Mark Bryant

@cR0w@infosec.exchange “IOCs valid until the bad guys change them. There, you have an expiration dumb ass.”

@johnduggins@infosec.exchange I hate to say it, but a $100 submission fee might cut back on that. The revenue stream should be cycled back into the pay outs. Maybe a tiered payout table with tiered submisson fee based on what you claim you find. Start with highest fee verification first. If verified you get the fee back and the payout. Independent auditing required to keep it on the up and up. 🤷‍♂️

@GossiTheDog@cyberplace.social Wasn’t it an Englishman that started all this anti-vax stuff? Yeah, I remember now. It was Andrew Wakefield. Total cunt.

@buherator@infosec.place 💯 a world wide phenomenon.

@mttaggart@infosec.exchange Ah, Eve Online, how you absorbed almost every free moment of my life for years. That was back before it sold, in the good old days where you could only play for $15 a month and nothing else was for sell except in ISK. Had a smallishly popular blog and YouTube channel about my adventures. Participated in some truly huge ops like this. It was still only $15 a month. I still have my account. I still have billions of ISK in ships, merchandise and cold hard cash - at least last I checked. Maybe they server wiped. Don’t know. Somewhat curious what inflation is like but not enough to go back in. All my friends have left too and that was always the best thing about the game back then, even if they were sometimes your “enemy.”

@bryan@dusty.ninja As the (illegal in this state) M-80s went off last night I shouldn’t have wished they’d all go deaf.

@david_chisnall@infosec.exchange I’ve a computer science degree from the mid 80s. I then spent the next decade on another career. While getting my degree, the term “binary” was only used to refer to base 2 numbers. Period. We didn’t even program in it. Assembly language was in base 8 and later base 16. When I started working my second career in computers in the mid 90s, binary was being used everywhere for programs. I had no idea why. It took me a while, but fortunately I was working at HP and there were many early computer scientists I could talk to. It’s all the fault of software developers. At some point after assembly language went out of fashion, they started using the word binary to distinguish between compiled and uncompiled code. Then it got picked up by lay people. Now we’re stuck with it. However, as a serious computer scientist I never use the term willingly unless I get deer-in-the-headlights look from lay people like sales reps, personal assistants, CEOs and devs.

@chetwisniewski@securitycafe.ca @Viss@mastodon.social Heard something today that kinda put this AI escapism into perspective. If you’re blue team, and you setup a sandbox in which to detonate malware, and the malware escapes the sandbox and nails you environment, the problem is not the malware but your incompetence in creating adequate sandboxes, which should be grounds for termination. Okay, I added that last part, but that doesn’t not make it true. This sandbox failure is neither new nor really unique. It just means they need better sandbox engineers.

@rk@mastodon.well.com @thomholwerda@exquisite.social There were so many similarities between the two (and I used both) that I can’t argue against this…nor would I want to.

@bryan@dusty.ninja Well, I’m slightly deaf if one ear due to an artillery mishap (not mine but I was the recipient) and it’s annoying as hell, but my livelihood is earned at a keyboard and I’ve too much arthritis to retrain my typing now. I’ll take the deafness. Bonus: I won’t hear the M-80s anymore. 😂

@0xabad1dea@infosec.exchange “what is WRONG with you” Desperation

@hannorein@mastodon.social Send them to me! My starting rate is $1000 per minute. Additionally minutes can be purchased on credit card confirmation. (DISCLAIMER: I am only an AI (Analyst Ingenious), not a developer. If you or someone else is experiencing buggy code, contact a real developer immediately. Buggy code is a fact of life, and I bet now you regret not having learned any real skills.)

@Viss@mastodon.social My dinner was Chicken and Andouille Gumbo; no okra (wrong part of the country) but extra jalapeño and Anaheim peppers. Only works if you make enough for 10.

@ifin@infosec.exchange @gayint@infosec.exchange

@wanderinghermit@mindly.social The company sent me to Las Vegas where I’ve been “hanging out” with 30k+ of my newest closest not really friends. And then there are the tourists. While it’s been an education in more ways than one, when I get home I think I’m going to just go into self imposed exile from all interpersonal anythings.

@h2onolan@infosec.exchange @Viss@mastodon.social grep with awk

@scalzi@mastodon.social Don’t need a Steam Machine. Been playing games on Fedora for over a year now on a 6 year old AMD CPU and a 2 year old Nvidia card. I did pick up a Steam Controller on the 2nd round to replace my nearly 20 year old Xbox controller (the sticks were getting pretty sloppy.) The controller is really good. Fits my hands better. Very responsive and accurate (always a great combo.) Can recommend.

@GossiTheDog@cyberplace.social Hot damn! Shoe’s on the other foot now isn’t it Sharefile. Suck it.

RE: https://mas.to/@SmudgeTheInsultCat/116871148508544099 My grandmother wouldn’t share her fried apple pie recipe or how her fried gizzards and gravy was always perfect so she can pout all she wants. My roasted chicken beats her’s any day of the week and I’ve not died of a heart attack young. (PS: I loved her very much.)

@patcharcana@furry.engineer @cR0w@infosec.exchange I’ve told users for decades it was okay to write (only) their password (no account name) on a piece of paper and stick it in their wallet. Hackers aren’t really into mugging. Just don’t ever throw it away because spies dumpster dive. 😉

@GossiTheDog@cyberplace.social Nope. That standard stuff works just fine. Hardest hit we’ve had in a while was pure social engineering of the user and help desk (I’m sad to say.) They just call…

@bryan@dusty.ninja I work with a man who had a stroke while being born and has only partial use of the left side. He bowls better than I do. Also works at a keyboard for a living. And he’s wicked smart. A true inspiration!

Anyone got intel on 103.215.75.19? Would love anything or a lot of people are going to be upset when I reel them back in from their weekend. @ifin@infosec.exchange @gayint@infosec.exchange

What is Lindsey Graham had to die so Mitch McConnell could live? This is a post about necromancy.

Regardless of where you stand in the #FIFA controversy, there is no denying that a sport with a reputation for fairness is now no different than any other #enshittified enterprise and we are all of us poorer for it. It feels bad.😞

And in case the reason isn’t apparent, here’s a graphic of the Earth at both equinoxes and solstices. At no point is Earth’s axial tilt less than 23.45 degrees. And yes, I get that the other is supposed to highlight solar radiation exposure and is technically correct… BUT NO TILT! AAAAAAAAAAA…

@briankrebs@infosec.exchange @LillyHerself@mastodon.social There was a time in my youth when the advertising industry was imminently respectable. They worked hard to tailor ad campaigns to their target audience in pleasing and attractive ways. Hell, some jingles from those times are culturally significant! When the Internet came along, it continued to be that way for a time, until men of lesser talent realized that quantity has a money earning potential as great as quality and they now had the medium that would support the wholesale enshittification of a once honorable profession. Thanks Google.

RE: https://infosec.exchange/@BleepingComputer/116883764643887984 You sure can tell CISA is now run by a bunch of Corporate wankers. Lots of orders, but is it actually getting done? I have doubts.

@GossiTheDog@cyberplace.social PS: we did raise these concerns when management announced everyone was getting Copilot. Took months (and months) to get them to agree to a test. “No one will be able to see anything they don’t already have access to,” they said.🤷‍♂️ Yes. Exactly.

@0xabad1dea@infosec.exchange I still have a copy on CD around here somewhere…

@catsalad@infosec.exchange @SecureOwl@infosec.exchange True story. I was interviewing for an IT job at UO after leaving the Army in 1995. The last leg of the route to the interview paralleled a river. Was going over interview type things in my head when suddenly (it’s always suddenly) a salmon falls out of the sky and hits the road 10 feet (or so) in front of my car. I drive over it, look into the rear view mirror, and indeed there is a Salmon flopping around on the road behind me. Started laughing. Laughed all the way to the interview. Tried to keep my composure as it started but couldn’t. Started laughing again and just had to get it all out. Had the whole room in stitches. Got the best personal call back ever. Everyone wanted to hire me but HR vetoed it because I “lacked work experience.” They could have hired a vet and a salmon connoisseur. Their loss, but at least we had the Salmon moment to remember.

@stshank@mstdn.social Modern theropods cannot sense capsaicin, or so they say but I’ve never seen a paper on it. This is purportedly an evolutionary adaptation to keep mammals from eating seeds that will not survive their gastrointestinal tract. However, I have far too much experience (to PTSD levels if I were to be honest) with chickens. I know of no seed that will make it through their gizzard without a hard shell. Needless to say, I doubt the veracity of the capsaicin evolutionary tale. But from what I know of most bird seeds, they are made of hard shelled seeds. Reading what @bryan@dusty.ninja wrote, it sounds like he got a suet based block. That could bind softer seeds and would emulate the plant tissue around pepper seeds where the capsaicin actually is. Anyway, just rambling some thoughts here. Tl;dr - I think it’s just a marketing ploy.

“One of you must do this.”

@GossiTheDog@cyberplace.social That said, my old Eve Online account hit 265 strength putting it in the top 20%. Honestly don’t know what to think about that.

When I am Emperor, service will be mandatory and all those who like loud bangs will be conscripted first. That way they can get all the loud bangs they can stand, and then some. Just like I got and no longer appreciate. Then they might learn what true patriotism is.

@GossiTheDog@cyberplace.social My name is in the top 4%! Oh wait, I can’t jump and have never been an NBA power anything.

Today I learned that at some conferences it is expected that if you have two talks back to back in the same room, it is expected that you leave and join the line to get into the second talk rather than just wait. Been to a lot of conferences where that’s not a thing, but sure, I get how that’s only fair for to those who got in line half way through the first talk. Also, you can leave con staff speechless when you have been working in the industry for decades but confirm this is your first time attending in response to their question to your point-of-order question.

@cR0w@infosec.exchange @Viss@mastodon.social @BleepingComputer@infosec.exchange Here is today’s example just because. They nailed this guy twice last month - poor SOB. Also, fuck Cloudflare but at least they put up a warning.

@cR0w@infosec.exchange @Viss@mastodon.social @BleepingComputer@infosec.exchange I’ve been very, very close to Azure tenant password sprays (more accurately credential stuffing) for over five years now. In those 5+ years there was only one time they got a correct password and past MFA. We have a few correct password a quarter, but those accounts are quickly reset. Seriously, there is no news here. It’s business as usual. Clickfix, Teams vishing and device code phishing were far more serious. Now we’re continuing with SEO poisoning (fuck Gemini) rejuvenating the good old MitM credential harvesting shtick. Those are far more news worthy than low effort credential stuffing attacks.

@GossiTheDog@cyberplace.social And then there is the non-monetary costs. We recently completed our first penetration test against Copilot in my corp and to say we found a lot of secret and confidential stuff out there just for the promoting is an understatement. The company totally believed Microsoft when they said everything would be safe guarded, yet I personally found a document with every marketing service account name and password. Vender contracts, company secrets, legal documents: we found it all. Copilot in a corporate environment is the single largest amplifier of poor IAM configurations. It is the largest insider threat I’ve ever seen.

Used the Internet Archives’ Wayback Machine (https://web.archive.org) today to analyze some malicious JavaScript from a website defacement that happened a month ago even though the domains hosting it are no longer active. Feels good! 👍

Aye, matey.

@cR0w@infosec.exchange Stack Exchange wouldn’t be the site it is today without Linus Torvalds.