Steve Werby

Security - cyber. Into 👨‍👩‍👦🏃📚🍺🏈🏫🏋️. Manages @todayininfosec (news/events from today in years past).

[Steve Werby @stevewerby]

Problem: Employee tapes passwords to desk.
Compliance: Stop it!
Engineer: Implement OTP instead!
Risk Analyst: Move it to your wallet.

[Steve Werby @stevewerby]

@robertgraham When I was about 7 my mom sent me to the grocery store with cash and a list of about 5 items to buy. I rode my bike by myself 0.6 miles and made it home with 5 items (3 of which were the right items) and change.

[Steve Werby @stevewerby]

Happy 40th birthday to the hacker e-zine, Phrack! 🥳

Though it has been published infrequently the last two decades, it's still around - the 72nd issue was published in August.

[Steve Werby @stevewerby]

It's the 30th anniversary of Hobbit's release of netcat.

Have any stories about netcat or later versions it spawned (using the same name, ncat, nc, etc.)? Cool/weird/interesting things you've done with it or its spawn - or that you've seen? If so please share.

[Today In Infosec @todayininfosec]

1995: The networking utility netcat was first released by Hobbit as netcat 1.0.

[Today In Infosec @todayininfosec]

1995: Mudge published "How to Write Buffer Overflows", one of the first papers about buffer overflow exploitation. Afterwards, Mudge sent a copy to Aleph One, who later wrote "Smashing the Stack For Fun and Profit" in 1996. Seminal security paper to seminal security paper.

[Today In Infosec @todayininfosec]

1986: "The Hacker Manifesto" was published by The Mentor (Loyd Blankenship) in issue 7 of the hacker zine Phrack. It was originally titled "The Conscience of a Hacker".

Read it.
Reread it.
Contemplate it.
Share it.

Excerpts below.

[Today In Infosec @todayininfosec]

1995: The movie Hackers was released. Yes, 30 years ago today. 🤯

It grossed just $7 million at the box office against a budget of $20 million. Ouch. A box office failure, but today it's a cult classic.

Crash Override.
Acid Burn.
Rollerblades.
Floppy disks.

Hack the Gibson!!!

[Steve Werby @stevewerby]

The cloud is just someone else's computer...which can bring down thousands of companies' services.

[Steve Werby @stevewerby]

@HackingLZ So in SoSafe's case the human simulations were 19% more effective.

(0.27*0.60)/(0.21*0.65)=1.187

If genuine, it's possible the AI phishing attacks CrowdStrike based its stats on used before AI models, better prompts, better templates, the methodology was different, etc.

2/2

[Steve Werby @stevewerby]

@HackingLZ No clue, but that's quite a jump from SoSafe's 2023 findings from 1,493 simulated phishing attacks, half human-generated, half AI-generated via ChatGPT-3.5. 21% click rate and 65% PI entry rate for the AI tests vs. 27% and 60% for human tests.

https://t.co/IsF5h4wPFq

1/2

[xssdoctor @xssdoctor]

I just found the coolest csp bypass ever! did you know that a valid pdf can ALSO be valid javascript? (details below)

[Florian Roth ⚡️ @cyb3rops]

oh, boy ... CVE-2025-33073 SMB Client Elevation of Privs is wild
https://t.co/piQIg0lDV7

[Today In Infosec @todayininfosec]

1986: Ferris Bueller's Day Off was released.

✅ Remotely hacked school's computer

✅ Socially engineered school principal

✅ Socially engineered restaurant staff

✅ Couldn't roll back analog odometer

🤔 The moral? One 1337 hacker can't do it all. 😂

[MG @_MG_]

Every time I travel, I let people charge their devices. Totally harmless.

They never know who I am or what I normally do with USB cables, but maybe one day… 😂

This lady’s phone died a few min into a 5hr flight. I just wanted her to enjoy her time.

[Today In Infosec @todayininfosec]

1993: The first DEF CON hacker conference was held at the Sands Hotel & Casino in Las Vegas. Initially planned by Jeff Moss as a farewell party for a hacker friend, about 100 people attended. It has since grown to become a 4-day conference with as many as 30,000+ attendees.

[Today In Infosec @todayininfosec]

1977: Hacker space epic "Star Wars" was released to little fanfare, though it has since become a cult classic. It's the tale of the droid R2-D2's hacking of the Death Star computer systems after his inept friends foolishly dove into a trash compactor.

[Steve Werby @stevewerby]

The phrase "a crisis of competence" is thought-provoking. Inability to focus, rapid context switching, lack of critical thinking, accepting info that's presented, measurements and incentives not matching desired outcomes, etc. Lots of reasons for incidents like this.

[Jeremiroquai @Jerematic79]

My oncologist tried to stop my chemotherapy* treatment last week because of a one-page synopsis he had read regarding my recent MRI, which mentioned that one of my brain tumors had progressed.

It turns out he had never actually looked at the MRI itself; and the specialist who wrote the synopsis had not actually compared the new images to my previous MRI from 2024.

I was skeptical, as my symptoms had not progressed; so I asked my oncologist to show me a comparison of the two most recent MRIs, to demonstrate the growth. So, he brought them up on his screen and showed me a clear difference between image on the left and one on the right.

"But the one on the left is the 2017 MRI," I said. "We both know the tumor has grown since then."

The doctor was surprised, and said, "You're right. I'm not sure why the 2024 MRI isn't showing up."

Anyway, we had to go to a different room and use a different computer to find last year's images. When my oncologist finally brought them up, he realized there was a clear REDUCTION in the size of my tumor, as well as a loss of contrast, indicating that the tumor was dying. So, the chemotherapy was working after all!

Had I taken my doctor at his word, and stopped my chemotherapy, I would have soon needed an extremely risky brain surgery that would have changed my life forever.

We are living through a crisis of competence in America — or is it in the world as a whole? It is absolutely essential that we remain vigilant and look out for our own health, because we apparently can no longer trust our doctors to do it for us. Remember to ask questions, get second opinions and, above all, don't just assume that your doctor is infallible. Now more than ever, your life is in your own hands.

[Steven Adler @sjgadler]

Anthropic announced they've activated "Al Safety Level 3 Protections" for their latest model. What does this mean, and why does it matter?

Let me share my perspective as OpenAl's former lead for dangerous capabilities testing. (Thread)

[Steve Werby @stevewerby]

Thought-provoking discussions/debate/points in this thread:

[Florian Roth ⚡️ @cyb3rops]

#BadSuccessor - a textbook example of why the security ecosystem is broken

- A privilege escalation vuln in Windows Server 2025 AD (via dMSA)
- Full domain compromise with default config
- Microsoft was told, agreed it’s real, but rated it "moderate"
- No patch, No fix
- No code execution needed
- No need to touch the DC
- No RPC, no ntds.dit
- Just a write to one attribute on an account you can create
- Rubeus already supports dMSA abuse (since February)
- Metasploit module is in the works

Researchers published everything anyway. Because… "we respectfully disagree with Microsoft’s assessment". So yeah, let’s just drop an end-to-end domain takeover technique online to prove a point.

To be fair, Windows Server 2025 isn’t widely deployed yet, so the real-world blast radius today is limited. But this isn’t about today - it’s about trust, process, and what happens when security decisions are driven by vendor priorities and researcher egos.

What this tells me:

1. Microsoft either:
- Can’t assess bugs anymore
- Or stopped caring about on-prem AD completely (because Entra ID is what they want to sell)

2. And the offensive sec crowd?
- They knew this would hit hard
- But chose to burn the world anyway
- Because their urge to be right > everyone else’s security

In the end, both sides look bad.
Microsoft, for being dysfunctional or apathetic
Researchers, for chasing clout over coordinated disclosure

Congrats. In a rare show of unity, both sides managed to screw this up.

Blog: https://t.co/f9eDCBmbjI

LinkedIn: https://t.co/dc1l5EUYpb

Metasploit issue: https://t.co/tcRkUHavo1

[Steve Werby @stevewerby]

Never use your own voice when speaking on the phone, in a videoconference, or in public with strangers, people you don't trust, or even people you trust. Audio of your voice can be recorded, allowing bad actors to use AI to impersonate you. There's no good solution. Good luck. 🤣

[Steve Werby @stevewerby]

@todayininfosec The full article: https://t.co/C0NnLouAy5