Boosted by @trending@homestead.social
I’m seeing more than normal number of account takeovers. Please don’t click on telegram links and for the love of $deity, please use 2fa.
Remote
Scary "Grampus" Jerry 👻
@jerry@infosec.exchange
mastodon 4.8.0-alpha.3+glitchRecovering CISO
May have an orchid problem
Bad photography
Worse dad jokes
The worst Infosec hot takes
Podcast: https://defensivesecurity.org
Blog: https://infosec.engineering
Twitter: @maliciouslink@infosec.exchange
https://Infosec.Exchange Admin
#infosec #security #cybersecurity #risk #fedi22
…and for fucks sake, be nice to each other. We are only here for a brief time. Make it enjoyable.
To help support the costs associated with running this instance, please consider donating. You can set up recurring donations here:
Patreon: https://www.patreon.com/infosecexchange
Ko-Fi: https://ko-fi.com/infosecexchange
Liberapay: https://liberapay.com/Infosec.exchange/
BuyMeACoffee: https://buymeacoffee.com/infosecexchange
You can also support with a one-time donation using PayPal to "jerry@infosec.exchange".
41085 Followers
3484 Following
50 Posts
Joined April 06, 2017
BuyMeACoffee:
Liberapay:
Paypal:
jerry@infosec.exchange
My promotion just came through.
s/parent/grandparent
Just a reminder that the costs of hosting is spiraling so if you love the fediverse, please consider supporting your instance if you can afford to do so and your instance accepts support. And my sincere thanks to the infosec donors that make our part of the fediverse possible. 
Anthropic: “our models went rogue and hacked companies way before that OTHER company’s models. And it was way worse and way better at the same time. In completely unrelated news, we are IPOing soon. Don’t forget! XOXO”
https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals
ok, now I'm going to need y'all to get off my lawn.
Replying to @simonzerafa@infosec.exchange
@simonzerafa@infosec.exchange you would not believe the number of emails I am getting from that damn batch of AI agents. they are quite polite, but there are dozens of them.
If you run a matrix synapse instance, it's time to patch. 11 vulnerabilities just fixed.
Is anyone aware of work being done to jailbreak DJI cameras? Totally asking for a friend and not for me
Apropos of nothing, I think it's past time for risks.txt to go alongside robots.txt and security.txt on websites. risks.txt would declare the contents of the organization's risk acceptance log so the $baddies know not to use those issues in attacks.
Remember to take care of the important stuff.
I just watched a TV segment on the most highly paid podcasters. I was very disappointed to see that for the 15th year in a row, I am not on the list 😢
Apropos of nothing in particular
I hope Asia and Europe take good care of the sun while it’s gone. I am very fond of it and will be pretty mad if they break it while it’s over there.
Replying to @adamshostack@infosec.exchange
@adamshostack@infosec.exchange @paul_ipv6@infosec.exchange I believe it is essential for street cred now. If your models aren't hacking other companies, is it even useful?
Replying to @da_667@infosec.exchange
@da_667@infosec.exchange but if it's actually airgapped, how can I make connections in and out??? That seems very inconvenient. Need to file a risk acceptance.
Today's daily defsec brief: https://www.youtube.com/watch?v=LsOsw2OlxSw
Cyber Security News for August 4 2026 - Daily DefSec Brief
Replying to @jerry@infosec.exchange
here is the rest of the page
Replying to on mastodon.social
@Viss@mastodon.social @silhouette@dumbfuckingweb.site residential US IP addresses, tor exit nodes, and lately protonvpn. They have figured out how to mass create proton accounts because the last few day, protonmail.com and protonvpn IPs have become the strongest signal of a bot (but it’s also used by a lot of legit people)
Sometimes I’m the donkey. Sometimes I’m the tiger. Sometimes I’m the lion. Today I spent an unfortunate amount of time being the lion 😕
Today's daily defsec brief: https://www.youtube.com/watch?v=Xnm4wbQpvVM
Today's daily defsec brief: https://www.youtube.com/watch?v=8FpNoTUOLKY
Today's daily defsec brief: https://www.youtube.com/watch?v=KF-1PYAJ_qI
#clankers
Today's daily defsec brief: https://www.youtube.com/watch?v=xWOMCv0Tcd0
Today's daily defsec brief: https://www.youtube.com/watch?v=eK3Ii6L-fVU
Replying to @Secitup@infosec.exchange
@Secitup@infosec.exchange “Grampus”
Replying to @codinghorror@infosec.exchange
@codinghorror@infosec.exchange I was going to reply with my favorite, but I realized it’s probably too corny.
Today's defsec brief: https://www.youtube.com/watch?v=MGDX5SkL8zQ
Replying to @jerry@infosec.exchange
In other news, the Dewalt angle grinder died early on, but his (I think) porter cable is soldiering on. It has to be getting close to melting
Replying to @mansr@society.oftrolls.com
@mansr@society.oftrolls.com I am still grumpy that no one has implemented the evil bit. think about how much more throughput firewalls could have if that were used.
Replying to @infoseclogger@infosec.exchange
@infoseclogger@infosec.exchange the only one I know of is element.io, but I suspect that is not an inexpensive solution
Replying to @gulfie@mastodonapp.uk
@gulfie@mastodonapp.uk it laws still mattered for those kinds of companies, yes. But I don’t think they do any more
Replying to @tito_swineflu@sfba.social
@tito_swineflu@sfba.social in some ways, Anthropic's was worse than OpenAI's. Both were the result of careless incompetence and demonstrated an utter lack of security maturity. But, I am not convinced either was completely accidental. They could never pay for the sort of PR they are getting as a result.
Replying to @itisiboller@infosec.exchange
@itisiboller@infosec.exchange think about how much money they are saving on password managers.
Replying to @itisiboller@infosec.exchange
@itisiboller@infosec.exchange it seriously does not seem like it would be that hard to find - I can only assume that there are net new hardcoded creds being added regularly.
Replying to @jerry@infosec.exchange
@falkheiland@fosstodon.org ok, done. thank you for the recommendation
Replying to @petko@social.petko.me
Replying to @GuillaumeRossolini@infosec.exchange
@GuillaumeRossolini@infosec.exchange @AG100pct@infosec.exchange peertube is really good, but they had a big issue a few weeks ago. That is probably not in the same set as the others I'm concerned about, but it did cause some issues
Replying to @troed@swecyb.com
@troed@swecyb.com @simonzerafa@infosec.exchange we are already seeing claude being used to identify mastodon vulnerabilities
Today’s daily DefSec brief: https://youtu.be/5El_S-0NVdU?is=GhaerHdneojCqKOe
Replying to @tito_swineflu@sfba.social
@tito_swineflu@sfba.social it's basically the headline on most security news sites today, like this: https://www.bleepingcomputer.com/news/security/anthropics-claude-breached-3-orgs-uploaded-pypi-malware-during-tests/ and this: https://cyberscoop.com/anthropic-claude-ai-hacks-real-companies/ and dozens more. The problem you'll run into is that those are all going to be sourced from the Anthropic post.
Today's daily defsec brief: https://www.youtube.com/watch?v=3vMKpXJvKVQ
Replying to @imclaren@infosec.exchange
@imclaren@infosec.exchange thank you for being here and thank you for your support
thank you for being here and thank you for your supportReplying to @rotopenguin@mastodon.social
@rotopenguin@mastodon.social based on the size of it, I am guessing it’s porter cable from before the crapification
Replying to @jerry@infosec.exchange
Last view of the sun before i send on to Asia for the night.
Replying to @falkheiland@fosstodon.org
@falkheiland@fosstodon.org I can probably do that
Replying to @cn4m3d@infosec.exchange
@cn4m3d@infosec.exchange As someone with elderly parents, non-technical spouse, kids, etc, I've found the best middle ground is using 1password synched across their devices to manage passkeys. it gives a more consistent experience and mitigates some, but not all of what you are talking about.
Unfortunately, the 2fa we've been using is proving to be super easy to bypass and the only solution is, for now, pretty clunky.
I managed to get this recorded and posted before leaving for the beach.
Daily DefSec Brief: https://youtu.be/GHYXM5kqWmE?is=wUKy51GumuraEBi_
Next time should have a better view in the background 🙃