Privacy, motorcycle, and craft beer geek. Adversarial thinker. Blue team your blue team for better red teaming.
The Interwebs
Joined July 2009
- Tweets19.6K
- Following1.8K
- Followers1.4K
- Likes13.3K
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
whenever these big wp2shell vulns come out i just laugh my ass off.
red team operators can use them on authorized targets for precisely 5 seconds before they notice multiple other homies hanging out there w/ them on the host and then need to be part of the deconflict/IR process
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
My default assumption with coding agents is simple if you point one at a directory, assume everything in that directory could end up with the provider.
That’s also why people have been recommending containers and VMs for months. They’re not just for isolation they’re about minimizing what the agent can see.
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
COM Hijacking. Set a trap in the Windows Thumbnail Cache (CLSID {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}). Wipe the cache, and the OS triggers your DLL automatically. blog soon (have to set up my lab for c2) also ending my relationship with havoc now adaptixc2 is by nest friend lol
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
LLMs can now reverse engineer obfuscated malware. But what happens when malware authors use LLMs to iteratively obfuscate back?
Elastic Security Labs explored the arms race between LLM-driven reverse engineering and LLM-driven obfuscation. Who wins when both sides have the same tools?
This is the question every malware analyst, detection engineer, and red or blue teamer needs to be thinking about right now.
elastic.co/security-labs/llm…
Author: @elasticseclabs
#MalwareAnalysis #ReverseEngineering #InfoSec
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
First blog post in a mini series where I look at "disposable tooling". This post shares what I have found to be useful when 1-shot'ing LLM generated Stage-0 agents for Mythic. specterops.io/blog/2026/06/2…
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
We’ve shipped a security-guidance plugin for Claude Code that helps identify and fix vulnerabilities as you’re writing code.
Available for all Claude Code users. Install from the plugin marketplace (/plugins).
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
We're finally ready to talk about Flipper One — a project we've been grinding on for years and have rebuilt from scratch several times. Read blog post >>
blog.flipper.net/flipper-one…
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
MiniPlasma LPE exploit works perftectly. Elastic Defend behavior protection catches the exploit primitives involved in the chain, providing detection coverage even against fresh public exploit.
github.com/Nightmare-Eclipse…
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
The site needs more authors, anyone has interesting techniques to share —> PR plzzzzzz 🙏
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
(1) The robot contribs don't auto-close if GH is down (cause it relies on GHA). We have retries but its pretty annoying.
(2) A PR isn't one and done. We need to comment, we need to run tests (~80 per run), and we do this multiple times per commit (due to review back and forth). So one PR has a lot of GH reliance right now.
(3) PRs tend to batch up, e.g. we don't do PR review constantly because all of us have other things to do, so we usually will try to review/merge multiple at one time. 3 PRs per day = 20 per week, which is a ton for volunteer time!
(4) We try to coordinate merge parties across maintainers in China+US+EU and if GH is down during our small time slice we just can't do any meaningful merging for 24 hours. We could alter our process here but that's just gaslighting.
(5) We get an order of magnitude more issue and discussion comments, which are affected by all of the above except CI. These are particularly affected by GHA/API outages.
(6) Dev work by maintainers happens in non-PR branches that run CI, and if CI is down we can't test our code (since Ghostty relies on a lot of testing we can't run locally, e.g. for platforms we don't have). It effectively pauses work on that branch.
(7) I've had multiple days in that 30-day window where Git operations themselves failed for different reasons. So I couldn't push a branch or whatever.
It just all adds up to be WAY too work impacting. The Ghostty maintainer channel is a stream of "oh GH is down again."
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
Ghostty is leaving GitHub. I'm GitHub user 1299, joined Feb 2008. I've visited GitHub almost every single day for over 18 years. It's never been a question for me where I'd put my projects: always GitHub. I'm super sad to say this, but its time to go. mitchellh.com/writing/ghostt…
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
Targeted Keberoasting with NetExec🔥
If you have Write privileges over a user, you can temporarily add an SPN to your target user, request the service ticket, and then remove the SPN. Voilà: a crackable hash without interfering with potentially critical users. Made by @azoxlpf🚀
ALT Targeted Kerberoasting with NetExec
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
We are very happy that today Apple issued a patch and a security advisory. This comes following @404mediaco reporting that the FBI accessed Signal message notification content via iOS despite the app being deleted.
Apple’s advisory confirmed that the bugs that allowed this to happen have been fixed in the latest iOS release. You can read more here: support.apple.com/en-us/1270…
Note that no action is needed for this fix to protect Signal users on iOS. Once you install the patch, all inadvertently-preserved notifications will be deleted and no forthcoming notifications will be preserved for deleted applications.
We’re grateful to Apple for the quick action here, and for understanding and acting on the stakes of this kind of issue. It takes an ecosystem to preserve the fundamental human right to private communication.
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
holy fuck, a hair dryer at a Paris airport broke Polymarket weather markets & made someone $34,000 richer
- polymarket was settling Paris temperature bets on a single Météo France sensor sitting near the Charles de Gaulle runway perimeter - basically unguarded
- the guy bought the long-shot outcome (like "22°C" when everyone expected 18°C) for pennies, since nobody thought it'd hit
- then he walked up to the probe and briefly heated the air around it with a portable heat source, spiking the reading just long enough to register as the daily max
- temperature snapped back to normal in minutes, the market resolved in his favor, and he cashed out - twice, on April 6 and April 15, before Météo France caught on and filed charges
hyperstitions.
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
New in Claude Code: /ultraplan
Claude builds an implementation plan for you on the web. You can read it and edit it, then run the plan on the web or back in your terminal.
Available now in preview for all users with CC on the web enabled.
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
Oh this is clean. A searchable, filterable RFID attack reference.
HID Prox, MIFARE, EM4100, animal tags, organized by frequency AND tool (Proxmark, Flipper, Chameleon...). This is the cheat sheet that used to live in your notes app.
Bookmark it!
you'll thank yourself on your next physical engagement.
redteam.vip/ram-rfid-attack-…
TechByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ ⚠️ retweeted
I wrote an essay about restraining AI development for the sake of safety. I think an idealized world would put itself in a position to do this if necessary, and that it's worth serious effort in the actual world, too, despite the many challenges and downside risks. Link below.
