dreadl0ck

Tortures computers for fun and profit. Interested in network security monitoring, machine learning, Golang and Rust. Shellscript ninja. Will debug for food.

[dreadl0ck @dreadcode]

Published my Bachelor Thesis: "Implementation and evaluation of secure and scalable anomaly-based network intrusion detection"
along with my network traffic analysis framework: https://t.co/pZBtGFuGIR #golang #IDS #NSM #DeepLearning #ML

[dreadl0ck @dreadcode]

Today, North Korean hackers tried to infect me with malware during a fake job interview.

While feeling honoured to be considered a valuable target, I have to admit I’m slightly disappointed that they didn’t put some more effort to pwn a cybersecurity guy.

Last week I got contacted on LinkedIn by someone claiming to work in the gaming industry (at @Cometh), who offered flexible and highly compensated remote consulting work on my own schedule, and in my area of expertise, cybersecurity.

Red flags were piling up faster than on an average beach in Bali:
No profile picture and Cometh not listed as employer on LinkedIn, meeting set up from a gmail account and not a company mail, interviewer claiming to be french but speaking english with a heavy korean accent, after showing a short video snippet of a middle aged european man pretending to have issues with his audio until we both turn off the camera.

It was honestly hard not to laugh during the interview. But I really wanted their code. And I got it.

After asking a few questions about my work experience, we got to the interesting part: a repo hosted at codeberg and me being asked to share my screen and set it up.

Finally. I ended the call, and got to work.

I’m thrilled to share a full technical breakdown of the state actor malware encountered on our company blog: https://t.co/0MtdUL14nw

It’s a pretty neat multi stage cross platform implant, that triggers when a user opens and trusts the project in VSCode, or runs npm install & co inside it to set it up.

The blog post also contains all IOCs and instructions how to check your machine for infections.

I hope that @Google, @Vercel and @Netlify will respond fast and take down their infra, before more damage is done.
Cause this is certainly still an ongoing campaign.

Can’t wait for my first chinese spy!

[dreadl0ck @dreadcode]

Curios about the impact of this on the Go compiler and the security implications? Read my blogpost :)

https://t.co/gtWrnMqxAO

[Daniel Lockyer @DanielLockyer]

TIL that macOS has a security feature called XProtect, which scans any new binaries you execute

But it also means it slows down edit-compile-run workflows with excessive checking

And the daemon is single threaded, so concurrent binary executions are blocked

good lord

[dreadl0ck @dreadcode]

@kylancodes @fofrAI @replicate Have a similar effect at https://t.co/LoA0w6HzCT but yours definitely wins 😆

[Simone Margaritelli @evilsocket]

Attacking UNIX Systems via CUPS, Part I

https://t.co/T6SqraB5nh

[Craig H. Rowland @CraigHRowland]

I'm glad everyone has discovered memory safe languages after several decades. Now can we start looking at secure package management or are we just going to import memory safe rando libs from ninja876 on Github forever?

[Erik Bernhardsson @bernhardsson]

My dystopian vision of an AI-powered future is that LLMs drives down the cost of generating long text even further, and the only way for readers to keep up is to use LLMs to summarize.

[dreadl0ck @dreadcode]

Guest: “Is that a RAM stick glued to your door?”
Me: “Yes. Old memories.”

[Sebastian @sebastian_paul]

Best security quote I heard this week:
"Do you want to mitigate against an auditor, or against an attacker?"

[dreadl0ck @dreadcode]

Finally, a book for dealing with those rusty locks 🔒 thanks @m_ou_se

[Bellingcat @bellingcat]

Bellingcat and investigative partners @derspiegel and @the_ins_ru have discovered a hitherto secretive group of engineers involved in Russian missile strikes on Ukraine.

These strikes have killed hundreds and left millions without heating or power https://t.co/vF8zQPmW2d

[dreadl0ck @dreadcode]

Awesome 👏 https://t.co/B3xeW21Uq1

[Simone Margaritelli @evilsocket]

You can force any v8/Electron process to execute arbitrary js code (child_process, http, etc) by forcefully enabling and abusing the builtin debug mechanism ... here's VS Code executing Calc, but I suspect any Electron app is susceptible 🔥 it works with SIP enabled on macOS

[Steven Kruyswijk @kruithoph]

@BadgeteamNL thanks for the great #MCH2022 badge - here's my Music Computing Handheld app, to be found in the Hatchery in ESP32 - Games. Happy soloing

[Maltego @MaltegoHQ]

Do you know you can set up a custom Transform server in #Maltego? The #DittoTRX Transform developed by @dreadcode can be used to investigate #IDNHomographAttack and imposter domain on various websites. Learn how to set it up here: https://t.co/niqYfSCjBE

[dreadl0ck @dreadcode]

@MattJamesBoyle @matryer Have you tried turning your program off and on again?

[dreadl0ck @dreadcode]

However, the homoglyph function example is not detected

[dreadl0ck @dreadcode]

Pretty cool that @github warns about the use of bidirectional unicode text in source code! Nice feature