MalwareLion

Posts are mostly about infosec / My opinions are my own

[MalwareLion @MalwareLion]

@vxdb Chat history in chatgpt that is called "generate me a password for google mail"

[Colin Robertson @mortgagetruth]

@jack @blocks Doesn't this eventually come full circle?

If we are building systems to replace humans, there will be fewer customers for your business as well.

So strong growth today, sure, but what will fuel strong growth tomorrow if more people are unemployed?

[Florian Roth ⚡️ @cyb3rops]

“The largest supply chain compromise in npm, Inc. history just happened, packages with a total of 2 billion weekly downloads just got turned malicious”

LinkedIn Post
https://t.co/dJ0tlPrSBJ

More info on hacker news
https://t.co/uncwjtFgxT

[Florian Roth ⚡️ @cyb3rops]

I’ve trained many analysts over the years - inside my own teams, in SOCs, CERTs, and various internal security teams. And lately, I’ve been noticing a trend that deeply saddens me.

There’s an increasing number of young professionals who struggle with the grind of our work. They get simple but necessary tasks - tasks that transform indicators, rework detections, or retrieve and process data - but they return flawed results, late and incomplete. Some even let AI do the work without checking if it's correct. And when I ask why, the answer, directly or indirectly, is often the same: "I want to do the exciting stuff."

But the truth is, 97% of what we do in cybersecurity is not exciting. It's slow, repetitive, and requires patience. We grind through logs, extract data from reports, and refine rules. Most of the time, we don’t see the direct impact of our work. A signature written today might detect something crucial in a customer’s system six months from now, and we’ll never even know. But every small piece matters.

What saddens me is not just the impatience, but the lack of care. The unwillingness to put thought and effort into something seemingly simple. The failure to reflect on how to make a task better. This goes against something deeply ingrained in my upbringing - a principle that I believe is also deeply rooted in both German and Japanese culture.

In German, my grandmother would always say: "Mach es gescheit." It’s hard to translate precisely, but it means: Do it properly. Not just complete a task, but do it in a way that is solid, thoughtful, and more than just "good enough." It doesn’t mean perfection - it means putting care into what you do, even if no one else will notice.

The Japanese have a similar philosophy, one that I greatly admire. There is a word, "shokunin" (職人精神), which means more than just "craftsman." It describes someone who dedicates themselves fully to their craft, always refining, always improving. Even in the smallest tasks, a shokunin finds a way to do things better, not because someone told them to, but because they take pride in their work.

I was reminded of this when I thought about my uncle, who was a carpenter. When I was a child, I watched him finish his masterpiece for his final exam - an intricately crafted dresser. After days of sanding, polishing, and checking every tiny detail, he wasn’t done. He took out a small, hand-carved wooden rose, which he had made separately, and carefully placed it on the dresser’s ledge.

It wasn’t required. No one had told him to add that ornament. But he did it because he cared. Because he wanted his work to be more than just acceptable.

And this is what I want to see in young professionals today. It’s not about making flashy things, or chasing after excitement - it’s about taking pride in your craft, even in the smallest details. Because in the end, that’s what makes a difference.

So my advice is this: Whatever you do, do it gescheit. Do it like a shokunin. Put care into your work, even if no one else will see it. That’s how you grow. That’s how you build trust. And in the long run, that’s what will set you apart.

[ゆのれい @Yunolay]

OffSec in the train #OffSec #OSCE3 #OSEE

[MalwareLion @MalwareLion]

If you also get panic cause youre emails are gone - thats the reason

[Microsoft 365 Status @MSFT365Status]

We're investigating an issue in which some users' email messages may be incorrectly flagged as malware and quarantined. More info can be found in the admin center under EX873252.

[MalwareLion @MalwareLion]

Update for azure and local assets

[MalwareLion @MalwareLion]

Crowdstrike BSOD Mitigation
Bitlocker recovery key required

[MalwareLion @MalwareLion]

@jordantwittt @MJHallenbeck Still better then QRader 🤣

[vx-underground @vxunderground]

When a Lockbit affiliate tries to log into the Lockbit panel this is what they see

[MalwareLion @MalwareLion]

@SwiftOnSecurity Microsoft Frontpage - best school memory

[Ivan at Wallarm / API security solution @d0znpp]

That was fun. I bypassed a @OpenAI ChatGPT /mnt/data restriction via a symlink, downloaded envs, Jupyter kernels' keys, and some source code from there. Reported via @Bugcrowd and got not applicable! Now this issue is fixed (in like an hours after my report).. Is it how it should be? Asking for the community here. Screenshots attached.

[MalwareLion @MalwareLion]

@citrix Can you please publish detection details if there are any?

[MalwareLion @MalwareLion]

Any known exploitation / detection vectors for CVE-2023-3519 (Citrix RCE) known yet? #citrix #CVE-2023-3519

[Volexity @Volexity]

.@Volexity discovers zero-day exploit impacting all current versions of Atlassian Confluence Server and Data Center. Attackers deploy in-memory Java implant to evade detection. Read more in our latest blog post: https://t.co/aCSwnSUfj8 #DFIR #ThreatIntel #InfoSec

[MalwareLion @MalwareLion]

@golem Was ist daraus eigentlich geworden? Die Seite von expanscape ist mittlerweile offline.

[MalwareLion @MalwareLion]

@SoumyadeepBas12 Stupid me, "prefere 32 bit" was the issue. Thanks for the support @SoumyadeepBas12

[MalwareLion @MalwareLion]

Also i dont see many WAF bypass patterns anymore, only the standard stuff from the beginning.

[MalwareLion @MalwareLion]

Am i the only one that only sees the normal and the WAF bypass patterns, but not the localhost bypass in current scanning activities? #blueteam #log4j #Log4Shell