Professional Shitposter
malwaretech@infosec.exchange
Joined June 2013
- Tweets511
- Following33
- Followers278K
- Likes10.9K
I think there's definitely an argument for browser that nation-states are hording browser 0days and this has some impact on that. But for N-days they mostly target OS bugs or server software, and the number of exploited bugs is suspiciously low. Would have expected to see 200+.
3
109
It's really not. Maybe at scale beyond what humans can physically achieve, but LLM spearphishing is mediocre at best.
5
286
Very few threat actors have the capabilities to discover high impact 0day, but more have the ability to reverse high impact N-days. So it's basically a derivative signal that a lot of the bugs were really not that useful to begin with.
UK apparently does the same, but I didn't get that question. I did get asked my opinions of Edward Snowden tho lol
1
11
1,526
Maybe the US version is different, but in the UK, secret clearance is so useless it was less paperwork than the background check for my corporate job.
Top Secret they made me list out the full legal name of every single person I've ever fucked and then went and interviewed them.
Honeypotting someone and finding out they only have secret clearance gotta be embarrassing af. Just going back to their handler like "I figured out what vehicles they use, it's something called a Humvee".
Nope. The company becomes public *after* the IPO. The IPO itself is typically only available to whoever the underwriting banks offer it to (typically institutional investors and high net worth individual).
2
3
241
Me explaining to AI dudes that cybersecurity ≠ vulnerability management and that the majority of cyberattacks involve exactly zero vulnerabilities
Project Glasswing:
* 37,966 findings.
* 2 exploited in the wild.
vulncheck.com/blog/anthropic…
I meant once it goes public, but also I think there's some loophole where retail investors can participate in the actual IPO part through certain platforms now. Idk how it works and if it's restricted to accredited investors, but my friend somehow got SpaceX shares at IPO price
2
5
2,085
I work in pro-bono pentesting against threat actors who didn't order a security audit but looked like they need one
3
15
569
The lockup period for founders/directors/major shareholders is usually 6 month to 1 year. I imagine the IPO will be dust by the time they are allowed to sell.
6
39
5,484
I really had to submit financial statements proving I'm an accredited investor to invest in farmland because it's considered "risky", but apparently yeeting all your money into a GPU rental company meme stock run by a doomsday cult is fine 🙃
At what point does an IPO just become a cap raise that bypasses Rule 506? Nothing about what Anthropic is doing is an IPO. They just can't raise any more money from private institutions so they're going public to try and raise from retail investors.
I'm relatively confident the attribution of the France attack is correct, but the second wave is currently unattributed and I'm leaning more towards it was a different actor
Ruling out false flags isn't that difficult. Intelligence agencies have resources that go far deeper than just mapping IPs to actors. If they're confidently publicly attributing an attack, you can usually safely assume they know who actually did it
1
2
84
Agreed. Coincidentally I was just typing out a post based on someone on LinkedIn having just made me aware of that fact, which I also think explains the France attack.
I think our theories are somewhat similar. I suspect it's more likely than not the second wave of attacks was a different actor from the first.
xitter.twitterapi.xyz/MalwareTechBlog/status…
According to a comment on my LinkedIn post, France was involved with shooting down a decent number of Iranian drones over the Middle East, which would 100% explain it. Iran basically considers anyone who provided even defensive assistance to be an aggressor, and therefore a legitimate military target.
What it doesn't explain is the much larger second wave of fridge attacks, which occurred last week, and hit around 9 EU nations. Several of those nations don't appear to have had any role at all in the Iranian war at all, but would be targets of interest for Russia.
Entirely speculation, but Russia has in the past repurposed other nation's cyberattacks for their own purposes. So I would not be surprised if it turns out the first wave of attacks was Iran and second wave was Russia, but also entirely plausible both were Iran and the reasoning is yet to become clear.
107