Logan

Scotch enthusiast and mediocre powerlifter. I also break computers sometimes.

Obligatory "tweets don't represent views of my employer, ever" disclaimer.

[Devon Kerr @_devonkerr_]

I opened a role for a manager reporting to me, focused on detection engineering and threat hunting. Before I post the link, here are the inflexible criteria:
- US-based
- detection engineering expertise in data-constrained environments
- leadership of high-performing teams

[Weston Walker @westonlwalker]

You can detect Copy Fail exploitation with the following auditd rules:

-a always,exit -F arch=b64 -S bind -F a2=88 -F key=alg_bind
-a always,exit -F arch=b64 -S setsockopt -F a1=279 -F key=alg_setsockopt

The exploit binds to this saddr once for each 4 bytes of the shellcode. So, if you see like 30-40 of these, it's probably a bad guy.

#DetectionEngineering

[Ryan Dowd @_rdowd]

Found a macOS TOCTOU bug while reviewing Apple EDR integrations at @HuntressLabs.
A non-admin user can delete TCC-protected content by hitting the right timing window. Came up unexpectedly during the review, which made it a fun one.

[Logan @maclarel_]

@jasonsaayman @github @martinwoodward possibly something you can help with?

[CIX 🦾 @cixliv]

Using a mocap suit to kick yourself in the balls with a robot is a great metaphor to close out 2025.

[Florian Roth ⚡️ @cyb3rops]

We’ve been digging through the #React RCE mess for two days now, trying to get at least some visibility into what’s going on out there. None of this is easy to detect, and most signals vanish in memory before you can even look at them.

My teammate @_swachchhanda_ put together a pair of #Sigma rules that cover the one thing that reliably shows up when someone actually executes code on a Node.js server -> child processes. One rule for Linux, one for Windows. It’s not a silver bullet, just one of the few angles that makes sense right now.

We pushed all our #YARA and #Sigma signatures for the React RCE cases as well, and contributed the Sigma rules upstream:
https://t.co/37MnloL5oV

This whole situation shows how much attack surface lives in places many of us didn’t think about before. I expect we’ll see more of this class of issues now that people realize what’s possible.

[Bug Bounty Village @BugBountyDEFCON]

Don't miss "Hunters and Gatherers: The Realities of Bug Bounty Life" by Logan MacLaren (@maclarel_), Jeffrey Guerra (@s2jeff_gh), Johnathan Kuskos, Katie Noble, Sam Erb (@erbbysam)! 📅 Saturday, Aug 10 ⏰ 11:30 AM 📍 Creator Stage 4 #BugBounty #DEFCON

[Bug Bounty Village @BugBountyDEFCON]

Exciting news! The Bug Bounty Village website is live! 🚀🌐 Join us at @defcon for everything bug bounty. Explore our speakers, presentations, sponsors, events, and more. Visit https://t.co/TfCIjoMqGB #BugBountyVillage #DEFCON #CyberSecurity #BugBounty #HackerCommunity

[ᴅᴀɴɪᴇʟ ᴍɪᴇssʟᴇʀ 🛡️ @DanielMiessler]

A lot of the AI stuff Google showed was cool. But I find myself unable to care.

- Their products are far harder to use
- They have a “throw it at the wall” feel
- If I like it they’ll probably cancel it

They’ve simply lost my trust.

[Logan @maclarel_]

@BugBountyDEFCON @defcon Tight timeline, but hoping to submit!

[Aaron White (Appy.ai) @aaronwhite]

Is authing the Rabbit R1 against any of your accounts actually secure? I'm not so sure

[Man Yue Mo @mmolgtm]

In this post I'll use CVE-2023-6241, a vulnerability in the Arm Mali GPU that I reported last November to gain arbitrary kernel code execution from an untrusted app on a Pixel 8 with MTE enabled. https://t.co/Flsas2jJtv

[Nagli @galnagli]

The team at @OpenAI just fixed a critical account takeover vulnerability I reported few hours ago affecting #ChatGPT.

It was possible to takeover someone's account, view their chat history, and access their billing information without them ever realizing it.

Breakdown below 👇

[Mick Gordon @Mick_Gordon]

Marty Stratton, @idSoftware Studio Director, lied about @DOOM Eternal's OST events in a Reddit post that used disinformation to blame me entirely for its failure

Later, he offered me a six-figure sum to never speak about it

The truth is more important.
https://t.co/zSNo2QG1mI

[Logan @maclarel_]

@krisnova Even my hot garbage code has not managed to cripple GitHub yet. You'll do great :)

[Jill Moné-Corallo @thejillboss]

Are you attending @ekoparty ? Go stop by the @GitHubSecurity booth and say hello to @s2jeff_gh from our Bounty Team.

[GitHub Security @GitHubSecurity]

Check out the latest researcher interview in GitHub's Bug Bounty Researcher Spotlight series https://t.co/QoMaFQCXVI

[Logan @maclarel_]

@thejillboss @MakeItHackin @defcon @thedarktangent @jaysonstreet @deviantollam @marcwrogers @AlexChaveriat xD

[GitHub @github]

Did you know that GitHub doesn’t just encrypt data at rest but also encrypts specific database columns? Read about our column encryption strategy and our decision to adopt the #Rails column encryption standard. https://t.co/pxlTTxvf13