dreadl0ck

Tortures computers for fun and profit. Interested in network security monitoring, machine learning, Golang and Rust. Shellscript ninja. Will debug for food.

[dreadl0ck @dreadcode]

Published my Bachelor Thesis: "Implementation and evaluation of secure and scalable anomaly-based network intrusion detection"
along with my network traffic analysis framework: https://t.co/pZBtGFuGIR #golang #IDS #NSM #DeepLearning #ML

[dreadl0ck @dreadcode]

Curios about the impact of this on the Go compiler and the security implications? Read my blogpost :)

https://t.co/gtWrnMqxAO

[Daniel Lockyer @DanielLockyer]

TIL that macOS has a security feature called XProtect, which scans any new binaries you execute

But it also means it slows down edit-compile-run workflows with excessive checking

And the daemon is single threaded, so concurrent binary executions are blocked

good lord

[dreadl0ck @dreadcode]

@kylancodes @fofrAI @replicate Have a similar effect at https://t.co/LoA0w6HzCT but yours definitely wins 😆

[Simone Margaritelli @evilsocket]

Attacking UNIX Systems via CUPS, Part I

https://t.co/T6SqraB5nh

[Craig Rowland - Agentless Linux Security @CraigHRowland]

I'm glad everyone has discovered memory safe languages after several decades. Now can we start looking at secure package management or are we just going to import memory safe rando libs from ninja876 on Github forever?

[Erik Bernhardsson @bernhardsson]

My dystopian vision of an AI-powered future is that LLMs drives down the cost of generating long text even further, and the only way for readers to keep up is to use LLMs to summarize.

[dreadl0ck @dreadcode]

Guest: “Is that a RAM stick glued to your door?”
Me: “Yes. Old memories.”

[Sebastian @sebastian_paul]

Best security quote I heard this week:
"Do you want to mitigate against an auditor, or against an attacker?"

[dreadl0ck @dreadcode]

Finally, a book for dealing with those rusty locks 🔒 thanks @m_ou_se

[Bellingcat @bellingcat]

Bellingcat and investigative partners @derspiegel and @the_ins_ru have discovered a hitherto secretive group of engineers involved in Russian missile strikes on Ukraine.

These strikes have killed hundreds and left millions without heating or power https://t.co/vF8zQPmW2d

[dreadl0ck @dreadcode]

Awesome 👏 https://t.co/B3xeW21Uq1

[Simone Margaritelli @evilsocket]

You can force any v8/Electron process to execute arbitrary js code (child_process, http, etc) by forcefully enabling and abusing the builtin debug mechanism ... here's VS Code executing Calc, but I suspect any Electron app is susceptible 🔥 it works with SIP enabled on macOS

[Steven Kruyswijk @kruithoph]

@BadgeteamNL thanks for the great #MCH2022 badge - here's my Music Computing Handheld app, to be found in the Hatchery in ESP32 - Games. Happy soloing

[Maltego @MaltegoHQ]

Do you know you can set up a custom Transform server in #Maltego? The #DittoTRX Transform developed by @dreadcode can be used to investigate #IDNHomographAttack and imposter domain on various websites. Learn how to set it up here: https://t.co/niqYfSCjBE

[dreadl0ck @dreadcode]

@MattJamesBoyle @matryer Have you tried turning your program off and on again?

[dreadl0ck @dreadcode]

However, the homoglyph function example is not detected

[dreadl0ck @dreadcode]

Pretty cool that @github warns about the use of bidirectional unicode text in source code! Nice feature

[Ross Anderson @rossjanderson]

The Trojan Source vulnerability allows supply-chain attacks on software written in C, C++, Go, Java, Javascript, Python and Rust. We're releasing details after a 99-day coordinated disclosure period, and some of these compilers will be patched quickly. See https://t.co/tO4xIU5Ncw

[Brendan Dolan-Gavitt @moyix]

Wow, just realized C is turning 50 next year. Not sure how to tell students that we're learning about security problems caused by a language that's half a century old.

[Nasko Oskov @nasko]

Memory safety in a huge codebase is hard. We've published some work and an update on our work in the Chromium codebase - https://t.co/ZEDl7RFjLS.

[dreadl0ck @dreadcode]

@cynicalsecurity @IcareAerospace @veorq Alice and Bob are now securely divorced.