Christopher Young

Infosec geek; Developer; Red Team; Blue Team; Learner; More degrees and certs than necessary; Retweets are interesting (period)

[Christopher Young @thund3rbunny]

Hey @AAAClubAlliance ! When you tow my kid’s car to the wrong location and lose track of it for two days, why does it become my problem to fix??? You took it to the wrong place and you’re making me work to find it and coordinate the tow? I know mistakes happen, but seriously?

[Jean @Jean_Maes_1994]

Lazysign now has a powershell only implementation. No more need for binaries at all thx to @KlezVirus
https://t.co/hKN6YXT8Eo

[Christopher Young @thund3rbunny]

Swag!!!!! This is going to be a good week. #WWHF.

[Christopher Young @thund3rbunny]

@FedExHelp I wish there were options for customers when the @FedEx driver makes a delivery attempt to the *wrong* address. I don’t even have the paper that says we missed you. Why can’t I talk to the local office that has my package? Frustrating!!!

[Azeria @Fox0x01]

Continuing the iOS exploit development series:

Part 1: Heap Exploit Development: https://t.co/vtvfasQlie

Part 2: Heap Overflows and the iOS Kernel Heap https://t.co/DdDynOqh2G

✨NEW: Part 3: Grooming the iOS Kernel Heap https://t.co/OA5jBgcrIM

[Wolfdroid @ShMalav]

CSP bypass writeups

https://t.co/TVhg8O0ltF
https://t.co/AuVjqA07P2
https://t.co/bkg7sWNSmw
https://t.co/YDhzQ4GzYC
https://t.co/2nPo70KBEe
https://t.co/g2OEqb08Dn
https://t.co/u20NMJ12MT
https://t.co/bz7JZW3NmB
https://t.co/u20NMJ12MT

[Ian Bond @CER_IanBond]

I know I over-use “must-read”, but this piece by @FranklinFoer for @TheAtlantic on how kleptocracy is taking over America, really deserves the term. And it could make many of the same points about several European countries, including the UK: https://t.co/ZZbJ7LzcRp

[Abhishek Arya @infernosec]

8 years and 27K bugs later, ClusterFuzz is now available for anyone to use - https://t.co/ahkqY6gvxe

[Christopher Young @thund3rbunny]

The number of good programmers in the world is a constant, and the number of programs being written is exponentially increasing. #WeAreScrewed. #InfoSec

[Daniel Isaksen @duniel_pls]

Hey kids! Wanna research some shitty Atrient Android apps? Follow along with me, this is going to be fun. (1/?)

[John Melton @_jtmelton]

Need recommendations: I have a friend whose daughter (high school junior in US) is interested in computer science. What are the best resources I can help her with (mentors, communities, books, etc.) in addition to my own time? Happy for any/all suggestions.

[Halvar Flake @halvarflake]

I gave another iteration of my weird machine talk at BWU today. Slides are here: https://t.co/mmDuJRHp3M

[Christopher Young @thund3rbunny]

I've seen a bell labs tool from the 70s thats still in use at AT&T. #TheGoodDontAlwaysDieYoung

[Charlie Miller @0xcharlie]

Damn GHIDRA still exists at NSA? That tool was already there when I left 13 years ago!

[Christopher Young @thund3rbunny]

@Conan1989 @WeldPond @0xcharlie @dlitchfield Seriously??? Why does server 2016 support Xbox live?

[Coalition Security @CoalitionSec]

New blogpost: .ENV Files publicly accessible - https://t.co/zgI3vCp1qX

[DirectoryRanger @DirectoryRanger]

Defending Windows Domain Against Mimikatz Attacks
https://t.co/ODnckwKo4v

[Ashar Javed @soaj1664ashar]

Server-Side Request Forgery #SSRF Tools/Stuff

https://t.co/Klcxbn7OM8

https://t.co/Pruy3KtHdD

https://t.co/bjFjveIwrd

https://t.co/yrshScjBEX

https://t.co/V2UfVq3Ww6

https://t.co/iHTo6HxW9E

https://t.co/sXZTRJssJA

https://t.co/1fTRoxrnXZ

https://t.co/QDJiUZ4utv

[Ashar Javed @soaj1664ashar]

Phishing Tools

https://t.co/CPjGuH3W1y
https://t.co/snmIacmLLq
https://t.co/JKgoNI5pUY
https://t.co/jrdnH61VAk
https://t.co/AHAI4MAgQ8
https://t.co/xvvLx3sxyG
https://t.co/CwafKiEKWx
https://t.co/0Mp9myFYFm
https://t.co/0TjxDJmzYf
https://t.co/AGw7DP2oFD

please add more.

[Christopher Young @thund3rbunny]

@HenrikJohansen It won't change because architecture and engineering are dead. Have been for awhile now. We build the world with Legos created from informal specifications and quality standards then throw it straight to a user. #InfoSec #oldfart. #SpeedKills

[Jeremiah Grossman @jeremiahg]

DAST is meant to find vulnerabilities that adversaries may exploit. SAST is meant to find those same vulnerabilities earlier in the SDLC — but does it really? What’s the best data-backed evidence available in order to support or refute this claim? My search results are sparse.

[Christopher Young @thund3rbunny]

I can't wait! Will video be available?

[Charl van der Walt 🌻 @charlvdwalt]

So, @4n0m4l1 and I have looked at the numbers again and again. We're ready to on stage at #BHEU tomorrow to share our findings on the practical value of Threat Intelligence feeds.

#Spoileralert.

It's not looking good.