Profile for joern
- Display name
- joernchen
- Username
- @joern@threatactor.club
- Role
- admin
About joern
Fields
- Website
- https://0day.click
- Threema
- https://threema.id/K8J68WTX
Bio
Your mom's favorite hacker!
My other account is @joernchen
- Joined
- Posts
- 724
- Followed by
- 1139
- Following
- 264
Stats
Recent public posts
exclude boosts
IDK but all those AI prompt injections like
seem to rely on in-band signalling which could have been avoided at design time by having separate channels for configuration and user input. But instead the 70s are calling and want their cereal whistles back
▓▓░░░░░░░░░░░░░ 10%
❓ Are there any standard data formats for asset/attack surface related information? Something like Structured Threat Information Expression (STIX) but for attack surface mapping that other tools and systems can consume.
Stuff we found on GitHub with no warranty or support, yet decided to underpin our entire product on - chain attacks.
Sometimes you just need to look at the right spot and have a good guts feeling to find vulns.
https://about.gitlab.com/blog/2023/01/24/git-security-audit/
speculation about layoffs and security posture
It's going to be interesting to see how the layoffs will impact security. According to birbsite and Mastodon, already some InfoSec people have been hit by layoffs. Fewer people means things stay broken longer, incidents take longer to respond to, etc. Meanwhile, hackers and ransomware gangs do not have to deal with layoffs... Guess who's going to have the competitive advantage?
CALL FOR PAPERS T2’23
Tired of your bosses suspecting conference trips to exotic locations being just a ploy to partake in Security Vacation Club? Prove them wrong by coming to Helsinki, Finland on May 4-5 2023! Guaranteed lack of sunburn, good potential for rain or slush. In case of great spring weather, though, no money back.
CFP and registration both open. Read further if still unsure:
https://t2.fi/2023/01/19/call-for-papers-2023/
Patch you Gits!
End of last year I had the big pleasure to work with @marver and @mumblegrepper in a code review of Git.
Here's what we got for you:
https://www.openwall.com/lists/oss-security/2023/01/17/4
https://x41-dsec.de/security/research/job/news/2023/01/17/git-security-audit-ostif/
Want to learn mobile reverse engineering and security analysis on iOS 📱🍎 but can't afford a training since you're a student? We'll do a free edition of day 1+2 of the Nullcon training end of February at TU Darmstadt. Drop me a DM if you're interested. Limited spaces, so better be fast 🔥
#iOS #security #reverseengineering
https://nullcon.net/berlin-2023/training/mobile-reversing-and-security-analysis/
Hey friends in #websec! Please remember to submit your research to the SecWeb workshop, a venue about building security for the web. The event is co-located with IEEE S&P in San Francisco (May 25) and our paper deadline os February 24th. We welcome new security flaws, solutions, wild ideas and even position papers. Let me know if you want to know more! https://secweb.work/2023.html
Please boost! 🔃
"A person working as an Ethical Hacker in Cape Verde typically earns around 180,000 CVE per month"
That are a lot of CVEs per month :D
HiP impressions: great schedule, lovely atmosphere. 10/10 would speak at again
Modern smart phones - we randomised the wifi Mac address
Also modern smart phones - "I'd like to request a dhcp lease and also I'd like to request to use 'joeblogsphone' as a hostname"
No one asked me about my thoughts on the #lastpass incident. I’m a little late, but here’s my lol jk.
DEFCON.social is now open - no more invite codes needed!
With the fix (🤞) to the federated image cache our new 30TB Block Storage server seems to be happy.
Next up we will enable search - just deciding between Elastic Search or Open Search, so any opinions welcome.
#MastoAdmin
Raise your hand if you don’t take proper notes but only rely on the shell history file. 🙋
OffensiveCon '23 CFP
https://cfp.offensivecon.org/offensivecon23/?s=09