Mike Manrod

CISO and faculty by day, adversary emulation/tools by night, bad jokes and memes all the time.

[Mike Manrod @CroodSolutions]

This was such a fun conversation. Thank you to @_josehelps and @M_haggis for hosting an amazing podcast and to @Shammahwoods for teaming up.

We mentioned the fun win ATM conversation you started up a while back @techspence, along with a shoutout to Mike Lisi / @RedTeamVillage_ and Spencer for the fun we all had with the Kiosk area of RTV.

Kiosks represent an attack surface that is frequently ignored - and, while the frequency of these attacks may be comparatively low, the impact level could be high.

1/🧵

(resources provided in thread)

[MagicSword @magicswordio]

Episode 18 | Kiosk Security https://t.co/3QFS0XNOXu

[MagicSword @magicswordio]

Two detection engineers walk into a detection podcast and talk about… prevention. 🎙️ Detection Dispatch with @alehurtadoxo:

https://t.co/VnO3mv7FVU

[Merill Fernando @merill]

This is going to be fun!! 😁

An Entra Chat with @UgurKocDe, @techspence, @m0bilej0n and @rucam365

If you want to see us all in person get your company to send you to https://t.co/jT18VuqTKE in Jan

[spencer @techspence]

Come to @wpninjasus!!! IT's gonna be an awesome event!

[The Hacker News @TheHackersNews]

🚨 UPDATE: PHP2Shell exploitation confirmed in the wild.

Perplexity researcher Adel Karimi observed successful exploitation on honeypot servers, with attackers executing shell commands to fetch additional payloads.

No second-stage payloads have been recovered so far.

Details: https://t.co/oz42LO1zla

[spencer @techspence]

Offense will always out-strike defense. But that does not mean all hope is lost. Defenders have home field advantage. 💪

[Mike Manrod @CroodSolutions]

@Alph4betSoup Also these robots overlap with our circle of kiosk risk as well.

[Harrison.Wells @L33tH4xcyber]

My GitHub is back!

They didn't even say anything to me it was just back all of a sudden.

[Marcus Hutchins @MalwareTechBlog]

The way frontier labs have restricted access to cyber capabilities makes no sense. If you're considered a "defender" you're not allowed access to the "offensive" versions of the models (the ones that can do development/validation of malware and exploits).

So for example, if you want to build some sample malware to test a detection system, nope.

Or if there's a major crisis due to a critical vulnerability in PHP and you need to rapidly triage fake exploits to see if there are any real ones floating around so you can warn people, nope.

Want to build a remote code exploit to make sure the detection rules you plan on proposing to the clients actually work? Hard nope.

You gotta call your red team friend and wait for them to do your job for you, because "defender" are only allowed to play in the sandbox with the children.

Not an expert, but I think that the ability to triage in-the-wild exploits during a major crisis affecting 40 million systems is possible maybe important.

And then they want to ban abliterated open weight models, which half of the people are only using because frontier labs will only give them access to lobotomized models.

[spencer @techspence]

Vulnerabilities surely will hit a critical mass and maybe we see some balance in the next year or two. Or maybe the end isn’t in sight.

But one thing is true.

New software is getting created faster than ever before.

Vulnerabilities are never going away.

[Mike Manrod @CroodSolutions]

@techspence 💯

[Jose Enrique Hernandez @_josehelps]

Malware is starting to talk to the LLMs that triage it.

@TalosSecurity's Ryan Fetterman (CAIRN) tracked "A3: AI-analysis evasion" across 84 samples: plaintext comments that tell an analyzer to ignore the file, refuse reverse engineering, or claim fake DoD contracts.

[Artem Tamoian @artemtam]

Produce as many fake AI-slop exploits as possible.

Security researchers will waste hours analyzing the code, only to discover it was nonsense all along. This will slow down the entire industry.

- Simple Sabotage Field Manual

[spencer @techspence]

I’ve seen some people insinuate that somehow there will be no more vulnerabilities once the “tsunami” is over. That’s some big pipe dream. There will never be 0 vulnerabilities. There will never be vulnerability-free software.

[Mike Manrod @CroodSolutions]

@kmcnam1 @_winter_wonders This is the best job title ever!!

[sudox @kmcnam1]

New job title

[Rey Bango @reybango]

Was reading a threat analysis report by @K7CyberSecurity and it motivated me to create a video about building an ISO to deliver a payload. Fun exercise leveraging techniques I learned from @_RastaMouse

https://t.co/1PbbusIZWk

[ATT&CK @MITREattack]

This is going to be a packed week for the ATT&CK team.

On Tuesday and Wednesday (10/27-28) join us at ATT&CKcon 7.0! In person registration is closed (and there are no ticket sales at the door) but free virtual registration is still available at https://t.co/DKP2WnDKwc.