Eric L

I'm not on Twitter anymore! If you're looking to join InfoSecNZ, contact me here: aW5mb3NlY256QGVyaWNsaWdodC5jb20=

[b33f | 🇺🇦✊ @FuzzySec]

I've seen some takes about the Storm actor being "lucky" and the like. Don't kid yourself, there is really good tradecraft happening here:

- Initial compromise (likely not the engineer), at a hard target (if VR angle then more likely the engineer)
- Situational awareness to understand about development processes and internal environments
- Lateral movement, most likely, to a target with access to development environments
- Lateral movement to development environment
- SOP knowledge about how production crash dumps are treated (happenstance maybe)
- Either knowing that there was a logic bug in how token signing was handled (scary) or finding this bug after having recovered the MSA key based on some research tasking (great forethought)
- Depending on crash dump size, possibly tooling to identify an extract the key material on endpoint in memory

And I'll remind you that Wiz disputes the impact of the MSA key compromise:
https://t.co/m3C33ecmIL

My open questions are still why the signing system crashed and what this race condition was that allowed key material to be in the dump to begin with.

[Eric L @RhyvenNZ]

@dabeave666 @threadreaderapp could you please do that unroll thing you do? Like with the wordy web page and stuff? Thank you kindly 🙏

[Eric L @RhyvenNZ]

@csoandy @SwiftOnSecurity Ah, fair - early days still 😁 It's on my Audible wishlist now!

[Eric L @RhyvenNZ]

@csoandy @SwiftOnSecurity Hey @csoandy who's doing the narration for the audiobook?

[Christopher Denny @cjmdenny]

Night shift. Auckland shrouded in fog.
@Aucklandhems @Rescue1Chopper

[Eric L @RhyvenNZ]

@JoeUchill Could you do the unroll thing please, @threadreaderapp

[Eric L @RhyvenNZ]

@urbankiwi testing testing?

[Eric L @RhyvenNZ]

@0xl4k @virolog157 Hi Lakshay, I'd be interested in this component too, are you happy to chat over DM?

[Eric L @RhyvenNZ]

@CHCon_nz @pepperraccoon @pepperraccoon I made progress on part two! I'm not sure a) that I've done it correctly, or b) if I'm at the end... but I got SOMEWHERE at least.

[Eric L @RhyvenNZ]

Working on the second part of the Easter Egg challenge from @CHCon_nz. So far it seems to not be a Caesar Cipher (numbers are too high), and it seems to not be a simple ASCII reference (numbers are too low), nor Ye Olde A1Z26.

[Eric L @RhyvenNZ]

@NZTEnews Hey team - were you aware that your sign-up page is broken? Following happens in the browser when trying to verify an email. Both Chrome and Firefox.

[Eric L @RhyvenNZ]

This one is pretty important, especially if you're looking after small businesses.

[Drum Cult @Drum_Cultist]

Additional reporting and context around the so called ZoomPortable campaign and a related, overlapping campaign delivering a backdoored version WindScribe

https://t.co/FGT5J9mRrI

cc @phage_nz
#cti #threatintel

[Eric L @RhyvenNZ]

@pepperraccoon Oh DM fail, I think you're not following me?

[Eric L @RhyvenNZ]

@pepperraccoon @FKeatingGeek @CHCon_nz Ooooo thanks for the offer! Incoming :D

[Eric L @RhyvenNZ]

@pepperraccoon @FKeatingGeek @CHCon_nz Argh I cannot figure out what I'm meant to decrypt with this OTP and I'm going crazy because I know it's RIGHT IN FRONT OF ME. /rant

[Eric L @RhyvenNZ]

@CHCon_nz @nzkarit @pepperraccoon Literally like a minute after tweeting this I realised that futureboy has done more than that epic GPG handbook. Have progressed further now :D

[Eric L @RhyvenNZ]

@CHCon_nz @nzkarit @pepperraccoon I've been trying with Mr 17, but no luck beyond decoding the Morse! Great evening to have a couple puzzles to work on though :D

[Eric L @RhyvenNZ]

@MachinePix Makes me look forward to @kiwicon EvEn MoRe

[Laura Bell Main @lady_nerd]

So me and @Sputina are doing a thing

The contents of our brains and everything we have done and learned about scaling security in a book....

You can pre-order now.

cc: @ResellerNewsNZ @CIO_NZ @businesskiwi

https://t.co/8IBLWmzshG

[Eric L @RhyvenNZ]

@lady_nerd @Sputina @ResellerNewsNZ @CIO_NZ @businesskiwi It took me about 30 seconds to buy this after @_tonijames posted about it. Can't wait, congrats!!