Joe Stewart

Principal Security Engineer @ Amazon. My tweets are my own - RTs != endorsement.

[Joe Stewart @joestewart71]

In this article I describe a potential attack against many Webauthn (i.e. passkeys or hardware security keys) implementations, that I'm calling an Authentication Method Redaction (AMR) attack.
https://t.co/Yg8WyC49zv
#Passkeys #Webauthn #Authentication #MFA #EvilGinx

[eSentire @eSentire]

APT31 infiltrated the email comms of top UK and US political leaders 🤯

@JoeStewart71, our Principal Security Researcher, discusses how he uses reverse engineering to trace a hack back to the threat actor(s) on the Click Here podcast.

Listen now ⬇️ https://t.co/wxHCbKWuUq

[Joe Stewart @joestewart71]

Our Threat Response Unit (TRU) uncovered the handles of operators behind the BatLoader & FakeBat malware-as-a-service crime groups! TRU also tracked the threat actors’ online activities, going back to 2017 for FakeBat and 2020 for BatLoader. https://t.co/gWp9yWMXdg

[Joe Stewart @joestewart71]

Yes, let me just reconfigure my entire network because iRobot can't devise a better protocol to sync the device with the app.

[PandaRE 🐼 🇺🇦 @PandaRE__]

Check out the #LockBit case we were investigating, where MSP was targeted using RMM tools

https://t.co/oV4qxE15pY

@esthreat

[Joe Stewart @joestewart71]

@sherrod_im I think I’ve literally told all my bosses that over the years. If you can shield me from the corporate BS and I have something interesting to work on, I don’t need any other motivation (well a paycheck is nice too). I’ll work on the problem non-stop.

[Briain Ó hEoghanáin (Brian Honan) #BLM He/Him @BrianHonan]

Hey @arm are you serious about this ridiculous move?

This is a valid resource to the greater security community and your actions create more harm than good

@Fox0x01 is an amazing researcher and her work needs as much support as possible to secure you and your customers

[PandaRE 🐼 🇺🇦 @PandaRE__]

@SophosXOps You guys are a month late, welcome to the campaign I named, and no credits were given 🥲
https://t.co/nhkNOWb03B
https://t.co/xQYSdvY59h

[Joe Stewart @joestewart71]

https://t.co/Rntib5tdty

[Katie Nickels @likethecoins]

If you know someone who wants to get into cybersecurity or threat intelligence, please share this event with them! KC7 is a great way to get hands-on experience in a supportive environment.

[eSentire Threat Intel @esthreat]

TRU is now tracking over 500,000 #Gootloader landing pages infecting Internet searchers. To protect your devices, you can download and block the list of URLs we are sharing on GitHub: https://t.co/dlx3I01cvw #cybersecurity #threatintelligence

[Joe Stewart @joestewart71]

@artem_i_baranov @AnFam17 @xurtio We can believe it. Dimitri certainly provided no evidence to back up his assertion. Maybe it says something about Dimitri and his motivations. Either way it was an interesting sidenote that someone made that claim, I'm sure there's a backstory that we may never know.

[Joe Stewart @joestewart71]

@artem_i_baranov @AnFam17 @xurtio We're not saying that he is. We're just pointing out that someone else made that assertion.

[eSentire Threat Intel @esthreat]

#gootloader unloaded
https://t.co/xRZ6YpPJGf

[eSentire @eSentire]

This just in!

Our Threat Response Unit unveiled their report "Unmasking VENOM SPIDER" today at @blackhatevents showcasing their findings about the hacker responsible for the Golden Chickens #malware.

Read the full press release to learn more: https://t.co/i6zhWM7KlG

[Joe Stewart @joestewart71]

@Joseph_Marks_ War in Ukraine and the corresponding sanctions against Russia will likely escalate the frequency and damage of these attacks as both existing and newly-formed Russia-aligned cyber threat groups either volunteer or are conscripted to attack Western interests.

[Joe Stewart @joestewart71]

@sankgreall Maybe?

[Joe Stewart @joestewart71]

Time for #InfoSecOASIS security conference - least distance I've ever traveled to attend a con https://t.co/1Wds8JGFyj

[Joe Stewart @joestewart71]

Did a little ransomware reverse-engineering for this article. Sometimes I feel like I'm doing QA for the amateur malware authors out there. https://t.co/HjCSNTz1oX

[Joe Stewart @joestewart71]

After a two-year break I've pulled out the sledgehammer and broken my debuggers out of the basement floor. Now available for malware incident consulting or RCE training. Latest work on behalf of @Armor: https://t.co/VFVIMVTTRN https://t.co/S8aZzdAoI0 https://t.co/dB9VjZAVvD