Johannes Ullrich

[Joshua Wright @joswr1ght]

People learn in different ways. I wrote Dynamic Incident Response, but not everyone wants to get cozy with a 666 page PDF. So I made a Gemini Notebook too: ask questions, critique, interact how you want. Free.

❤️👨‍💻

https://t.co/wlp8jKQMHz

[Johannes Ullrich @jullrich]

@Manservant_H @sans_isc Sorry, I am not able to verify if someone was a facilitator for a SANS event.

[Johannes Ullrich @jullrich]

@MarkBaggett I blame AI

[Johannes Ullrich @jullrich]

@joswr1ght On the other hand, it worked also very well in many Linux distributions having updated packages ready within minutes of PHP releasing the patch.

[Johannes Ullrich @jullrich]

I think this was a fail for coordinated disclosure. Some info about the patch leaked early. Last night, a vendor that got a heads-up from PHP released a patch to its customers ahead of the official release :( Coordinated disclosure usually works, but if it doesn't, it fails badly.

[Johannes Ullrich @jullrich]

@manicode I don't think any language is as good as Perl. Rust has a long way to go to catch up to Perl :)

[Johannes Ullrich @jullrich]

@paulgear1 trying to keep it serious, but it is getting harder and harder to talk about these issues with a straight face.

[Johannes Ullrich @jullrich]

Just got my mail-in ballot. I do not take bribes. But if a candidate thinks it is important enough to turn this county/state/country into red/blue/green: I am taking donations to offset the cost of researching the candidate's programs. Is it worth $1 to you to make sure I have the resources necessary to properly evaluate your program? For $10, I may read it twice. Or join my elite research club, schedule a call with me to walk me through your program, for only $1,000. I may also raffle off a dinner with me to a candidate.

[SANS Institute @SANSInstitute]

The threats are evolving. Your skills should too. 🛡️

@SANS_EDU graduate certificates help professionals specialize in high-value areas like Cloud Security, Cyber Defense Operations, and Digital Forensics. Explore your options: https://t.co/0JPU5Tho9d

[Johannes Ullrich @jullrich]

@clubjk not quite ready yet to hand my data over, but may check out to see if it is any better.

[Johannes Ullrich @jullrich]

Hermes Agent: anybody actually getting it to do any work... All I get is stuff like: "No — I haven't executed any commands to get the repo yet. My entire response was just talking about failing instead of actually doing the work."

[SANS Institute @SANSInstitute]

Does your employer offer tuition assistance? 💼

You're likely eligible to use those benefits toward a cybersecurity degree or certificate @SANS_EDU. Learn how: https://t.co/VYC9KM9BDl

[Johannes Ullrich @jullrich]

@JoelEsler you got it all wrong. it is
1 - AI
2 - AI
3 - even more AI
!!!

[SANS Institute @SANSInstitute]

Would you get a Cybersecurity Master's Degree if your boss paid for it?

Put your employee benefits to work with the @SANS_EDU master's program. Earn 9 GIAC certifications while advancing your career: https://t.co/WL6KpwfJY4

[Costin Raiu @craiu]

Heads up, there is a 1-day full MikroTik RCE chain against SSH being used in the wild. Patch was released yesterday, so if you have a MikroTik router with ssh open on the internet, it may already be compromised. Detection guidance and IOCs courtesy of @CERT_Polska_en https://t.co/9RDSNxp3xD

[Johannes Ullrich @jullrich]

I think it is a ��train/find the speaker” issue. There are plenty of people who have interesting topics to talk about, but they don’t think they are able to present. From my experience, local organizations often have a shortage of speakers and default to the once that are easy to book. Would gladly volunteer some time to help out local people to prep for a presentation if that is what it takes to build a larger pool of speakers

[SANS Institute @SANSInstitute]

The Find Evil! winners are Mulder, TRUDI and Camel. All three open source today.

[SANS Institute @SANSInstitute]

No CISO has ever regretted the training. Here's why one still blocks 5 days a year for it. #Cybersecurity

[Johannes Ullrich @jullrich]

@AskAmex : Why do you inject ads into your login confirmation page? The accept/reject buttons are covered up. Security-relevant pages should not be used for ads.

[Johannes Ullrich @jullrich]

@jeffmcjunkin found it. https://t.co/cVSgPm95xm