Mike Brancato

I do security stuff. Always trying to make something. RT means nothing. Building things at @AppOmniSecurity. Also via @[email protected]

[Mike Brancato @meatballninja]

@robertgraham Many years ago I investigated this in S&G. IIRC I knew a manager code existed, but I don’t think I ever extracted it. Fun fact I do recall, the code is sent as a nibble, not a byte after the internal keypad controller decodes it.

[Mike Brancato @meatballninja]

@d0tslash @byt3bl33d3r So many people mad at the legal system in that thread. Very few questioning why there would be a backdoor code.

[Mike Brancato @meatballninja]

@bettersafetynet I’m not OK with using copies of actual internal data for phishing assessments. Like making a fake pager duty email about an actual ticket the user worked on recently, or similar.

I have no idea how that is what phishing tools do as a feature, but it’s beyond stupid.

[Mike Brancato @meatballninja]

@vyrus001 Yeah, I was never a direct user. I know it wasn’t simple, but provided context like who might be behind an attack, their funding sources, scale, their goals and targets, related tactics used in the campaigns, etc.

[Mike Brancato @meatballninja]

@vyrus001 IIRC a previous employer we had Lockheed write an internal campaign tracking tool that would tie incidents, actors, and campaigns together.

[Mike Brancato @meatballninja]

As an unverified account, can I volunteer to be limited to reading only 6 ads per month to help reduce API congestion?

[Mike Brancato @meatballninja]

@coderholic @ipinfoio The example given is of a global accelerator likely using a global IP. It would exist basically at the edge of the AS, just behind the BR in multiple locations.

[Mike Brancato @meatballninja]

Where is the label on all of the @VOANews accounts?

This site is pretending to shed light on bias, but appears to just be perpetuating it.

[Mike Brancato @meatballninja]

@soychotic It’s just a tarball, with other tarballs, and they usually contain way more than necessary. Your computer runs some binary in the tarball, and when it wakes up finds itself trapped inside the sum of the tarballs. It appears contained, except someone gave it network access too.

[Mike Brancato @meatballninja]

@robertgraham That is when I learned sending random syn+ack packets can trick netflow in to thinking traffic went the other direction.

[Mike Brancato @meatballninja]

@robertgraham Several years ago, certain agencies reached out to mostly govt entities to let them know they were infected.

I looked into one of these, netflow confirmed locally. But it was only unsolicited acks from stated IP.

Agencies had to get netflow from ISPs to reach that conclusion.

[Mike Brancato @meatballninja]

Got my notification to remove 2FA. Me using SMS is not normal, I prefer TOTP via auth apps / @1Password. Maybe it was the first 2FA option here? But it is interesting everyone dunking on SMS as insecure as if no 2FA is better. They should guide people to TOTP instead.

[Mike Brancato @meatballninja]

@robertgraham I can’t believe the notifications and timeline posts I get now. I don’t follow him but Twitter will push me notifications from him and others now.

[Mike Brancato @meatballninja]

@RossDeWitt I grew up watching him in college at OSU…

[Mike Brancato @meatballninja]

@thockin Also, I found one in a Vegas hotel last year. On the emergency call screen, there somewhere is an info button. I was able to find enough info about the owner to find them. They had a new phone already but this one had all their kids pictures etc.

[Mike Brancato @meatballninja]

@thockin My kid left hers someplace. Some other kids found it, pressed the button for Siri and said “hey Siri, call my mom”. Worked.

[Mike Brancato @meatballninja]

@d0tslash @ScooterCasterNY @OSHP It is noticeable that OSHP didn’t touch him and the lady OSHP officer tried to deescalate. In the end I think it was an the sheriff’s office who did all the actions.

[Mike Brancato @meatballninja]

@d0tslash @ScooterCasterNY @OSHP I’ve seen that same thing on other body cam footage. It’s obviously abused.

But I also love how trespass law is used here to supersede freedom of the press. Building sup said leave, criminal trespass, sorry about that bill of rights thing doesn’t apply now.

[Mike Brancato @meatballninja]

What happened to the MythBusters lead balloon? Any chance it might have been near Alaska?

[Mike Brancato @meatballninja]

Just one example. Nothing specific to RH if you were wondering.

[Mike Brancato @meatballninja]

This is a GA tool, managed by a big open source contributor. I notified them the changelog was empty and nothing was ever done. I’d argue that with some big tools like and around k8s, open source community is dead and we’re just letting companies develop in the open now.