Scott Treacy

Application Security and Web Application Firewalls.
Talking about WAF-as-a-Service, Bots, AppSec & InfoSec in general.
Treacy Consulting Services Ltd.

[Scott Treacy @AppSecMan]

I was honoured to have been asked by @SamanthaNiblet4 to share my expertise in cyber security at an All-Party Parliamentary Group (APPG) for Cyber Innovation in the Houses of Parliament yesterday.
https://t.co/YNoZP8T0rj

#Cybersecurity #E2EE #ADP

[Calif @calif_io]

Introducing HTTP/2 Bomb: a remote DoS in nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora. A single client pins 32GB of server memory in 10s. Found by Codex.

Blog post: https://t.co/WO9MeExoun

PoCs: https://t.co/NpVgEHBHPl

[Scott Treacy @AppSecMan]

@dsobeski @DougPolkVids @LodgePokerClub @TheBradOwen PS I'm not suggesting a BMW is a real car... try driving one in the snow 😱

[Scott Treacy @AppSecMan]

@dsobeski @DougPolkVids @LodgePokerClub @TheBradOwen I've been in both the 3 and Y at various times... horrible plastic cars with an iPad dashboard... I'll be sticking to real cars thank you.

[Dave W Plummer @davepl1968]

You might think it's just a game, but it's so much more!

Minesweeper was included to teach users how to right-click.

Solitaire was included to get people familiar with drag and drop.

Cardfile was included to familiarize people with MDI applications.

Paint was included for mouse dexterity, range selection, and more advanced mouse use.

Pinball was included just because it was cool.

Credit to @dsobeski for pointing it out!

[Barracuda Networks @barracuda]

The number of attacks targeting web applications and APIs has increased significantly and shows no sign of slowing 📈

See what Barracuda CPO Neal Bradbury has to say regarding the reasons why web applications are attractive targets for attackers. https://t.co/UB3pdMZqOQ #AppSec

[Dave W Plummer @davepl1968]

I wrote this Format dialog back on a rainy Thursday morning at Microsoft in late 1994, I think it was.

We were porting the bajillion lines of code from the Windows95 user interface over to NT, and Format was just one of those areas where WindowsNT was different enough from Windows95 that we had to come up with some custom UI.

I got out a piece of paper and wrote down all the options and choices you could make with respect to formatting a disk, like filesystem, label, cluster size, compression, encryption, and so on.

Then I busted out VC++2.0 and used the Resource Editor to lay out a simple vertical stack of all the choices you had to make, in the approximate order you had to make. It wasn't elegant, but it would do until the elegant UI arrived.

That was some 30 years ago, and the dialog is still my temporary one from that Thursday morning, so be careful about checking in "temporary" solutions!

I also had to decide how much "cluster slack" would be too much, and that wound up constraining the format size of a FAT volume to 32GB. That limit was also an arbitrary choice that morning, and one that has stuck with us as a permanent side effect.

So remember... there are no "temporary" checkins :)

Follow me for more random code musings!

[Barracuda Networks @barracuda]

Did you know that denial of service, social engineering, and credential theft were the most prevalent attack vectors in 2023?

Stay informed by reading our new Cybernomics 101 report https://t.co/x8WMQPwS5d #cybercrime

[Scott Treacy @AppSecMan]

@SeanWrightSec I personally hate the term AI... Why? Because there is no intelligence there, artificial or otherwise... It's all just machine learning at this point.

[Barracuda Networks @barracuda]

How are you combatting attacks and preventing costly breaches? https://t.co/QKcFdVbsFe #ApplicationSecurity

[Barracuda Networks @barracuda]

Don’t miss this @insights_expert podcast about cyber resilience with Barracuda CTO Fleming Shi https://t.co/l9QkjQEU5H #CyberResilience

[Barracuda Networks @barracuda]

How is your company dealing with bot attacks, web application vulnerabilities, and flawed API security? https://t.co/dsRbyGWBOM #ApplicationSecurity

[Scott Treacy @AppSecMan]

I have registered for Infosecurity Europe 2023. First time in a few years. Looking forward to catching up with friends and former colleagues l've not seen in person since the pandemic https://t.co/vTqgb0jOPJ

[Barracuda Networks @barracuda]

Don’t miss these new insights about app security https://t.co/58BpNrbvCA #ApplicationSecurity #APISecurity

[Barracuda Networks @barracuda]

How are you protecting your apps from today’s most sophisticated cyberthreats? https://t.co/WLh7wHeWHR #ApplicationSecurity #APISecurity

[Scott Treacy @AppSecMan]

@MentorWebDev I would suggest replacing chapter 10 with "@OWASP Top 10 and Web Application Security" before moving on to "Job"... Although l would hope these things are already being introduced and discussed in the proceeding chapters?

[Barracuda Networks @barracuda]

How are you protecting against API security vulnerabilities? https://t.co/mHIByW4FGC Join Barracuda for a look at the state of API security #APISecurity

[Barracuda Networks @barracuda]

What kind of visibility do you have into application traffic? What about bad traffic? https://t.co/wgSmeUh2BZ #ApplicationSecurity

[Barracuda Networks @barracuda]

This new blog post covers the 2023 OWASP top 10 API security risks https://t.co/4JAs52Nivg #APISecurity #OWASPTop10

[Zuk @ihackbanme]

The recent WhatsApp accounts takeover is simple and genius.

This is how it works:
You're sleeping.
A "hacker" tries to login to your account via WhatsApp.
You get a text message with a pincode that says "Do not share this".

You don't share it, yet you still get hacked.

How?