Jeff Stice-Hall

CEO/Principal Consultant - Architecture, Security for Digital Maelstrom. @[email protected] @digitalchckn.bsky.social

[Jeff Stice-Hall @digitalchckn]

I've left for bluer skies. To all the awesome tech folks I've met here, I hope you will too. Be done with this hideous place.

[Jeff Stice-Hall @digitalchckn]

@EricaZelic @NathanMcNulty @fabian_bader @MySnozzberries @merill @JefTek @Ox4d5a @egre55 @DrAzureAD @reprise_99 @kfosaaen Take that as a sign you’re going in the right direction.

[Jeff Stice-Hall @digitalchckn]

@EricaZelic Maester is the bees knees

[Jeff Stice-Hall @digitalchckn]

@EricaZelic Never forget to PIM 🤪

[CISA Cyber @CISACyber]

🚨We’re seeing reports of a large-scale #spearphishing campaign targeting multiple sectors, including government and IT. A foreign threat actor is sending phishing emails with malicious RDP files to gain network access. Take proactive measures. More info: https://t.co/V9t7sZy5Ep

[Jeff Stice-Hall @digitalchckn]

@UK_Daniel_Card I really do love Ubi’s attention to the config UI. It’s not perfect, but it’s so much more usable than many competitors.

[Jeff Stice-Hall @digitalchckn]

@EricaZelic

[Jeff Stice-Hall @digitalchckn]

@bettersafetynet

[Jeff Stice-Hall @digitalchckn]

Stellar thread by @EricaZelic. Hopefully useful for others

[IAM!ERICA @EricaZelic]

I've had a couple people ask me for some quick tips about responding to an Adversary-in-the-Middle (AITM) successful phish.

Let's make a thread!

PS: Put your pitchforks away. This is to help the orgs that don't have dedicated security pros on staff. Perfectionists UNwelcome!

[Jeff Stice-Hall @digitalchckn]

@bettersafetynet See, I’m at a hard no there. You want help, you MUST be able to carry the minimum over the line. Every single time I’ve done more; I’ve DEEPLY regretted it later when all they wanted was a scapegoat, patsy, etc.

[Joshua Bloch @joshbloch]

My ballot has been counted. Has yours? Our forefathers fought and died to preserve this right, an we owe it to them to exercise it so that future generations can vote too.

[Jeff Stice-Hall @digitalchckn]

@JenMsft @UK_Daniel_Card

[Jeremy Kirk @Jeremy_Kirk]

Microsoft has been running massive deception campaigns that flood new phishing sites with bogus credentials for bogus companies on MS tenants. When attackers log in, they deliver a torrent of fresh threat intelligence that can be used to defend: #infosec https://t.co/hFqljCGndq

[Jeff Stice-Hall @digitalchckn]

@rekdt #truth

[Hayden Barnes @unixterminal]

Microsoft has open sourced its new cross-platform virtual machine layer written in Rust: https://t.co/RtHaf3oDx5 From many of the same team who created WSL, including @benhillis.

[Senator Chris Larson @SenChrisLarson]

An anonymous group has sent thousands of text messages to young voters in WI with misleading claims about college students' eligibility to vote.

Let me be clear - college students CAN vote in Wisconsin so long as they do not also vote in another state. Pass it on!

[Mick Douglas 🇺🇦🌻 @bettersafetynet]

The way to interpret things like this is as follows:

LLMs neither "understand" (at least as a human would) your prompt, nor the output they generate.

They're simply (very convincing) pattern detection and response engines.

Keep that in mind and you'll do better than most w/ AI

[Jeff Stice-Hall @digitalchckn]

@bettersafetynet It’s the lead exposure.

[ᴅᴀɴɪᴇʟ ᴍɪᴇssʟᴇʀ 🛡️ @DanielMiessler]

Doing pentests on orgs with no security is like doing full genome analysis on morbidly obese people.

You're wasting valuable time and money by not jumping directly to diet and exercise.

The pentest industry thrives off the false belief that the problems are hard to find.