Rob Bu

dad, hubby, #infosec, hike proverbial and literal mountains #MISEC

[Rob Bu @mrrobertb]

@I_CAN_COMPUTER I dropped off about 100 random stickers on a table and was suprised after they disappeared after 15 minutes. We love hacker stickers

[rekdt @rekdt]

It’s not officially autumn until you update your password to Fall2026!

[Rob Bu @mrrobertb]

@I_CAN_COMPUTER @GrrCON Sip club coffee at the old Panera on the walk over to linecon

[Rob Bu @mrrobertb]

@d1ngbat_ @SwiftOnSecurity A little outside of my budget

[Rob Bu @mrrobertb]

@elaifresh @JackRhysider Hah, thanks for posting this. I was listening to ep1 and couldn't shake that it was actually Jack. Same cadence of speech. But it makes sense after listening to all of ep1 where the source material explained

[Rob Bu @mrrobertb]

@0xTib3rius Only heard of its vile taste. Never experienced it

[Rob Bu @mrrobertb]

@Visible have a samsung watch 7, LTE service provisioned, can make calls, can receive text, cant send texts, help articles send me in loops, anyway to reprovision the esim on thr watch

[Vaishnavi @_vmlops]

MICROSOFT OPEN-SOURCED THEIR ENTIRE SENTINEL SECURITY TOOLKIT

most teams building on azure figure out threat detection the hard way

trial and error, custom KQL, dashboards built from nothing, playbooks written by hand

nobody told them it was already done

the sentinel github repo has:

▫️ 1000+ pre-built threat detection rules
▫️ hunting queries for active threat investigation
▫️ automated response playbooks
▫️ security workbooks + dashboards
▫️ data connectors for 100s of sources

the hard part was already done

https://t.co/VHbH2pIRRe

[Alex @xaitax]

So Microsoft Copilot has its own App-Bound Encryption now. The standalone Copilot app (mscopilot.exe) is a full Chromium browser based on Edge, ships with its own elevation_service.exe, a dedicated COM interface (IElevatorCopilot), and a separate ABE key scope.

Decrypting the ABE key gives us some cookies (https://t.co/jDTRHwilyP auth, MUID, MSAL session, Cloudflare tokens) and the Microsoft Account token from the token_service database.

Local Storage also holds MSAL.js cached tokens. An ID token, two access tokens (chatai.readwrite for the Copilot API + https://t.co/Zgut26Y35L for Microsoft Graph), and account metadata for the signed-in MSA.
These use MSAL's own browser-bound CryptoKey encryption, not ABE.

Edge 147 also quietly hardened IElevator2 by switching from oleaut32 to a custom proxy/stub but simultaneously registered IElevatorCopilot with oleautomation. Closed one door, opened another.

Next up: decrypting the MSAL tokens? 🤔

[Rob Bu @mrrobertb]

@HackingDave Coat of my time to migrate out of 1password to bitwarden is more than buck a month, so they got me. Still pretty decent price hike...

[EZ @IAMERICAbooted]

Unsolicited reminder: the only admins that should be able to login to your M365 from an unmanaged device are your unnamed cloud only breakglass accounts which are excluded from all CAPs and have FIDO2 hard keys.

[Trond Eirik Haavarstein @xenappblog]

What's the difference between @MSIntune "Wipe", "Fresh Start", "Retire" and "Delete"? Great infographic

[ULA @ulalaunch]

Go Artemis II! The upper stage of the Artemis II rocket is the ICPS -- Interim Cryogenic Propulsion Stage. Built by ULA in collaboration with @BoeingSpace, the ICPS will boost Orion and the astronauts into a high Earth orbit in preparation for its lunar trajectory.

See our rollout photo gallery:
https://t.co/cMQcO2ongV

[Security Onion @securityonion]

Security Onion 2.4.201 now available with Suricata and Zeek Updates!

https://t.co/xiZraWqnWt

[TryHackMe @tryhackme]

As we say goodbye to another Advent of Cyber, we hope you loved saving SOC-mas and outsmarting King Malhare’s beautifully chaotic plans 🐰🎄

A massive thank you to every single one of youwhether you’ve been here for years or this was your very first Advent with us. You showed up, you learned, and you made this one special.

Missed a few days? You’re still in luck.
You can complete challenges until 31 December and still stand a chance to win from the $150,000 prize pool 💥

See you in the labs. 👀 https://t.co/HrCNLSLqfG

[TryHackMe @tryhackme]

Merry Hackmas 🎄

[SANS Institute @SANSInstitute]

🎄 The SANS #HolidayHack Challenge 2025 is here!

Solve festive cyber puzzles, test your skills, and enjoy the most fun you’ll have in a browser this season.

Start your free holiday hacking now ❄️ https://t.co/sxu3vgWOmi

#CTF #HolidayHackChallenge