Mikail Tunç

I do security things

[Mikail Tunç @emtunc]

Today I am open-sourcing SlackPirate, a tool I developed over the last couple weeks. It's designed to run under a given Workspace token and enumerate + extract sensitive/interesting/confidential data for easy offline viewing - https://t.co/YGRAskePsn

[Mikail Tunç @emtunc]

@habazzi Let me know if you'd like any pro-bono cyber security advice/consultancy. My DMs are open.

[Mikail Tunç @emtunc]

@MishaalRahman ah that makes sense - should have checked the page source! Thanks ☺️

[Mikail Tunç @emtunc]

@MishaalRahman you or someone you know might have a clue what's going on here - I share links from Chrome all the time but this is the first time the sharing link (ft dot com) is different from the actual URL of the page. Link to the Ars article in pic:
https://t.co/YogFyNMcJf

[Mikail Tunç @emtunc]

@NahamSec @TomNomNom question for y'all - what bug bounty platform are you finding most security-researcher friendly these days? I know a lot of it comes down to the program but the platform as a whole, triage team, etc make a big impact too.

[Mikail Tunç @emtunc]

@MalwareJake Wait until you check out Alfred. It's even snappier and more flexible in terms of config and what "things" are searched and indexed.

[Mikail Tunç @emtunc]

@mattjay I wrote some thoughts on the topic here https://t.co/bMVGhkVpgI

[Mikail Tunç @emtunc]

@AlecMuffett This "test" uses FaceTec behind the scenes. I have no doubt FaceTec use the imgs & biometrics to train their algs. Also, your phone will immediately start uploading images to their (FaceTec) servers *as soon as* you've given camera permissions before any scans take place!

[Mikail Tunç @emtunc]

@BSidesLondon

[Mikail Tunç @emtunc]

@peterfox One reason is to determine authentication policies for the user as different groups of users may have diff policies assigned to them. e.g., userA belongs to a group that is enabled for passwordless logons so a password field for that group isn’t appropriate

[Mikail Tunç @emtunc]

@troyhunt Didn’t the Silk Road guy end up getting caught because he was logged in to Skype over Tor?

[Mikail Tunç @emtunc]

@Burp_Suite I think 2023.1.2 breaks WebAuthn/security keys in Chromium. They work again for me when I roll back to .1

You can test on https://t.co/1VMOwSGGYl to see if it returns an error or not.

[Mikail Tunç @emtunc]

@quentynblog It's to line up with the seasons 🤣

[Mikail Tunç @emtunc]

@CircleCI When will audit logs be programmatically available? Q1? Q2?

[Mikail Tunç @emtunc]

@CircleCI I see the audit log docs have been updated which is an improvement https://t.co/EGNHuVFLTv

Are there plans to allow programmatic access to the logs so we can send them to a SIEM?

[Clint Gibler @clintgibler]

🔬 Open Sourcing Chronicle Detection Rules

A collection of detection rules for Google’s cloud-native SIEM, Chronicle

➡️GitHub, Okta, Google Workspace, Slack

AWS, Kubernetes, others coming soon

Code: https://t.co/ejof1pQ87O

By @emtunc

https://t.co/7mMDyxKuuc

[Mikail Tunç @emtunc]

@ejcx_ @IanColdwater Are deleted vaults truly deleted? I moved away from LastPass a couple years ago.

[Mikail Tunç @emtunc]

@brianwhelton If you're into the home automation space or think you might be in the future then it's probably worth checking which have the best integration with home automation platforms like Home Assistant, etc

[Mikail Tunç @emtunc]

@EEHelpdesk @EE hey team, what can we do about these spoofed spam calls?