|
thaddeus e. grugq
@
thegrugq
https://grugq.tumblr.com
|
|
Security Researcher :: Cultural Attaché :: grugq@comae.com :: PGP keybase.io/grugq :: Не верь, не бойся, не проси :: you can’t fight a meme with an exploit
|
|
|
280,419
Tweets
|
358
Following
|
101,966
Followers
|
| Tweets |
|
|
thaddeus e. grugq
@thegrugq
|
1m |
|
It should also be added that the “DNC hack” was actually attacks against multiple targets, included falsified data, and was a blatantly obvious Russian attack. Which was covered to death by infosec at the time. There was no mystery there. link.medium.com/vQ5YCaOv9V
|
||
|
||
| thaddeus e. grugq retweeted | ||
|
Porkus Bellius III
@porkbellyfuture
|
7m |
|
Also when the stolen data is being trickled out to manipulate news cycles, and the publications absolutely know they are being played but stay quiet about it because they don't feel like they have any other choice.
|
||
|
|
||
|
|
thaddeus e. grugq
@thegrugq
|
7m |
|
Don’t forget to add up the scores on how critical they are!
|
||
|
|
||
|
|
thaddeus e. grugq
@thegrugq
|
8m |
|
You should back this awesome project to extract data on hacker history from the public record to public access. twitter.com/hexadecim8/sta…
|
||
|
|
||
| thaddeus e. grugq retweeted | ||
|
Micheál Keane
@aexia
|
12m |
|
The other big failure was the conflation of the publicly released Clinton SOS emails, the Podesta hack and the DNC hack into one single amorphous But Her Emails story.
Thanks to the coverage, I wager most voters thought Wikileaks leaked Clinton's private server emails
|
||
|
|
||
| thaddeus e. grugq retweeted | ||
|
Joseph Cox
@josephfcox
|
13m |
|
New from us: this is absolutely mad. A hacker broke into two apps used for GPS tracking cars; monitoring for employers etc. But the hacker gained the capability to remotely cut the engine, which is built into the product motherboard.vice.com/en_us/article/…
|
||
|
|
||
|
|
thaddeus e. grugq
@thegrugq
|
12m |
|
Dealing with stolen data that is provided as an exclusive scoop to an media outlet is a very hard ethical problem. It doesn’t get easier when multiple outlets have the material. This issue needs to be addressed now, while there’s time, before it is too late.
|
||
|
|
||
|
|
thaddeus e. grugq
@thegrugq
|
14m |
|
Well, Linux does have more bugs so at least part of that is true? Or how does it go again?
|
||
|
|
||
|
|
thaddeus e. grugq
@thegrugq
|
15m |
|
The “hack and leak and media coverage” attacks were far and away the most effective information operations of 2016. Media outlets are having a great time berating Twitter & Facebook (rightly so), but how about dealing w/the beam in their own eye before the mote in social media’s? twitter.com/donie/status/1…
|
||
|
|
||
| thaddeus e. grugq retweeted | ||
|
Donie O'Sullivan
@donie
|
58m |
|
NEW w/@oliverdarcy: Most of the news organizations that CNN contacted for this story did not reveal any sweeping changes to its rules about publishing hacked materials since the 2016 election.
cnn.com/2019/04/24/med…
|
||
|
|
||
| thaddeus e. grugq retweeted | ||
|
John Regehr
@johnregehr
|
21m |
|
quick blog post on what has become my favorite first example of program verification to show students
blog.regehr.org/archives/1667
|
||
|
|
||
| thaddeus e. grugq retweeted | ||
|
Daniel Schauenberg
@mrtazz
|
1h |
|
Yubikeys are still one of my fav things. And in an ongoing attempt to move them more away from magic towards tech I understand I recently read the U2F protocol overview and it was such a fun read developers.yubico.com/U2F/Protocol_d…
|
||
|
|
||
| thaddeus e. grugq retweeted | ||
|
Deadprogrammer
@deadprogrammer
|
12h |
|
AWS is not about paying for what you use, it’s about paying for what you forgot to turn off.
|
||
|
|
||
|
|
thaddeus e. grugq
@thegrugq
|
21m |
|
And honestly, it’s looking great. You go Greenland, be the best you!
|
||
|
|
||
|
|
thaddeus e. grugq
@thegrugq
|
21m |
|
Geez. Way to be a negative nelly!
|
||
|
|
||
| thaddeus e. grugq retweeted | ||
|
Katie Moussouris
@k8em0
|
54m |
|
"“It's like an oversubscribed cell network,” Moussouris said.
The idea that bug bounties provide “continuous coverage” because someone is always poking at the system looking for vulnerabilities “is predicated on a bottomless skilled labor market..that doesn’t exist" twitter.com/DecipherSec/st…
|
||
|
|
||
| thaddeus e. grugq retweeted | ||
|
Doyensec
@Doyensec
|
1h |
|
On insecure zip handling, Rubyzip and @metasploit RCE (CVE-2019-5624). A new @Doyensec blog post is out! blog.doyensec.com/2019/04/24/rub… We look forward to the first(?) Metasploit module against Metasploit itself.
|
||
|
|
||
| thaddeus e. grugq retweeted | ||
|
ringzerØ.training
@_ringzer0
|
1h |
|
If you’re interested in #firmware vulnerabilities and Defense, there’s no better source to learn than from the masters themselves. @ABazhaniuk and @jessemichael teach “SYSTEM FIRMWARE ATTACK AND DEFENSE” at #Ringzer0. There’s scholarships too ringzer0.training/system-firmwar… cc @c7zero twitter.com/eclypsium/stat…
|
||
|
|
||
| thaddeus e. grugq retweeted | ||
|
glyph
@glyph
|
12h |
|
If you're using a theorem prover to write & verify your C, you're not really *writing* C, you're using C as an incredibly tedious compiler backend. As I understand it, SEL4 was developed as an executable specification in Haskell before it was semi-automatically translated to C.
|
||
|
|
||
| thaddeus e. grugq retweeted | ||
|
quarkslab
@quarkslab
|
4h |
|
"Android Application diffing: Engine Overview"
In this blog post @rh0main and @bla5r describe the challenges of spotting changes between two versions of the same Android app and
how they addressed them
blog.quarkslab.com/android-applic…
|
||
|
|
||