Alex Cowperthwaite

Everything can be hacked, it's just a question of resources and creativity.

[James Kettle @albinowax]

Param Miner 1.51 is now out in the BApp store! In case you missed it, Param Miner now uses timing analysis to detect hidden parameters, and help detect & exploit reverse proxies. Let me know if it finds you anything cool :)

[wvu @wvuuuuuuuuuuuuu]

Fortra FileCatalyst Workflow CVE-2024-6633:

dbPassword="GOSENSGO613"

[Hackfest.ca @hackfest_ca]

Les mots de passe, c'est nul ! Avec 86 % des violations impliquant des informations d'identification volées, il est temps d'adopter les passkeys.

Découvrez pourquoi ils repr��sentent l'avenir de l'authentification dans la conférence perspicace d'Alex. @AlexInSecurity

[Kroll @KrollWire]

Our offensive security team has been working closely with the maintainers of the TorchServe project and AWS to correct two vulnerabilities that could compromise AI infrastructure. Read more in the blog: https://t.co/Xcmji553H8

#AISecurity #AIIntegrity #AIVulnerability

[Matthew Green @matthew_d_green]

So Apple has gone and updated the iMessage protocol to incorporate both forward security (very good!) and post-quantum cryptography. https://t.co/c7lidT3P9b

[Hackfest.ca @hackfest_ca]

This shows again how our government are disconnected from the reality and doesn't understand technology. Banning a tool that is use in less than 1% of car thief is NOT going to reduce car theif.

Ignorance of deputies like @FP_Champagne is a danger to cybersecurity in Canada.

[Steve Weis @sweis]

This iMessage exploit is crazy. TrueType vulnerability that has existed since the 90s, 2 kernel exploits, a browser exploit, and an undocumented hardware feature that was not used in shipped software:
https://t.co/YJdY6alLbV

[Techmeme @Techmeme]

Google starts prompting users to create a passkey for their account by default, but says passwords will "still remain part of our lives as we make the pivot" (@zombie_wretch / The Verge)

https://t.co/LSZ0CzE6Gg

📫 Subscribe: https://t.co/OyWeKSRpIM
https://t.co/X85d9Bqb28

[SwiftOnSecurity @SwiftOnSecurity]

Holy shit Microsoft figured out how their signing key was leaked
https://t.co/bJuY0tDFzn

[Matthew Green @matthew_d_green]

Apparently there are concerns that the LastPass thieves are cracking vaults and stealing cryptocurrency seed phrases. https://t.co/xHcAA0qluf

[kat traxler @NightmareJS]

Thrilled to be able to launch a new cloud tool to the community.
Huge thanks to my employer @Vectra_AI for supporting #opensourcesecurity
#threatdetection #cloudsecurity
See you all @cloudvillage_dc !

[Alex Cowperthwaite @AlexInSecurity]

This is one of the most underrated enumeration/discovery techniques out there.. I've had lots of success with it. Great to see a new tool to help with this technique!

[0xc130d @0xc130d]

Releasing my first proper open-source tool: CloudPrivs. Brute force AWS permissions from credentials. Has a very high coverage rate is fast. https://t.co/KDLHUtQdz2
#infosec #Pentesting #Hacking #CyberSecurity

[サイバー犯罪さん🔻 @g0jirasan]

Just released a post on Windows driver signature timestamp forging 👀 really stoked to finally release this! This technique effectively bypasses driver signature enforcement in Windows https://t.co/LIdEUlbsy0

[hacker.house @hackerfantastic]

The team behind this sphere have claimed it is "unhackable" - cc @defcon

[Balaji @balajis]

If you’re an H-1B stuck in an endless green card line, set your alarm for July 16.

Canada now has an experimental program where they’ll give 10000 permanent residencies to engineers that the US is repelling.

Part of their new tech talent strategy.
https://t.co/aTCwNoRgSw

[Chris Farris (@[email protected]) @jcfarris]

Time to announce my latest project - https://t.co/T5Ju5hkI4k

[Merill Fernando @merill]

Super exciting stuff.

Google released passkey support today!

[Paul Seekamp @nullenc0de]

Need to bypass the JWT signature? Kid param injection + directory traversal = signature bypass

Vulnerable apps using 'kid' for key retrieval might allow attackers to force a predictable key file (e.g. static file or /dev/null)🔓 Crafted malicious tokens signed w/ known key

[shubs @infosec_au]

https://t.co/GEZzjZdos7