Tim (Wadhwa-)Brown :donor:

push(@fediverse, "Adversarial Engineer"); # i hack in Perl

Papers and presentations: https://scholar.google.co.uk/citations?user=vx_iiGYAAAAJ&hl=en
Blogs: https://blogs.cisco.com/author/timwadhwabrown | https://labs.portcullis.co.uk/author/tmb/
GitHub repos: https://github.com/CiscoCXSecurity | https://github.com/timb-machine
Twitter: https://twitter.com/timb_machine
LinkedIn: https://www.linkedin.com/in/timb-machine
Web site: https://www.nth-dimension.org.uk/

Public Key

npub1feda6kwfz0r3vxaferk7alqjpe00gce0gz8n9dfk2zd4kf8q2ngs6a8w07

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsyuk7at8y383ckrw5u3m0wlsfquhh5vvh5prejk5m9px6myns9f5gpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds2zwfqx

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1feda6kwfz0r3vxaferk7alqjpe00gce0gz8n9dfk2zd4kf8q2ngs6a8w07

Show more details

Last Notes

2026-07-19 12:42:10 UTC

@npub1yak…d8rp If I buy all the spare parts from the online store and the new 2026 bits (both already done), do I need the 2024 green front board or will it work without? If I do, do you have any spares on site?
Asking as I gave my 2024 badge to someone who missed out and I'm trying to bootstrap a replacement from the spare parts...

2026-07-19 08:24:53 UTC

- reply

Could do with some saying you are number X in the queue. That would be very #emfcamp :bloblaugh:..

2026-07-19 07:54:28 UTC

Found a wristband, so if you could all check the whereabouts of yours before I have to involve orga, @npub1x0e…yc6u, lost property and site security...
#emfcamp, #emfcamp2026

2026-06-28 20:58:13 UTC

Regretting not fixing the mower earlier in the season, the garden was one big thistle patch.

2026-06-25 18:16:04 UTC

Tim's first law of thermodynamics: Hot weather makes people drive like dicks.

2026-06-19 18:34:01 UTC

$snoopcon ++; # The yearly trip to Birmingham has concluded. Many thanks to those friends who helped organise the event

2026-06-16 11:07:11 UTC

Trying to talk a customer out of buying firewalls for their MPLS transport network. They'd do better to invest the time in hardening, monitoring but apparently that's too hard.

2026-06-14 19:28:54 UTC

What parts of #detection #engineering do people find difficult?
#blueteam

2026-06-12 21:23:39 UTC

Splunk sadness courtesy of [@index](https://labs.watchtowr.com/ ):
https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/
#threatintel, #splunk

2026-06-09 19:55:36 UTC

There is an irony that despite my offensive background, the only cyber security discipline I don't hold current certs for is offense.
#purpleteam

2026-05-25 13:48:15 UTC

Fan thought: Can't imagine many states going for it, but a tax on war might be interesting...

2026-05-16 07:18:20 UTC

Excellent DR exercise last week after the DC caught fire. Now, I do parallel backups so wasn't directly caught out but it turns out the corporate backup solution doesn't notify on failure. This seems a gap.

2026-05-14 22:46:34 UTC

Gotta love IT. copy.fail directions that use perl and curl to apply patches. Not only elite UNIX knowledge but the patching command rhymes. We must curl the perl.

2026-05-14 17:41:25 UTC

Did some adulting today. Took my parents-in-law into central London for an eye hospital appointment. Same one my dad used to go to. Tired.

2026-05-13 22:28:44 UTC

Today in Tim meets old colleagues in random places, bumped into one of our old red team and an old Portcullis customer at the ATT&CK event.

2026-05-13 09:47:07 UTC

Off to @npub1h8w…vyt6 MASIG.

2026-05-12 17:43:17 UTC

I wonder how many offensive folks have done IR for ILOVEYOU, SFPs, an MPLs infrastructure, a mainframe, an entire bank and busses amongst other things.
#purpleteam

2026-05-10 21:12:58 UTC

For all the AI hype, I'm absolutely fascinated to see more bug content that focusses on the mass of internal, commercial, compiled code that runs businesses. Most of the disclosures thus far appear to be for open source, where we should assume the models know the code, have seen the bug reports and have access to the patches but that's really not the reality of "interesting" enterprise software.

2026-05-10 14:49:04 UTC

Interesting links of the week:
Strategy:
* https://cset.georgetown.edu/article/chinas-pla-challenges-and-competitions/ - analysing .cn PLA strategy
* https://ccdcoe.org/news/2026/locked-shields-2026-united-the-power-of-41-nations-to-defend-cyberspace/ - Locked Shield 2026 reporting
* https://www.homeaffairs.gov.au/about-us/our-portfolios/cyber-security/cyber-incident-review-board - post-incident review is necessary, ya galah
* https://dukesecurity.ai/incidents - SEC disclosed incidents
* https://www.theguardian.com/world/2026/may/07/revealed-russia-top-secret-spy-school-hacking-western-electoral-interference - how .ru trains their spies on fiddling with elections
* https://arxiv.org/abs/2509.00462 - AI, stealing all the jobs
* https://arxiv.org/abs/2604.01637 - but first they need job specs
* https://www.ncsc.gov.uk/guidance/guidance-on-digital-forensics-protective-monitoring - NCSC guidance on DFIR and protective monitoring
* https://blog.mozilla.org/en/privacy-security/ai-security-zero-day-vulnerabilities/ - thought piece from Mozilla on Mythos
* https://www.aisi.gov.uk/blog/our-evaluation-of-openais-gpt-5-5-cyber-capabilities - UK AI Security Institute review of GPT 5.5
* https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/ - behind the Mythos curtain with Mozilla
* https://uktl.org.uk/news-events/uktl-ncsc-and-ericsson-strengthen-the-security-of-uk-mobile-networks/ - improving UK telco security
Threats:
* https://www.trendmicro.com/en_us/research/26/d/inside-shadow-earth-053.html - Trend write up on .cn attacks in Asia
* https://www.rtl-sdr.com/student-arrested-in-taiwan-for-using-sdr-and-handheld-radios-to-halt-four-high-speed-trains-with-tetra-hack/comment-page-221/ - TETRA abuse in the wild
* https://home.s2grupo.es/hubfs/Informe%20LAB52-%20EasterBunny_Complete.pdf - new reporting on APT29
* https://i.blackhat.com/Asia-26/Presentations/AS26-Ishimaru-Tropic-Trooper-Reloaded-REV01.pdf - reporting on Tropic Trooper from BlackHat Asia 2026
* https://www.catonetworks.com/blog/global-campaign-discovered-with-modbus-plcs-targeted/ - attacks on CNI intensify
Detection:
* https://righteousit.com/2026/03/27/linux-forensic-scenario/ - [@hal_pomeranz](https://infosec.exchange/@hal_pomeranz )'s Linux investigation (there are a number of follow on posts)
Bugs:
* https://retr0.zip/blog/cve-2026-31431-copy-fail.html - more on copy.fail
* https://seclists.org/oss-sec/2026/q2/332 - winning a race with Rust
* https://aisle.com/blog/aisle-discovers-cve-2026-42511-a-21-year-old-freebsd-remote-command-execution-vulnerability#the-vulnerability - more on the FreeBSD dhclient whoopsie
* https://copy.golf/ - copy.fail.golf
* https://visit.suspect.network/reversing-adventures/inadvertent-injections - accidentally injecting shells
Exploitation:
* https://fuzzinglabs.com/exploring-nvidia-linux-drivers-internals-basics-ioctls/ - exploring NVIDIA's LKM attack surface
* https://www.blackhillsinfosec.com/the-p-in-pam-is-for-persistence-linux-persistence-technique/ - @npub1hrj…mtaz discuss persisting in PAM
* https://www.group-ib.com/blog/pluggable-authentication-module/ - why PAM matters
* https://blog.trailofbits.com/2026/05/05/c/c-checklist-challenges-solved/ - solutions to @npub1rcs…7sw8's C challenges
* https://ipurple.team/2026/05/04/cross-session-activation/ - cross session lateral moment in Windows with @npub14pv…scte
* https://heyitsas.im/posts/drinking-llms/ - bug hunting the Linux kernel with LLMs
* https://www.incendium.rocks/posts/Fuzzing-MS-RPC-structures-and-monitoring/ - fuzzing Microsoft RPC
Hard hacks:
* https://labs.taszk.io/articles/post/tapocalypse/ - TP-Link whoppers
* https://tantosec.com/blog/2026/04/route-to-root-in-4g-industrial-router/ - hacking a 4G router
Hardening:
* https://jan.wildeboer.net/2026/05/PSA-CopyFail-CVE-2026-31431/ - @npub1m7m…2e7k's approach to beating copy.fail
* https://www.secwest.net/copyfail-mitigation - more on copy.fail mitigations with
Nerd:
* https://tekin.co.uk/2025/09/the-ruby-community-has-a-dhh-problem - be mindful of who you mix with
* https://di.day/en - declare your independence
#security, #research

2026-05-10 13:42:53 UTC

Interesting Git repos of the week:
Strategy:
* https://github.com/center-for-threat-informed-defense/attack-flow - mapping ATT&CK flows
Detection:
* https://github.com/timb-machine-mirrors/ddamenova-IRQL.md - KQL for IR
* https://github.com/ridgelinecyberdefence/vanguard - Go toolkit for IR
* https://github.com/SharonBrizinov/Holy-Grail-PCAP - new food for Packet Monkey
* https://github.com/Nextron-Labs/surface-watch - @npub1582…zvg8's code to keep an eye on the front door
* https://github.com/keydet89/RegRipper3.0 - @npub12px…9x9m's seminal IR toolkit in Perl
Bugs:
* https://github.com/V4bel/dirtyfrag - more Linux sadness
Exploitation:
* https://github.com/azqzazq1/SunnyDayBPF - imagine that, a kernel that lies
* https://github.com/BlackSnufkin/LitterBox - red teamer's sandbox
* https://github.com/L1v1ng0ffTh3L4N/EdgeSavedPasswordsDumper - dump Edge passwords from memory
* https://github.com/her3ticAVI/PAMSkeletonKey - a skeleton key for PAM
* https://github.com/segmentati0nf4ult/linux-pam-backdoor - an earlier version of the same code
* https://github.com/Kudaes/Puzzle - abusing Windows minifilters
* https://github.com/diemoeve/oxide - a new C2 framework
* https://github.com/TwoSevenOneT/DefenderWrite - enumerate AV whitelisted executables for LPE with @npub1dt0…th85
Hardening:
* https://github.com/wgnet/wg.copyfail.patch - a nice little eBPF patch for copy.fail
* https://github.com/atgreen/block-copyfail - another eBPF approach to copy.fail from [@atgreen](https://hachyderm.io/@atgreen ) 🤖
#security, #research, #code

2026-05-09 19:25:01 UTC

Citations are nice. Thank you anon.

2026-05-07 19:41:52 UTC

Long old week but 5 happy customers, two commuting to renewals makes it all worthwhile. I shall sleep well tonight.

2026-05-06 19:15:19 UTC

Provided genuine and nuanced feedback on AI slop on AI slop. Comments all deleted and article published. That'll teach me to spend time making suggestions to improve an article.

2026-05-06 16:18:22 UTC

- reply

Sidebar: Please don't get your pet to paraphrase me and then attribute the work to me.

2026-05-06 16:17:32 UTC

Stumbled into a channel where everyone is replacing themselves with their AI pets and well, if you're the kind that needs an agent to do anything then no wonder you're having trouble installing an agent...

2026-05-05 12:42:57 UTC

The statement "lies, lies and statistics" could have been written by an AI, and now thanks to LLM, it will be.

2026-05-04 18:55:00 UTC

Congratulations to Canonical on poor life choices:
https://seclists.org/oss-sec/2026/q2/332
#threatintel, #non-GNUcoreutils

2026-05-04 12:04:37 UTC

- reply

A little contribution: https://github.com/timb-machine/presentations/blob/main/A%20rising%20tide%20lifts%20all%20ships%20-%20Cyber%20security%20culture%2C%20competence%20and%20community.pdf

2026-05-04 11:07:10 UTC

Got bored so started submitting rules to @npub1582…zvg8' auditd ruleset...

2026-05-03 07:04:10 UTC

- reply

Tea.

2026-05-03 06:38:57 UTC

Toast.

2026-05-02 21:48:47 UTC

Interesting links of the week:
Strategy:
* https://www.kpmgcri.com/insights/calculating-the-impact-of-a-cyber-attack-on-critical-infrastructure - KPMG discuss how to calculate the cost of CNI impact
* https://shkspr.mobi/blog/2026/05/nhs-goes-to-war-against-open-source/ - @npub1x59…gect discusses the -ve impact of LLMs on NHS open source strategy
* https://www.kcl.ac.uk/building-nhs-resilience-to-ransomware-1 - a study in national health resilience, not to disease but ransomware
* https://www.rusi.org/explore-our-research/publications/cyber-effects-perspectives/cyber-exercises-and-capture-flag-competitions-uk-policy-tools - with all this ransomware, why cyber exercises are still helpful
* https://insinuator.net/2026/04/when-paradigms-are-shifting-infosec-in-the-age-of-ai/ - @npub1x7q…f3q0 in the days of LLM
* https://www.provos.org/p/finding-zero-days-with-any-model/ - @npub1mc0…w5tc chips in on whether it's the models or the automation
* https://www.technologyreview.com/2026/04/27/1136322/rebuilding-the-data-stack-for-ai/ - MIT Technology Review gives a take on how to rearchitect for AI
Standards:
* https://www.rfc-editor.org/rfc/rfc3631.html - Internet-facing security controls
Threats:
* https://medium.com/mitre-attack/attack-v19-ff329cb65d66 - ATT&CK v19 is out
* https://www.darktrace.com/blog/inside-zionsiphon-darktraces-analysis-of-ot-malware-targeting-israeli-water-systems - an attack on the .il water system?
* https://www.sentinelone.com/labs/fast16-mystery-shadowbrokers-reference-reveals-high-precision-software-sabotage-5-years-before-stuxnet/ - SentinelOne discuss the pre-stuxnet years
* https://mp.weixin.qq.com/s/nJpqvXCYV3ZdvNgYGrG4ow - .cn reporting on Sandworm
* https://blog.talosintelligence.com/uat-4356-firestarter/ - @npub1xkd…cc62 report on FIRESTARTER
* https://www.cisa.gov/sites/default/files/2026-04/AR26-113A_MAR_FIRESTARTER_backdoor.pdf - joint NCSC/CISA write up on FIRESTARTER
* https://citizenlab.ca/research/uncovering-global-telecom-exploitation-by-covert-surveillance-actors/ - @npub12h8…ac3t discuss global telecom breaches
* https://infrawatch.com/blog/inside-the-mobile-farm-the-oem-stack-powering-us-4g-5g-proxy-networks - SIM farms and how they work
* https://github.com/search?q=knock_functions.sh&type=code - this is fine...
Detection:
* https://x.com/westonlwalker/status/2049931249180119321 - auditd rules for copy.fail
* https://scythe.io/scythe-labs/what-your-rdp-sessions-leave-behind - exploring RDP's stains
* https://www.ncsc.gov.uk/blogs/could-your-choice-of-metrics-be-harming-your-soc - NCSC discuss useful KPIs for a SOC
* https://www.slideshare.net/slideshow/first-cti-2026-evaluating-threat-intelligence-through-velocity/287191850 - @npub1am5…d84n discusses threat intel speed in defence
* https://extsentry.github.io/#dashboard - can you and should you trust browser agents
Bugs:
* https://copy.fail/ - reliable LPE for many Linux releases
* https://xint.io/blog/copy-fail-linux-distributions - blog post with the copy.fail details
* https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854 - Wiz found a nice parameter pollution bug in GitHub
* https://shittrix.moksha.dk/ - much Citrix sadness
* https://www.freebsd.org/security/advisories/FreeBSD-SA-26:12.dhclient.asc - dhclient oopsie in FreeBSD
* https://www.freebsd.org/security/advisories/FreeBSD-SA-26:13.exec.asc - poisoning FreeBSD's argv[][] for LPE oopsie
* https://blog.calif.io/p/mad-bugs-even-cat-readmetxt-is-not - abusing a pty for fun and oopsies
* https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html - more fun Linux whoopses
Exploitation:
* https://windows-internals.com/goodbye-secure-pool-hello-kdp-pool/ - changes afoot in Windows kernel land from [@yarden_shafir](https://infosec.exchange/@yarden_shafir )
* https://securelist.com/phantomrpc-rpc-vulnerability/119428/ - @npub1ger…6hxz, on new ways to beat a dead horse
* https://ghostbyt3.github.io/blog/nday-research-ai - hunting for n-days
* https://blog.zsec.uk/bullyingllms/ - [@zephrfish](https://bladerunner.social/@zephrfish ) talks through his approach to abusing LLMs
* https://blog.talosintelligence.com/bad-apples-weaponizing-native-macos-primitives-for-movement-and-execution/ - more rotten apples, this time from @npub1xkd…cc62
Hardening:
* https://alexreed.srht.site/blog/agent-security-audit.html - @npub1w8v…ympw looks at how to audit and harden your agent
Nerd:
* https://prism-break.org/en/all/ - escaping the US-led ecosystem
#security, #research

2026-05-02 18:56:49 UTC

Interesting Git repos of the week:
Detection:
* https://github.com/gadievron/honeyslop - a side bar to RAPTOR, a vulndev slop detector from @npub1h9h…ta2c 🤖
* https://github.com/Nehboro/nehboro - a Chrome extension to help protect you from phishing scams
* https://github.com/trustedsec/SysmonCommunityGuide - TrustedSec dropped guides for Sysmon
* https://github.com/JPCERTCC/LogonTracer - watch out for unexpected logins with JPCERT
* https://github.com/persistent-security/month-of-bypasses - a month of detection engineering tips and tricks
* https://github.com/sjzasada/agentflash - my old uni house mate has written a tool to keep an eye on Claude
Bugs:
* https://github.com/theori-io/copy-fail-CVE-2026-31431 - copy.fail \o/
Exploitation:
* https://github.com/CyberStrikeus/CyberStrike - sloppy pen testing 🤖
* https://github.com/SnailSploit/Claude-Red - another agentic pen tester 🤖
* https://github.com/PurpleAILAB/Decepticon - rise of the bots 🤖
* https://github.com/hackerschoice/team-teso - courtesy of @npub1a0s…dmkd, an archive of TESO
* https://github.com/BishopFox/cirro - @npub1chl…p3zh created Cirro to map clouds 🤖
* https://github.com/thomasdullien/vulpine - @npub1cj7…nq3s dabbles in AI bug hunting and vulndev
* https://github.com/boostsecurityio/smokedmeat - smoked meat attacks CICD pipelines for hot red team action
* https://github.com/mandiant/gopacket - Mandiant ported Impacket to Go
* https://github.com/trailofbits/trailmark - @npub1rcs…7sw8's Trailmark graphs code 🤖
* https://github.com/sailay1996/vss-fr2system - arbitrary reads to SYSTEM \o/
* https://github.com/asset-group/Sni5Gect-5GNR-sniffing-and-exploitation - attacking 5G for sniffs and giggles
* https://github.com/ANSSI-FR/bmc-tools - ANSSI parses your RDP screenshots
* https://github.com/BSI-Bund/RdpCacheStitcher - BSI stitches them together
* https://github.com/califio/publications - @npub1dw7…3cdf and friends do interesting things 🤖
* https://github.com/jedireza/reserved-subdomains - what subdomains are reserved?
Hardening:
* https://github.com/sektioneins/ovpncc - One of SektionEins's various config checking tools, this onefor OpenVPN
* https://github.com/HarmonicSecurity/claudit-sec - audit your Claude Desktop posture
Cryptography:
* https://github.com/nitram2342/bruteforce-crc - crunching through CRC32
Data:
* https://github.com/op7ic/SwarmMaker - my good friend opt7ic drops a new tool to build LLM skills
Nerd:
* https://github.com/moshix/BRICKS_TS - mainframe code
#security, #research, #code

2026-05-02 16:47:46 UTC

Unauthorised maths.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/505/975/782/999/185/original/e145ceb77f0dbfb5.jpg

2026-05-01 18:18:46 UTC

"We're all doomed. GlassWing can read source code and find vulnerabilities."
If the adversary has access to the source code, then they already somewhat could. They will still have to sort the wheat from the chaff no matter if they're using grep or some new super intelligence because not every bug ends up being exploitable. Also, how many controls have they subverted to get there...

2026-05-01 18:15:17 UTC

"One of the things that upsets me about AI is that it doesn't think. It just keeps pushing existing ideas."
Yeh, no shit sherlock.

2026-04-30 19:58:22 UTC

Copy fail is vibe-arg'ing at its finest...
https://copy.fail/
#threatintel, #linux

2026-04-29 09:43:27 UTC

Given that BlueSky 302's <username>.bsky.social to the user's profile with content that they control, I wonder what they do to filter username against reserved DNS subdomains...

2026-04-29 08:15:35 UTC

- reply

I might rewrite the logic at some point, kinda feels like the data model has changed sufficiently that my parsing logic might need some love.

2026-04-29 08:13:48 UTC

Running threat-crank to update https://github.com/timb-machine/attack-ti with v19 data.
#threatmodelling

2026-04-29 07:35:01 UTC

- reply

This is with respect to "traceroute 2.1.2 - MPLS Extension Out-of-Bounds Read". Feels sloppily written...

2026-04-29 07:22:13 UTC

Today in CVSS questions:
CVSS v3.1 Score: 5.9 (Medium) — AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector: Network (on-path / rogue router)
Do you mean AV:A?

2026-04-28 23:11:37 UTC

@npub1ysw…uzpe has just given me bad dreams, uttering "systemd-openclawd"...
*shudder*

2026-04-28 19:43:22 UTC

- reply

Full write up here: https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

2026-04-28 19:42:26 UTC

Fun with Citrix:
https://shittrix.moksha.dk/
#threatintel, #citrix

2026-04-28 19:01:17 UTC

We welcome ATT&CK v19:
https://attack.mitre.org/resources/updates/updates-april-2026/
Blog post here:
https://medium.com/mitre-attack/attack-v19-ff329cb65d66
#redteam, #blueteam, #threatintel, #att&ck

2026-04-28 18:54:13 UTC

Hard ouch:
https://x.com/sagitz_/status/2049153195243372569
#threatintel, #github

2026-04-28 18:43:13 UTC

I do wish Reform would stop posting their recycling through my letter box.

2026-04-28 14:27:50 UTC

Discuss: x isn't a security boundary because ... (where x is represented in https://attack.mitre.org/datacomponents/ or other control lists).
Counter point: Anything that changes the profile of the attack surface and presents an opportunity for detection can be considered a security boundary. Some may be more effective than others, some may have bugs, others may be configured badly but they all have some boundary value. The point of a security test is to point out the bugs and misconfigurations.

2026-04-27 13:43:27 UTC

Just looked at some AI agentic shit being touted for red teaming and I am both terrified by the ROE it has and how it might feel about some of the scenarios real red teams have to deal with and fascinated as to how the skills will fall apart when given upwards of 140000 hosts to target across the globe...

2026-04-25 11:11:13 UTC

Maybe not you, but *some* people do want persistent access to Cisco devices:
* https://blog.talosintelligence.com/uat-4356-firestarter/
* https://www.cisa.gov/sites/default/files/2026-04/AR26-113A_MAR_FIRESTARTER_backdoor.pdf
#threatintel, #cisco

2026-04-25 11:06:08 UTC

Accidentally leverage a supply chain attack this week when it turned out that the GitHub org I'd cloned for a cyber exercise was "unofficial" and none of the exercise participants knew who actually owned it although they did recognise the committers. Chaos ensued.
#purpleteam

2026-04-25 09:19:46 UTC

RE: https://infosec.exchange/@thc/116158209911493617
Somehow I missed this dropping but wow, so much history.
#note15pp…aezp

2026-04-24 12:25:05 UTC

Interesting Git repos of the week:
Bugs:
* https://github.com/timb-machine-mirrors/Gi7w0rm-badboy2.js - Adobe Reader PoC
Detection:
* https://github.com/dougburks/ohmypcap - @npub10xz…tx5u dumps packets
* https://github.com/cyb3rmik3/presentations - interesting presentations from @npub19p6…c4yy
* https://github.com/bad-antics/rupurt - another tool to hunt for Linux root kits
Exploitation:
* https://github.com/pandaadir05/snoop - tracing with eBPF 🤖
* https://github.com/x41sec/force-push-scanner - scanning Git hard pushes for leakage with @npub1a7k…guxz
* https://github.com/brightio/penelope - landing all those bind and reverse shells
* https://github.com/vmi-rs/ephemera - handle Microsoft's crash dumps without licking with Windows
* https://github.com/winterknife/EVENSTAR - @npub1x9x…t8d2's experiments with poking holes in Windows
* https://github.com/NextronSystems/APTSimulator - @npub1582…zvg8 and friends play dress up
Hard hacks:
* https://github.com/dmaynor/apple-vuln-research - @npub102f…9ak9's rotten apples
* https://github.com/fizzyade/sfpdoctor - is there an SFP doctor in the house?
Nerd:
* https://github.com/timb-machine-mirrors/karpathy-llm-wiki.md - combining wikis with RAG and LLM for the ultimate lifestyle experience 🤖
#security, #code, #research

2026-04-23 17:00:11 UTC

Interesting links of the week:
Standards:
* https://github.com/OWASP/APTS - @npub1nfk…dr9f has a crack at defining autonomous testing standards
* https://cert.pl/en/posts/2026/04/annual-report-2025/ - .pl CERT gives us their annual update
* https://www.ncsc.gov.uk/news/apt28-exploit-routers-to-enable-dns-hijacking-operations - more on that Guardian story from a couple of weeks back about Russian hostmasters working for free
* https://arxiv.org/abs/2603.29545 - exploring how cyber crime's vibe will change
* https://gambit.security/blog-post/a-single-operator-two-ai-platforms-nine-government-agencies-the-full-technical-report - how .mx got popped
* https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a - .ir are planning a silent disco and all of US are invited
Threats:
* https://socket.dev/blog/bitwarden-cli-compromised - careful warden, I see you're managing a password
* https://krebsonsecurity.com/2026/04/germany-doxes-unkn-head-of-ru-ransomware-gangs-revil-gandcrab/ - .de doxes head of REvil
* https://www.ic3.gov/PSA/2026/PSA260407 - .ru completes sticker collection of logos from every major law enforcement agency
* https://www.lumen.com/blog/en-us/frostarmada-forest-blizzard-dns-hijacking - .ru... in your modem, stealing your DNS requests
* https://dti.domaintools.com/research/dprk-malware-modularity-diversity-and-functional-specialization - .kp IT skills continue to develop
* https://pushsecurity.com/blog/device-code-phishing - phishermen continue to catch phish, news at 10
Bugs:
* https://www.jamf.com/blog/darksword-ios-exploit-kit-three-lessons-mobile-security/ - breaking our on Safari
* https://blog.calif.io/p/we-asked-claude-to-audit-sagredos - Claude vs qmail but FFS, it shouldn't have taken that much effort to spot that one
* https://heyitsas.im/posts/cups/ - printing a new 0day
Exploitation:
* https://vulnbench.ghostsecurity.com/ - testing LLM efficacy on the work bench
* https://agentic-threat-modeling.github.io/MAESTRO/ - how to make friends with agents and influence them
Hard hacks:
* https://gpubreach.ca/ - another hammer, another pixel dead...
Hardening:
* https://lore.kernel.org/lkml/[email protected]/ - an interesting new kernel driver for Linux
Cryptography:
* https://www.openssh.org/pq.html - #OpenBSD takes a stance on PQC
#security, #research

2026-04-23 16:12:16 UTC

Please hold. You are number 1 in the torment nexus. There is no-one in front of you and no-one behind. Your call *is* important to us and there is *no* escape. There is no-one to hear your screams. Please hold.
#microfiction

2026-04-23 12:58:31 UTC

Interesting to read about the hardware differences between USB<>fibre and ThunderBolt<>fibre and how they affect the attack surface. Anyway, ordered an SFP adapter that present via ThunderBolt as Intel chips, so that I can play with ethtool a bit more.

2026-04-22 17:50:17 UTC

Everyone should be 💜:
https://github.com/Neo23x0/auditd/issues/178 provoked:
"serving up the defense on a silver platter i see 😜" from one of my team... He knows me quite well and was just teasing, but still!
Despite all my ❤️, I built my first SOC on SQL Server... and handled ILOVEYOU...
That's how 💙 I am!

2026-04-22 07:52:51 UTC

As we enter conference season, if you're a first time, or less experience speaker:
https://github.com/timb-machine/presentations/blob/main/A%20rising%20tide%20lifts%20all%20ships%20-%20Cyber%20security%20culture%2C%20competence%20and%20community.pdf
#payforwards, #mutualaid

2026-04-21 17:23:21 UTC

Now that's /some/ shit posting from the TA:
https://www.linkedin.com/posts/jamie-williams-108369190_spoofing-as-a-red-team-is-%F0%9D%9A%9D%F0%9D%9A%8E%F0%9D%9A%8C%F0%9D%9A%91%F0%9D%9A%97%F0%9D%9A%92%F0%9D%9A%8C%F0%9D%9A%8A%F0%9D%9A%95%F0%9D%9A%95%F0%9D%9A%A2-share-7452388382078349312-RxLL?utm_source=share&utm_medium=member_desktop&rcm=ACoAAABLaKEBOSsLj2DTcDmlwFtVAzzZ9BjjPwc
(MDSec is one of the UK's own... so a TA pretending to be them... \o/)
#threatintel, #shitposting

2026-04-21 12:33:55 UTC

- reply

Particularly like the "Waiver required for all participants"... Presumably this means that if someone turns up shooting, it's on individual attendees heads... Bold move, "you might get shot, but that's on you...".

2026-04-21 12:10:44 UTC

Hmm. Just got invited to Guns & Cyber by virtue of our CREST membership. I'm sure for some this would be a very welcome invite but not really one for me. Should I follow my personal ethics and make a complaint that I'm not really all that keen on shooting things and ask if they have an alternate event for people who would prefer to help people?

2026-04-20 18:12:14 UTC

If like me, you're a fan of Kae Tempest's written word:
https://www.theguardian.com/culture/2026/apr/18/kae-tempest-on-creativity-and-his-gender-transition-im-just-glad-to-be-alive

2026-04-20 14:51:57 UTC

Someone's just listed out "all" the Windows versions - with the tag line "which one did you start on" - and I am genuinely sad they forgot Windows 2.

2026-04-19 11:10:05 UTC

Forget about the intricacies of the DNS spec. This should have seemed like a bad life choice in any event. Turning user input into a command line when all you really wanted to do was write a 0 byte file:
sprintf(acfcommand, "/bin/touch %s/control/notlshosts/'%s'",
info->pw_dir, partner_fqdn);
fp = popen(acfcommand, "r");

2026-04-19 10:55:30 UTC

Regular reminder to myself that whilst I don't always agree with everything Jericho says, that he makes a lot more sense than he gets credit for.

2026-04-19 10:23:41 UTC

Interesting links of the week:
Strategy:
* https://www.isc.org/blogs/2026-04-16-How-to-report-a-vulnerability/ - @npub1uus…s9sg makes some useful suggestions on reporting vulnerabilities
* https://sushegaad.github.io/Claude-Skills-Governance-Risk-and-Compliance/ - building a GRC framework with Claude 🤖
* https://jericho.blog/2026/04/17/nvd-gives-up/ - Jericho from @npub1dy2…hp28 gives us the skinny on the NVD updates
* https://www.usenix.org/system/files/login/articles/login_apr15_12_geer.pdf - Dan Geer predicts...
* https://security.googleblog.com/2025/04/google-launches-sec-gemini-v1-new.html - remembering Sec-Gemini v1 hype
* https://init6.com/papers/Day-Zero-Normal-CISO-Brief.pdf - @npub1ryt…hg6k comes with another take on AI and LLM
* https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/04/mythosready-20260413.pdf - the Cloud Security Aliance chip in
* https://cje.io/2026/04/08/offense-scales-with-compute-defense-scales-with-committees/ - as does @cje
Detection:
* https://pub.expmon.com/ - Haifei Li's EXPMON
* https://obdev.at/blog/little-snitch-for-linux/ - @npub1lky…0sa8 comes to Linux
Bugs:
* https://x.com/Gi7w0rm/status/2042370775546482815 - more on that spike in Adobe Reader bugs chain
* https://rhisac.org/threat-intelligence/bluehammer-windows-local-privilege-escalation-zero-day-publicly-released/ - moar on Blue Hammer #1
* https://www.cyderes.com/howler-cell/windows-zero-day-bluehammer - moar on Blue Hammer #2
* https://www.coresecurity.com/blog/analysis-bluehammer-lpe-exploiting-windows-defender-updates - moar on Blue Hammer #3
Exploitation:
* https://www.slideshare.net/slideshow/how-i-use-ai-for-penetration-testing-teri-radichel-2nd-sight-lab-3fb8/286987132 - @npub1sqh…qex8
Hard hacks:
* https://hackers-arise.com/scada-ics-hacking-and-security-attacking-the-modbus-protocol-with-rofuzz/ - attacking ICS and other OT with rofuzz
* https://medium.com/@theopenshelf/amazon-is-cutting-kindle-store-access-on-pre-2013-kindles-a7b495cb51ee - Amazon has a Kindle problem and how you can help...
Development:
* https://appsec.guide/docs/languages/c-cpp/lang-c-cpp-bug-classes/ - @npub1rcs…7sw8's security coding guidance with bits'n'pieces from @gsuberland
* https://blog.trailofbits.com/2026/04/09/master-c-and-c-with-our-new-testing-handbook-chapter/ - @npub1szz…t4fx's accompanying blog post
* https://arxiv.org/html/2603.21852v2 - all elementary functions from a single operator
Data:
* https://cardcatalogforlife.substack.com/p/google-has-a-secret-reference-desk - getting more out of GOOG
It's notable how many of the talking heads on AI and LLM are US based or funded *and* how many of them come from a cloud centric generation of businesses...
#security, #research

2026-04-19 08:49:05 UTC

Anyone seen any good guidance on hardening Nokia 7xxx series service routers? The common criteria guide is from the old Alcatel days and whilst I'm familiar with them in their older form, wondering if much has changed...

2026-04-19 08:37:04 UTC

- reply

Will be tagging Git repos with obvious signs of LLM contributions with 🤖 going forwards.

2026-04-19 08:35:52 UTC

Interesting Git repos of the week:
Strategy:
* https://github.com/mr-r3b00t/iso27001-sample - [@UK_Daniel_Card](https://infosec.exchange/@UK_Daniel_Card )'s example ISMS, explicitly written with 🤖
Detection:
* https://github.com/NeffIsBack/EVENmonitor - remotely monitor your Windows events from @npub19xe…f5sr
* https://github.com/clausing/scripts - @npub18dl…s0mw shares some of his SANS ISC tooling 🤖
* https://github.com/mr-r3b00t/fingerprintdetector - [@UK_Daniel_Card](https://infosec.exchange/@UK_Daniel_Card ) shares his code for spotting active web site user fingerprinting
* https://github.com/obdev/littlesnitch-linux - bringing Little Snitch to Linux
Bugs:
* https://github.com/Nightmare-Eclipse/RedSun - Another PoC, this time to make Defender punch itself in the face
Exploitation:
* https://github.com/cutaway-security/chaps - PowerShell for reviewing Windows hardening 🤖
* https://github.com/NVIDIA/garak - NVIDIA's LLM scanner 🤖
* https://github.com/skelsec/minikerberos - natively abuse KRB5 in Python
* https://github.com/hardenedlinux/userland-exec - userland exec PoC to be used as attack vector technique
* https://github.com/OtterHacker/M365Pwned - fingerprinting O365
Hard hacks:
* https://github.com/traboda/r0fuzz - fuzzing OT protocols
#code, #security, #research

2026-04-18 14:58:47 UTC

@npub1szz…t4fx Suggestion for Unsafe Warnings: "Body Onboard" stickers for car drivers.

2026-04-18 09:35:27 UTC

Which fucking idiot agreed to a game of football starting at half 12.
#brentfordfc

2026-04-17 16:44:21 UTC

The sun is out, I have a beer in hand and I'm ruminating. The AI security testing efficacy paper is taking shape in my head...
But also... Enjoying all the local dogs out on their Friday evening walkies.

2026-04-17 16:20:34 UTC

Toying with flagging "interesting Git repos" depending on AI contributions. There are some great ideas that Claude "has had" but at least in some cases, a human had the idea first.

2026-04-15 22:25:03 UTC

I don't spend nearly enough time breaking into people's switching stacks from first principles. I have been spoilt by weak passwords, SNMP, telnet and the like.
#hardhacks, #reverse, #engineering, #redteam

2026-04-15 19:06:05 UTC

That time of the year when I renew Binja and Hopper :)

2026-04-14 23:06:38 UTC

Knee deep in u-boot...

2026-04-14 14:59:55 UTC

RE: https://messydesk.social/@synec/116403583002221158
Existence of FreeBSD implies the existence of ExpensiveBSD.
#note15jg…rd5y

2026-04-13 17:22:00 UTC

When times were simpler:
"text generator"
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/398/545/697/160/770/original/5b7142feb5ce6c17.png

2026-04-13 16:34:34 UTC

Pleased to announce I've done the training to work in a NERC CIP regulated environment and now fully understand what things will really piss off the blue team. :blob_laughing:
#redteam

2026-04-12 20:55:37 UTC

- reply

Interesting to compare how ChatGPT understands a system of record depending on whether you specify US or UK banking...
https://gist.github.com/timb-machine/f738eb63d6e9c133d3ce7c43cd7c5a4c

2026-04-11 17:51:45 UTC

Interesting Git repos of the week:
Bugs:
* https://github.com/Nightmare-Eclipse/BlueHammer - PoC to punch Defender in the face (original buggy code)
* https://github.com/atroubledsnake/SNEK_Blue-War-Hammer - alternate PoC for punching Defender in the face
* https://github.com/jgamblin/OpenClawCVEs/ - @npub1660…u8rt tracks bugs in OpenClaw
Exploitation:
* https://github.com/mrT4ntr4/NtWarden - inspect your Windows system
* https://github.com/vu-ls/Crassus - hunt for Windows LPEs with @npub12xh…zxeq
* https://github.com/chadi0x/TheBigBrother - weaponised OSINT
* https://github.com/cybergibbons/pentesttools - @npub1ne0…087a's pen testing framework
Hardening:
* https://github.com/microsoft/agent-governance-toolkit - Microsoft's governance framework for agentic AI
Nerd:
* https://github.com/lsahn-org/unix-v6 - UNIX v6 source
* https://github.com/0xAX/linux-insides - a book about the Linux kernel
* https://github.com/maaslalani/sheets - a spreadsheet in a tty
#security, #research, #code

2026-04-11 13:04:24 UTC

Back to the football. Bees Vs Toffee.
#brentfordfc

2026-04-11 09:22:03 UTC

Interesting links of the week:
Strategy:
* https://www.enisa.europa.eu/sites/default/files/2026-01/ENISA%20International%20Strategy.pdf - ENISA outlines their cyber security strategy of international engagement
@npub1m24…d9a3 leaves Xitter
* https://hamishcampbell.com/why-do-i-keep-bringing-this-up/ - @npub1psz…d0w0 extols the value of community
* https://www.eff.org/deeplinks/2026/04/eff-leaving-x -
* https://www.anthropic.com/glasswing - Anthropic's GlassWind post definitely got everyone talking (and occasionally thinking)
* https://youtu.be/kgwvAyF7qsA?si=IEfHj6YtBa--ncXA - @npub1cl0…dsrh discusses the @npub1rcs…7sw8 AI strategy
* https://sockpuppet.org/blog/2026/03/30/vulnerability-research-is-cooked/ - @npub1856…64fe gives his take on how AI LLM will affect vulndev
* https://aisle.com/blog/ai-cybersecurity-after-mythos-the-jagged-frontier - an analysis of the Mythos claims vs smaller models
* https://tryaether.ai/blog/anthropic-glasswing-frontier-attack - more hot takes on AI LLM
* https://joshuasaxe181906.substack.com/p/exploits-dont-cause-cyberattacks - AI LLM hot takes just keep on coming
* https://www.redhat.com/en/blog/navigating-mythos-haunted-world-platform-security - one more for luck, this time from the folks with the red hats
* https://www.youtube.com/watch?v=bDJb8WOJYdA - 10 years on, a reminder of how NSA TAO did it first with [@RGB_Lights](https://infosec.exchange/@RGB_Lights )
* https://ctid.mitre.org/blog/2026/04/09/fraud-fighters-unite-with-mitre-f3/ - MITRE's CTID map fraudulent outcomes
* https://words.filippo.io/crqc-timeline/ - @npub1jzt…jnwm discusses the PQC timeline
* https://www.magonia.io/research/operationalizing-mandiants-attack-lifecycle-the-kill-chain-mitres-att-ck-and-the-diamond-model-with-practical-examples/ - rethinking kill chains and attack tree models of threat
Threats:
* https://www.theguardian.com/technology/2026/apr/08/britons-warned-russian-hackers-internet-routers-cyber-security-espionage - NCSC warnings on router hygiene hit mainstream press
* https://www.dragos.com/blog/electric-grid-cybersecurity-threats - @npub13th…kaxz give us a feel for attacks on BES
* https://drive.google.com/file/d/1GvfRqK2h7me3jmPGauXH68KPq4Ycg0Or/view - @npub1vrk…94xy intel report on state of OT
* https://pr3tack.org/ - a hypothesis based view on what attackers might target next
Detection:
* https://righteousit.com/2026/04/06/jq-for-forensics/ - @:hal_pomeranz discusses using jq for forensics
* https://justhaifei1.blogspot.com/2026/04/expmon-detected-sophisticated-zero-day-adobe-reader.html - spotting ITW Adobe PDF reader bugs
* https://graylog.org/post/clm-for-nis2/ - @greylog take a look at logging for NIS2 compliance
Bugs:
* https://github.com/rapid7/metasploit-framework/pull/21158 - @npub1nws…w2y2 get their hands on the Cisco SD-WAN control plane
* https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-209201 - TETRA bugs always catch my eye
Exploitation:
* https://blog.calif.io/p/mad-bugs-feeding-claude-phrack-articles - what happens if you feed Claude Phrack?
* https://denizhalil.com/2026/01/21/snmp-security-exploitation-guide/ - a reminder from @npub1ll3…v4hg, even in the end of times that AI claims to be, basic hygiene problems are a thing... this time with SNMP :)
* https://webcrack.netlify.app/ - unpicking obfuscated JS, courtesy of a conversation started by @npub12xh…zxeq
* https://obf-io.deobfuscate.io/ - unpicking obfuscated JS, courtesy of a conversation started by @npub12xh…zxeq
* https://leosmith.wtf/blog/p3ng0s-devlog-archconf.html - automating Linux pen testing
* https://cloudbrothers.info/en/avoid-entra-conditional-access-sccauth/ - ask a different broker, get a different answer with [@fabian_bader](https://infosec.exchange/@fabian_bader )
* https://tharros.com/finding-vulnerabilities-with-crassus-a-case-study-with-eset/ - @npub12xh…zxeq gives us a case study for bug hunting with Crassus
* https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd - using Claude to write a FreeBSD PoC
Hard hacks:
* https://bryankeller.github.io/2026/04/08/porting-mac-os-x-nintendo-wii.html - OS X on a Wii
* https://arstechnica.com/security/2026/04/new-rowhammer-attacks-give-complete-control-of-machines-running-nvidia-gpus/ - when the only thing you have to attack an Nvidia chip is a hammer, everything feels like a fail...
* https://gddr.fail/files/gddr.pdf - paper on GPU attacks
Nerd:
* https://smallsheds.garden/blog/2026/on-the-acceptance-of-genai/ - the realities of generative AI stripped bare by @npub1eex…s3h7
* https://gist.github.com/artfwo/63eaaffdb47cbba342b04f989bd9463b - a sloppy dictionary from @npub1mkz…p8ye
* https://scp-wiki.wikidot.com/scp-3008 - beware of Ikea
Interestingly, this was the first time that several articles I read earlier in the week had gone by the end. The joys of AI...
#security, #research
#note1uem…5jal

2026-04-09 19:10:33 UTC

- reply

I asked ChatGPT about treasury systems. I wasn't particularly specific on what I asked (why help it?) but it makes the case pretty well for me.
https://gist.github.com/timb-machine/daa99dba6c7570bac8cddf9215152489
A treasury-focused red team should prioritise:
* Identity > privilege escalation > financial action
* End-to-end transaction abuse (trades or payments)
* Cross-system inconsistencies
* Detection evasion
Not just:
* CVEs
* Generic web vulnerabilities

2026-04-09 18:50:55 UTC

"We're not sure what security policies we have..."
"The networks team monitor the network" < from the security team
"The security team monitor the network" < from the networks team
"We don't have any agreed standards for hardening systems..."
Just a few of the astounding comments I've had whilst reviewing the OT security architecture for a utility company this week.
Glad they're not operating here.

2026-04-09 09:10:41 UTC

- reply

One of my more academically minded friends pointed me at this:
https://www.redhat.com/en/blog/navigating-mythos-haunted-world-platform-security
I think I have an idea for my next research paper :)

2026-04-09 08:56:23 UTC

- reply

I actually have an interesting side quest in my head now... all the bugs I've ever reported are due to real world threats that need testing... now I wonder which products/projects I have tested are a) actually recognised and understood by the average LLM and b) for which source code or binaries are available

2026-04-09 08:52:59 UTC

- reply

Further question, has anyone seen any analysis of optimal conditions where an LLM might reasonably be expected to find and exploit a vulnerability and what %age of CVE targetted software and KEV affected software meets that profile?

2026-04-09 08:48:53 UTC

Has anyone seen any analysis of CVE:KEV ratios over time?

2026-04-08 19:44:36 UTC

Bathroom thought: Is the Margaret Thatcher memorial toilet still free, or has it been, ironically, privatised?

2026-04-08 19:13:10 UTC

@npub1szz…t4fx Ah, another celebrant :)

2026-04-08 19:05:42 UTC

@npub1gw9…kljq Ding, dong, the witch is dead :)

2026-04-08 18:46:08 UTC

Pro-tip: NIST CSF is structured as it is, to remind people with different cyber security skills to work together. Not one domain is going to fix things on their own.

2026-04-08 13:49:53 UTC

- reply

Day 5: Mugshots all taken, EPROM all dumped. Using tesseract to try and dump the text from the photos.

2026-04-08 11:24:38 UTC

Reality is a lot more complicated than any one person's experience.

2026-04-06 22:55:25 UTC

- reply

https://www.openwall.com/lists/oss-security/2026/04/06/1 if you want to play along at home...

2026-04-06 13:44:08 UTC

Heads up Samba users:
There will be Samba security updates for
4.22, 4.23, and 4.24 on Thursday, April 9, 2026. Please make sure that your Samba servers will be updated soon after the release!
Impacted components:
- File Services, CVSS 10.0, affecting some configurations
- File Services, CVSS 10.0, affecting some configurations
- File Services, CVSS 7.1 affecting some configurations
- File Services, CVSS 6.5 affecting uncommon configurations
- AD DC CVSS 8.0, affecting some configurations
- AD DC CVSS 7.5, affecting uncommon configurations
#threatintel, #samba

2026-04-04 10:56:18 UTC

- reply

I like that, just back from Lidl and straight out the back to feed the prisoners. He cares!

2026-04-03 20:13:58 UTC

- reply

Well and truly down the rabbit hole as far as attacking SFPs. Who knew they could be so interesting?