threatactor.club

▓▓░░░░░░░░░░░░░ 10%

❓ Are there any standard data formats for asset/attack surface related information? Something like Structured Threat Information Expression (STIX) but for attack surface mapping that other tools and systems can consume.

#security #monitoring #osint #assetmanagement

Stuff we found on GitHub with no warranty or support, yet decided to underpin our entire product on - chain attacks.

CALL FOR PAPERS T2’23

Tired of your bosses suspecting conference trips to exotic locations being just a ploy to partake in Security Vacation Club? Prove them wrong by coming to Helsinki, Finland on May 4-5 2023! Guaranteed lack of sunburn, good potential for rain or slush. In case of great spring weather, though, no money back.

CFP and registration both open. Read further if still unsure:
https://t2.fi/2023/01/19/call-for-papers-2023/

Want to learn mobile reverse engineering and security analysis on iOS 📱🍎 but can't afford a training since you're a student? We'll do a free edition of day 1+2 of the Nullcon training end of February at TU Darmstadt. Drop me a DM if you're interested. Limited spaces, so better be fast 🔥
#iOS #security #reverseengineering

https://nullcon.net/berlin-2023/training/mobile-reversing-and-security-analysis/

Hey friends in #websec! Please remember to submit your research to the SecWeb workshop, a venue about building security for the web. The event is co-located with IEEE S&P in San Francisco (May 25) and our paper deadline os February 24th. We welcome new security flaws, solutions, wild ideas and even position papers. Let me know if you want to know more! https://secweb.work/2023.html

Please boost! 🔃

An alignment chart for how you ping the local host (eg, on #Linux). I'm open to be convinced that some of these should be swapped.

#IPv4 #IPv6 #nerd #humor #localhost

"A person working as an Ethical Hacker in Cape Verde typically earns around 180,000 CVE per month"

That are a lot of CVEs per month :D

OK, so what does fidget mean? What information do you have around you, right now? Take a deeper look. Why is that WiFi AP named XNF998FE? Why is your laptop's serial number XY3327S? How often is that helicopter circling? Why are so many license plates from a particular state with a specific prefix? Look for the lack of entropy that is an encoded signal.

In the early Metasploit days this involved dumping function addresses of DLLs from a literal binder of DVDs. The opcode database and later analysis by folks like skape (matt miller) and spoonm made exploit development much easier as a result.

Scanning the internet is easy. Understanding all the data coming back takes a lifetime. Grab some data dumps and sift through specific protocols and fields. Toss Fiddler at a Windows thick client (or enable HTTP event tracing).

We are flooded in dodgy software, weak numeration, and information leaks. Stop for a bit, breath, pick one, and go deep.

HiP impressions: great schedule, lovely atmosphere. 10/10 would speak at again

Modern smart phones - we randomised the wifi Mac address
Also modern smart phones - "I'd like to request a dhcp lease and also I'd like to request to use 'joeblogsphone' as a hostname"

No one asked me about my thoughts on the #lastpass incident. I’m a little late, but here’s my lol jk.

DEFCON.social is now open - no more invite codes needed!

With the fix (🤞) to the federated image cache our new 30TB Block Storage server seems to be happy.

Next up we will enable search - just deciding between Elastic Search or Open Search, so any opinions welcome.
#MastoAdmin