SOCtastic

Critical thinking some security. GSEC, GCIH, GAWN... Security is my career and hobby!

[Derek Devicemanager @IT_unhinged]

We have a strict zero-trust policy for local admin rights.

A graphic designer requested elevation to install a custom font called "Bebas Neue".

I replied with the standard Vendor Risk Assessment questionnaire.

It's a 40-page Excel document.

He asked if this was a joke. He just needs a font for a PDF.

I told him all third-party code requires a security audit, a data privacy impact assessment, and VP approval.

He said the font is open-source and free.

I explained that "free" means we need legal to review the licensing agreement.

He asked how long that takes.

I said anywhere from four to six months.

He sat in silence for a minute.

He replied, "I'll just use Arial."

I closed the ticket as "Alternative Solution Accepted."

I love Arial.

[Sharbel @sharbel]

HOLY COW!!!!!!! 🤯🤯

Did you know people can take money from your phone without you approving anything?

[impulsive @weezerOSINT]

Windows defender has been compromised.
right now there is a public unpatched exploit that gives any app on your windows PC full system admin access. no password. no popup. nothing

your antivirus doesnt stop it. your antivirus IS the exploit. windows defender is the attack vector

ransomware gangs can use this to encrypt your entire machine and steal every saved password, browser session, and discord token you have. fully patched windows 11. real time protection on

thread

[Anthropic @AnthropicAI]

Introducing Project Glasswing: an urgent initiative to help secure the world’s most critical software.

It’s powered by our newest frontier model, Claude Mythos Preview, which can find software vulnerabilities better than all but the most skilled humans.
https://t.co/NQ7IfEtYk7

[Riley Coyote @RileyRalmuto]

slowly but surely, this is going to be the experience and expressed sentiment of virtually every human being with a shred of ambition.

and they’ll all start waking up and we’re all going to be watching with popcorn.

we’re still so early, chat. somehow.

[SOCtastic @SecurityByUS]

#Clawd2Death name for the bad thats prob going to come from the ClawdBot BOTNET that is building.

[SOCtastic @SecurityByUS]

@ItakGol #Clawd2Death calling it… thats the name of the attacks that could generate form this massive BOTnet ;P

[Shruti @heyshrutimishra]

https://t.co/PFLXeRXaIu

[SOCtastic @SecurityByUS]

I tried this out and just had Copilot review the output for pII.. worked great! :P

[IT Guy @T3chFalcon]

Think your browser autofill is harmless?

Check this file:

%LocalAppData%/Microsoft/Edge/User Data/Default/Web Data

Inside:
– Emails
– Names
– Company info
– Sometimes card details

Stored in plain SQLite.

For red teamers? Easy recon.
For users? Big Privacy risk.

[IT Guy @T3chFalcon]

Think your browser autofill is harmless?

Check this file:

%LocalAppData%/Microsoft/Edge/User Data/Default/Web Data

Inside:
– Emails
– Names
– Company info
– Sometimes card details

Stored in plain SQLite.

For red teamers? Easy recon.
For users? Big Privacy risk.

[SOCtastic @SecurityByUS]

#xfinity prob not the best timing for this campaign.

[SOCtastic @SecurityByUS]

I dont post much, but if you have Gemini Pro, go select the personalization model as seen in the image. Now ask "What do you know about me?" = SUPER SCARY!! #Security #privacy

[Tony Redmond @12Knocksinna]

.@Office365 This is a very interesting way to block #Copilot Chat from accessing sensitive documents and using their content in its responses: use a DLP policy to block access based on sensitivity labels. It's in preview, but the block works: https://t.co/Ljdp7NhiKp
#Microsoft365

[SOCtastic @SecurityByUS]

@elonmusk Same should go for social media ;)

[Mark Simos @MarkSimos]

Another 'hidden' treasure in the CISO workshop is the security metrics we recommend programs consider. You probably won't use these exact metrics, but we do recommend that your program success measurements include focusing on these four areas.

https://t.co/eRSPlxMWh6

1/x

[Bloomberg @business]

TSMC has achieved early production yields at its first plant in Arizona that surpass similar factories in Taiwan, a significant breakthrough for a US expansion project initially dogged by delays and worker strife https://t.co/9PcFIMAlSQ

[Rick Wilson @TheRickWilson]

PLEASE do NOT share this @DaveBautista message with @realdonaldtrump of the Trump family. It will upset them, and that would be so, so wrong. 😂

P.S. I will never get the giraffe image out of my head.

[SOCtastic @SecurityByUS]

@MalwareJake I don’t know what I don’t know…

[Laura Burkhardt @LauraAnnSTL]

From Jennifer Carter, a teacher at Apalachee High School in Winder, Georgia.

What the hell are we doing?

[Chris Mowrey @chrisdmowrey]

To republicans in congress: come to Georgia and look families in their eyes. I dare you.