Jake Williams

Breaker of software | VP R&D @hunterstrategy | CTI/DFIR | @ians_security faculty | Bookings: jake at malwarejake dot com | GSE #150 | He/him

[Jake Williams @MalwareJake]

Let's not mince words:
* If you don't support trans people, you're a bad human
* If you have to add caveats to your support (e.g. "as long as my kids don't see"), you're one of the worst kinds of human
* Trans deserve your *unconditional* support for their humanity

[Kate Brew @securitybrew]

My top 5 men IMHO in cybersecurity who support and mentor women: @RayRedacted @MalwareJake @robertgraham @TheOnlyMike_E @HackingDave Thoughts or post your own list 🙂

[Jake Williams @MalwareJake]

@PrincessNyinah Yes, because they have telemetry.

[Jake Williams @MalwareJake]

Dear app developers,
I have never had the desire to review an app. Prompting me to leave a review doe not make me want to do it any more. Making me click multiple times to dismiss your "nudge" and get back to using the app just makes me want to uninstall it.
Sincerely,
Every smartphone user ever

[Jake Williams @MalwareJake]

This is absolutely amazing. This non-profit printed out the Epstein files (at least those released to date) and made a reading room that they're bringing to DC.

Totals 3437 printed and bound volumes. I donated to keep this very important project going.
https://t.co/gIn9HISzSt

[Jake Williams @MalwareJake]

@MikeTalonNYC Mine will have flames so it looks like I'm going fast.

[Jake Williams @MalwareJake]

I am officially old :(

[Justin Scarpaci @scar_sec]

@techspence @MalwareJake did a talk 10 years ago about similar priv esc on Linux using cron, scripts with weak permissions, etc. Always useful and often forgot about. I still go back to it every once in a while https://t.co/XWUhGW4gtj

[Jake Williams @MalwareJake]

ZOMG after I wrote this about another app while on hold with a customer service rep, I got off the call and Google asked me to review the *phone app* - an application that I cannot uninstall - on a Pixel, their own freaking hardware.

The Jetsons promised me robots and flying cars, not this...

[Jake Williams @MalwareJake]

Dear app developers,
I have never had the desire to review an app. Prompting me to leave a review doe not make me want to do it any more. Making me click multiple times to dismiss your "nudge" and get back to using the app just makes me want to uninstall it.
Sincerely,
Every smartphone user ever

[Jake Williams @MalwareJake]

@scar_sec @techspence Goodness, it really has been that long ago.

[Jake Williams @MalwareJake]

Woof. Insider threat anyone?

[Pankaj @the2ndfloorguy]

ai layoffs are getting out of hands so I built “I GOT FIRED” button 🚨

one click, and it makes entire company codebase public, pushes .env secrets to public repo, drops staging db and finally notifies my lawyer 🙂

I hope I never need it but it’s ready 👍🏻

[Georgia Weidman @georgiaweidman]

I wrote this in response to a reply, but wanted to share it more generally. Many years ago, when I was starting in security, I was involved in a situation with a podcast where I was being mistreated in a very gendered way. Literally, the man who had done the same thing faced zero consequences, whereas I was banned from the premises and no longer allowed to work on the show. @strandjs was the only person involved who stood up for me, and even pointed out the gendered discrimination of it all. That meant a lot to me.

[Mick Douglas 🇺🇦🌻 @bettersafetynet]

Hey infosec folks, if you don't mind... can you give this a read?

I still have mad respect for @shenetworks
I still have mad respect for @BHinfoSecurity

Two things can both be true.

I'd like to share some info about my departure from BHIS
🧵

[Snakesan @Snakesan]

Yea, I'm less willing to assume someone was trying to hurt anyone, more the ball was dropped somewhere and legal needed a cop out.

People were likely harmed due to bureaucratic nonsense and unfulfilled paperwork adjustments. Not a good look for anyone, worthy of a reputational hit when it happens.

Which is why testimony like this is needed. Getting folks to stop assuming bad intentions, like myself, is going to require this kind of input.

[Jake Williams @MalwareJake]

I've seen some of the things behind the scenes that John and BHIS have done for employees over the years.

FAR above and beyond most firms even multiple times their size. I know several employees John bent over backwards to accommodate who would have been released anywhere else.

[strandjs - [email protected] @strandjs]

There has been a lot of talk about BHIS and our maternity and employment policies.

Please check out the following site for more details.

https://t.co/guIv8SkZV5

Thanks!

[Jake Williams @MalwareJake]

I laughed so hard at this that I snorted more than once.
https://t.co/2ckhok5z62

[Jake Williams @MalwareJake]

Malicious compliance.

[Derek Devicemanager @IT_unhinged]

A marketing director discovered that P1 Critical tickets have a 15-minute response SLA.

He started logging all his routine tickets as P1.

Yesterday he submitted a P1 because his wireless keyboard needed new batteries.

According to our enterprise SLA, P1 incidents require an immediate, continuous all-hands bridge call until resolution.

He submitted the ticket at 11 PM.

I initiated the emergency bridge.

Our automated system dialed his cell phone, his desk phone, and his emergency contact.

It woke up his wife.

He joined the call in a panic, asking what was on fire.

I told him we were assembled to resolve his critical keyboard outage.

I asked him to describe the battery compartment.

He hung up.

Our SLA policy states that if the user disconnects from a P1 bridge, we must call them back immediately.

I called him back.

He asked me to downgrade the ticket.

I told him P1s can only be downgraded after a post-incident root cause analysis.

He buys his own batteries now.

[Jake Williams @MalwareJake]

Georgia: where they know how to spell Walmart, but not Saturday...

[Jake Williams @MalwareJake]

@CapitalOne called to "verify my information" and then got belligerent when I wouldn't. I asked for a publicly verifiable phone number I could call, instead they gave me an 800 number not on any Capital One website. But somehow *this* is on Capital One's website. Please make it make sense...

[HunterStrategy 🇺🇦 @HunterStrategy]

Tired of phishing? Not getting results with brute force?

Just exploit a mid-tier app role, add a federated domain, forge a SAML token, and you're a Global Admin.

This is the Entra ID attack path that should be keeping security teams up at night.

Full breakdown on the Hunter Strategy blog: https://t.co/N0qyngu3Lp

#EntraID #IdentitySecurity #CyberSecurity #InfoSec

[Jake Williams @MalwareJake]

@rnelson0 @c7five @SANSInstitute Amen.

[Jake Williams @MalwareJake]

Sad to see an org I was so involved with for so many years taking nearly $500k in blood money from ICE. Seriously disappointed with @SANSInstitute today.

I get that the economy is bad and sales are hurting. But taking money from ICE is *a choice*.
https://t.co/6qHotBZWC5

[Jake Williams @MalwareJake]

@c7five @SANSInstitute There's a world of difference between "picking a fight" by refusing registration from ICE and pursuing the award of a sole source contract.