Sabitlenmiş Tweet
Problem: Employee tapes passwords to desk.
Compliance: Stop it!
Engineer: Implement OTP instead!
Risk Analyst: Move it to your wallet.
English
Steve Werby
31.2K posts
Steve Werby
@stevewerby
Security - cyber. Into 👨👩👦🏃📚🍺🏈🏫🏋️. Manages @todayininfosec (news/events from today in years past).
Richmond, VA, US / Cyberspace Katılım Şubat 2009
1.9K Takip Edilen7.2K Takipçiler
@robertgraham When I was about 7 my mom sent me to the grocery store with cash and a list of about 5 items to buy. I rode my bike by myself 0.6 miles and made it home with 5 items (3 of which were the right items) and change.
English
I have a memory from 6 or 7 years old of my parents giving me some money to go down to the corner store maybe a half-mile away to buy something.
LADE HERSELF@Thebiglade
Be Honest.. Did parents really just let their kids wander the neighborhood all day with no phone and just say... be back before dark??
English
Happy 40th birthday to the hacker e-zine, Phrack! 🥳
Though it has been published infrequently the last two decades, it's still around - the 72nd issue was published in August.
English
It's the 30th anniversary of Hobbit's release of netcat.
Have any stories about netcat or later versions it spawned (using the same name, ncat, nc, etc.)? Cool/weird/interesting things you've done with it or its spawn - or that you've seen? If so please share.
Today In Infosec@todayininfosec
1995: The networking utility netcat was first released by Hobbit as netcat 1.0.
English
Steve Werby retweetledi
1995: Mudge published "How to Write Buffer Overflows", one of the first papers about buffer overflow exploitation. Afterwards, Mudge sent a copy to Aleph One, who later wrote "Smashing the Stack For Fun and Profit" in 1996. Seminal security paper to seminal security paper.
English
Steve Werby retweetledi
1986: "The Hacker Manifesto" was published by The Mentor (Loyd Blankenship) in issue 7 of the hacker zine Phrack. It was originally titled "The Conscience of a Hacker".
Read it.
Reread it.
Contemplate it.
Share it.
Excerpts below.
English
Steve Werby retweetledi
1995: The movie Hackers was released. Yes, 30 years ago today. 🤯
It grossed just $7 million at the box office against a budget of $20 million. Ouch. A box office failure, but today it's a cult classic.
Crash Override.
Acid Burn.
Rollerblades.
Floppy disks.
Hack the Gibson!!!
English
The cloud is just someone else's computer...which can bring down thousands of companies' services.
English
@HackingLZ So in SoSafe's case the human simulations were 19% more effective.
(0.27*0.60)/(0.21*0.65)=1.187
If genuine, it's possible the AI phishing attacks CrowdStrike based its stats on used before AI models, better prompts, better templates, the methodology was different, etc.
2/2
English
@HackingLZ No clue, but that's quite a jump from SoSafe's 2023 findings from 1,493 simulated phishing attacks, half human-generated, half AI-generated via ChatGPT-3.5. 21% click rate and 65% PI entry rate for the AI tests vs. 27% and 60% for human tests.
sosafe-awareness.com/company/press/…
1/2
English
Anyone know where this stat came from?
"AI-generated phishing emails are 5x more likely to succeed than human-written ones."
x.com/CrowdStrike/st…
English
Steve Werby retweetledi
Steve Werby retweetledi
oh, boy ... CVE-2025-33073 SMB Client Elevation of Privs is wild
synacktiv.com/publications/n…
Florian Roth ⚡️@cyb3rops
Windows SMB Client Elevation of Privilege Vulnerability CVSS Score: 8.8 Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Do I have to say more? msrc.microsoft.com/update-guide/v…
English
Steve Werby retweetledi
1986: Ferris Bueller's Day Off was released.
✅ Remotely hacked school's computer
✅ Socially engineered school principal
✅ Socially engineered restaurant staff
✅ Couldn't roll back analog odometer
🤔 The moral? One 1337 hacker can't do it all. 😂
English
Steve Werby retweetledi
Steve Werby retweetledi
1993: The first DEF CON hacker conference was held at the Sands Hotel & Casino in Las Vegas. Initially planned by Jeff Moss as a farewell party for a hacker friend, about 100 people attended. It has since grown to become a 4-day conference with as many as 30,000+ attendees.
English
Steve Werby retweetledi
1977: Hacker space epic "Star Wars" was released to little fanfare, though it has since become a cult classic. It's the tale of the droid R2-D2's hacking of the Death Star computer systems after his inept friends foolishly dove into a trash compactor.
English
The phrase "a crisis of competence" is thought-provoking. Inability to focus, rapid context switching, lack of critical thinking, accepting info that's presented, measurements and incentives not matching desired outcomes, etc. Lots of reasons for incidents like this.
Jeremiroquai@Jerematic79
My oncologist tried to stop my chemotherapy* treatment last week because of a one-page synopsis he had read regarding my recent MRI, which mentioned that one of my brain tumors had progressed. It turns out he had never actually looked at the MRI itself; and the specialist who wrote the synopsis had not actually compared the new images to my previous MRI from 2024. I was skeptical, as my symptoms had not progressed; so I asked my oncologist to show me a comparison of the two most recent MRIs, to demonstrate the growth. So, he brought them up on his screen and showed me a clear difference between image on the left and one on the right. "But the one on the left is the 2017 MRI," I said. "We both know the tumor has grown since then." The doctor was surprised, and said, "You're right. I'm not sure why the 2024 MRI isn't showing up." Anyway, we had to go to a different room and use a different computer to find last year's images. When my oncologist finally brought them up, he realized there was a clear REDUCTION in the size of my tumor, as well as a loss of contrast, indicating that the tumor was dying. So, the chemotherapy was working after all! Had I taken my doctor at his word, and stopped my chemotherapy, I would have soon needed an extremely risky brain surgery that would have changed my life forever. We are living through a crisis of competence in America — or is it in the world as a whole? It is absolutely essential that we remain vigilant and look out for our own health, because we apparently can no longer trust our doctors to do it for us. Remember to ask questions, get second opinions and, above all, don't just assume that your doctor is infallible. Now more than ever, your life is in your own hands.
English
Steve Werby retweetledi
Anthropic announced they've activated "Al Safety Level 3 Protections" for their latest model. What does this mean, and why does it matter?
Let me share my perspective as OpenAl's former lead for dangerous capabilities testing. (Thread)
English
Thought-provoking discussions/debate/points in this thread:
Florian Roth ⚡️@cyb3rops
#BadSuccessor - a textbook example of why the security ecosystem is broken - A privilege escalation vuln in Windows Server 2025 AD (via dMSA) - Full domain compromise with default config - Microsoft was told, agreed it’s real, but rated it "moderate" - No patch, No fix - No code execution needed - No need to touch the DC - No RPC, no ntds.dit - Just a write to one attribute on an account you can create - Rubeus already supports dMSA abuse (since February) - Metasploit module is in the works Researchers published everything anyway. Because… "we respectfully disagree with Microsoft’s assessment". So yeah, let’s just drop an end-to-end domain takeover technique online to prove a point. To be fair, Windows Server 2025 isn’t widely deployed yet, so the real-world blast radius today is limited. But this isn’t about today - it’s about trust, process, and what happens when security decisions are driven by vendor priorities and researcher egos. What this tells me: 1. Microsoft either: - Can’t assess bugs anymore - Or stopped caring about on-prem AD completely (because Entra ID is what they want to sell) 2. And the offensive sec crowd? - They knew this would hit hard - But chose to burn the world anyway - Because their urge to be right > everyone else’s security In the end, both sides look bad. Microsoft, for being dysfunctional or apathetic Researchers, for chasing clout over coordinated disclosure Congrats. In a rare show of unity, both sides managed to screw this up. Blog: akamai.com/blog/security-… LinkedIn: linkedin.com/feed/update/ur… Metasploit issue: github.com/rapid7/metaspl…
English
Never use your own voice when speaking on the phone, in a videoconference, or in public with strangers, people you don't trust, or even people you trust. Audio of your voice can be recorded, allowing bad actors to use AI to impersonate you. There's no good solution. Good luck. 🤣
English
@todayininfosec The full article: atariarchives.org/bcc1/showpage.…
English
1975: The article "Students Stuff the Contest Box" was published. 26 Caltech students exploited McDonald's "Enter as often as you wish" rules to win 20% of a contest's prizes by submitting 1.1 million entries to 98 stores. McDonald's WAS NOT PLEASED.
English