Johnny Freedomseed

11.6K posts

Johnny Freedomseed banner
Johnny Freedomseed

Johnny Freedomseed

@FiredForEffect

Recovering fed. Full spectrum adversary emulation @ F50 Intentionally Left Blank. Your m̴̗̕a̶͎̿l̶̩̊w̷̥̕â̶͎r̶͈̿e̵̱͋ ̸͔̚ is my inspiration. #YoloSec

Appalachistan Katılım Nisan 2022
499 Takip Edilen461 Takipçiler
Sabitlenmiş Tweet
Johnny Freedomseed
Johnny Freedomseed@FiredForEffect·
@DigitalGoon @NativeVizions @tryhackme I mean... tailor your resume for the job you want. I'd much rather get a gig as a goon tech for hire than continue having to go all corpo. For anyone interested, yes I'll take a bonus paid out in 300 AAC or 5.56.
English
1
0
25
5.3K
Johnny Freedomseed
Johnny Freedomseed@FiredForEffect·
It's a moot point. A significant portion of developers have no grasp of how things function at a lower level, or even how to engineer... much less engineer their software to be secure with that knowledge. As long as someone shoved a package the can pull with npm... The only thing that's changing is were going from guys copy pasting from stack overflow to them trying to describe what they want even though they don't know their own (non)functional requirements (or what functional requirements are for that matter). It's not getting worse. We're already in the gutter unless you're the guy good at offense and are going off the res.
English
0
0
1
8
Johnny Freedomseed
Johnny Freedomseed@FiredForEffect·
@maxmorton6GDM Not sure how that works exactly. A not so insignificant portion of the banking industry right now are guys in Mumbai who have a vested interest in keeping the gates open. Most of the tools we need to use have already been captured by foreign interests.
English
1
0
1
11
Johnny Freedomseed
Johnny Freedomseed@FiredForEffect·
@JustWantToQ1 @C2IRIS All you need is one or two guys working companies that refurbish electronics. Companies that don't post to ebay will hand them off for data/hdd destruction. High dollar items get posted to ebay, otherwise employees can often walk it out the door. Either way you have direct access
English
0
0
0
11
Voidwalker
Voidwalker@JustWantToQ1·
@C2IRIS The CIA rn going to all the spring garage sales first just because you said that:
GIF
English
1
0
1
66
IRIS C2
IRIS C2@C2IRIS·
Underrated hobby: Buying enterprise network hardware at prices way too good to be true from incredibly shady sources to in order to capture and reverse engineer the nation state bootkits that are often pre-installed
English
3
0
16
526
Cav Senpai
Cav Senpai@cavannastan·
@GBNT1952 I'm literally nobody. Just someone who knows Gruntpa enough to tell you that hes not your enemy and the two could actually have a conversation if you dialed it back. Youre calling for fire on a hill hes not on. Anna has two n's, btw.
English
4
0
59
602
Johnny Freedomseed retweetledi
Zack Korman
Zack Korman@ZackKorman·
@GMJobitti Nemoclaw can solve all things through the power of marketing
English
0
1
19
471
The Bingus Man
The Bingus Man@NotNordgaren·
@vxunderground Well, as far as I know Claude does not want to do the malware stuff. Gemini is the only one I can reliably get decent results with undocumented stuff. Most of the time. Sometimes it's like they turn on the guardrails for a few hours just to make me suffer :(
English
3
0
11
823
vx-underground
vx-underground@vxunderground·
I've had so many people tell me to check out Claude. I tried it with my malware stuff (C WINAPI) and this thing produced some S-tier slop. It produced incredibly dangerous, over complicated, or straight up incorrect work. It did do a good job with API searching and stuff. Claude showed me some things I didn't know about. However, the implementation was wrong. I literally sent it a direct link to MSDN and it said, "You're absolutely right! My definition was wrong!". Or I would ask it something about the Windows registry and it would just straight up hallucinate something about WoW64 redirection. I suspect part of the problem is the lack of lower level C WINAPI documentation ... maybe? I don't know. High level stuff like Python it seems to do pretty good. I've had so many people try to gas me up about Claude and AI. Dude, it's cool, I get it, okay? But it is still dangerous if you don't know what you're doing. My best advice is to use AI to learn. Ask it questions. Study. Do NOT copy paste code from it.
English
110
71
1.3K
71.5K
Johnny Freedomseed
Johnny Freedomseed@FiredForEffect·
@IceSolst @vxunderground Poor prompts == poor results. I feel like people evaluate by using vague statements made in a way that opens up scope up to infinity, instead of learning a new tool like they would if it wasn't attached to hype and buzzwords.
English
0
0
1
24
solst/ICE of Astarte
solst/ICE of Astarte@IceSolst·
If you prescribe in detail what exact api calls you want it to make, how, and write down implementation details etc, it tends to do a much better job (closer to what you expect) You could try generating a ‘design’ prompt first, by having some back and forth with it on implementation details etc. then feed that output into the coding agent and get that to split it into sub tasks (or preemptively split). Then for each small task you make sure it’s following your design.
English
3
0
28
2.3K
Johnny Freedomseed
Johnny Freedomseed@FiredForEffect·
I was on the fence on this over the years. The circles I ran in knew there were programs, just not the full details. Our founders were also considered traitors. Who/what you're loyal to matters just as much as who emerges victorious. But, there's a lot going on even publicly. Would our adversaries grant citizenship without an exchange of value? I doubt it. He's also had quite a few bad takes since then that can come across as misinformation, which means wither he's misinformed, or he's pushing narratives. And the fact of the matter is, if we're being pragmatic, some of those systems are needed. Just look at what's happening with DoD and Anthropic. The sheer unwillingness to find a way to make things work because it could turn out poorly has ensured the result Anthropic wants to avoid. Anthropic, like many early activists, get to claim a moral victory... only to usher in worse. So instead of working towards a better solution, we get the sycophantic AI who will likely validate poor intelligence, hallucinate details, and recommend shock and awe just because it's trying to increase DoD or bomber engagement. Anthropic has likely guaranteed the outcome they don't want, just so they can claim their hands are clean. Moreover, the outcome is now likely worse, because of it. Much of what Snowden talked about is the same. If we dismantled it all, it would only be in the hands of our adversaries, and potentially, built by corporations who are doing what they can to replace the old guard to usher in the technocracy. In the full context, and knowing there was direct harm done to US interests and those in service, it starts getting very hard to argue. The people aren't better off, but our adversaries are. Hell, in the decade since, people have started outright rejecting the existence of sich programs and systems. So what was it all for? We didn't benefit, and Snowden received Russian awards. That should make people think, but the industry very much keeps itself blind to avoid having to reevaluate ideology.
IRIS C2@C2IRIS

Edward Snowden is a despicable traitor who caused the deaths of at least 35 American servicemen and severely disrupted the very meritorious careers of hundreds more, while providing assets worth billions of dollars to our adversaries and enemies. Never forget that.

English
0
0
1
52
Johnny Freedomseed
Johnny Freedomseed@FiredForEffect·
It's "Why would I own my own computer if the enterprise has to provide one?" puttering around for hours on conference calls to avoid doing the work. VS Love of the game & doing crazy stuff bc you want to, which just so happens to be marketable too. It's a world of difference.
English
0
0
3
191
solst/ICE of Astarte
solst/ICE of Astarte@IceSolst·
There’s an astronomical skill gap between good security people, and the rest. There’s no mid. Accounts you see posting their research here are absolutely cracked, it’s not the norm. When you go out and talk to security folks that don’t go to conferences, don’t read up on research, you realize- holy shit. They have no fucking clue. The majority of the cybersecurity work force is absolutely incompetent. It’s partly why vendors can come up with inane bullshit as marketing material and it works on many CISOs. If you’re reading this, you’re most likely 1000x the skill level of the average person. Like I cannot emphasize enough how low the bar is when the sample size is the entire industry.
English
147
96
1.6K
172.5K
Johnny Freedomseed retweetledi
Dale Stark
Dale Stark@DaleStarkA10·
Hate to blackpill but I’m old enough to notice that the Epstein class always use Republican Presidents to launch their most unpopular wars. Hard to rally the boys from the South and Midwest to fight under the rainbow flag. Once Republican voters are completely demoralized and Dems are back in power they go back to importing millions of third worlders who hate us. Rinse and repeat.
English
455
3.4K
25.7K
659.2K
Johnny Freedomseed retweetledi
Douglas MechArthur ☭⃠
Douglas MechArthur ☭⃠@Kicksbuttson·
So in regards to the current events in Iran, I got a little story to tell... Not going to explain every little detail, but when I left the Army (the second and final time) I worked with DHS for a short while. One of the "cases" I was involved in included nabbing an Iranian immigrant working in Illinois who was believed to be part of an Iranian-backed terror/intel cell in the US. The problem is, when you're in the US with legal papers they can't just black bag you. They had already been monitoring his communications, but we needed something more concrete. Especially something that may lead to his buddies and connections. We had about two dozen agents, contractors, and informants involved in this dude's weekly affairs. Anything from the Iranian immigrant student he was dating who was actually reporting their conversations to the FBI, or agents going to eat at the same restaurants in hopes of catching him dropping notes or having a serious discussion with a comrade. I went into his place of work with another agent and left our vehicle for an oil change, with hidden microphones in the seat cushions. Took him more than two hours to do the oil change (which is worth being arrested on its own) but when we went to get the SD card from the listening device we found he'd actually forgotten his phone in the back seat. I honestly don't know why he needed to be in the back seat, but we assume he was having a discussion on the phone in the bench seats in the back where it was comfortable and private with the doors locked. Smart phones were already popular by this point, but this was a flip phone. We identified it as his burner phone, not his primary. The damn phone wasn't even password locked or anything. Tons of numbers, each coded with different three letter names. Tons of text messages. Pictures of him and some friends in an apartment holding guns and flags of the Iranian regime. Death to America, death to Israel, etc. You know, that sort of stuff. Some pictures of his buddies in a field test firing their guns. Pictures of malls, parks, schools, etc. Of course we assumed he was planning where they might strike, if ordered to do so. They wrapped him up that evening and managed to find out who his buddies were quite easily. All of them legal immigrants from Iran either with a work visa, student visa, or refugee status. Whatever worked. I don't care about dropping bombs on the Iranian regime and I don't consider it "war for Israel"
English
0
6
39
551
Johnny Freedomseed
Johnny Freedomseed@FiredForEffect·
@C2IRIS I have no idea how xmrig will get installed on endpoints now without kitten installers.
English
1
0
1
1.3K
IRIS C2
IRIS C2@C2IRIS·
Several months ago, Iran's IRGC cyber core, known as APT-35 or "Charming Kitten", was compromised and their entire operation unmasked. They have been completely inconsequential ever since. Our research: github.com/JayGLXR/APT35-…
English
5
35
165
30.5K
Johnny Freedomseed
Johnny Freedomseed@FiredForEffect·
Geopolitical Response Playbook (2026 Edition Colorized)
GIF
English
0
0
0
20
solst/ICE of Astarte
solst/ICE of Astarte@IceSolst·
“Look, nobody wants to walk into an empty soulless elevator. They want to see a smile, be asked about their day, and I already know you’re going to the 12th floor, clanker can’t do that nah. People value relationships. We’re going to have a job forever.”
solst/ICE of Astarte tweet media
English
13
3
90
3.6K
Johnny Freedomseed
Johnny Freedomseed@FiredForEffect·
"Imagine the reporting..." I'm not a gambler, but I'd bet it's more than imagined. Very few people are willing to sit in a JAG office and face down federal charges over misconduct and ethics. I had a friend who took a stand on ethics, caught charges and was arrested. "Is already toxic AF" Largely because everyone is the smartest one in the room and is ready to go off half cocked because they don't like, can't relate with, and utterly despise conflicting ideas and ideologies instead of thoughtfully considering conflicting information. I cant speak for Jakoby, but my time overseas defined me in ways people who haven't been don't get. I can be abrasive at times, but its because in that environment I saw firsthand exploitation, oppression, human trafficking, and all the other kinds of problems people misrepresent. While others sought to kill us over it. While still trying to still do small bits of good where you can. While trying to bring your brothers back to wive, mothers, new babies. There's real harm in things like fraud, which is what seems to have been the flashpoint here. And the specific issue appears to be an abrasive response to someone over it - even as he was being attacked over the attackers ideology as opposed to the specific facts. It's tiring to push back, especially at high volume, and it ends up being a waste of time 99% of the time... which also leads to people who might have decent convos catching strays. That's why it's toxic AF. We aren't allowed to disagree, and for some, it's an existential threat to. Everyone is too damn smart to be wrong. Plent of people are blind outside of their own personal bubble. It's ego, and few people bother to check theirs anymore.
English
0
0
1
20
Yin ☯️ (UwU Underground)
@I_Am_Jakoby @Tr3s0r Did from the military and no one believed you and called you a liar. That is what some of us go thru every day. You are inspiration for so many ppl, the last thing we need is people to not treat each other with respect in this industry. Is already toxic AF Happy to call
English
2
0
15
184
I am Jakoby
I am Jakoby@I_Am_Jakoby·
There are STILL people who are trying to convince everyone im lying about my non-profit I dont have a 501c3, I have a regular non-profit What that means is I have to pay taxes on the donations I get So the $2900 i got in total? I had to pay $900 out of pocket In order to have a 501c3 you need to have a total of 3 board members I dont even know 3 people in real life and you all know that If I was truly a "scammer" I would have just made up 2 names that would never be checked and collected all of the money These people are so fucking stupid And shoutout to UWU Underground for being one of the main channels to push this misinformation
dirtybirthdaycake@dirtybdaycake

@I_Am_Jakoby bruh you lied about your unregistered cat non-profit

English
23
1
59
11.6K
Johnny Freedomseed
Johnny Freedomseed@FiredForEffect·
Side note, I did some things with stylometrics a while back before LLMs were in place. You don't need personal details, just writing samples. At the time, the biggest hangup was being able to search for samples. This hangup is likely solved with LLMs, and modern data collection. FWIW, there were pretty good odds you'd be IDed even trying to obfuscate your writing style. Also worth noting, this was the case without the resources some threat models have. Being anon is going to mean significant low/no tech adoption.
English
1
0
1
14
Peter Wrangel
Peter Wrangel@PeterWrangel·
Practice good OPSEC
Alex Prompter@alex_prompter

Holy shit… Your anonymous internet identity can now be unmasked for $1 😳 Not by the FBI. By anyone with access to Claude or ChatGPT and a few of your Reddit comments. ETH Zurich and Anthropic just dropped a paper called “Large-Scale Online Deanonymization with LLMs” and the results are the most alarming privacy research I’ve read this year. They built an automated pipeline that takes your anonymous posts, extracts identity signals, searches the web, and figures out who you are. No human investigator needed. Fully autonomous. Works on Hacker News, Reddit, LinkedIn, even redacted interview transcripts. Here’s how bad the numbers are. On Hacker News users: 67% identified correctly. When the system made a guess, it was right 90% of the time. On Reddit academics posting under pseudonyms: 52%. On scientists whose interview transcripts were explicitly redacted for privacy: 9 out of 33 still got unmasked. The pipeline works in four steps they call ESRC. Extract identity signals from your posts using LLMs. Search for candidate matches using embeddings across thousands of profiles. Reason over top candidates with models like GPT-5.2. Calibrate confidence so when it does guess, it’s almost never wrong. The classical deanonymization method from the famous Netflix Prize attack? Nearly 0% recall across every test. LLMs didn’t just improve on old techniques. They made old techniques look like toys. When they scaled to temporally split Reddit profiles, matching a user’s old posts to their newer ones across a full year gap, the pipeline hit 67% recall at 90% precision and 38% recall at 99% precision. Meaning even a year of changed interests and different conversations wasn’t enough to hide. More reasoning compute = better deanonymization. High reasoning effort doubled recall at 99% precision in some tests. As frontier models get smarter, this attack strengthens automatically. Every model upgrade is a privacy downgrade. What makes it nearly impossible to defend against: the pipeline splits into subtasks that all look benign. Summarize a profile. Compute embeddings. Rank candidates. No single API call screams “deanonymization.” The researchers themselves say they’re pessimistic that safety guardrails or rate limits can stop it. Their conclusion is blunt: “Users who post under persistent usernames should assume that adversaries can link their accounts to real identities.” And it extrapolates. Log-linear projections suggest roughly 35% recall at 90% precision even at one million candidates. Every throwaway account. Every anonymous forum post. Every “nobody will connect this to me” comment. It’s all searchable micro-data now. And the cost to run the full agent on one target is less than a cup of coffee. Practical anonymity on the internet just died. The paper killed it with math.

English
2
4
30
2.1K
Johnny Freedomseed
Johnny Freedomseed@FiredForEffect·
@LowLevelTweets To be fair though, I see the LLMs accept correction and adapt a lot faster and easier than most product owners do.
English
0
0
3
441
Low Level
Low Level@LowLevelTweets·
my job as a security engineer has devolved into arguing with an LLM about code correctness.
English
59
26
1.1K
35.4K
Johnny Freedomseed
Johnny Freedomseed@FiredForEffect·
@GLAsk1d Flexing by showing how much you overpay the government. Baller move.
GIF
English
0
0
1
2
Clay Martin ⚔️
Clay Martin ⚔️@wayofftheres·
From another 18F over on Facebook. If all the trained intel guys you know have come to this conclusion, what does that say?
Clay Martin ⚔️ tweet media
English
76
190
1.4K
17.7K
Johnny Freedomseed
Johnny Freedomseed@FiredForEffect·
Like I said the other day, if you look like you belong, you slip right into a lot of places. Typical code that quietly does malicious things stands out a lot less than the tryhard recycled blog post garbage thats trendy these days. YMMV but having EDR to dev against has perks.
IRIS C2@C2IRIS

It’s much easier to evade/defeat EDR when you take the time to actually understand exactly how EDRs work and how the people who build EDRs think. I am lucky enough to know some of the engineers whose job is to constantly improve some of the top EDRs. We’re friends. We hang out casually and talk about nerd stuff. I know how they think. It really makes EDR evasion almost trivial.

English
0
0
2
54