Enrico M.

product security - appsec - caffeine addicted

[Aurélien Chalot @Defte_]

Really great blogpost about bypassing client isolation on wifi networks (WPA till 2 and public) from Ben Knight https://t.co/yZreoQWj6h

[Enno Rey @Enno_Insinuator]

Uncovering hidden paths in 5G core: Exploiting protocol
tunneling and network boundary bridging
https://t.co/MHjfh0dqne [PDF]

[Johann Rehberger @wunderwuzzi23]

🔥 Microsoft fixed a high severity data exfiltration exploit chain in Copilot that I reported earlier this year.

It was possible for a phishing mail to steal PII via prompt injection, including the contents of entire emails and other documents.

The demonstrated exploit chain consists of techniques that didn't even exist 2 years ago. 🔥

In particular, it involves:

1. Prompt Injection 💉
2. Automatic Tool Invocation (without human in loop) to bring PII into chat context ⚙️
3. ASCII Smuggling 🫣
4. Rendering of benign link + invisible text 👀
5. (Optional) Conditional instructions to only trigger when certain users view the content ☝️

Discussing two demos (stealing sales data and MFA codes), including the videos I had shared with MSRC in February.

@simonw @goodside @llm_sec

https://t.co/G0xpiwYfOZ

[Chris Bakke @ChrisJBakke]

The next time you have imposter syndrome at work, just remember:

[@mikko @mikko]

Andy was the CISO for Maersk Line when they were hit by Notpetya in 2017. He told what really happened to the audience of the t2 conference this May. Video here:
https://t.co/SBY9ZSvjX0

[ʎ3ʞʍoן @lowk3y]

Time to make some hype! #BSidesLjubljana

[0xor0ne @0xor0ne]

Nice blog post by @McuOnEclipse on embedded devices reverse engineering ( IoT monitoring/sensor device)

https://t.co/Ao7iHI1Qev

#iot #embedded #reverseengineering #infosec #hacking

[Security Obscurity @SecObscurity]

@theluemmel @ZephrFish Based on my experience, the most interesting vulnerabilities on Nessus you can find it tagged as INFO <.<

[Enno Rey @Enno_Insinuator]

This is super-interesting research by @merlinchlosta et al.:
Drone Security and the Mysterious Case of DJI’s DroneID
https://t.co/Bq1MMfDLz6 [PDF]

[Offensive OSINT @the_wojciech]

I built a real-time intelligence gathering tool and it's accessible online. Open Source Surveillance has 18 features including social media, cameras, #IoT, #ICS, transportation and more. #osint #intelligence #infosec #privacy

[Enno Rey @Enno_Insinuator]

Network Measurement Methods for Locating and Examining Censorship Devices
https://t.co/whnLlLRVJm [PDF]

[Trond Hjorteland @trondhjort]

TIL: The CIA “The Simple Sabotage Field Manual” from WWII suggested enforcing the bureaucracy at companies that delivered to the enemy as a viable sabotage technique.
https://t.co/oXwNRERaCt

[Matt Johansen @mattjay]

This is the best infosec blog post I've read in years @swagitda_ - https://t.co/Npr10IVOeH

[Soufiane @S0ufi4n3]

Just installed Nmap and ran it... Mind blowing tho.. I'm getting addicted to this shit lol
OpenAI is awesome 😁😁

[raptor @0xdea]

Not fan of "awesome" lists in general, however these maturity models collected by @Eliyahu_Tal_ can turn out to be pretty useful
https://t.co/mg82DcHCZ0

I've developed some maturity models myself in the past, and I found them to be a valuable infosec tool (if used properly).

[Mark Simos @MarkSimos]

What are your top security Antipatterns? (opposite of best practice)
(https://t.co/fuHxuOgpFg)

I have these so far
- 10 patching antipatterns
- "compliant is not secure" @scritches
- "Collection is not detection" for log data
- re-using the same password

what else?

[Enrico M. @ilmila]

@Al3ssiaManka @Corriere Ricordiamolo indici libertà di stampa 2022, Italia 58 posto al mondo assieme al Niger.. https://t.co/hQpdh8C3B0

[Enrico M. @ilmila]

@ACmanville @ring Current status of iot security...@mikko law strikes again..."if it's smart it's vulnerable"

[Enrico M. @ilmila]

@0xdea MS Teams with "take control" functionality acts exactly in that way...A user can access to the clipboard of the other user..

[Steve Weis @sweis]

NSA released its future Quantum Resistant algorithms for National Security systems:
https://t.co/uROeNGWXap

https://t.co/6sbsIcwFtG