@[email protected]

Just me!

[Alex Neff @al3x_n3ff]

@cookieTheft and I have been accepted to speak at Troopers this year🎉

Hope you all are eager to learn a thing or two about ADCS and ESC17. See you there!

[SkelSec @SkelSec]

My cli scripts are safe from any LLM interactions because even they can't figure out the correct input parameters

[Steven Lim @0x534c]

“So WSUS with HTTPS is secure, you said? 😂”

Turns out… not really.
According to the excellent research by Alexander Neff and Phil Knüfer in “Using ADCS to Attack HTTPS‑Enabled WSUS Clients,” a misconfigured ADCS environment can completely undermine HTTPS‑protected WSUS.

They demonstrate how overly permissive certificate templates—especially those allowing user‑defined subject names and limited to the Server Authentication EKU—let an attacker obtain a trusted certificate and impersonate a WSUS server. Combine that with classic WSUS interception techniques, and suddenly you can push malicious updates that run with full admin privileges on Windows clients, all while the traffic looks perfectly valid and encrypted.

From a defender’s point of view, the big question becomes:
How do you detect if your WSUS clients have been talking to a hijacked WSUS server? 😅

Good news: it is detectable—and here’s the KQL to help you spot it.

#Cyberesecurity #WSUSHiJackAttack

[@[email protected] @cookieTheft]

@0x534c Also note that, while our example attack creates a user or adds one to a group, this is basically arbitrary command execution on the victim. Attacks could come in different forms and sizes. Better to look for suspicious process spawning initiated by WSUS updates.

[@[email protected] @cookieTheft]

@0x534c The KQL is interesting in case that you want to specifically detect attacks on encrypted WSUS traffic. Otherwise, wouldn't it be better to just detect suspicious activities initiated by WSUS traffic, no matter the port?

[@[email protected] @cookieTheft]

We did a thing

[Alex Neff @al3x_n3ff]

Using ADCS to Attack HTTPS-Enabled WSUS Clients:

@cookieTheft and I have extended the research by @Coontzy1 on WSUS attacks and explored how to leverage misconfigured ADCS templates to gain code execution on HTTPS-enabled WSUS clients.

1/2🧵

[Marcello @byt3bl33d3r]

This key takeaways from this report:
- Agentic AI lowers the bar for cyber attacks (we knew this)
- Dramatically increases scale (we knew this)
- without a human in the loop, success rate is low (we knew this)

The report itself leaves a lot to be desired from a technical aspect , I caution reporters to not read too deeply into the conclusions.
If you’re an org, standard defense in depth still applies here as defense against these AI assisted attacks.

[Rémi GASCOU (Podalirius) @podalirius_]

I have released an OpenGraph collector for network shares and my first blogpost at @SpecterOps on the subject!

You can now visualize attack paths to network shares in BloodHound 👀

https://t.co/2e2DBIndcU

[Florian Hansemann @CyberWarship]

''Abusing sAMAccountName Hijacking in GPP: Local Users and Groups - Cogiceo''

#infosec #pentest #redteam #blueteam
https://t.co/ZP8e3FTHSZ

[S3cur3Th1sSh1t @ShitSecure]

Raw NTFS parsing for SAM/SYSTEM/NTDS.dit access?

https://t.co/EerQ3lFxlA

400 lines Powershell - easy peasy ❤️🔥

[Signal @signalapp]

Until now, if you lost or broke your phone, your Signal message history was *gone,* a real challenge for everyone whose most important conversations happen in Signal. So, with careful design and development, we’re rolling out opt-in secure backups.

https://t.co/MfpQGe2XSr

Secure backups will let you save an archive of your Signal messages remotely in privacy-preserving form, refreshed every day.

Now available in the latest Android beta release, rolling out to iOS and Desktop in the near future.

[@[email protected] @cookieTheft]

@SpecterOps @harmj0y I have evolved? 😯

[Signal @signalapp]

https://t.co/HS5P66thps

[Rémi GASCOU (Podalirius) @podalirius_]

Opening a new chapter 📖

From tinkering with old systems to giving talks at @BlackHatEvents, it’s been a wild ride.

I am thrilled to share that I’m joining @SpecterOps as a Senior Security Researcher! Time to go full-time into deep technical security research🥰

[Marc Smeets @MarcOverIP]

An attacker on your network is indistinctable from IT admins. As long as this is true, attackers win. (Loosely borrowing Lambert’s list/graph quote.

Solution: tiering and clean source

[Alex Neff @al3x_n3ff]

Releasing a side project of mine: wsuks - automating the WSUS mitm attack🔥
https://t.co/92D4idVy7V

TL;DR:
If the Windows Server Update Service (WSUS) is configured to use HTTP instead of HTTPS, it's possible to take control of any Windows machine on your local network.

1/4🧵

[Meredith Whittaker @mer__edith]

Use Signal.

We promise, no AI clutter, no surveillance ads—whatever the rest of the industry does.

We lead we don’t follow❤️

[SkelSec @SkelSec]

https://t.co/Xnm6zR47jS

[Alex Neff @al3x_n3ff]

The feature rundown of the NetExec v1.4.0 release is now live on our wiki: https://t.co/L7r4KOIGev

Give them a read, there are so many great new features!

Kali has updated NetExec to v1.4.0, so all the new changes are also available via apt🚀

[Oliver Lyak @ly4k_]

👇
https://t.co/bz5mDBUAwu