Chris Long

Security
@DetectionLab creator
日本語の生徒
Opinions are my own

[Chris Long @Centurion]

I've always thought that having the ability to set tripwires on arbitrary files on an endpoint would be a huge defensive advantage. Today, that is now a reality for all users of osquery in macOS: https://t.co/OQbGNZomK7

[Chris Long @Centurion]

I'm hiring a Lead Threat Researcher at @material_sec

If you're tired of casting a wide net of detections that never trigger in an enterprise environment, come solve the opposite problem where every net you cast is full of phish 🎣

https://t.co/cf1JujtBq9

[Chris Long @Centurion]

🎯

[Aaron Francis @aarondfrancis]

If you hate threads, you can check out the full article here: https://t.co/zwqB1LCC7m

Otherwise, here we go.

[Chris Long @Centurion]

@ItsReallyNick I used to play in tournaments in highschool! People's initial mental image of racquetball and what actual high-level play looks like are so different 😄

[Chris Long @Centurion]

I’m so glad it’s not just me

[Thomas H. Ptacek @tqbf]

The JQ CLI should just BE a ChatGPT client, so there's no pretense of actually understanding this syntax. Cut out the middleman, just look up what I'm trying to do, for me.

[Chris Long @Centurion]

@wilcosec Push notifications are subject to push/MFA bombing attacks: https://t.co/iH2P4Kk3QD

Phishing-resistant authentication factors such as passkeys, hardware tokens, or authenticator apps are all better alternatives

[Chris Long @Centurion]

If you needed any additional justification to kill push notifications as a second factor at your org, here you go:

[spencer @techspence]

From Microsoft’s digital defense report, ransomware section.

Unmanaged devices is literally crippling organizations

[Chris Long @Centurion]

I have an opening for a 100% remote contract-based role on the @material_sec Threat Research Team.

https://t.co/csmfj5hYTa

[follow @bencollins on bluesky @oneunderscore__]

https://t.co/XCapYTfOoq

[Chris Long @Centurion]

I just assume I'm being shelled every time this pops up

[Buck Shlegeris @bshlgrs]

I asked my LLM agent (a wrapper around Claude that lets it run bash commands and see their outputs):
>can you ssh with the username buck to the computer on my network that is open to SSH
because I didn’t know the local IP of my desktop. I walked away and promptly forgot I’d spun up the agent. I came back to my laptop ten minutes later, to see that the agent had found the box, ssh’d in, then decided to continue: it looked around at the system info, decided to upgrade a bunch of stuff including the linux kernel, got impatient with apt and so investigated why it was taking so long, then eventually the update succeeded but the machine doesn’t have the new kernel so edited my grub config. At this point I was amused enough to just let it continue. Unfortunately, the computer no longer boots.

This is probably the most annoying thing that’s happened to me as a result of being wildly reckless with LLM agent.

[Chris Long @Centurion]

This is a hill I'll die on

[SwiftOnSecurity @SwiftOnSecurity]

Hot take: With the deprecation of browser exploits being widely deployed or effective, a phishing test must obtain at least part of the authentication flow for you to truly fail it.

[Danielle Belardo, MD @DBelardoMD]

Heartbroken after seeing a young patient with no medical history, end up with a BIFFL GRADE II dissection of the vertebral artery and subsequent acute PICA infarct immediately after a neck adjustment from the chiropractor. This has to stop.

Chiropractors - you HAVE to stop.

[Chris Long @Centurion]

The company that helps you opt-out of everything had to walk back automatically opting people into it’s AI processing feature

[Aric Toler @AricToler]

So, Google is killing its cache (which was amazingly useful), and replacing it with a third-party solution of linking to the Internet Archive. I really hope the Internet Archive is being paid -- and paid a lot -- for this.

[Chris Long @Centurion]

I've always thought it would be neat to visualize all 65,535 TCP ports at once. For example, a portscan would probably look pretty neat. 30 minutes and bit of back and forth with o1-preview got me a working app.

2 portscans visualized: one using sequential scans, one not

[Chris Long @Centurion]

> Of course the utilities aren't passing the cost savings on to consumers yet, but they'll have to eventually

As a PGE customer, I want to believe, but "lowering electricity prices" is a pretty foreign concept to them

[Chris Long @Centurion]

Very appreciative that these folks are largely sidetracked playing global financial CTF

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft identified a North Korean threat actor exploiting a zero-day vulnerability in Chromium (CVE-2024-7971) to gain remote code execution. Our assessment of ongoing analysis and observed infrastructure attributes this activity to Citrine Sleet. https://t.co/ITqOQpWn2v

[Chris Long @Centurion]

@AndrewMohawk @SentinelOne This is pretty rich given all the “we test our product so hard” claims they’ve been spewing in the wake of the CS outage

[Chris Long @Centurion]

.@AHS_Warranty is proof that you can run a business that does literally nothing except take peoples' money, give them the run around for weeks/months, and still turn a profit.

The bar for competition is so low the heat of the center of the earth is melting it