Had an absolute blast at @WWHackinFest again this year. Crazy to think that last year #WWHF was my first con.
Slides from my talk on DoH for Attackers and Defenders are here: https://t.co/keXaWAoZ5z
Look out for a full write-up soon.
@seanhn Lots of buzz about GLM 5.2 cyber performance, I've yet to see a benchmark run though. Who will pay for the inference to run CyberGym, ExploitBench for these open weight models? We're talking 5-10k per run per bench. Non-trivial for individual researchers.
@ItsReallyNick@Ground_app@grok I have been testing out for a while and found it very illuminating. Generally slower than NYT or WSJ for push notifications but getting headlines at a glance and blindspot focus is really helpful
@brysonbort I think about this a lot and what it means when we talk about exec comms. It's a journey not a destination blah blah but how does a CFO/CEO/CTO/board know they are on the right trajectory when there are always budget requests on the cutting room floor?
@IceSolst@tuckner FYI can scale response by retrieving the directory from $chromeprofile\Default\Local Extension Settings\pajkjnmeojmbapicmbpliphjmcekeaac on all hosts and using https://t.co/VfQokRvMIh to check for presence of keys
MSRC fixed a RCE bug in TCPIP module.
I found the bug several months ago.
Its score is 9.8 and exploitation is more likely. Please apply the patch immediately.
Wild West Hackinโ Fest is taking its conference to new heights in 2025! Join us in Denver for Wild West Hackinโ Fest @ Mile High 2025! Pre-con training: Feb. 4-5, 2025 and conference: Feb. 5-7, 2025.
Register now! โก https://t.co/teZY5w5Vlw
1/2
For those dealing with lots of Azure Windows VMs stuck in a boot loop due to CrowdStrike - you can automate the workaround using https://t.co/LdcUYqky9v CC @NathanMcNulty@GossiTheDog
@gleeda Surprised to see no mentions of threat validation. When I did DE, being able to run malicious activity to validate detection was key. Ideally detection rules should be continuously validated in prod. Engineers either need access to tooling to validate or need the skills to do so
@NathanMcNulty Yep used that and encourage it for setting interactive retention since it will work for any new data. But it seems the only way to set *archive* retention up is by table: https://t.co/qkvGkVWIqa
@NathanMcNulty I was surprised to see no option to set total archive period for log analytics at the workspace level, so thought I'd share this one-liner to set across all tables:
@cryps1s Glad Snowflake is waking people up to the infostealer risk. The target may have been accounts without MFA this time but soon people will realize the same thing can be done with their SSO tokens...
@cryps1s The standard I have been suggesting is to require a compliant or at least enrolled Intune device for conditional access in Entra ID, so you can require EDR on devices with tokens. On the vendor side I want better support for token binding as well
@arekfurt Entire hospital systems are going down due to criminally negligent AD security defaults (designed by Microsoft) and ransomware, not medical device vulnerabilities