Marcus Hutchins :verified:

https://infosec.exchange/@malwaretech

Cybersecurity

Website: https://marcushutchins.com
Security Blog: https://malwaretech.com

Public Key

npub1uu7gddsfwccptfz3wgqqgxz0wuwx302e07k3u475he6qzasfkz4q0hgs7t

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsww0yxkcyhvvq453ghyqqyrp8hw8rgh4vhltg72l2tuaqpwcymp2sprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntdtg8p2

Publishing to

relay.momostr.pink

Author Public Key

npub1uu7gddsfwccptfz3wgqqgxz0wuwx302e07k3u475he6qzasfkz4q0hgs7t

Show more details

Last Notes

2026-07-22 21:44:21 UTC

My take on the story about OpenAI's model going rogue and hacking a competitor's systems, why it matters.
Also probably the fastest turnaround time for a video that I've managed so far. I'd just got off a 12h flight when the story dropped.
https://youtu.be/GB8gaeI0fLs?si=ss3hD78xG2XUREYn

2026-05-07 18:36:32 UTC

I found a zero day in a security vendor's firewall software that allows you to remotely crash the entire system by sending it a single malicious packet. Since the firewall is responsible for inspecting traffic prior to the operating system handling it, no ports even need to be open for it to work.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/534/738/287/375/008/original/2eb9415580efecdf.mp4

2026-05-05 05:24:43 UTC

I built an AI that autonomously finds zero day exploits https://www.youtube.com/watch?v=BLqRiL_GY3A

2026-04-30 14:23:27 UTC

Listening to cybersecurity people freak out over Mythos is so tiring. Like, bro, your local water treatment plant runs Windows XP, your mobile provider's hardware is older than you are, and the protocol that routes internet traffic is secured by everyone just agreeing that hijacking it would be uncool.

2026-03-18 23:53:59 UTC

After years of planning a potential collab, I finally got to sit down with fellow cybersecurity YouTuber David Bombal for an in person interview! Below you can check out the video from what will hopefully be the first of many more collaborations 😃 :
https://www.youtube.com/watch?v=KsXzTz5H2QQ

2026-03-09 00:10:17 UTC

- reply

"feedback" is not what I'd call that, unless you meant your intention was for the recipient to feed it back into their shredder.
All you did was make a bunch of baseless and asinine assertions, then accuse me of spreading "FUD" by... *checks notes*
explaining how the law actually works.
You get what yo give

2026-03-08 23:00:23 UTC

- reply

Each sentence of your comment is increasingly dumber than the last. "We’re all aware that international treaties exist" yeah, your average internet user definitely understands international legal assistance processes.
There's nothing "FUD" about my statement. It contains only facts which enable users to better inform their decisions.
"breaking US tax law is unlikely to have any impact on Swiss authorities" Is an extremely funny statement given it was the US who forced Switzerland to roll back some of it's bank secrecy laws so the US could go after tax evaders.
If you're gonna accuse me of spreading FUD, at least put in a modicum of effort.

2026-03-08 22:29:52 UTC

It feels like Proton are being intentionally misleading in their statements. They know that most of their customers aren't familiar with how legal process actually works, so are happy to spread half-truths.
Under US law, a US law enforcement agency (LEA) typically has to apply for a subpoena or search warrant with a US court. The court is then responsible for deciding if the legal bar for search a request has been met, then either grants or denies it.
The problem is, if a company has no real US footprint (no US corporate entity, offices, servers, etc.), then a US court typically doesn't have the jurisdiction to compel the company to hand over customer data (except in some rare circumstances). Even if the court approved the warrant anyway, it wouldn't really be legally binding.
Which is why the Mutual Legal Assistance Treaty (MLAT) exists. MLAT enables law enforcement agencies in one company to send requests for information to law enforcement agencies in another. Switzerland has such a treaty with the US. This means that the FBI can request that Swiss authorities hand over a Swiss company's data on their behalf.
Any country requesting information held by a company in a foreign jurisdiction would typically do so via MLAT. Which means from Proton's perspective, the legal request would appear to originate from their local law enforcement, not the FBI. Which they clearly understand based on their Reddit post.
Saying "we don't respond to legal requests from anywhere other than Swiss authorities" seems very intentionally worded to give the impression that the company does not cooperate with foreign law enforcement. But since it'd be the Swiss authorities handling any such requests, they'd have to comply, since as they admitted, they have to comply with local laws.
There is, however, some useful (but more nuanced) information here:
Firstly, MLAT requests are handled by local law enforcement according to local law. So if there is a difference between the law of the sending and recipient country, that might mean the MLAT request is denied. That probably doesn't mean much, because if you're on the FBI's radar, the chances are you did something that is also massively illegal in Switzerland too.
Secondly, they are 100% correct in saying that no other service provider is going to do any better. They're all beholden to local laws, and the ones that think they're not tend to get their doors blown off by SWAT like CyberBunker did. The only exception is if the company resides in a country which does not cooperate with US law enforcement (which Proton does not).
But the part that's extremely disingenuous is that the "we only respond to requests from the Swiss authorities". That statement is likely intended to imply they don't cooperate with law enforcement in any other countries, which is simply not true. Switzerland has MLAT agreements with over 30 counties.
People really need to understand that no company is going to shield you from the FBI (or any reputable law enforcement agency). They'll use misleading statements to make it sounds like they don't cooperate with law enforcement, but they do. They have to.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/195/916/812/004/684/original/c9b267c29540586b.png

2026-02-25 06:09:07 UTC

We plan to decrease operational costs for our AI model by building custom servers that are immune to cosmic radiation, then spending trillions of dollars launching them into space. Yes, our CFO did tech themselves math using ChatGPT, why do you ask?

2026-02-24 20:52:06 UTC

Anthropic when Chinese companies use Claude to train their own AI models vs Anothropic when they’re stealing everyone’s data to train Claude
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/127/585/108/948/125/original/f474ce1657d0aa13.jpeg

2026-02-08 20:59:15 UTC

When the state sponsored threat actor has vibe coded their entire control server, all the login code is client-side, and they’ve infected themselves with their own malware.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/037/016/208/070/006/original/211e71447c96776e.jpeg

2026-02-03 05:01:56 UTC

I can’t believe we’re doing this again. It’s just a bot that generates the text you ask it for. If you put it in charge of critical decisions, it will kill people. Not because it’s secretly evil, but because it’s a word generator. It’s like putting your toaster in charge of air traffic control.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/004/940/386/328/628/original/7d05413e7c3f2ac8.jpeg

2026-01-20 21:14:51 UTC

My latest blog post investigating a malware campaign which infects victims by utilizing only legitimate infrastructure. The malicious activity spans hundreds of hacked websites, the BSC blockchain, and a popular CDN.
https://expel.com/blog/clearfake-new-lotl-techniques/

2025-12-27 18:08:11 UTC

One concern about the AI bubble that I've not yet seen discussed is how many All-In podcasts it's going to create. Every time one of these AI companies is bought or IPOs, it creates like 10 new billionaire who will start a podcast where they pass their single brain cell around a table and influence people on issues they know nothing about.
Remember when David Sacks and Jason Calacanis got together with Elon Musk and tried to sabotage Ukraine's defense because they convinced themselves that angering Russia would lead to a nuclear war? Now imagine there's 400 of them. At this rate the entire media sphere will just be midwit billionaires with podcasts.

2025-12-15 17:38:26 UTC

The tariffs certainly appear to be working. American companies are no longer importing goods from China. Instead, they're becoming Chinese companies and producing good domestically.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/724/799/528/162/680/original/d2f4f8a00ab0abb7.png

2025-12-13 20:55:48 UTC

Ever since Amazon ruined 30,000 people's holidays be laying them off in the name of "efficiency", they've massively improved their next day delivery system. It used to be that I'd only get one next day delivery per package, but now I get 5 for the price of one. Every day they tell me it's arriving the next. Incredible value for money!

2025-12-11 19:59:28 UTC

Is it me or are major internet platform outages getting more frequent? I used to instinctively reboot my router, now I just assume it's the platform. GitHub broke for me this morning, now LinkedIn is offline. Reddit and Twitter feel like they go down twice a week. Meanwhile all these companies are bragging about layoffs because they've "become more efficient with AI". Like, dawg, you can't even keep your website online.

2025-11-28 20:20:29 UTC

Here's an easy way to understand the US "hacking back" / Offensive cyber operations proposal: You lose the keys to your house down the back of the couch. It would be very time consuming to try and dig them out, but buying new locks would cost money.
The least expensive option is to simply remove the entire front door, which your family approves of. This would leave more money to gamble in the slot machine (some guy who says he is 100% definitely not the owner of the slot machine has told you that if you put in enough money, you will receive a return on your investment).
After voting to remove the front door, someone walks into your house and steals your TV. Having to buy a new door, new locks, and new TV would cut into the slot machine fund. Which is unacceptable.
You decide the most cost efficient option is to track down every thief in the world and punch them in the face. The family agrees that punching every thief in the face would certainly deter any further theft, and have absolutely no possible negative consequences at all.
The not slot machine guy has also offered to buy all your house's windows for $30, to help you recuperate some of the losses from your TV being stolen. You agree that this is indeed a good deal, and proceed to remove every window.
One day you come come to find a 600 pound grizzly bear rooting around in your pantry eating all your food. Your are completely perplexed. Despite your best efforts to secure your home against theft, people have still been walking in and taking whatever they want. However, a grizzly bear is new.
You consult with the not slot machine guy, who has recently used all his not slot machine money to buy up every local hospital. You are concerned that the punching everyone in the face policy does not appear to have affected theft rates. Also, this policy was designed for humans, not bears.
The not slot machine guy reassures you that this is the best way. He tells you that you just aren't punching people hard enough. He also says that there is no reason why the same policy couldn't also be applied to bears. He sells you some punching classes for $5 trillion dollars and send you on your way.
With your new found punching skills, you are now ready to fight the bear. You return home to find out that all of the local bears have learned that your pantry is a great place to get food. There in now an entire group of them. That is ok though, you've been training for this.

2025-11-17 04:57:28 UTC

Do You Need To Worry About China's Agentic AI Cyberattacks?
https://www.youtube.com/watch?v=siZaZf3lK_8

2025-11-13 07:36:28 UTC

This post from the President of Windows basically reads like someone trained an LLM on those SF billboards that just say incomprehensible nonsense.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/541/238/524/941/100/original/f5ed0b44f69f166d.png

2025-10-30 16:27:51 UTC

Watch OpenAI go public and just follow Tesla's business model (convincing retail investors to shovel their money into a fire while announcing "AGI is coming next year" every year forever).

2025-10-28 00:55:13 UTC

This would be extremely significant. China implemented a similar law in 2021 requiring security researchers to report zero day vulnerabilities to both the software vendor and the Chinese government. It was followed by an absolutely massive explosion in zero day use by CN state sponsored groups.
I suspect it not only lead to a huge increase in the number of zero day exploits China was in possession of, but also their calculus on how and when to use them.
Normally, zero days are used very sparingly. There is always a risk they will be detected and patched. However, if the vulnerabilities are being simultaneously reported to the vendor and the intelligence services, they're getting patched anyway. There's very little downside to using them, and only a small window to do so.
I can't say 100% the legislation change is what caused the changed in behavior, but since then, there have been many documented cases of Chinese APTs using high value zero day exploits to indiscriminately hack systems. Not just high value targets, basically anything with an internet connection.
https://risky.biz/risky-bulletin-russian-bill-would-require-researchers-to-report-bugs-to-the-fsb/

2025-10-25 01:45:39 UTC

Absolutely incredible stuff coming out of Bozo The Clown School of Economics.
1. convince everyone you're going to fix the economy by slapping tariffs on everything.
2. Tell Americans that other countries will pay the tariffs, even though tariffs are paid by importers (you).
3. Americans gets mad when beef prices go up because as it turns out, importers do in fact pay the tariffs.
4. That's ok, the tariffs were really about rewarding companies who produce goods locally, so at least the American farmers are happy.
5. Wait, never mind. Other countries have started importing beef from elsewhere because US beef is too expensive now.
7. Don't worry though, it's all part of the plan. We will fix this by simply giving $20 billion dollars of taxpayer money to Argentina.
8. Ok, that didn't seem to have worked. Maybe if we announce we're going to give them $40 billion dollars instead?
9. Hmmm, bailing out Argentina doesn't seem to have fixed the US economy.
10. Lower Argentina's beef import tax rate to less than it was before you got into office, costing US farmers even more money.
11. Somehow all of this is actually good and part of a completely sane economic policy, I'm just too dumb to understand the grand plan.
MAGA - Make Argentina Great Again?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/432/274/878/019/634/original/551dacad58e4c810.png

2025-10-24 20:09:56 UTC

Did you know that you can passively download malicious payloads onto target systems?
Lots of software caches images locally to save bandwidth, often without stripping metadata.
You can leverage this functionality to download payloads.
Simply store your payload inside a valid image, then just have the target's web browser or email client download it for you.
No more web requests to obtain follow-up payloads!
https://malwaretech.com/2025/10/exif-smuggling.html?a=1

2025-10-17 15:03:38 UTC

You know how billionaires end up with severe cognitive deficits as a result of becoming surrounded by yes men who constantly tell them their every idea is genius? What if we made a bot that just does that to everyone. I think that would be great.

2025-10-08 16:41:45 UTC

We encountered a unique variant of the ClickFix malware technique. The catch? The user is social engineered into running a PowerShell script which downloads no files, makes no web requests, and embeds no payload.
Regardless, it's still able to install a malicious loader to maintain a foothold on the infected system. Check out my latest blog post to find out more:
https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/

2025-10-03 23:04:35 UTC

Looks like the 3rd party platform Discord uses for support tickets got breached and someone was able to gain access to Discord user information as well as trust & safety reports
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/312/733/307/736/834/original/53d654fc338cb929.png

2025-09-23 23:29:42 UTC

Did The Secret Service Really Foil A Plot To Destroy New York's Cellphone Infrastructure?
https://www.youtube.com/watch?v=TBZj_h0zujY

2025-08-04 08:32:58 UTC

Every Reason Why I Hate AI and You Should Too
https://malwaretech.com/2025/08/every-reason-why-i-hate-ai.html?a=1

2025-08-01 16:34:02 UTC

It's wild that Apple was the only major big tech company to not drink the AI kool aid, and now they're being forced to because every dipshit analyst is like "well the earnings are really good but we're concerned about the lack of AI". How are these people real 😭

2025-07-31 04:32:54 UTC

I'd be curious to know how much of Meta's huge increase in ad revenue this quarter is down to AI companies lighting VC money on fire to get their name out there

2025-07-28 17:08:37 UTC

In the interest of both being an AI hater and doing things purely for content, I've signed ChatGPT up for a brokerage account and given it several thousand dollars to trade with. Will report back with how it goes.

2025-07-26 04:47:20 UTC

Not really buying this claim from Tea. I'm not aware of any laws which require platforms to retain raw identification documents, especially not for "cyberbullying prevention". Some laws require retention of user metadata like IP addresses, but retaining photos of government IDs used for ID verification is just plain reckless.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/917/719/333/469/528/original/9407b42d0d9e6ed6.png

2025-07-23 20:15:39 UTC

This is what it's like publishing research in 2025. I write an extremely popular blog post on EDR bypasses and Google just comes along and steals my search traffic in the most brazen way possible.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/904/382/725/891/160/original/cce7dbee3382637d.png

2025-07-23 19:32:35 UTC

The part I still don't understand is a large portion of the internet monetizes traffic via Google Adsense. By replacing search with a chatbot, thereby encouraging people not to visit websites, they're cannibalizing their own revenue sources in a way that they'll never be able to recoup with AI. Not really sure what Google's endgame is here.
https://www.404media.co/googles-ai-is-destroying-search-the-internet-and-your-brain/

2025-07-23 18:13:16 UTC

Being in tech and having a single modicum of critical thinking is just screaming "this isn't what LLMs are designed for" over and over. Meanwhile people are shoving a bunch of word predictors into critical decision making processes because a glorified used car salesmen told them it would fix all their problems.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/903/901/461/293/709/original/91cc2be28c993efe.png

2025-07-11 05:45:21 UTC

A programming fact that still amazes me is that the HTTP header which containers the referring url is called "referer", because the developer spelt "referrer" wrong and the spell checker didn't catch it, so it made it into the official standards and they just never changed it lmao

2025-07-11 04:46:42 UTC

I've changed my mind about AI. I now believe it will be able to replace programmers. I asked Grok a question and it responded by forgetting how to use its own API, spending 3 minutes trying to read the documentation in-between failed attempts at getting it to work, then just gave up entirely. It's just like me fr.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/832/782/221/290/392/original/36d39acc4ea9f424.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/832/782/222/258/645/original/09d703ed22d1d1b3.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/832/782/219/589/011/original/de2ef6e1527926a0.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/832/782/221/320/499/original/35d1c9dd27d997c2.png

2025-07-10 01:35:06 UTC

Looking to get started learning malware analysis or reverse engineering? Check out my ever increasing selection of practical labs. Challenge range in difficulty and each one is designed to introduce a new malware technique.
https://malwaretech.com/labs/

2025-07-02 18:46:02 UTC

Yet more companies laying off employees not because AI is replacing them, but because they need more money to fund their AI. I can't remember the last time I saw sunk cost fallacy at this scale.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/785/121/832/072/782/original/a3e5d8c6daff454d.png

2025-06-27 17:23:32 UTC

Useful threat intelligence signal: deploy honeypots to your network then filter out any traffic that matches public databases of known malicious IPs. Malicious traffic hitting your network is interesting, but what's hitting your network that isn't hitting everyone else's is much more so.

2025-06-23 06:11:14 UTC

Cyberwar With Iran: How Bad Could It Get? | Hacker Explains
https://www.youtube.com/watch?v=7MApLKC3_Es

2025-06-12 19:53:51 UTC

The wonderful world of technology: I can't read my (physical) mail, because Cloudflare is down and the mailroom uses electronic access control.

2025-06-05 08:44:51 UTC

As much as I don’t like Generative AI, it’d be beneficial for schools to teach students how to properly navigate it, rather than banning it. People are going to use AI regardless. Everyone needs to understand the limitations, or risk sacrificing critical thinking to something that can’t even think.

2025-05-12 10:03:11 UTC

As much as I love the job security, someone is going to have to stop these AI bros before they have us watering the crops with Brawndo.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/494/287/618/576/384/original/99fe46b2fe5c3613.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/494/287/734/645/542/original/ade27f87a960ba4a.png

2025-05-06 20:48:01 UTC

After 7 years of external circumstances getting in the way, I finally managed to sit down with @npub1j70…q6fl and record a Darknet Diaries episode. Check it out here! :D
https://darknetdiaries.com/episode/158/

2025-05-05 20:47:59 UTC

The AI Intelligence Paradox - An Argument For Why LLMs Lack Intelligence
https://marcushutchins.com/blog/tech/opinions/the-ai-intelligence-paradox.html

2025-05-05 15:55:51 UTC

Soviet Union style planned economy, but make it so that no one involved has any idea what planning or an economy is.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/456/033/894/437/681/original/4257af6c14ab43ae.png

2025-04-16 19:16:35 UTC

This is the kind of high quality cybersecurity content you only get on X dot com. "People support the cybersecurity guy who said the election wasn't rigged because cybersecurity is full of leftists & sexual perversion"
(Note: Chris Krebs is a lifelong Republican & Trump nominee, not even remotely left-wing).
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/349/243/374/911/712/original/15e8d612c6ad837c.png

2025-04-10 03:12:39 UTC

Just woke up to find out the president has revoked the security clearances of everyone at a cybersecurity company because Chris Krebs went to work there. Krebs was his director for the agency in charge of Cybersecurity & Election Security during his first term and refuted his claim the 2020 election was "stolen".
Revoking the clearance of every employee basically kills the company's ability to do government contracts, which is a major source of revenue for cybersecurity companies. The White House press release also restates the false claim that the 2020 election was "rigged and stolen".
The US is basically a fascist dictatorship at this point. One where the president goes after entire companies because a single person spoke out against his verifiably false claims. You'd have to be completely insane to travel here right now.

2025-04-08 18:04:21 UTC

What Is Fast Flux And Why Is The NSA Calling It A National Security Threat?
https://www.youtube.com/watch?v=CQ3nnlZ8nbw

2025-04-08 06:42:18 UTC

I bought $200 worth of stuff from Costco this week and they bought $0 worth of stuff from me. To resolve this deficit I will be charging myself $50 every time I go to the store. With this extra income I will build toasters, which I will attempt to sell to my local Costco for $200 each.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/300/978/517/719/702/original/b6a96a1f935d1746.png

2025-03-28 21:39:34 UTC

- reply

Wait, so he basically saddled all the private equity investors in his startup with the Twitter debt? lmfaooooo

2025-03-28 05:38:18 UTC

The US Needs A New Cybersecurity Strategy: More Offensive Cyber Operations Isn't It
https://malwaretech.com/2025/03/the-us-needs-a-new-cybersecurity-strategy.html

2025-03-11 07:38:42 UTC

DDoS attacks almost always originate from hacked devices. The country/countries that the traffic originates from has never been an indicator of who's behind the attack. Musk's implication that Ukraine was responsible for the Twitter DDoS attack based on seeing some traffic originating from Ukrainian IPs is just dangerous speculation.
I've mapped botnet professionally for a decade, and all that looking at IP addresses locations tells you is the geographical distribution of compromised devices. When you plot this kind of data of chart, you typically just get a heat map of population density, slightly skewed by economic factors. Nations with larger populations tend to have more devices, but developing nations tend to have a higher percentage of older less secure devices, which are more likely to be hacked and recruited into botnets.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/142/654/004/992/205/original/7be0e9fcbce4375b.png

2025-02-16 07:53:49 UTC

Really great thread on Bluesky by @npub1wym…dmr0 about the disparity between economic indicators and voter's actual lived experience.
https://bsky.app/profile/tarah.org/post/3liaxh3vjyk23

2025-02-14 07:40:52 UTC

It's endlessly depressing watching cybersecurity people throw their support behind the government spending equivalent of the My Pillow guy auditing the electoral process. A lot of organizations are now full of insider threats because people aren't able to detach their personal love for Elon Musk from their job to secure information systems.

2025-02-13 18:53:19 UTC

Interesting statement filed in the case against the Treasury and DOGE which gives us some cybersecurity insights. Here's the key takeaways:
- Only a single DOGE employee (25 year old engineer Marko Elez) has direct access to the Treasury payment systems.
- The DOGE employee was only allowed to access the systems from an encrypted government issued laptop.
- The government issued laptop is equipped with monitoring software, data loss prevention, and tools to block internet access, and use of removable storage devices.
- Strict instructions were given that no data could leave this laptop for the duration of the engagement.
- The employee was meant to only have read access to treasury systems, but was accidentally granted write access.
- Following the accident, the employee's laptop was examined and it was concluded that no data had been written during the mistake.
- After the employee temporarily resigned over racist Twitter posts, all access was revoked, and all government issued equipment was recovered.
- The DOGE employee shared updates about his work with another DOGE employee, which "may have occasionally included screenshots of payment systems data or records"
My take:
If true, it seems that unlike other instances at different agencies, the Treasury abided by strict security protocols.
My only real cybersecurity question here are:
1) They document claims screenshots of payment records were shared with another DOGE employee. It doesn't specify how they were shared. Was it just the authorized employee showing his screen to someone, or were they transmitted outside of the laptop? If it's the latter, then it calls much of the claims made in the article into question.
2) This statement isn't clear "The Bureau enabled enhanced monitoring on his laptop, which included the ability to monitor and block website access, block the use of external peripherals (such as USB drives or mass storage devices), monitor any scripts or commands executed on the device, and block access to cloud-based storage services."
The use of the phrase "included the ability to" isn't really clear on if those security controls were actually being enforced. The phrasing could simply mean they enabled software that had those capabilities, but they weren't being used.
Now, cybersecurity aside, the bigger question is what was the purpose of any of this? To audit something as complex as a treasury payment systems, you'd need teams of forensic accountants.
A single 25 year old software engineer with no prior treasury experience poking around some files on a laptop is not an audit. The entire DOGE operation seems like a charade. The organization consists almost entirely of young engineers pulled from Musk's other companies, has produced no plan for how they intend to audit any of these systems, and lacks any oversight at all.
https://www.documentcloud.org/documents/25521978-gov/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/998/084/512/015/506/original/81bb52baef818701.png

2025-02-12 09:14:10 UTC

- reply

When someone is comfortable with making posts supporting the AfD, defending a Nazi salute, and mocking trans people & DEI from their professional account under their real name, you can only wonder what they do in private. I'm certainly not comfortable sharing a space with someone like that, and I'm sure many others aren't either.

2025-02-12 09:06:51 UTC

Lol, Florian is big mad because I called him out for defending a Nazi salute and spreading AfD (German Neo-Nazi party) propaganda.
It's true though, I do dislike him for other reason. I've disliked him ever since 2020 when I had to unfollow him for posting MAGA nonsense. I then disliked him even more when he decided not to respect my decision to leave Twitter and kept reposting my posts there without my permission while simultaneously mocking my choice to leave, and now that he's gone full blown mask-off neo-Nazi, I dislike him close to the maximum amount I can dislike a person.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/990/058/886/676/180/original/d638466668312fea.png

2025-02-09 06:15:39 UTC

Oh man, I have so many stories about the "startup" (Path Network), which the 19-year-old DOGE employee, Edward Coristine previously worked for.
https://www.wired.com/story/edward-coristine-tesla-sexy-path-networks-doge/
My first interaction with the founder, Marshal Webb, was in 2016 when the company was called "BackConnect'. I'd recently posted a research paper on the Mirai botnet, which lead to him harassing me online, simply because he considered himself to be the sole authority on Mirai.
It later turned out, that a lot of his knowledge came from the fact that he was personally hosting the threat actors' infrastructure, therefore had direct insight into the botnet. He tried to play it off as an "intelligence gathering operation". Everyone knew he was really just in bed with the threat actors, but nobody could prove it enough to make a case against him.
At some point shortly after, a DDoS-for-hire service got hacked and its entire customer database along with all DDoS attack logs was leaked online. One of the records traced back to an employee of his DDoS mitigation firm, and from a combination of attack logs and corroboration with customers, it was determined that they had been launching DDoS attacks against businesses, then cold calling them to sell DDoS protection services.
It was fairly apparent from the fact the emails coincided with the DDoS attacks, but did not originate from the the employee performing the attacks that the company was in on it, and this wasn't the work of some rogue employee. Nevertheless, said employee got thrown under the bus, convicted, and was unsuccessful in proving that his employer was in on the conspiracy, although they most certainly were.
Eventually, the founder ended up being named in some kind of criminal complaint or other FBI related court document. The specific wording seemed to imply that he'd gotten caught doing something illegal enough that he'd become an informant to save himself. Amusingly, when the document surfaced, the company just issued a press release about how they were "helping the FBI stop crime" and nothing become of it.
The company has always been shady as hell, and while it's not abnormal for cybersecurity firms to hire reformed hackers, I've not seen a single employee who was not directly involved in cybercrime immediately prior to getting hired. Furthermore, multiple of the employees have been caught committing cybercrime while working for the company.
Originally, when I posted this thread on February 6th, I stopped short of any allegation that Edward himself was involved in cybercrime. Since then @npub1vc3…axsh was able to trace his aliases back to a known cybercrime organization and confirm he indeed was directly involved in cybercrime as recently as May 2024.
You can find Brian's Mastodon thread on the matter here:
https://infosec.exchange/@briankrebs/113965646509637016
https://infosec.exchange/@briankrebs/113957683483583881
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/972/460/071/311/426/original/ac0158c98b850633.png

2025-02-03 04:47:19 UTC

Why I think AI guardrails designed to stop cyber criminals from abusing LLM to generate things like malware and phishing emails are essentially useless security theater.
https://www.youtube.com/watch?v=dLOpEPENwF0

2025-01-25 16:30:02 UTC

The entire tech industry right now
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/889/941/875/043/929/original/4866dcd3365f691a.mp4

2025-01-24 10:49:55 UTC

I went back to the Nerd Reich website to see who in infosec was defending the Nazi salute, and wasn't super surprised to see Florian Roth. He's spent the last few months posting pro-AfD (German Neo-Nazi party) propaganda and interacting with AfD accounts in his replies. Just a heads up for those of you who work with him.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/882/933/230/089/903/original/9ff8cb89692f1cea.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/882/933/478/437/157/original/e7c434d7e6e030ab.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/882/933/948/039/072/original/2af9ed5bce41f452.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/882/949/223/907/168/original/7958046eef66eab3.png

2025-01-18 06:16:48 UTC

I don’t think I’ve ever seen a more perfect reading of Biden’s statement where he waited until the last day of his presidency to tell everyone that they live in an oligarchy
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/847/894/104/790/556/original/56af49248054ae6a.png

2025-01-09 04:56:13 UTC

Why You Probably Don't Need A VPN To Stay Secure On Public Wi-Fi
You've probably heard advice about how hackers can steal all your sensitive information if you don't use a VPN on public Wi-Fi, but is that actually true? In this video I'll walk through some of the major risks of public Wi-Fi such as Man-In-The-Middle Attacks, Rogue Access Points, SSL Stripping, and TLS Downgrades, as well as discuss how modern security measures prevent them.
https://www.youtube.com/watch?v=i7GwjGGwxzg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/796/616/858/522/154/original/73b33f85b5ef4dc6.jpeg

2024-12-16 23:15:45 UTC

None of this feels like the result of any technical limitations. I'm pretty sure they're just trying to maximize their engagement metrics at the expense of Mastodon. IMO Threads should be defederate until they "figure out" how to implement actual federation.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/665/036/041/846/415/original/d2e1f4d014d5a326.png

2024-12-16 22:25:28 UTC

Learn a new language? No thanks, I already work in cybersecurity.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/664/847/206/026/486/original/6bc716eeafac37ff.png

2024-12-14 17:55:36 UTC

- reply

Just back up a bit and you'll be back at LAX lol

2024-12-13 14:32:02 UTC

It’s wild how little Meta has changed in 15 years. They spent an entire year ignoring users’ requests for features that would make Threads usable, then when people started leaving for Bluesky, they tried to get them back by copying Bluesky. Unfortunately, the only feature they can’t copy that matters is not being Meta or having Mosseri in charge.

2024-12-07 12:17:38 UTC

Someone has been flooding Bluesky with bots that use ChatGPT to respond to random posts, disagreeing with whatever the author says in a polite but annoying way. I have no idea what the goal is, but it kind of just makes it feel like Twitter before generative AI

2024-12-07 01:04:21 UTC

A hill I’ll die on every time: NAT is a security feature. It wasn’t intended as one, it shouldn’t be used as one, but it IS one. If I go into my router and disable the firewall, then do the same on every device I own, not a single extra device on my network becomes publicly exposed. That is security. It makes it hard for users with poor cybersecurity awareness to accidentally expose devices to the entire internet. If we disabled uPNP by default, we’d see a huge drop in automated exploitation.

2024-12-03 02:29:35 UTC

This year I'll be featuring in TryHackme's Advent Of Cyber!
Every day until Christmas they'll be releasing a cool new Cybersecurity challenge. It's free to join and there's over $100k in prizes to be won!
https://tryhackme.com/r/christmas
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/586/534/730/933/412/original/47e8921afb288e8b.png

2024-11-30 06:31:52 UTC

Thank god my warranty is ok
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/570/497/101/318/643/original/c3ffb0a6d7b9cf63.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/570/497/363/147/165/original/a2d6fdf7daba2b68.png

2024-11-19 22:35:00 UTC

- reply

Paying $400 for a game is actually insane lol

2024-11-14 16:42:03 UTC

The BlueSky wiki is absolutely hilarious
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/482/289/325/029/953/original/00ca4e78404a1ea2.png

2024-11-14 16:36:21 UTC

FWIW, BlueSky is probably worth also maintaining a presence on. They went the decentralized route too, and It took a bit of time but the users finally managed to bully Jack into leaving the company and selling all of his ownership.
I'm mostly active here & on BlueSky.
https://bsky.app/profile/malwaretech.com

2024-11-14 04:36:01 UTC

Already every time my European friends come to visit I have to defend my decision to live here. But like wtf do I even say at this point.
I can explain that the electoral college is flawed and that every country was doing dumb shit in 2016.
But "yes, I know the country overwhelmingly voted to elect a convicted sex offender with 34 felonies as president, the new secretary of defense is most definitely a neo-Nazi, and the head of the entire federal justice system has been known to occasionally diddle kids, but America really isn't a stupid country if you just give it a chance"
Like, I'm sorry, I got nothing at this point.

2024-11-14 03:55:01 UTC

Oh no, they won the house too.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/479/286/706/920/827/original/776012be248e54f4.png

2024-11-10 20:31:52 UTC

I just saw an FBI agent in the wild wearing one of those jackets that says FBI in big yellow letters and realized I've never once seen one before. I was starting to think it was a Hollywood trope 😆

2024-11-10 16:31:59 UTC

I'm hoping Trump wins the popular vote purely because we really really need to skip the months or years of arguing X or Y state should do a recount, the electoral college should be abolished, the election was stolen, or any other pointless straw grasping & denialism. Every minute spent on that is a minute spent not helping the people whose safety is at risk.

2024-11-07 21:33:19 UTC

Calling my ISP tech support department is the bane of my existence. I don't want be all Ron Swanson "I know more than you", but I also don't have 2 hours to waste while they hold my hand and walk me through debugging a network stack they don't understand, only to conclude the problem is on their side, which I already concluded because I debugged my entire network stack before calling them

2024-11-07 16:16:36 UTC

Honestly, all the election really came down to is very very bad luck. A lot of the fallout from covid only really started to take hold around early 2021 when Biden took office. So for someone who doesn't have a decent understanding of economics (which is most voters), it just looks like "things were good under Trump, things bad under Biden, we need Trump back".
Then you have the genocide in Gaza, which the democrats were going to lose a lot of voters over either way. Their choice was basically alienate pro-Israel voters who would go to Trump, or alienate anti-genocide voters who'd then sit out the election entirely (which tells you a lot about the state of US democracy when giving bombs to a country airstriking hospital, aid workers, and refugee camps full of children is considered the politically safe play 😖).
Then there were a couple of minor surprises which probably had no real effect, but are concerning, like the GenZ vote. Typically younger voters are reliably more liberal than conservative, but I think the red pill manosphere nonsense that sprung up in early 2020s poisoned a decent portion of the male GenZ/younger millennial base and handed them to Trump.
But all in all, I think most of it really just boiled down to a lot of bad shit happened which gave the lead to whoever isn't in office because they can just point at all the fire and say "are you going to do something about those fires?" without needing any sort of plan for how they'd handle anything.

2024-11-07 15:45:46 UTC

I can tell I'm in a social media bubble because everyone on most of the platforms I'm on is being reasonable despite being sad/scared.
Then I go over to Threads and my feed is entirely just left wing voters beating the shit out of each other. They're going after people who voted independent, people protesting genocide, and somehow even Obama is taking strays. I want to say it's bots designed to increase division, but honestly, deep down we all know it's not.

2024-11-06 21:42:30 UTC

- reply

I did learn a lot about business in the process. I came into the industry with the naive view of "just make a good product", and got a reality check.
I jokingly refer to what we were building as a "reverse EDR" because instead of monitoring your network for signs of threat actors, it monitors the threat actor's networks for signs of you.
The model had pretty high fidelity because we weren't just making signatures based on what threat actors might do, then deploying them to the client's network and hoping someone triggers one of the signature. We already knew which networks they're targeting, because we were literally watching them do it.
The problem was, cybersecurity is a very difficult industry in which to evaluate products or quantify their impact. Even with the level of experience I have, if you gave me a bunch of security products and told me to develop tests to figure out which one is best, I honestly couldn't tell you. And for that reason a lot of cybersecurity revolves around how good you are with marketing. Which is where we really struggled.
The means by which we were able to keep close tabs on threat actors were highly sensitive, because if the threat actors found out how we were able to monitor them, they'd just deploy countermeasures and we'd lose our visibility. So what we ended up with was a product that's great at what it does, but we can't publicly explain what it does. So we're basically left trying to sell a magic black box in a sea of magic black boxes with billion dollar marketing budgets.

2024-11-06 21:03:36 UTC

- reply

Quitting was a ridiculously hard decision to make. They gave me the option to transfer to the new company and get founder shares in the process. The new product was honestly one of the coolest things I've seen in a long time, and way better than what I was working on. But having just committed 9 years of my life to nothing, it's kind of hard to again stake my future on a startup, knowing that all matter of things could go wrong.

2024-11-06 20:46:59 UTC

I genuinely though this was gonna be a good year lol. Federal case over, covid mostly over, perfect time to start putting my life back together.
The year starts off with the company that acqui-hired me deciding they want to pursue a different business and disbanding the product we spent 9 years building, vaporizing the majority of my net worth in the process. Then things kinda just kept going downhill from there.
I get the whole "what doesn't kill you only makes you stronger" but I don't have any plans to fight god.

2024-11-06 18:44:50 UTC

While I think everyone is aware of how harmful Trump's policies are, what actually scares me the most is the constitutional side of things. We just went very far into uncharted territory.
When the constitution was created and the US institutions were constructed, they were built on the belief that the people needed to be protected from the government (think they hit the nail on the head there). But...
They put such a strong focus on protecting the people from the government, that a lot of the constitutional limits only apply to the government's powers, not private individuals. Which means that it not only doesn't limit the power of private individuals, but also limits the government's power to rein them in.
This got touched on a bit with the whole Twitter misinformation debacle. The government cannot censor you based on your views, but a private platform can censor anyone for any reason. So what happens if a private individual just buys one of the largest online public squares in existence and pledges his unwavering support behind a fascist?
Trump could not ask, instruct, or coerce him into censoring political opponents, but he could go "gee, I really hate how many followers my political opponent is getting". And a private individual could just delete that person account of their own free will.
Same for a lot of the other amendments too. For the government to search someone's private property, they must show probably cause that a crime is being committed, then argue that before a judge. But a private individual in charge of say, a private social media platform, could just volunteer private user data to the government.
As wealth and power becomes more and more centralized, it becomes easier and easier for the government to side-step all of the checks & balances because everything was so focused on "what if the government tries to do tyranny" and not "what if private individuals accumulate power equivalent to that of governments and take the tyranny into their own hands"
This all of course assume the constitution even matters anymore, as it's basically only upheld by the shared belief that certain principals are immovable, which kind of hasn't been the case for a really long time. It was just never really tested what exactly happens if someone says "fuck the constitution, and fuck the supreme court"

2024-11-06 17:08:02 UTC

- reply

Only thing that really springs to mind is this old video from the Indian philosopher Osho
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/437/098/307/442/723/original/5c8f549fcad009bc.mp4

2024-11-06 17:03:28 UTC

As bad as I thought the election was going to go, that went so much worse. It wasn't even lightly Trump, it was full on just "yes daddy, please fist me"

2024-11-06 05:00:15 UTC

I think regardless of how the election goes, all of Europe really needs to rethink tying so much of their security to a country that's always a coin toss away from descending into fascism. Russia taking Ukraine shouldn't rest on the vibes of a bunch of people who can't grasp the fact that the president doesn't set gas prices.

2024-11-06 02:08:09 UTC

I accidentally double booked my election night party with my browsing foreign real estate party

2024-11-05 21:07:02 UTC

I started doing independent threat research again, and one thing I always need is IP addresses.
It reminded me of a couple years ago I needed IPv4 addresses, so I asked nicely on Twitter if anyone could spare me some, and this ISP gave me an entire /16 (65,536 IP addresses).
Everyone was like "on no the IP shortage" meanwhile I had 65 thousand of them pointed to a single server lmao. OG infosec Twitter was the absolute goat.

2024-11-04 22:31:26 UTC

Non-Americans watching the US struggle to decide between electing a professional career politician or a racist serial sex offender with 34 felony convictions and the IQ of a spoon
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/427/023/978/260/403/original/4df699c5800c7dc7.png

2024-11-02 22:15:14 UTC

Does anyone know much about those account recovery scammers who claim to be hackers who can help you recover lost social media accounts or hack your ex? Are they individuals/small groups or large organizations like the call center scams?
There's a couple who've been using my real name to scam people and I'm annoyed enough to take out a couple of low level scammers, but not yet annoyed enough yet to spend time dismantling an entire foreign organization.

2024-11-02 18:29:49 UTC

- reply

Every one of his businesses follows exactly the same playbook. Build a tech that nobody else wants to build, then use his charisma to convince people to keep funding it until he figure out how to make it work.
He is no longer doing that. He is trying to take on tians who have been in the industry for decades in businesses he doesn't even understand. Betting against Elon is literally free money. xAI is just shit OpenAI, Optimus is shit Boston Dynamics, and his Robotaxi is shit Waymo. All he has going for him is his ever dwindling cult of personalities

2024-11-02 16:40:08 UTC

- reply

It used to be that they'd just quietly inform social media platforms of known disinformation and they'd usually remove it but then somebody whose name begins with Elon and ends with Musk fucked that up

2024-11-02 15:11:33 UTC

Something I've always found fascinating is social media troll bots, because on paper they shouldn't work at all.
Every US election, a bunch of the US' adversaries spin up call centers where they register social media accounts pretending to be Americans. The goal is to basically drive a wedge between the left and right by taking up the other side of any political debate, while being as annoying as humanly possible.
In theory it shouldn't work, because the people running the accounts are minimum wage employees in foreign countries who aren't Americans and have zero understanding of American culture or politics. It should be a "how do you do, fellow kids" type situation, where they immediately get clocked by any actual American.
But it works fairly well, and I think a big factor in why it does is the existence of MAGA. Their politics are so inflammatory, simplistic, and devoid of nuance, that it's actually really easy for someone with little understand of US culture to replicate their talking points and debate style.
So essentially what you get is a situation where the left can't discern MAGA trollbots from actual MAGA voters, the right can't discern MAGA troll bots from actual MAGA voters, MAGA voters can't discern MAGA trollbots from themselves, and MAGA voters can't discern left wing troll bots from their own mental caricatures of how the left behaves. The left wing troll bots seem a lot more apparent to everyone, except for MAGA, but the MAGA ones blend in almost perfectly.
As a result it turns a "this person clearly has no understanding of the US, US politics, or US culture" type situation into a massive raging debate where nobody's really sure who's real.

2024-11-02 13:57:28 UTC

For those with a short term memory:
You really don't need to wonder how Trump would have handled the Middle East. On his 6th day in office he signed an executive order banning Muslims from entering the US. 3 months later he dropped the biggest non-nuclear bomb the US has ever made on Afghanistan for no reason other than he really wanted to drop the biggest bomb they had. Then to round out his first year in office, he gave Jerusalem, the most religiously significant place on earth for Muslims, Christians, and Jews, to Israel, resulting in the UN calling an emergency security meeting where every single member voted "wtf, no", only to get overridden by the US' veto power.
Sure, Biden and Netanyahu absolutely deserve to be dragged kicking and screaming down to The Hague to face a war crime tribunal, but if you think Trump isn't going to make things 1000x worse, just go ahead and save me the time by writing "I told you so" on a sticky note and stapling it to your forehead.

2024-11-02 12:23:38 UTC

Swing voters really be like "hmmm, I just can't decide what to have for breakfast this morning. It's between this cereal I don't really like and an entire raw chicken I found in a dumpster"