G0rb

Just renewed my @malcat@infosec.exchange License because it's still my favourite Tool for doing DFIR stuff. You should check out at least the free Lite Version: https://malcat.fr/

@cR0w@infosec.exchange my Threat-Model does not allow for corpo infra. Also, seriously don't connect private stuff to corpo devices.

I don't want to push anyone, but I'd definitely apply for it. SRLabs is doing cool research and rather thrilling projects like [REDACTED]. I can personally vouch for @LisaLobmeyer@infosec.exchange as the responsible team lead for this position and in general the people at SRLabs are pretty chill, top tier hackers. https://security-research-labs.jobs.personio.de/job/2726007 PS: The only downside is, I'll be your colleague. But if you want to do some s*ck #threathunting and collect more CTI about threats like [REDACTED] and the incredible cool tooling of [REDACTED], then here's your chance. #getfedihired #DFIR #advertising

that's some cool iranian open-dir http://178.239.149.60[/arya/ #shodansafari #opendir #threatintel

@cR0w@infosec.exchange hacking is illegal and for nerds.

I'm having a discussion with my lovely Partner at the moment and need statistical data: If you would be called an infosec influencer, how would you feel about the memory of it?

@cR0w@infosec.exchange I'm trying to improve my threat model so much, that I can do a job without computers and DFIR.

@jerry@infosec.exchange ah okay, so OpenAI doesn't monitor for abnormal outbound network traffic of critical systems.

Shodan-Query of the day: asn:"AS59399" vuln:"cve-2014-0160" #ThruntersAnonymous #shodansafari #yeet

@flyingpenguin@infosec.exchange as long as the NSA, CIA and Pentagon parking lot is constantly pinging out the serials from the cars tire pressure sensors, it's even playing ground.

@cR0w@infosec.exchange you totally underestimate the threat of me being bored + to much OSINT services.

@fluepke@chaos.social Shitposting is an Anagram of Top Insight

@cR0w@infosec.exchange Love it. So quantum edge devices will have dozens of open ports (one for every quantum entanglement / connected client). This means a corp with 5000 devices will now have 5000 "ports" to suck up ../ instead of one public facing.

@cR0w@infosec.exchange @theorangetheme@en.osm.town exactly this so much.

@captainfutura@mastodon.social dann könnte man den kram auch direkt via paperless automatisiert wegsortieren

@FritzAdalis@infosec.exchange just for you 😅 http.html_hash:1670442135

@brahms@chaos.social by me?

@theorangetheme@en.osm.town was an unsecured C2 Panel, just cleaned up a little bit.

@jfslowik@infosec.exchange small related Funfact: https://beta.shodan.io/host/214.3.115.13

@p3m@mastodon.social sure. Also something I regularly use. Malcat is my first tool if I need a quick overview and write some Yara Signatures, afterwards it's Ghidra vor Radare2

@EricAlper@mastodon.social Mr.Robot

@flyingpenguin@infosec.exchange wow, you are awesome

Bin ja etwas überrascht das Leute verwundert sind wenn bei nem NATO-Gipfel bei dem die Rüstungsindustrie ein inhärentes Thema ist, Leute irritiert sind wenn sie nen Revolver geschenkt bekommen.

@dirksche@social.tchncs.de ouh, located near nuremberg atm. But I'm in Stuttgart sometimes.

c093b8c996e66e6b91ffc1e9937f3c8f5fdc7033

Wie inkompetent kann man sein? https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals

@a_watch@bewegung.social stimmt schon, sind immerhin 0,00000014 Maskendeals.

@Viss@mastodon.social why the f*ck do they need AI for 17k log lines? Throwing AI at an Incident and calling it "forenaics" is the laziest incident response I've ever seen.

@corq@infosec.exchange another ../-victim

@cR0w@infosec.exchange if I quit doing forensics, I'll start with tactical tarot incident response.

Shodan-Query of the day: hash:-220028446 #ThruntersAnonymous #shodansafari #APTSweatyPants

I believe their is at least one APT Operator followong me on Mastodon. #WhoKnows #GottaKeepThemOnTheirToes

Apple: "Yeah, we got so much issues with spyware we introduced an optional hardened security mode for our devices." Also Apple: "Btw you can't easily change the Name of the Wifi-Hotspot. We want everybody to know that you are here using an iPhone for Marketing reasons."

@quinn@social.circl.lu noooo, just drop that 17k logs Ingo an other AI Model. Problem solved.

@Viss@mastodon.social @cR0w@infosec.exchange @afeinman@wandering.shop the difference is, grep is deterministic and has a proven track record.

@LisaLobmeyer@infosec.exchange @srlabs@infosec.exchange @darfplatypus@infosec.exchange after carefully considering your infosec-shitposting skills I come to the conclusion that you should apply so we can hunt [REDACTED] together and do some dope research on them.

@kinghaunst@sueden.social jap, basically das selbe Problem das die Consulting-Branche hat.

Took some time... Feeling a little bit sleepy

@cR0w@infosec.exchange wasn't a CISA KEV yesterday, and they still have till 4th of August to patch.

Evidence of Shitpost:

@mikemacapple@mstdn.social ja, aber denk doch mal an den armen Merz der diese Stimmung aushalten muss

@dirksche@social.tchncs.de we should definitely drink one together. Your profile looks like person I would have fun and feel comfortable drinking beer with.

@Viss@mastodon.social I would love to have incidents with 17k of log entries. A normal Plaso/Log2Timeline output has easily more than 2 Million lines and even they can be easily analyzed with Klogg as an log viewer. The hell you can even use grep for such pathetic stuff and their first idea is "Frontier AI Model"? Exactly that's the reason why companies get (more or less) independent, external forensics. If you can't defend your environment to a certain degree (and honestly, nobody hates on you when you get pwned by nation state threat actors) then you are far away from the skill level needed for good digital forensics.

FunFact: #nsogroup's internal sharepoint had/has the subdomain conflu.nsOgroup.com #dadhumor #pegasus

Deutsche Cyber-ThreatIntel be like:

@Viss@mastodon.social @jonathankoren@sfba.social I'm pretty sure that you can handle 90% of incidents with the compute power of an 8GB RaspberryPi 5.

@geheimorga@chaos.social ist fremdgehen dann DLL-Sideloading?