Muscle in "trying to be a good dad despite having a bad dad" gang, “he/him/coffee drinker supreme”, hacker, Jesus follower, husband, father. #neurodiversesquad
Never never land
Joined May 2013
- Tweets5.9K
- Following1.1K
- Followers775
- Likes8K
Bryan Austin retweeted
The FLARE team now freely distributes its quality reverse engineering and malware analysis educational content at github.com/mandiant/flare-le…. Launched with:
- Malware Analysis Crash Course
- Go Reversing Reference
- Intro to TTD
Bryan Austin retweeted
The evidence is clear, this is not a Tomahawk
Iran alleged that an American Tomahawk Cruise Missile hit a school (buried in an IRGC compound) in southern Iran, killing 165 people.
Analysis of a newly released video tells a different story.
ANALYSIS:
A-I analysis confirms the wings of the munition in question sit about 40%-45% down the body of the munition. On a Tomahawk, the wings sit roughly 49%-50% down the body of the munition.
The wing to body ratio of the munition in question matches an Iranian Kh-55–derived Land Attack Cruise Missile.
Further, the video shows the munition in a steep dive angle for the final attack phase. This places the attack angle at approximately 70%, which is the max attack angle for a Tomahawk.
The attack angle does not match the KH-55. That angle maxes out at about 55 degrees. So what would have caused this?
CONCLUSION:
The wing positioning alone makes the munition impossible to be a Tomahawk. The attack angle is at the max of the Tomahawk's capabilities. The typical attack angle for a Tomahawk is much lower than 70 degrees. The typical angle is between 20-45 degrees.
This is due to the flight pattern of Tomahawks. They fly very low horizontally to the ground, often only 50-100 meters AGL to avoid detection and interception. In order to achieve that attack angle, the missile would have had to gain altitude several kilometers away, this would leave it vulnerable for interception. This is highly unlikely on the first day of US attacks.
So what could have caused this?
Simply put, GPS jamming of an Iranian KH-55. The USA and Israel were, and continue to actively jam the Iranian airspace.
If the KH-55's signal was jammed, this could result in an uncontrollable dive. Think of GPS jamming more like disorienting the missile.
On 03/07 President Trump stated:
“No, in my opinion, based on what I’ve seen, that was done by Iran.”
Today, I concur with the President.
Bryan Austin retweeted
I want to share a quick thought for people in cyber security. This will be my longest tweet ever.
I’ve spoken to many lately who are having an existential crisis from the constant posts about “the end of cybersecurity jobs.”
Yes, things are changing quickly. This is a significant moment for the tech industry. Change can be uncomfortable. But we’ve seen cycles like this before.
• When GitHub and open source took off, people said software engineers would disappear because code was free.
• When AWS and cloud computing emerged, people said infrastructure jobs would vanish.
• When fuzzing and SAST tools improved, people said vulnerability research would disappear.
• Virtualization would eliminate infrastructure jobs.
• Mobile computing was going to end desktop dev.
• Exploit mitigations would end exploitability. It didn't.
Each time automation improved, the amount of software grew faster than the automation. It does feel "different" this time as it's explosive.
Some roles will shrink:
• repetitive pentesting
• basic vulnerability scanning
• tier-1 SOC monitoring
But other areas are expanding rapidly:
• AI system security
• supply chain security
• identity architecture
• autonomous agent security
• critical infrastructure protection
Historically, every time we eliminate one class of bugs, new classes emerge. Right now people are vibe-coding entire systems, giving AI access to their machines, crossing trust boundaries, and deploying autonomous agents with excessive permissions. The legal and regulatory world is nowhere close to ready.
There will absolutely be new failure modes. Humans are amazing and always adapt, finding new ways to do things.
The worst thing you can do right now is fall into a doom loop.
...and I’ll be honest, I too have felt the "psychological paralysis" a few times thinking, “Is this time different?” It's especially impactful when it comes from someone I respect in the community. There are certainly unknowns, in an industry where we've become accustomed to predictability.
But... the majority of those reactions are usually driven by social media, not reality. Platforms like X reward engagement, and sensational doom posts spread faster than measured thinking.
If you see something like:
“Holy #$%^! Opus 66.6 just found every bug in Chrome and replaced 50 startups!”
…mute it and move on.
Instead:
Stay curious.
Learn the new technology.
Adapt your skillsets.
Build things.
We’ll get through this transition the same way we always have. If I'm wrong then Sam Altman better be right about UBI! :) I'm sure that if this tweet gets any engagement that I'll get some heat for it, but a good friend of mine reminds me often to focus on what you have control over. I'll revisit this tweet at DEF CON 40!
Bryan Austin retweeted
If you've been laid off by the Washington Post this week and have any questions re: digital security, please email me on [email protected]. I'll help you pro-bono for the rest of the month.
I’ve been quiet on here for a while, but I am currently in the job market. If anybody is looking for a consultant for threat intelligence, SOC ops, incident response, or social engineering please reach out to me. If you know of a position in any of those areas, I am happy to chat
I can attest, this person is amazing, patient, kind but is also an absolutely brilliant researcher and engineer. HIRE HIM NOW!!!!!!
You’re unable to view this Post because this account owner limits who can view their Posts. Learn more
Bryan Austin retweeted
🟢 START:
- Using phishing resistant MFA (FIDO, passkeys, etc.)
- Paying a high schooler to comb through your network looking for creds
- Investing in automation
- Ensuring least privilege
- Designing with an assumption of breach: How do we detect, contain, …? (Threat model)
Bryan Austin retweeted
Stealth trick for Red Teaming - why worry about being caught by an MDR (i.e., Artic Wolf, FireEye, etc.) when you can kill their visibility? 🧐
ipconfig /displaydns - Find API Endpoint
echo 127.0.0.1 blahblah.fireye.com >> c:\windows\system32\drivers\etc\hosts
Bryan Austin retweeted
1/ In one ransomware case, the attackers started an EXE file that dropped the vulnerable GIGABYTE driver to C:\Windows\System\gdrv.sys.
The TA used the vulnerable driver to load a malicious driver as a kernel driver, who hunted and killed Symantec processes. 🧵
#CyberSecurity
Bryan Austin retweeted
Wow, @halvarflake managed to capture the security "old-timer" experience in three succinct bullet points.
Bryan Austin retweeted
Polling the #CTI community here. What countries do you know of publish an annual cyber threat report -- even if it is embedded inside of a larger, overall national security threat report? Is it the national CERT or CIRT publishing the report, counterintelligence agency for
Bryan Austin retweeted
Cobalt Strike ain't 💩
Let's chat about how to unravel Cobalt Strike and deny the adversary further access
As ALWAYS, I am showing you data so fresh out the kitchen it hasn't even been cleared by ThreatOps Director @MaxRogers5 👀🧑🍳 🧵
Bryan Austin retweeted
My investigation and analysis mantra in a nutshell...
A questions well stated is a problem half solved.
