Romain Carnus

[Binni Shah @binitamshah]

A Practical Tutorial on PCIe for Total Beginners on Windows (Part 1) : https://t.co/pKnigJjXeF credits @daax_rynd

[raptor @0xdea]

Fascinating #vulnerability #research and #exploit #development writeup by @NCCGroupplc

The exploitation part that describes how they worked around a plethora of constraints is especially cool​ 😍

MeshyJSON: A TP-Link tdpServer JSON Stack Overflow
https://t.co/RPefT1mvsD

[Sam Curry @samwcyo]

More car hacking!

Earlier this year, we were able to remotely unlock, start, locate, flash, and honk any remotely connected Honda, Nissan, Infiniti, and Acura vehicles, completely unauthorized, knowing only the VIN number of the car.

Here's how we found it, and how it works:

[Corben Leo @hacker_]

I hacked a phone company earlier last year.

I found a stupidly simple way to view the call logs of 50M customers.

Here's how I did it:

[Romain Carnus @RCarnus]

@plmaltais Was I the last one ? Oof

[Edward Snowden @Snowden]

It begins.

[vx-underground @vxunderground]

Microsoft now offers the ability to link Azure Active Directory accounts to personal Microsoft accounts.

It will be enabled by default, so Threat Actors can compromise both your business and your home life, essentially doubling the capabilities of Threat Actors.

Very cool

[Ken Klippenstein @kenklippenstein]

Great work today guys

[vx-underground @vxunderground]

Today the United States National Security Agency (NSA) announced they will be making a strategic shift to memory safe programming languages. The NSA suggests organizations explore such changes themselves by utilizing languages such as C#, Go, Java, Ruby™, or Swift®

tl;dr ew

[Matthew Green @matthew_d_green]

I decided to take this week (mostly) off Twitter just to see what Mastodon was like. I joined an infosec-focused server and I’ve spent the past few days trying to use it like Twitter. Here’s a quick review. 1/

[memenetes @memenetes]

Using Kubernetes + ELK stack + Prometheus to deploy a static site

[GuidedHacking @GuidedHacking]

Little known fact:
It's possible to visit a website without trying to hack it

[Daniel Cuthbert @dcuthbert]

If 41 lines of code can bypass the authentication process on the administrative interface of FortiGate firewalls, FortiProxy web proxies, and FortiSwitch Manager (FSWM) on-premise management instances, then something is very wrong.

This is not acceptable @Fortinet

[Mark Ermolov @_markel___]

A very bad thing happened: now, the Intel Boot Guard on the vendor's platforms can no longer be trusted... ☹️

[raptor @0xdea]

CVE-2022-26766: the CoreTrust bug

"For years, macOS allowed any root certificate when checking code signatures, making code signing completely useless."

// bug discovered by @LinusHenze
// writeup by @zhuowei

https://t.co/vuC4mcxwim

[an0n @an0n_r0]

Here is why NetNTLMv1 should be disabled in prod networks ASAP. Besides cracking the hash back to NTLM (and then forging Silver Tickets) is straightforward, there is also a lesser known but immediate relay attack path by removing the MIC and doing RBCD abuse. Demo in screenshots.

[NCC Group Research & Technology @NCCGroupInfosec]

☁️ Tool Release - ScoutSuite 5.12.0 ☁️

The newest release of our open-source multi-cloud security auditing tool contains tons of feature enhancements (& more) for AWS, Azure and GCP.

Learn more about what's new:
https://t.co/KYkgbLONIB

[raptor @0xdea]

Always a great read:

https://t.co/LjZsWJqinZ

“We took a locked down FDE laptop, sniffed the BitLocker decryption key coming out of the TPM, backdoored a virtualized image, and used its VPN auto-connect feature to attack the internal corporate network.”

[/ˈziːf-kɒn/ @x33fcon]

x33fcon 2022 interviews: @thefLinkk

[Melvin langvik @Flangvik]

Had a blast presenting at #DEFCON30 today, GitHub repo for TeamFiltration is online! https://t.co/oNdwyUrccS
Thank you so much for all the amazing feedback, can't wait to see what this tool looks like in a year now that it's public!