Andrea P

Security Consultant @semperistech . Independent Security Researcher. Cyclist & Scubadiver. MSRC MVR 2022. "So di non sapere"

[Andrea P @decoder_it]

@unsigned_sh0rt Same here and tbh I don't have that much to blog about yet 🤷‍♂️

[Andrea P @decoder_it]

@LaGrevia E se vi dicessi che io, nato analogico, nell’era dei nativi digitali mi ritrovo ancora a spiegare a ragazzi e adolescenti come funziona Internet?

E non parliamo nemmeno di cybersecurity, privacy e rischi della rete…

Per dire, eh. 🙃

[Andrea P @decoder_it]

Tiny OS from scratch. Console looks like an IBM 3270 running TSO. Divide by zero? ABEND S0C9. READY
😅

[Andrea P @decoder_it]

@ShitSecure This bug reminds me of a “sensitive” web application I found about 20 years ago: authorization enforced entirely on the client side.

if (isAdmin === true) { doDirtyThings(); }

Some things really never change. 😄

[Andrea P @decoder_it]

@stanzaselvaggia Sapere poco, commentare tutto e avere comunque un’opinione su ogni cosa: un talento raro.

[Andrea P @decoder_it]

To prove you are not a robot prove you're a stupid human 😆

[Natalie Silvanovich @natashenka]

In July, Microsoft fixed CVE-2026-50343, a Windows privilege escalation bug reported by Calif and 9 others, dubbed “Dark Elevator”.

But was it really fixed?

Ask @tiraniddo

https://t.co/4YgBY2N2KZ

[Andrea P @decoder_it]

@techspence Hard one! 😅 also every new Windows 11 insider release seems to need another “fix” just to get LocalKDC to start again 🤷‍♂️

[Andrea P @decoder_it]

Finally got LocalKDC working on W11 insider, now let's see... 😅

[Andrea P @decoder_it]

Works also for loopback authentication

[Andrea P @decoder_it]

@_dirkjan That's good news 😅

[Marcos Oviedo @marcosd4h]

Been digging deep into the Windows Endpoint Security Platform (WESP) in Win11 25H2, definitely one of the most fascinating security features Microsoft has built in a while.

The concept is neat: compile rules to decision graphs in user mode, hand them to wesp.sys, and let the kernel evaluate them in-path while telemetry streams asynchronously in the background.

I did an AI-assisted reverse engineering dive into the whole stack (wesp.sys, espclient.dll, and wesp_elam.sys), documented the wire protocols, disposition tables, and the enforcement gate, and built esptool, a research harness with 118 XML rule docs so anyone can test live telemetry and in-kernel blocking.

Repo: https://t.co/ZPYPHfmCP4

Tech doc: https://t.co/P2s4geHEsI

Thanks to @yarden_shafir for putting this on my radar

[Andrea P @decoder_it]

@lastknight @Revolut Resta valido anche il metodo più “arcaico”: davanti anche al minimo dubbio, si alza il telefono, si chiama direttamente l’ente o l’ufficio interessato usando un contatto verificato e si chiede conferma 😅

[Andrea P @decoder_it]

AI may eventually become the new Cold War: everyone keeps building more powerful systems because they can’t afford to let the other side get ahead. Chip manufacturers may become the equivalent of uranium supplier controlling access to the resource that makes the race possible

[Panos Gkatziroulis 🦄 @ipurple]

askWAM - Requests Microsoft Entra access tokens silently through Windows Web Account Manager (WAM) by @_dirkjan

https://t.co/MfgvTu15gf

[BURKOV @burkov]

A new O'Reilly bestseller!

[Andrea P @decoder_it]

@_EthicalChaos_ Let’s see, I’m a bit rusty these days 😅

[Andrea P @decoder_it]

@_EthicalChaos_ 👍 maybe in lpe scenarios for authentication reflection...

[Andrea P @decoder_it]

@merill Agreed on moving toward modern auth, but “modern” doesn’t automatically mean “more secure.” The right approach is migration and secure configuration of all protocols , also of the legacy protocols (yes it is possible) that are still widely used.