanned Tommy Robinson, which is driving a lot of this. https://www.bbc.com/news/articles/cl4y0453nv5o

2024-08-04 09:40:55

- reply

I used to live just down the road from this in Liverpool. Locals burnt it down and stopped the fire brigade from putting out the fire.
https://cyberplace.social/system/media_attachments/files/112/903/091/154/014/934/original/ccc8591c3a6d067f.jpeg

2024-08-04 07:31:25

- reply

More than 90 arrests after far-right demonstrations turn violent https://www.bbc.com/news/articles/c0jqjqxl3dyo

2024-08-04 07:20:57

- reply

Rioting is still continuing in parts of the UK due to social media posts about the Southport attacker.
People are turning up with “STOP THE BOATS” banners.
It was a kid born in Wales.
https://cyberplace.social/system/media_attachments/files/112/902/540/733/944/340/original/f79ce67ce51281e8.jpeg

2024-08-03 23:18:32

Al Jazeera rebuffs Israeli claim killed journalist was Hamas operative https://www.bbc.com/news/articles/c1rwr8lj9jro

2024-08-03 22:52:33

Copilot’s front page on the app today suggests I ask “tell me a fact”.
I did.. the first one is “Banging your head against a wall burns 150 calories”, which links to a Reddit thread, which links to an article, from a “contributor”, which mentions it in the headline then has no citation or mentions it again.
https://cyberplace.social/system/media_attachments/files/112/900/541/079/569/043/original/58d53c7bcab70c55.png
https://cyberplace.social/system/media_attachments/files/112/900/541/572/661/708/original/3b4db94ad12b87e0.png

2024-08-03 21:21:34

- reply

Previously on Crowdstrike Falcon vulnerability research, check out this timeline where they tried to use NDAs to avoid disclosure, then fixed it without telling anybody. https://modzero.com/modlog/archives/2022/08/22/ridiculous_vulnerability_disclosure_process_with_crowdstrike_falcon_sensor/index.html

2024-08-03 19:52:02

- reply

I only cache media for one day, which is sub 100gb.
No real user impact - if a user views an old post, it just retrieves it from the original server on load.

2024-08-03 18:34:52

- reply

I’m gonna end up 100%’ing it, aren’t I
https://cyberplace.social/system/media_attachments/files/112/899/528/268/959/052/original/7bbe97a616381b7b.jpeg

2024-08-03 18:26:08

- reply

Me trying to remember the controls in Red Dead Redemption 2 six years later
https://cyberplace.social/system/media_attachments/files/112/899/493/988/456/781/original/3048ebe4f83c3e64.mp4

2024-08-03 15:59:57

Back in 2018 I took two weeks off work for the launch of Red Dead Redemption 2.
I played it for about 50 hours, but only completed about 40% of the main story.
I just loaded it up for the first time since then and, oh boy, I forgot how good this world is.

2024-08-03 10:35:42

- reply

fully agree. People in China are consistently doing the best research, while us westerners high five each other for being shit in comparison

2024-08-03 09:46:11

If you’re a fan of the BBC’s Saving Lives at Sea, I shot some of the aerial shot footage in upcoming series 10.

2024-08-03 06:47:42

- reply

360 takes a look at the Crowdstrike kernel drivers - finds they implement an eBPF like system, contain a wide attack surface, don’t check validity of update files (eg no signing of updates) and claim they contain conditions for LPE and RCE vulnerabilities. https://mp.weixin.qq.com/s/uD7mhzyRSX1dTW-TMg4UhQ

2024-08-03 06:15:36

- reply

We’ve reached the part of the brand cycle where people are using CrowdStrike as an excuse https://www.theverge.com/2024/8/2/24212298/mrbeast-beast-games-crowdstrike

2024-08-02 22:40:33

- reply

we have way over that many servers, and my last few jobs have had that too

2024-08-02 22:39:22

This is proper facepalm stuff by the Home Office - they refused a passport for a child named Khaleesi as they said Warner Bros owns the name.
https://www.bbc.co.uk/news/articles/c4ng1xd06xwo

2024-08-02 21:14:28

- reply

XDA Developers, who were a good source of behind the scenes info during the Microsoft Recall saga, are saying Microsoft have kicked Recall into the long grass and they think it may never launch. https://www.xda-developers.com/thread/microsoft-wants-you-to-forget-about-copilot-recall-it-seems/
It’s been almost two months since Microsoft said it would launch for Insiders in “weeks” instead.

2024-08-02 20:57:35

- reply

Additionally to loop this in, CrowdStrike submitted a takedown for a parody label (they’ve since rescinded it after being called out).
https://cyberplace.social/system/media_attachments/files/112/894/427/261/866/901/original/7638af20832cf4a3.png

2024-08-02 20:52:54

- reply

CrowdStrike complained to Cloudflare about a CrowdStrike parody site… and Cloudflare took it down. Without a court order. https://clownstrike.lol/crowdmad/

2024-08-02 18:49:18

- reply

it didn’t even offer the download link

2024-08-02 15:28:53

- reply

CrowdStrike’s website then vs now
https://cyberplace.social/system/media_attachments/files/112/893/134/034/079/028/original/bf13406cec3d11dc.jpeg
https://cyberplace.social/system/media_attachments/files/112/893/134/759/551/848/original/0e436fd3e0814ae1.jpeg

2024-08-02 15:09:35

- reply

I escaped the escape room
https://cyberplace.social/system/media_attachments/files/112/893/058/870/348/237/original/080449af87c40e22.jpeg

2024-08-02 14:17:30

- reply

issue baseless DMCA claims

2024-08-02 10:44:46

- reply

somebody is going to end up writing a book about crisis comms on this whole thing 🤣

2024-08-02 10:03:40

Aside from sending cease and desists for parody websites, CrowdStrike sent a cease and desist for a label. The security industry should not try to abuse its power.
https://cyberplace.social/system/media_attachments/files/112/891/855/960/999/253/original/223809d020ca4ad0.png

2024-08-02 08:11:39

- reply

The UK government also removed the AI bill from the King’s Speech, and instead brought forward cybersecurity legislation.
“When I became secretary of state, within a very short period of time, and I’m talking hours, not multiple days, I became very, very aware that there was a cybersecurity challenge that our country faced that I simply wasn’t aware of before becoming secretary of state,”
He went on to say he’s making cybersecurity the national security priority.
https://www.theguardian.com/uk-news/article/2024/jul/29/uk-desperately-exposed-to-cyber-threats-and-pandemics-says-minister

2024-08-02 08:08:18

Good. UK Government shelves £1.3bn AI plans https://www.bbc.com/news/articles/cyx5x44vnyeo

2024-08-02 07:54:12

- reply

🤣

2024-08-02 07:38:31

https://cyberplace.social/system/media_attachments/files/112/891/284/803/675/905/original/71920170b67fc51d.png
https://cyberplace.social/system/media_attachments/files/112/891/285/239/294/064/original/a7448a490269595e.png

2024-08-01 21:58:52

- reply

pretty much, this is how big enterprise IT works

2024-08-01 21:52:17

- reply

pray for the Delta account manager on those calls

2024-08-01 20:41:49

- reply

that’s a small number compared to my last 3 employers

2024-08-01 20:40:08

Metal Materials Inc have filed an 8-K alleging “…a former executive officer of the Company deliberately de-activated and cancelled the renewal of the Company’s website, which significantly impacted the Company’s IT systems, including delivery and receipt of electronic email communications from customers, investors and other stakeholders of the Company.”
https://www.sec.gov/ix?doc=/Archives/edgar/data/1431959/000095017024089345/mmat-20240725.htm
#threatintel