Larry Orton

Co-Founder & CEO at WireWolf | UC Berkeley MICS | Senior Army Leader | Computer Scientist

[Larry Orton @LarryOrtonJr]

To be precise: first exploitation attempts hit Defused's decoys Oct 8.

[Larry Orton @LarryOrtonJr]

SonicWall SMA1000 got a CVSS 10. It was disclosed Oct 6 and exploited by Oct 8. Finding it took seconds; patching every client is the actual job.
MSP owners: how many of yours are patched right now?
https://t.co/ooweyF64Gb

[Larry Orton @LarryOrtonJr]

RMM abuse jumped 277% last year. Attackers don't pick locks when you leave the master key under the mat.
MSP owners: what's the one thing you've done to lock yours down?
https://t.co/yTpZngLNV1

[Larry Orton @LarryOrtonJr]

@dailytechonx Huntress found the second rogue ScreenConnect client uninstalling the first to cover its tracks. MSPs: are you allowlisting your own ScreenConnect instance, or just the app name?

[Larry Orton @LarryOrtonJr]

@SecAlertsCo Patching is the easy part. The hard part is knowing which of your 30 clients is still running SSM On-Prem. Could you answer that right now?

[Larry Orton @LarryOrtonJr]

@directorcia Agreed. I can teach someone the stack in a month, but I can't teach curiosity in a year. What's the best interview question you've found for spotting it?

[Larry Orton @LarryOrtonJr]

@andrewchen Hackathons are the best diligence ever invented. 24 hours shows you who ships and who just makes decks. Good luck LA.

[Larry Orton @LarryOrtonJr]

@hnshah Security is the extreme case. Mid-market teams buy 30 tools and staff zero people who know all 30. The interface was always the attack surface. When software learns the user instead of the other way around, the misconfig era ends.

[Larry Orton @LarryOrtonJr]

@andrewchen Underrated part of autonomy: a clean handoff to humans when it hits the edge case. Every autonomous system will meet its Fleet Week. The winners won't be the ones that never need a human, they'll be the ones that know exactly when to call one, and fast.

[Larry Orton @LarryOrtonJr]

@edsim @satyanadella @KeycardAI @ianliving Right frame. Insider-risk programs never trusted the analyst, they trusted the clearance and the audit log. Agents need the same: least privilege, scoped per task, expiring by default. Weird twist: the model is the first insider that can be socially engineered by a PDF.

[Larry Orton @LarryOrtonJr]

@ivanainai Give an agent a goal, a browser and no rules of engagement and you've built a very fast private with no sergeant. The fix isn't smarter models, it's guardrails outside the model: scoped permissions, approval gates, full logging.

[Larry Orton @LarryOrtonJr]

@CSOonline At this point NetScaler patching isn't maintenance, it's a standing watch rotation. Patching the edge is half the job. If it was exposed before the fix, assume someone already used it and go hunt.

[Larry Orton @LarryOrtonJr]

@johnmcclure00 'Assume compromise' is the line most people will skim past. Patching closes the door; it doesn't evict whoever walked through it. Anyone running fleets of these needs a sweep for new accounts, web shells and odd sessions, not just a green checkmark.

[Larry Orton @LarryOrtonJr]

@BleepinComputer Attackers now know who's been butchering Bohemian Rhapsody at 1 AM. Joke aside: 'fan database' is exactly the system nobody owns, nobody patches, and everybody forgot was still connected. Forgotten assets are where breaches live.

[Larry Orton @LarryOrtonJr]

@vxunderground Underrated ATT&CK tip: read it backwards. Pick a technique, then ask 'would I actually see this in my environment today?' Most teams find a great map and a coverage plan full of holes.

[Larry Orton @LarryOrtonJr]

@vxunderground Trust is the most exploited vulnerability in healthcare and it never gets a CVE. 'It came from Bob' beats every filter we've built. If your awareness training stops at 'check the sender,' you're guarding the front gate while the enemy walks in wearing our uniform.

[Larry Orton @LarryOrtonJr]

6/ Bottom line: finding vulns is cheap. Fixing them fast is the actual job. Find, fix, prove it. Repeat until retirement.

[Larry Orton @LarryOrtonJr]

1/ September Patch Tuesday: 973 CVEs, an all-time record. Help Net is calling it the "Patch Apocalypse." Here's how to survive it without losing your mind. 🧵

[Larry Orton @LarryOrtonJr]

5/ Even the domain system isn't sacred. Attackers hijacked the .gh, .sl and .as registries and got valid certificates for Google and YouTube domains. Watch the public certificate logs for your own domains.