threatactor.club

"A person working as an Ethical Hacker in Cape Verde typically earns around 180,000 CVE per month"

That are a lot of CVEs per month :D

OK, so what does fidget mean? What information do you have around you, right now? Take a deeper look. Why is that WiFi AP named XNF998FE? Why is your laptop's serial number XY3327S? How often is that helicopter circling? Why are so many license plates from a particular state with a specific prefix? Look for the lack of entropy that is an encoded signal.

In the early Metasploit days this involved dumping function addresses of DLLs from a literal binder of DVDs. The opcode database and later analysis by folks like skape (matt miller) and spoonm made exploit development much easier as a result.

Scanning the internet is easy. Understanding all the data coming back takes a lifetime. Grab some data dumps and sift through specific protocols and fields. Toss Fiddler at a Windows thick client (or enable HTTP event tracing).

We are flooded in dodgy software, weak numeration, and information leaks. Stop for a bit, breath, pick one, and go deep.

HiP impressions: great schedule, lovely atmosphere. 10/10 would speak at again

Modern smart phones - we randomised the wifi Mac address
Also modern smart phones - "I'd like to request a dhcp lease and also I'd like to request to use 'joeblogsphone' as a hostname"

No one asked me about my thoughts on the #lastpass incident. I’m a little late, but here’s my lol jk.

DEFCON.social is now open - no more invite codes needed!

With the fix (🤞) to the federated image cache our new 30TB Block Storage server seems to be happy.

Next up we will enable search - just deciding between Elastic Search or Open Search, so any opinions welcome.
#MastoAdmin

OffensiveCon '23 CFP
https://cfp.offensivecon.org/offensivecon23/?s=09

@akareilly dachte, m/w/d steht für männlich, weiß, deutsch 🤔

📯 I'm happy to finally be able to release my #obsidian #writing style plugin to anyone interested!

The plugin helps you write better by pointing out problems in your writing beyond simple spelling mistakes. It's perfect if you use Obsidian for drafting blog posts, job openings, documentation, and other online content.

Read me more and grab it here: https://github.com/michenriksen/obsidian-writing-style

Sysdig out with a report on zomg supply chain attacks and #SBOM in dockerhub images.

Dead me doing a talk on it in 2015 citing other people’s research on it with different buzzwords of the day.
https://speakerdeck.com/barnbarn/security-for-non-unicorns-2?slide=59

#InfoSec #ThreatyThreats

#HiP22
Second chance for time travelers & "Verpeilte"
We have extended the CfP until 04.12.2022 23:42:00 and the second round of ticket sales will start on 06.12.2022 at 12 noon

https://events.ccc.de/2022/11/28/dezentral-2022/

I am amused that SignalApp joined mastodon.

The fediverse is everything they stand against.

- federation instead of centralization
- open, community driven protocol
- using pseudonyms
- multiple implementations of client and server software

Not sure what I mean, check out their blog post on these topics: https://signal.org/blog/the-ecosystem-is-moving/

As for the multiple implementations, Signal denied a request to have a 100% open source fork of their app in F-droid. See for yourself:
https://github.com/signalapp/Signal-Android/issues/9966#issuecomment-681943985