G0rb

"All the world will be your enemy, Prince with a Thousand Enemies, and whenever they catch you, they will kill you. But first they must catch you, digger, listener, runner, prince with the swift warning. Be cunning and full of tricks and your people shall never be destroyed." #watershipdown Richard Adams

@Viss@mastodon.social why the f*ck do they need AI for 17k log lines? Throwing AI at an Incident and calling it "forenaics" is the laziest incident response I've ever seen.

@tagesschau@ard.social was ein Threat-Model und so relevant.

@Viss@mastodon.social @cR0w@infosec.exchange @afeinman@wandering.shop the difference is, grep is deterministic and has a proven track record.

Just renewed my @malcat@infosec.exchange License because it's still my favourite Tool for doing DFIR stuff. You should check out at least the free Lite Version: https://malcat.fr/

@cR0w@infosec.exchange my Threat-Model does not allow for corpo infra. Also, seriously don't connect private stuff to corpo devices.

I don't want to push anyone, but I'd definitely apply for it. SRLabs is doing cool research and rather thrilling projects like [REDACTED]. I can personally vouch for @LisaLobmeyer@infosec.exchange as the responsible team lead for this position and in general the people at SRLabs are pretty chill, top tier hackers. https://security-research-labs.jobs.personio.de/job/2726007 PS: The only downside is, I'll be your colleague. But if you want to do some s*ck #threathunting and collect more CTI about threats like [REDACTED] and the incredible cool tooling of [REDACTED], then here's your chance. #getfedihired #DFIR #advertising

that's some cool iranian open-dir http://178.239.149.60[/arya/ #shodansafari #opendir #threatintel

@cR0w@infosec.exchange hacking is illegal and for nerds.

I'm having a discussion with my lovely Partner at the moment and need statistical data: If you would be called an infosec influencer, how would you feel about the memory of it?

@cR0w@infosec.exchange I'm trying to improve my threat model so much, that I can do a job without computers and DFIR.

@jerry@infosec.exchange ah okay, so OpenAI doesn't monitor for abnormal outbound network traffic of critical systems.

Shodan-Query of the day: asn:"AS59399" vuln:"cve-2014-0160" #ThruntersAnonymous #shodansafari #yeet

@flyingpenguin@infosec.exchange as long as the NSA, CIA and Pentagon parking lot is constantly pinging out the serials from the cars tire pressure sensors, it's even playing ground.

@cR0w@infosec.exchange you totally underestimate the threat of me being bored + to much OSINT services.

@Viss@mastodon.social @jonathankoren@sfba.social I'm pretty sure that you can handle 90% of incidents with the compute power of an 8GB RaspberryPi 5.

@fluepke@chaos.social Shitposting is an Anagram of Top Insight

@cR0w@infosec.exchange Love it. So quantum edge devices will have dozens of open ports (one for every quantum entanglement / connected client). This means a corp with 5000 devices will now have 5000 "ports" to suck up ../ instead of one public facing.

@Viss@mastodon.social I would love to have incidents with 17k of log entries. A normal Plaso/Log2Timeline output has easily more than 2 Million lines and even they can be easily analyzed with Klogg as an log viewer. The hell you can even use grep for such pathetic stuff and their first idea is "Frontier AI Model"? Exactly that's the reason why companies get (more or less) independent, external forensics. If you can't defend your environment to a certain degree (and honestly, nobody hates on you when you get pwned by nation state threat actors) then you are far away from the skill level needed for good digital forensics.

FunFact: #nsogroup's internal sharepoint had/has the subdomain conflu.nsOgroup.com #dadhumor #pegasus

@cR0w@infosec.exchange @theorangetheme@en.osm.town exactly this so much.

@FritzAdalis@infosec.exchange just for you 😅 http.html_hash:1670442135

@brahms@chaos.social by me?

@theorangetheme@en.osm.town was an unsecured C2 Panel, just cleaned up a little bit.

@jfslowik@infosec.exchange small related Funfact: https://beta.shodan.io/host/214.3.115.13

Took some time... Feeling a little bit sleepy

@mikemacapple@mstdn.social ja, aber denk doch mal an den armen Merz der diese Stimmung aushalten muss

@cR0w@infosec.exchange wasn't a CISA KEV yesterday, and they still have till 4th of August to patch.

Shodan-Query of the day: hash:-220028446 #ThruntersAnonymous #shodansafari #APTSweatyPants

@dirksche@social.tchncs.de we should definitely drink one together. Your profile looks like person I would have fun and feel comfortable drinking beer with.

@corq@infosec.exchange another ../-victim

Wie inkompetent kann man sein? https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals

Deutsche Cyber-ThreatIntel be like:

Evidence of Shitpost:

@p3m@mastodon.social sure. Also something I regularly use. Malcat is my first tool if I need a quick overview and write some Yara Signatures, afterwards it's Ghidra vor Radare2

@LisaLobmeyer@infosec.exchange @srlabs@infosec.exchange @darfplatypus@infosec.exchange after carefully considering your infosec-shitposting skills I come to the conclusion that you should apply so we can hunt [REDACTED] together and do some dope research on them.

I believe their is at least one APT Operator followong me on Mastodon. #WhoKnows #GottaKeepThemOnTheirToes

@cR0w@infosec.exchange if I quit doing forensics, I'll start with tactical tarot incident response.

@quinn@social.circl.lu noooo, just drop that 17k logs Ingo an other AI Model. Problem solved.

@netzpolitik_feed@chaos.social @BlnBDI@social.bund.de clever, der Kamera Hersteller Saige hosted seinen Kram in der Google Cloud, aber immerhin in Europa (auch wenn das die US-Dienste sicher wenig interessiert).

32a451ea903c655f5a7c5693a3034832

@flyingpenguin@infosec.exchange wow, you are awesome

@geheimorga@chaos.social ist fremdgehen dann DLL-Sideloading?

@EricAlper@mastodon.social Mr.Robot

c093b8c996e66e6b91ffc1e9937f3c8f5fdc7033

@dirksche@social.tchncs.de ouh, located near nuremberg atm. But I'm in Stuttgart sometimes.

@kinghaunst@sueden.social jap, basically das selbe Problem das die Consulting-Branche hat.