Johnathan Norman

Security research and engineering lead at @microsoft. on mastodon: and @spoofy.bsky.social not posting here anymore.

[Johnathan Norman @spoofyroot]

still hiring hackers in the UK https://t.co/eZV2c62x7w

[Johnathan Norman @spoofyroot]

@decoder_it @splinter_code you're right the fix didn't land. I will correct the post.

[Johnathan Norman @spoofyroot]

@decoder_it @splinter_code hrm... I reviewed a fix but perhaps they didn't roll it out yet or even pulled it back because it broke something.. give me a bit to dig.

[Johnathan Norman @spoofyroot]

https://t.co/L5MsTGCpJr

[Johnathan Norman @spoofyroot]

We get lots of questions about about admin protection in Windows. So we decided to provide some context and details. Part 2 will be out shortly... https://t.co/3PszJqlQwc

[Zack Bornstein @ZackBornstein]

until the day i die i will never understand how this wasn’t the end of it

[John Scott-Railton @jsrailton]

WILD: actual photo of Musk-hired door knockers being driven around #Michigan.

This group of mostly-black workers were driven in the back of a truck with no seats.

They say they were flown in, given unrealistic goals, and threatened with their lodging being cut off & being forced to pay their own way home if they couldn't meet them.

Some didn't even know which candidate they were working for.

Article by @JakeLahut
https://t.co/yf04EBKcI3

[James Forshaw @tiraniddo]

Put up the slides for my @MSFTBlueHat 2024 presentation on improvements to https://t.co/42E3mF0Bs0 https://t.co/IZshDbQScS You can also grab v1.15 of https://t.co/42E3mF0Bs0 from the PS Gallery which has the new features to generate proxy clients on the fly.

[John Scott-Railton @jsrailton]

NEW: @X is pushing partisan content, most of it supporting Trump & sowing election doubt.

@WSJ reporters created new accounts with interests in things like crafts, then observed what content the accounts got recommended.

Their "for you" feeds showed pro-Trump content at double the rate of pro-Harris content.

By @jackgillum @AlexaCorse & Adrienne Tong
https://t.co/07gpbZlCKA

[Johnathan Norman @spoofyroot]

@kryc_uk Yeah but I get a 3x performance increase by removing the check 🥴

[Alex Ionescu @aionescu]

It’s wonderful to see what @XenoKovah and his collaborators have built for the community. I always recommend OST2 for my new hires and other juniors, or just anyone trying to get started on a new topic. The courses are excellent. It’s an honor to sponsor the Windows Security Path

[Ryan M @Grimdoomer]

Here's a time lapse video showing my 360 hypervisor exploit triggering in ~18.5 minutes. This is a pretty average time for the exploit with about 40% success rate. People asked if it works on winchester and I don't think there's any reason it won't but I don't have one to test on

[Johnathan Norman @spoofyroot]

@Harvesterify I hope so, it is really up to @mamyun

[Johnathan Norman @spoofyroot]

The new account type for services finally landed in WIP. Now when running Windows Protected Print (WPP) the service will run as "Restricted Service" and no longer SYSTEM. There will be a SYSTEM process, but it basically just launches the worker.

[Johnathan Norman @spoofyroot]

This update will land in non-WIP builds (GA) likely in January. Big thanks to @tiraniddo who gave us early feedback on the design... and shoutout to @Grimdoomer who did the prototype. It was really fun working with the Print team.

[Johnathan Norman @spoofyroot]

@tiraniddo @decoder_it @bopin2020 @splinter_code I wont publicly share my view on sudo. Other than to say i'm glad there's a warning about security risk when enabling it. When Admin protection is enabled, certain sudo configurations simply don't work and return an error. But i hope people just dont enable it.

[Johnathan Norman @spoofyroot]

@decoder_it @tiraniddo @bopin2020 @splinter_code This is where things get difficult. We fully expect usability challenges and it will take time to really refine the user experience. We're trying to fix decades of decision making around UAC, it will take some time to get right. But this direction is better than the alternative.

[Johnathan Norman @spoofyroot]

its unfortunate people in Texas have to do this, in Washington we just mail our ballot. Took like 10 minutes , no lines and no problems.

[Joshua Martin @JoshuaRMartin]

It’s the first day of early voting in Texas and it’s PACKED in deep blue HARRIS county!

Houstonians are excited to vote for Kamala Harris & Colin Allred!!!

[Johnathan Norman @spoofyroot]

@decoder_it @tiraniddo @bopin2020 @splinter_code We wouldn't consider it a bypass if a user must click through a security prompt. We reviewed a large (~100?) number of auto elevated com interfaces, pretty sure ICMLua was one. You should get a prompt, if not we missed something.

[Hayden Barnes @unixterminal]

Microsoft has open sourced its new cross-platform virtual machine layer written in Rust: https://t.co/RtHaf3oDx5 From many of the same team who created WSL, including @benhillis.