Tim Brown

21.5K posts

Tim Brown banner
Tim Brown

Tim Brown

@timb_machine

push(@twitter, 'Adversarial Engineer'); # i tweet in Perl

London, United Kingdom Katılım Aralık 2008
5.3K Takip Edilen3K Takipçiler
Sabitlenmiş Tweet
Tim Brown
Tim Brown@timb_machine·
PSA: Y'all are gonna see less tech content from me here going forwards but I'm not leaving either (you'll be able to find me at @timb_machine" target="_blank" rel="nofollow noopener">infosec.exchange/@timb_machine if you're so inclined). Till it burns down entirely at least, to borrow from Wikipedia: en.wikipedia.org/wiki/They_shal… (fixed typo :))
English
1
1
7
0
Tim Brown
Tim Brown@timb_machine·
Also, with these moves around digital ID, advanced state level monitoring of mobile devices etc, what happens if a threat actor is involved and actively targets the victim based on their identity, they could target specific groups.
English
0
0
0
68
Tim Brown
Tim Brown@timb_machine·
I wonder what would happen if you needed to demonstrate harm for the CMA to be applicable. It's always frustrated me that we can't price cyber crime in more effectively.
English
1
0
0
142
mRr3b00t
mRr3b00t@UK_Daniel_Card·
Also these robot dogs are cool and scary 🤣
English
2
0
4
1.2K
mRr3b00t
mRr3b00t@UK_Daniel_Card·
Ok the science part of today was cool! This drone has an awesome IR camera! And the robot was … interesting!
mRr3b00t tweet mediamRr3b00t tweet media
English
1
1
9
2K
Tim Brown
Tim Brown@timb_machine·
Vote Binface!
Français
0
0
4
91
Tim Brown
Tim Brown@timb_machine·
@_subTee Funnily enough, we're working on that problem, having seen it in countless SOCs. Figuring out how to bring together views from NMS, cloud inventories, CMDB etc.
English
0
0
0
35
Tim Brown
Tim Brown@timb_machine·
@dinodaizovi Mainframes are very much still about. I looked at 4 different vendors for the last customer, all with nice green interfaces. Starting another test in the next week.
English
0
0
0
90
Dino A. Dai Zovi
Dino A. Dai Zovi@dinodaizovi·
I think of PCs running tn3270 clients to connect to mainframes whenever anyone mentions the hope of fully migrating from legacy to modern systems. The reality is that we just build new layers on top of them and those legacy systems become our heritage, forever part of our modern environments.
𝘽𝙤𝙗𝙗𝙮 𝙃𝙚𝙖𝙡𝙮@realBobbyHealy

software built 60 years ago still running in Dublin airport. love to see it. (gdpr violations redacted)

English
1
2
23
3.1K
mRr3b00t
mRr3b00t@UK_Daniel_Card·
This guy is talking shit….
Santiago@svpino

What’s up with fully armed soldiers walking around public places in Brussels, Paris, or London? It seems random, and it feels weird having these guys with their long guns out like nothing. I’ve never seen this in the US (which is kind of funny, when you think about it). Do people feel safer when they see this? Is there a specific reason they do this? If you are visiting the US and you see this, run.

English
5
0
26
4.8K
mRr3b00t
mRr3b00t@UK_Daniel_Card·
@Nadsec11 @timb_machine If they were told and didn’t fix it it’s not really a zero day….. 🤣 (Happy to agree it is but that’s deffo a funny spin on common usage terms)
English
2
0
0
40
nad
nad@Nadsec11·
Is it reasonable to bring a bucket full of zero days to a pentest?
English
6
2
12
3K
Tim Brown
Tim Brown@timb_machine·
@UK_Daniel_Card @Nadsec11 Very rarely do I do pen tests as you describe. Strongly dislike the term too, way too generic. Mostly we open white box, with all the attack surfaces covered. Not product tests, but full architectural scope work.
English
3
0
2
27
Tim Brown
Tim Brown@timb_machine·
@UK_Daniel_Card @Nadsec11 That means if they're using commercial components, you bet we'll have access to the install, creds etc. We'll do infra too, but one attack surface view informs others.
English
0
0
1
14
Tim Brown
Tim Brown@timb_machine·
@UK_Daniel_Card @Nadsec11 Very rare that I don't walk away with a bucket of 0day. Whether I bring them depends on whether the vendor has fixed them since last time I had a pop.
English
2
0
0
65
mRr3b00t
mRr3b00t@UK_Daniel_Card·
@Nadsec11 a penetration test is looking for 'known' vulnerabilities & misconfigurations so .. no.
English
8
0
20
1.9K
Tim Brown
Tim Brown@timb_machine·
@HackingLZ I once asked the red team at an EDR vendor about reporting bugs. The response resulted in me not reporting bugs. Just disclosure things, nothing new here.
English
0
0
0
210
Justin Elze
Justin Elze@HackingLZ·
The current lolz is that everyone is AI assisted REing EDR products, backchanneling stories and findings, and quietly comparing notes. People are just avoiding talking about it publicly so vendors don’t start harassing them, targeting tenants, or doing other fun things.
English
17
29
230
26K
Tim Brown
Tim Brown@timb_machine·
@HackingLZ I once asked the red team at an EDR vendor about reporting bugs. The response resulted in me not reporting bugs. Just disclosure things.
English
0
0
2
180

Keşfet

@emfcamp @UK_Daniel_Card @_subTee @dinodaizovi @brianwhelton @Nadsec11 @elonmusk @BarackObama