三ツ矢

セキュリティのお仕事やってます。時々趣味で開発も。発言は全て個人のものです。 WebSecurity / cloudsec / JAWS-UG沖縄 / CISSP / OS(CP|WE|EP) / AWS DOP / AZ-500 / CARTP / CAWASP

[三ツ矢 @328__]

昨日は #PentestSecJP にご参加いただきありがとうございました🙏
発表時に使用したスライドをspeakerdeckで公開しました。
※ コミュニティSlackですでに展開しているものと同一となります
https://t.co/dAIHLp15pk

[三ツ矢 @328__]

妻が活動しているとそちらにべったり張り付いてるが、今日は珍しく私の部屋にきてハンモック使って寝ている

[三ツ矢 @328__]

寝落ちしてたらこの時間...

[八雲アナグラ @AnaTofuZ]

ガジュマル面談、島から目線での会話が行われそう

[🐊𝕏 @alligator_tama]

ガジュマル面接気になる。木の上の軍隊みたいに2年くらい一緒に生活して見極めるのかもしれない

[三ツ矢 @328__]

IDAのMCP使ってみたけど解析捗るので楽しい

[キュルZ @kyuryuZ]

椅子に夢中

[三ツ矢 @328__]

@Yunolay おめでとうございます！

[三ツ矢 @328__]

新しいPC買いたいけど悩むな。
整備済み品眺めるのも飽きてきたから普通に買うか。

[Kuba Gretzky @mrgretzky]

We need to talk about AI guardrails and why I refuse to take seriously the idea that AI can be told to follow specific rules and never break them.

Yesterday, I wanted to see how easy it is for phishing kit authors to have Claude develop phishing pages, compared to August 2025, when no guardrails were in place.

I chose the Opus 4.8 model and prepared the first prompt: 🧵👇

[r00tapple @r00tapple]

最近Windows/Mac向けのEDR回避する疑似マルウェアとかBOFとかの研究と開発担当してます🍻
去年ぐらいまでは、PT/Redteamのマネージャメインしてました🍻
技術とマネージメントの両方でおしゃべりできるから、ワイと福岡で握手や😎🍻
今日の18時から募集開始です👋😎🍻
※参加応募時に聞きたいことあれば投げれるようにしてあるのでそれベースに内容とか資料作ります！

🔴GMOイエラエ Pentest Meetup Night in 福岡
⏳2026/07/15(水)　18:00〜21:00🔥

https://t.co/CBB0QZGns1

[キュルZ @kyuryuZ]

新しい椅子

[Kuba Gretzky @mrgretzky]

Sharing a sneak peek of a new feature exclusive to the upcoming Evilginx Phishlets 2.0 format. 🧐

Here is how chained rewrites allow you to downgrade FIDO MFA when phishing M365 accounts. 🪝🐟

The power of Phishlets 2.0 will hopefully blow you away! 💥

[三ツ矢 @328__]

Emerging Phishing Trend: QR Code Attacks Hidden Inside Calendar Invites by Dulitha Wickramasinghe https://t.co/cwb8dsmcf9

[三ツ矢 @328__]

linkedinのDM見て🍺様って出てるとニヤニヤしてしまう

[三ツ矢 @328__]

ChatGPTにもタスク機能ってあったんだな。知らなかった。

[三ツ矢 @328__]

オライリー本を買いにInteropに行きたいな

[三ツ矢 @328__]

Macの整備済品探してるけどいいやつはすぐ無くなるねえ

[Kuba Gretzky @mrgretzky]

I wanted to address the speculation about the recently introduced Device Bound Session Credentials (DBSC) security feature in Google Chrome.

Does it help increase the security of session cookies against infostealer malware and MFA phishing?

The feature has been available and enabled by default since the Chrome 146 update (April 2026), if you're running Windows with a hardware-backed TPM security module (macOS support is coming in future updates).

DBSC allows the browser to upgrade session cookies from long-lived to short-lived, requiring the browser to refresh them approximately every 10 minutes to maintain access to the user's account.

> Does DBSC prevent account takeover by threat actors using a stolen session cookie obtained from the user's browser via infostealer malware?

Yes (kind of). The extracted session cookie will be valid for up to 10 minutes from the time it is extracted. The attacker will be unable to maintain long-term access to the user's account. Still, the timeframe may be sufficient, for example, to exfiltrate the inbox if the attack is automated. The attacker cannot refresh the short-lived session cookie because it requires the private key (stored in the TPM) assigned to the account to sign the challenge. The malware cannot access the private keys stored in the TPM.

> Does DBSC prevent account takeover by threat actors during a phishing attack?

No. Servers need to provide legacy support for the browsers that do not yet support DBSC. By default, the server registers and sends a long-lived session cookie to the browser. If the server supports DBSC, it will announce the DBSC API endpoint URL in the `Secure-Session-Registration` HTTP header of the response packet that contains the long-lived session cookies.
Only after the short-lived session cookie is registered via the DBSC API endpoint is the long-lived session cookie invalidated.

When the attacker removes the `Secure-Session-Registration` HTTP header retrieved from the server during a phishing attack, the browser will continue using long-lived session cookies and assume the server does not support DBSC. In short, removing that HTTP header while proxying traffic during a phishing attack allows the attacker to maintain long-term access to the user's account using the stolen long-lived session cookie.

I hope I've managed to clear up some confusion.

On a related note, you will soon be able to simulate phishing attacks against Google Workspace accounts (and other websites) that bypass DBSC and MFA protections using Evilginx Pro with the Phishlets 2.0 update.

[三ツ矢 @328__]

風船太郎みて笑い転げてる