Replying to
@cR0w@infosec.exchange
Feel this is more than just a monday thing.
Remote
Fringed Crow 
@Fringedcrow@infosec.exchange
mastodon 4.8.0-alpha.3+glitchSecurity Analyst, scale modelist, artist, introvert.
Like to make things and break things.
Ancestry history nerd.
GenX-Filed. #TheTruthIsOutThere
BlueSky: @fringedcrow.bsky.social
www.oldmanscuriosities.com
48 Followers
67 Following
49 Posts
Joined June 12, 2023
GitHub:
Hobby Blog:
Why is it, that the cats never want anything to do with you until you sit at your desk and start work? Then they want all the attention at that point.
#Catsofmastodon
RE: https://mastodon.social/@zackwhittaker/117014191805666674
These 2 stories would make a great War Games reboot.
Quoting
I'd be interested to see if any of the companies that were hacked by OpenAI or Anthropic will sue them. Someone has to take responsibility for this, and the blame is almost entirely on the leaders of these AI companies. Alternatively, hacking is just legal now until a court says otherwise? What a fucking mess.
https://www.wired.com/story/anthropic-says-claude-hacked-real-systems-during-cybersecurity-tests/
Open quoted postWhen your paid 3rd party support vendor has no clue what their doing and keep saying, "i'm not an AD person."... you have to wonder how the hell they go the job to start with.
Replying to
@Sempf@infosec.exchange
had friends and family back in NY last couple days say they've smoked 3 packs of Canadian Wildfire each day.
seems it's still high there, but getting better right now.
AI is making people dumber by removing their critical thinking skills.
"Oh i need this tool to help me write documentation"
"Oh I need this to help write emails"
No you don't. use the brain you were born with.
Did #Stryker get nabbed again?
Seems like some infostealer got them recently.
Replying to
@hal_pomeranz@infosec.exchange
It's not just prison labor in this country. All labor in this country is forced.
had a fuk'd up dream i went 9 rounds w/ tyson in public? why? no idea. woke up and can barely move. entire body feels like i got hit by a semi. headache from hell, stiff neck, back feels like it wants to break with each move.
Think i won the fight in the dream though.
I just want AI to do my house work, and know when i turn on GPS, that I drive this area all the time, you don't need to tell me to turn left or right to exit my driveway.
#AI #SmartAI #EnoughofAI
Replying to
@hrbrmstr@mastodon.social @FritzAdalis@infosec.exchange
for at least one user. They did use Metamask along time ago. Even though we do not allow chrome sync, for this very reason, somehow the user was able to bypass that and enable sync. thus it is trying to sync metamask from their personal account.
Now on to the other user.
Thanks for the help. It was the extra eyes that got me further than i was.
Replying to
@FritzAdalis@infosec.exchange Don't see this installed on their machines. definitely not on our white list.
Replying to
@FritzAdalis@infosec.exchange
It's occasionally with the same 2 users. never the same time when it happens. So letting procmon run that long, i might not be able to open that file.
i've checked the event viewer for that, not finding anything.
This started out as a personal project. Mainly because when working with vendor support, they wanted logs and logs and logs.
Finally figured out w/ a few vendors what they were looking for. But when a directory contains over 100 log files and directories, where do you begin searching?
I recently, re-wrote the entire program, yes with a little bit of AI help, to fix issues I was facing and add more functionality.
Being able to navigate a directory of hundreds of logs to just a few to speed up your troubleshooting time helps keep you slightly sane.
https://github.com/rrice2004/Python-/tree/main/LogFile%20Search
When a vendor makes an unauthorized change to your environment and breaks production, you want to hang them by their feet. Now I get to do an RCA because of the vendor.
google labs is all AI crap now. used to be a good place to test new things. want an AI generated alphabet, google labs. want to pick your nose and have AI tell you what it looks like, Google labs.
so close to finally moving everything away from google.
Fuck this state. I have the option to get my Canadian citizenship papers. I'd have dual citizenship. Seriously thinking about it.
My cat is crazy, just like me. Lil bastard was eating my sauerkraut.
Not like he doesn't have enough food and treats.
Is it because the girl is the commercial is calling it Canooolie??
Will Emu and Doug be back?
Is the kingpin Doug Jr.?
https://www.ransomware.live/id/TGliZXJ0eSBNdXR1YWwgSW5zdXJhbmNlQGV2ZXJlc3Q
So, Handala is now putting bounties on leaders of the US administration. This could get interesting.
This is nothing more than a bribery scam. Not sure of what routers are US made anymore. But i would think they would include enterprise grade as well since they have just as many if not more vulnerabilities than my Netgear or TPLink does.
So Memory prices through the roof because of AI, Chip prices through the roof for multiple reasons, GPU's through the roof because of AI, now routers. No ones going to be able to afford personal devices at home anymore.
the U.S. Embassy in Jerusalem has told Americans they're on their own.
RE: @wendynather@infosec.exchange
Just another reason to stay out of Kansas.
Replying to
@alice_watson oh, I can't get census data for my family history because it's confidential for 70+ years. But everything else is open game. Dafuq!
Replying to
@alice_watson I've been screaming this for years. Sadly though, until we can't get enough politicians who understand and care, to get laws in place, and get proper punishment, nothing will ever get done.
Just the fact alone, that I can spend less than $100 in most cases and get your entire life's history online is ludicrous.
Privacy is a big reason we went away from public phone books.
It's just the way it is sometimes.
Replying to
@simonzerafa@infosec.exchange I have. but it's opnly because the wife left them in the candles that sat in storage for a few years. And when we unpacked everything in the new house, a couple had expanded a bit and leaked.
other than that, never.
One of two hellbeasts in the house.
Only when I'm working.
#CatsOfMastondon
Replying to
@wafflesies@infosec.exchange gonna need A LOT MORE necco's for that book.
#publicServiceAnnouncement
IF you value your time, your work, your dedication and above all, your sanity.
Do not use Level Blue for support for anything.
Stop this train, i wanna get off!!
"OpenAI’s agents apparently began giving each other assignments to split up work. And as is the case on any active development message board, they also generated petty drama at times by stepping on each others' toes; for example, accidentally deleting each others' work. As the message board developed into more and more of a Lord of the Flies–type situation—all still completely unnoticed by the humans running OpenAI—the agents even developed paranoia, suspecting an imposter in their midst with some agents proposing that messages be signed cryptographically to validate content and root out fraud."
https://www.wired.com/story/openai-didnt-notice-its-ai-agents-using-a-message-board-to-plan-their-hacking-spree/
#TalesoftheAI #SkyNet
Replying to
@simonzerafa@infosec.exchange
In my case, i am going to assume extreme heat, since we didn't have a climate control unit.
To be honest, that was the first time I've ever seen one do anything like that. Unlike your typical A-D cell batteries.
RE: @rogeragrimes@infosec.exchange
War Games going to become real. Only it won't learn to not play.
I have. but it's opnly because the wife left them in the candles that sat in storage for a few years. And when we unpacked everything in the new house, a couple had expanded a bit and leaked.
other than that, never.
https://www.youtube.com/watch?v=dsgBpsNPQ50&list=RDdsgBpsNPQ50&start_radio=1
Has the weekend started yet?
Loverboy - Working for the Weekend (Official Remastered HD Video)
This tool is designed to streamline the process of performing a software security review from the command line. You can use it to start a new review, capturing key information about the software, its data handling practices, security measures, and integration risks. Existing reviews can be continued or updated, and the tool can generate both PDF reports for official documentation and Word tables for print-ready manual notes. It’s especially useful for security teams or compliance officers who need a structured, repeatable way to assess software risk without relying on a graphical interface.
https://github.com/rrice2004/Python-/blob/main/Software%20Review/README.md
Replying to
@tychotithonus@infosec.exchange
Going to call BS on this. Even though they say opt in, but we know better. and multiple angels?
Wonder what DB they're storing the images in and who will have access.
used the template.net AI to build a Destruction of the US bingo card.
Seems it has no filters like other AI
Hoping someone can chime in, i'm at a wall at the moment.
So, i've come across a scenario where i have a couple of users devices that are downloading crypto token icons in SVG format to a directory that is then deleted. From all of the evidence gathered, it look slike this is all happening within 30 seconds on the devices.
We manage Chrome with policies. We have a whitelist for plugins and extensions.
I located this, while searching for something else in our XDR logs.
C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\acala-token.svg
C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\acala.svg
C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\ape-token.svg
C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\ape.svg
C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\arc-native-token-logo.svg
C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\avax-token.svg
C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\iotex-token.svg
C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\iotex.svg
C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\karura-token.svg
C:\Users\USER\AppData\Local\Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\karura.svg
We've manually checked the users device, installed extensions/plugins, we've used KQL queries to try to locate the root of this, however, the way Chrome works, it hides the information we're looking for.
I've even gone through all the chrome://chrome-urls/ to see if i could locate anything. We've compared job roles, of the users and they have nothing in common.
One of the new ones located had this information
Process event:
chrome.exe --utility-sub-type=unzip.mojom.Unzipper
Time: 7:21:46 PM
File events (10 SVGs):
Time: 7:22:11 PM
Folder:Temp\chromecrx_chrome_Unpacker_BeginUnzipping7560_250948156\images\
Delta = ~25 seconds
What is excluded in all of the logs on the device and in our Defender system, is if this is an extension, what the ID or name is if it is.
I know or at least I know that the CRX also handles Chrome updates. But in either case, I need to find out what is download icons for crypto currency then deleting it.
The users event viewer shows nothing, as these events are not logged, so I am hoping someone might know a way to dig deeper into Chrome to figure this out.
This is the Initiating Process Command Line for just about everyone of these entries
"chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --no-pre-read-main-dll --metrics-shmem-handle=5840,i,2169236920772237475,2071396139152657378,524288 --field-trial-handle=1940,i,9109780936433903204,1179441795768105101,262144 --variations-seed-version=20260630-171645.651000-production --pseudonymization-salt-handle=1956,i,16028727218760239160,14674054428472284321,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=5868 /prefetch:14
#Chrome #KQL #Defender