lo0sr

Interested in all things offensive cyber, implant development and vulnerability research.

Github: [email protected]

[vx-underground @vxunderground]

> Peter Stokes
> Scattered Spider guy
> Arrested
> Microsoft helps FBI
> Read court documents
> Page 12
> Microsoft tracks Stokes from GDID
> Microsoft Global Device Identifier (GDID)
> Stokes used Windows
> Page 34
> GDID assigned to each OS install
> GDID unique to each device
> GDID only change if OS wiped
> Stokes GDID 6755467234350028
> GDID reported internet activity to Microsoft
> GDID showed Stokes using Ngrok
> GDID reported Stokes IP address
> GDID showed Stokes web activity
> GDID showed timestamps of web activity
> GDID mapped with video game activity
> GDID showed games played
> GDID undocumented
> GDID only mentioned in one MSDN document
> Azure UCDOStatus
> Azure Monitor Logging

[lo0sr @a_lo0sr]

@HackingLZ @LinkedInLunat1c

[lo0sr @a_lo0sr]

@vxunderground Reading a paper has a high motivational barrier of entry compared to a small checklist. In my past experience of running a cyber security club, only the high moto (small subset) of people would show up whenever I did a deep dive on a topic, which is also why I quit.

[Signal @signalapp]

Right now there are a lot of new eyes on Signal, and not all of them are familiar with secure messaging and its nuances. Which means there’s misinfo flying around that might drive people away from Signal and private communications.

One piece of misinfo we need to address is the claim that there are ‘vulnerabilities’ in Signal. This isn’t accurate. Reporting on a Pentagon advisory memo appears to be at the heart of the misunderstanding: https://t.co/QfWgOxHAzp. The memo used the term ‘vulnerability’ in relation to Signal—but it had nothing to do with Signal’s core tech. It was warning against phishing scams targeting Signal users.

Phishing isn’t new, and it’s not a flaw in our encryption or any of Signal’s underlying technology. Phishing attacks are a constant threat for popular apps and websites.

In order to help protect people from falling victim to sophisticated phishing attacks, Signal introduced new user flows and in-app warnings. This work has been completed for some time and is unrelated to any current events. If you’re interested in learning more, this WIRED article from February 19th (over a month ago) goes into more detail:
https://t.co/xvVVdPDhSs

Signal is open source, so our code is regularly scrutinized in addition to regular formal audits. We also constantly monitor [email protected] for any new reports, and we act on them with quickness while also working to protect the people who rely on us from outside threats like phishing with warnings and safeguards.

This is why Signal remains the gold standard for private, secure communications.

[lo0sr @a_lo0sr]

@namedobject I bought 2 off of FB marketplace for $150 and would do it all over again.

[lo0sr @a_lo0sr]

@vxunderground @whid_ninja Sounds like fun, would love to win this.

[lo0sr @a_lo0sr]

@LukasHozda @gnukeith That's sick, I thought that this was a heavily modded Brave. Ill definitely try out Nyxt.

[lo0sr @a_lo0sr]

@vxunderground @BckyrdBandwidth I'd gladly take a free VPS

[lo0sr @a_lo0sr]

@deadvolvo Davinci Resolve is really good for video editing and its free

[lo0sr @a_lo0sr]

@gnukeith Kagi

[uwo's lab | the funny science man @uwutoowo1]

I smoked meat with 500 cigarettes to see what it tastes like (it was horrible)

[lo0sr @a_lo0sr]

@emil_priver Its quite useful for prototyping and or quick scripts. Create x function that does y using foo library. Time saver for that type of stuff, but def not good for production code

[lo0sr @a_lo0sr]

@tgeijten Kinda looks like Jack Sparrow running with his arms flailing around like that

[lo0sr @a_lo0sr]

@gnukeith @Novarg32 @ProtonPrivacy @brave @GrapheneOS Interesting, did not know that

[lo0sr @a_lo0sr]

@gnukeith @Novarg32 @ProtonPrivacy @brave @GrapheneOS I think Mull is also a decent alternative

[5pider @C5pider]

I haven't posted anything about Havoc in a while so imma share something I have been working on. Wrote a custom VM/Interpreter (based on the RISC-V instruction set) to execute exploits and other arbitrary code.
The client is now fully extendable and scriptable via the Python API

[lo0sr @a_lo0sr]

@TELOtrucks @MoneyPlatters @AriaGroupInc What is your projected time until these will be sold/delivered?

[Greg Linares (Laughing Mantis) @Laughing_Mantis]

Since I'm 6 drinks in for 20 bucks, let me tell you all about the story of how the first Microsoft Office 2007 vulnerability was discovered, or how it wasn't.

This was a story I was gonna save for a book but fuck it, I ain't gonna write it anyways.

[lo0sr @a_lo0sr]

@ShitpostGate How would one acquire this?