Aiden Mitchell

Moved to

[Hayden @the_transit_guy]

Can someone add me to the US DOT group chat? I just want to talk about trains.

[Aiden Mitchell @amitchell516]

Park in FSD doesn't work at all, lol

[Sawyer Merritt @SawyerMerritt]

Tesla now has one thing left to do on this list

[sam scholten @samkscholten]

🚨 Detection coverage for CVE-2025-21298:

🤝 h/t to our friends at @delivr_to for their excellent detection work: https://t.co/DTPxTbHOVe 💪

🔍 @sublime_sec 's existing rule flags this too: https://t.co/8nlY30SBtL

[Sublime Security @sublime_sec]

Scammers are using distribution lists to hide their tracks while blasting a wide range of targets in this new variant of Living Off the Land (LOTL) + callback phishing attacks.

We’ve seen it with trusted brands like Microsoft, Venmo, and PayPal. Learn how the scam works: https://t.co/hl1fzvTw7m

[Aiden Mitchell @amitchell516]

@sublime_sec YARA rule is here: https://t.co/UCI4vC6jFI

[Aiden Mitchell @amitchell516]

New @sublime_sec rule out for this, utilizing our ability to run YARA rules on attachments: https://t.co/moYEOwtxiK

Looking back, we've seen this technique in use for some time. FWIW, Office does warn you that the document is corrupted, and only to click "yes" if you trust it.

[ANY.RUN @anyrun_app]

🚨ALERT: Potential ZERO-DAY, Attackers Use Corrupted Files to Evade Detection 🧵 (1/3)
⚠️ The ongoing attack evades #antivirus software, prevents uploads to sandboxes, and bypasses Outlook's spam filters, allowing the malicious emails to reach your inbox

The #ANYRUN team discovered that as part of this #zeroday attack, threat actors attempt to conceal the file type by deliberately corrupting it, making it difficult for certain security tools to detect

📌 Our sandbox solves this problem thanks to interactivity. It launches these broken files in their corresponding programs, which allows it to identify #malicious behavior
See example:
https://t.co/8MFElzg47r

🚫 Although these files operate successfully within the OS, they remain undetected by most security solutions due to the failure to apply proper procedures for their file types

They were uploaded to VirusTotal, but all antivirus solutions returned "clean" or “Item Not Found” as they couldn't analyze the file properly

[Josh Kamdjou @jkamdjou]

EML attachments are a clever way to bypass traditional analysis because they automatically get rendered and embedded in the original message, without user interaction, by most mail clients:

https://t.co/89vpok3qqW

h/t @amitchell516

[Aiden Mitchell @amitchell516]

Please, everyone, use an ad blocker.

[Brian in Pittsburgh @arekfurt]

The way that Google handles accepting and displaying search advertising is the opposite of "Secure by Design".

https://t.co/4WNkn33S6p

[Aiden Mitchell @amitchell516]

Yeah, I won’t believe it until I see it, what with Google’s history of killing things at random.

[Shea Cohen @futureform_]

Am I the only one who thinks 7 years of OS updates is just completely unnecessary? It feels like it’s just for marketing.

That would be like the original Pixel running Android 14. Completely impractical, and a terrible experience.

[Polling Canada @CanadianPolling]

Canada 🤝 United States
Pick New Speakers

[Aiden Mitchell @amitchell516]

@SwiftOnSecurity @CRSD72 is still this way… students can print directly to the superintendent’s office 🙃

[Aiden Mitchell @amitchell516]

why make employees suffer with these useless assessments, when you could invest in better email security

punishing employees for failing phishing tests is not the answer...

[Cybergibbons 🚲🚲🚲 @cybergibbons]

Recently had to do @KnowBe4's "Security Awareness Proficiency Assessment", and I've got to say, I think it's actively harmful to improving security.

Let's look at the questions

[Josh Kamdjou @jkamdjou]

If you're running @sublime_sec, you can prevent this at your email perimeter. @delivr_to put out a detection for the WinRAR vuln when the CVE initially dropped: https://t.co/AJovKYMLzW

[Frank McGovern - INACTIVE @FrankMcG]

Average age of last reboot time on core switches.

[Aiden Mitchell @amitchell516]

Can confirm, it just works. Now it looks like I have a FortiGate at home :p

maybe tomorrow it'll look like I have a Sophos firewall

[Andrew Morris (afk) @Andrew___Morris]

someone in GN Sensors Early Access just asked if their beefy 16gb ram server would be enough to run a GreyNoise sensor👀

512mb ram to run literally anything from lighttpd to Microsoft Exchange and beyond.

if it can run wireguard and iptables, itll run.

https://t.co/rScxOkQRG7

[Josh Kamdjou @jkamdjou]

This is so sick. Email -> Attached EML -> Embedded image -> OCR -> NLU to identify a financial request. Outlook/many clients will render an attached EML in the *original* message, making this an effective evasion technique. We've seen this in the wild recently. h/t @amitchell516

[Aiden Mitchell @amitchell516]

@Andrew___Morris @GreyNoiseIO @kimb3r__ I need this now

[Aiden Mitchell @amitchell516]

k bye
https://t.co/7UrGBE3L0y

[Aiden Mitchell @amitchell516]

@TransLink Turn backs have now been cancelled, end-to-end service restored. Expect delays, as there is still single tracking in place.

[Aiden Mitchell @amitchell516]

@TransLink Passengers, use the 119 bus at Metrotown and Edmonds to bridge the gap.