psych

I’m very offensive when it comes to security…

[psych @psychsecurity]

I've just blogged about MFA Phishing using noVNC and setting up the infra in AWS. Shoutout to @mrd0x for this neat technique! https://t.co/WQelWRX2Kd

[Matthew Carrigan @carrigmat]

Complete hardware + software setup for running Deepseek-R1 locally. The actual model, no distillations, and Q8 quantization for full quality. Total cost, $6,000. All download and part links below:

[Rasta Mouse @_RastaMouse]

Never ceases to amaze...

[psych @psychsecurity]

@_RastaMouse Haha what in the actual fuck! 😂

[psych @psychsecurity]

@woolworths what’s going on with your online orders? Way past my delivery window and no updates! On the phone for an hr and no one is pickup up.

[Dirk-jan @_dirkjan]

The recordings of @a41con are available! If you're interested in credential phishing, device code phishing, applying that to phish for PRTs and Windows Hello keys... Give it a watch! 😁 https://t.co/3RnDOQvANY

[Blaine Brown @blizaine]

Infinite seamless mega meme mashup 🤭

Keyframes were used to seamlessly transition between 20 memes w/ audio 🤯

@LumaLabsAI Audio on 🔊

[psych @psychsecurity]

@ustayready @TrustedSec @curi0usJack Congrats!

[Dino A. Dai Zovi @dinodaizovi]

A+ quality hacking:

https://t.co/yqTnImMqNe

[inversecos @inversecos]

APT Emulation Labs: NOW LIVE 🎉

Solve incidents emulating APT29, APT10 and other threat groups.

$45 per month access to ALL labs:
👀 150+ hours of lab content
👀 Disk forensics + ELK logs
👀 Hints, questions and point system
👀 7 days free trial

Labs are created & designed by industry peers:
@ZephrFish @svch0st @ippsec @DebugPrivilege @HuskyHacksMK @inversecos

Each lab comes
with scoping notes, Windows VM with forensic tools, network diagrams, disk forensics, ELK access and was created from our collective experience working in the field.

👇ACCESS THE LABS HERE 👇
https://t.co/raaUSztKtT

[LaurieWired @lauriewired]

Airdrop doesn't use cryptographic salts, and rainbow tables are easily able to de-anonymize users

Nations like China are already taking advantage of this. Here's how it works:

1. Airdrop broadcasts a Bluetooth advertisement
2. Advertisement contains a partial hash of the sender's phone + email address
3. If the hashes in the recipients device match, they authenticate and allow file sharing.

Because they (can't) be salted, the SHA256 hashes of all possible phone numbers for a single nation are easily computable into a rainbow table only a few TB large. Then it's just a matter of looking up the hash to de-anonymize the original sender.

There is currently no way to prevent your phone number and email address from being leaked via Airdrop.

[Adam Chester 🏴‍☠️ @_xpn_]

Whew, what a Christmas! Spent the end of 2023 and the beginning of 2024 in a total mess!

I’ve tried to be open about my experiences with mental health, primarily OCD which has a nice way of spiking when I least expect/want it. But even with all the therapy, an amazingly supportive wife, and an awareness of my minds tricks, things have a horrible way of creeping in when you’re not aware!

Then on top of that you add in the usual unforeseen life stresses, client deadlines, a report due yesterday, festive commitments, all while trying to put on a smile like everything is ok and hoping that you just make it through... and one way or another the downward spiral continues until you hit the bottom.

Ignoring all the warning signs is easily done, even with years of experience.. But struggling to get out of bed, not being able to stomach food, and doubling your medication to just be able to function, all in the space of a few weeks… it just isn’t worth it.

If this post rings true with anyone, therapy is a life saver! It’s one of the best investments I’ve made alongside a gym membership. I can’t imagine how I would cope without some of the techniques I’ve been given over the years.. you don’t want to find yourself in that “hopeless” position without a path to take to get back up again.. trust me 🙃 Unfortunately NHS waiting lists for seeing a therapist are 6+ months, but if you are lucky enough to afford private therapy… go for it, even if you think you don’t need it right now.

I hope that someone out there who’s struggling or noticing the early signs of stress realises that these kinds of mental health issues are unfortunately common. Not many people talk about it in the open… but it happens to us all!

Take care of yourselves h4xx0rz!

[vx-underground @vxunderground]

IHMYGOD itS Log4J 2.0 !! They'll get your Internet Protocol and 0day your Wifi!!!!

[Jason Lang @curi0usJack]

The problem isn't really one of funding, but expectations. Today's CISOs grew up in the "DA by lunch" MSF attack chains of yesteryear and believe that is still how it works with today's mature orgs. Lol that is not the case anymore, hench the need for red R&D and lots of time.

[Matt Johansen @mattjay]

Okta got hacked. Leading to impact for CloudFlare, 1Password, and BeyondTrust.

Here's everything we know about it:

[CrikeyCon @CrikeyCon]

Oh no, droppy just dropped this supercool picture of the con. And this link: https://t.co/RtfPAHO7x1. How clumsy!

[BSidesCanberra @BSidesCbr]

As promised by @rankstar591, here are all the details for the #BSides2023 bPod badge #badgelyfe #bsidescbr

https://t.co/0CyXwe02IS

[psych @psychsecurity]

The WebP 0day https://t.co/zSp3HMfSPm

[Jason Lang @curi0usJack]

Chasing a hacker in your network: movies vs reality.

[David Dowling @David_S_Dowling]

Massive thank you to the @BSidesMelbourne team for organising the weekend