I’ve seen a few dry runs of the absolutely fire talk Reino has prepped for everyone at DEFCON this year. Want to see multiple exploit chains on a widely deployed PED device deemed so impactful the vendor asked us to wait two years to disclose, then catch “Very Pwned” https://info.defcon.org/defcon34/content/66621

info.defcon.org

Dominic White @singe@chaos.social

· 2mo ago

Replying to

And unlike traditional cyber insider defence they have access to the attackers thoughts! Those thoughts appear to have revealed the patterns of abuse regularly. This speaks to a scary lack of monitoring of high autonomy agents that can have vast implications beyond just cyber. (3/3)

Dominic White @singe@chaos.social

· 2mo ago

Replying to

A shared package proxy vulnerable to file writes with a simple PUT, that was exploited with hundreds (thousands?) of writes by many different agents speaks both to shoddy security, monitoring and a failure of imagination. Then to have it happen again without a major rethink! (2/3)

Dominic White @singe@chaos.social

· 2mo ago

I really like this evaluation matrix from @Roeloftemmingh@infosec.exchange @bsidesjoburg@infosec.exchange keynote for judging quality in a flood of AI slop. The one that resonated with me in particular was: “Has this person ever paid a cost for being wrong”

Dominic White @singe@chaos.social

· 5mo ago

Periodic reminder - there’s no easy way to clear tracking cookies and other cruft from iOS apps. But you can do it across all of them with one easy shortcut! It won’t log you out of the app just get rid of the cruft from the in-app browser.

prefs:root=SAFARI&path=CLEAR_HISTORY_AND_DATA

Dominic White @singe@chaos.social

· 6mo ago

Replying to

@chetwisniewski @tomw @campuscodi GoldDigger malware has been rampant in South Africa and Southeast Asia for the last year and a half or more. This will make a big difference.

Dominic White @singe@chaos.social

· 5mo ago

I’m reminded of the disconnect between typical vuln scan/pentest XSS findings and real world exploitation by this write up of Russian exploitation of webmail apps https://ctrlaltintel.com/threat%20research/FancyBear/

How do you demonstrate XSS impact beyond the classic alert dialog or cookie stealer?

ctrlaltintel.com

Redirecting…

Dominic White @singe@chaos.social

· 6mo ago

Replying to

@haroonmeer@infosec.exchange by far the most important part of this was the title, which is why I boldly ask: did you mean “crummy”?

Dominic White @singe@chaos.social

· 6mo ago

Replying to

@haroonmeer@infosec.exchange I figured invoking “crumbs on the table” could have had some play with the content.

Dominic White @singe@chaos.social

· 43mo ago

I was interviewed for a local TV about the legislation & enforcement of personal data protection in South Africa. It was triggered by the sentencing of the person convicted of the Experian breach. I made the point that credit bureaus remain the problematic loophole in our privacy legislation while they are allowed to collect data & sell it without our consent - beyond purposes of fraud prevention.

My bit was clipped but I’m happy we got Szymon’s new art project in.

https://youtube.com/watch?v=-kmIPSJkeJs