Chris

private sector computer forensic and cyber breach investigator. some time security researcher and occasional speaker

[Chris @0dayforensics]

In Soviet Russia, refund defunds you

#Cyber #phishing #scams

[Chris @0dayforensics]

It's what I do. I hash and I know things.

[Chris @0dayforensics]

I see that there is a #teamsoutage. Would you like me to reschedule your video calls and order pizza?

[Chris @0dayforensics]

Somebody needs to just bite the bullet and do what we all know needs to be done: integrate #clippy with #ChatGPT

[Jake Williams @MalwareJake]

When your incident response team selects the wrong tools for the job and just makes things worse...

[Chris @0dayforensics]

I wonder if all of the legacy systems with this issue will be gone by then?

Who am I kidding, we'll probably still be finding XP boxes then 😞

[Randall Munroe @xkcd]

Y2K and 2038 https://t.co/cHJPMtlDs0

[Chris @0dayforensics]

@lockdownurlife I clicked on the thing

[Chris @0dayforensics]

@ariadneconill My own garbage collection if they merged it the wrong way 😔

[Eric Zimmerman @EricRZimmerman]

Windows 11 testing. Did any artifacts change?

Prefetch: Nope
Lnk files: Nope
Jumplists: Nope
Recycle Bin: Nope
Amcache: Nope
AppCompatCache: Nope
Registry: Nope
Event Logs: Nope

#DFIR #ThankGod

[Accidental CISO @AccidentalCISO]

InfoSec is like a stray cat.

At first you just want to be helpful, but feed it, and you own it.

[Eric Zimmerman @EricRZimmerman]

Thanks!! I appreciate this! It makes a difference.

[Chris @0dayforensics]

#SANS SEC560 and GPEN complete. Thanks @TimMedin for recording such a brilliant on-demand course and @hacks4pancakes for the in depth blog post on preparing for these things (I hope you approve of the sticky notes!)

[Joshua Wright @joswr1ght]

@strandjs The logging events that are generated at the first attempts to bypass are the true value proposition for most defense tools.

[Tim Medin @TimMedin]

This PHP compromise would be horrible

... if anyone actually updated PHP

(ask your friendly pen tester about that one)

[Chris @0dayforensics]

@TimMedin I was doing a large scale crack when I was watching your SEC560 recording on common passwords... Surely enough, knee deep in SeasonYear and Welcome1

[Troy Hunt @troyhunt]

2FA -> 1FA -> 0FA

[Chris @0dayforensics]

Hey @refeist , what's it been like watching the plot of "Rise of a Merchant Prince" play out online this last week or two?

[Chris @0dayforensics]

@secvalve Activate the IR team

*Queue anime/90s cartoon suit up sequence*

[Chris @0dayforensics]

When talking ransomware mitigation, it's important to speak clearly and not confuse "disconnected backups" with "disk connected backups"

#DFIR

[Chris @0dayforensics]

@4n6Bexaminer @Haxo1ot1 Interesting like the proverb: may you live in interesting times 😔