Mathieu D.

Random infosec worker / Coffee addict / Rum lover

[Laurent Cheylus @lcheylus]

Google is working on a new feature called Shielded Email that lets users create unique email aliases for signing up for services, which helps protect their privacy and reduce spam. #Privacy #Mail https://t.co/nXw0s7yz0p

[yan @bcrypt]

reminder that the bcrypt hash function ignores input above a certain length! so if you do bcrypt(username || password) for some reason, a sufficiently long username will make it accept any password. to fix this you can sha256 the input first.

[Trail of Bits @trailofbits]

AWS Nitro Enclaves offer strong isolation for sensitive workloads but require careful security implementation. Learn how to avoid common pitfalls and harden your enclave deployments. https://t.co/aiDjLLfXN7

[Hacking the Cloud @HackingthCloud]

Discover how to determine the AWS account ID associated with access keys using sts
or by decoding the key itself. Learn these effective techniques for better AWS environment assessments. Dive into the details here: https://t.co/vBe8GEFETH

[Synacktiv @Synacktiv]

Following on from our #GitHub action exploitation series, @hugow_vincent discovered a new exploitation technique that allowed us to push arbitrary code onto the spring-security project using the Dependabot GitHub app.
https://t.co/y53ZVySc8C

[Mathieu D. @_mdeous_]

@florent_viel Il y a Hiya (ce qui est utilise sur les Samsung) par contre en app standalone je ne sais pas ce que ca vaut

[Mobile Hacker @androidmalware2]

Bluetooth LE spam attack is now ported to dedicated Android app to push notifications for Android and Windows

For Android, is can advertise over 170 devices
https://t.co/mT6It2DjbW

[Arvind Narayanan @random_walker]

OpenAI's security team noticed that a group reverse engineered and was abusing ChatGPT's internal API. Instead of shutting them down, they quickly replaced ChatGPT with CatGPT… and then lurked in the attackers' Discord to watch the chaos. Absolute legend. https://t.co/g1mloXtKCN

[Kévin GERVOT (Mizu) @kevin_mizu]

Excited to launch my first browser extension, DOMLogger++! Now available for both Firefox and Chromium! 🎉

DOMLogger++ allows you to monitor, intercept, and debug JavaScript sinks based on customizable configurations 🔥

Check it out 👇

https://t.co/D9OiEIKQp3

1/5

[Matthew Green @matthew_d_green]

PS If a viral report goes around saying there’s a vulnerability and you should turn off link previews, there’s really not a lot of cost to being cautious for a day or two. It’s not like someone is asking you to inject chlorine into your veins.

[hacker.house @hackerfantastic]

If you dont know why @xillwillx and #sub7 is trending in hacker land because you weren't born, this retrospective review by @DarkCoderSc is a good summary. It was the 1999 hackers preferred RAT tool that inspired the likes of DarkComet. https://t.co/wmnqMRPzHF

[ᅟ𝖎𝖑𝖑𝖜𝖎𝖑𝖑 @xillwillx]

I'm dumping this before my talk at @bsidesct so I don't get distracted. Enjoy fuckers.
https://t.co/LnaE96R1z5
cc: @vxunderground

[Edznux @Edznux]

My team just released a Kubernetes attack path tool named KubeHound!

Release blog post (with examples)
https://t.co/v5TyHMfhMw

Website / docs: https://t.co/97ZWGd8u8W :D
Should be able to handle large k8s env!
Feedback welcome!

[ESET Research @ESETresearch]

#ESETresearch uncovered a #Lazarus attack against an aerospace company in 🇪🇸, deploying several tools, most notably a publicly undocumented and sophisticated RAT we named LightlessCan. The attack is part of Operation DreamJob. @pkalnai https://t.co/VK9nGEn2Gp 1/6

[Christian Blichmann 🇺🇦 (on bksy and Mastodon) @AdmVonSchneider]

In the spirit of "this talk could've been a tweet", I just pushed a button:

#BinDiff is now open source.

- Snapshot release, no major new functionality
- Release binaries later today or tomorrow
- This is my 20% and I won't we able to act on PRs until end of Q4 (OOO traveling)

[Jake Williams @MalwareJake]

Repeat after me: no amount of security awareness training will solve the social engineering problem. You might as well be relying on ancient chants and sacred crystals if this is the plan.

Thank you for coming to my TED talk...

[Joseph Cox @josephfcox]

New: I tracked the precise movements of an NYC subway rider. Saw what specific time they got on and at what station. It became obvious which station was nearest to their home.

This was all because of a 'feature' on the MTA website

Wide open to abuse https://t.co/334xmokeFB

[🥝🏳️‍🌈 Benjamin Delpy @gentilkiwi]

Just published a little presentation "ST25TB series NFC tags for fun in French public transports" 🥝

It demonstrates why it's not a good idea to use chips without authentication (like SRT512 & ST25TB512-AT) for convenience transport tickets

> https://t.co/My91mnxg4Y

[gquere @_gquere]

I wrote an article on bypassing BitLocker on a Lenovo laptop:

https://t.co/ZB5n7AGCXB