Mɪᴄʜᴀᴇʟ Tᴏᴇᴄᴋᴇʀ

21.9K posts

Mɪᴄʜᴀᴇʟ Tᴏᴇᴄᴋᴇʀ banner
Mɪᴄʜᴀᴇʟ Tᴏᴇᴄᴋᴇʀ

Mɪᴄʜᴀᴇʟ Tᴏᴇᴄᴋᴇʀ

@mtoecker

Electric Power Geek, Hardhat Hacker, Control System Security Engineer, & .... Opinions are my own. (ಠ_ಠ) c[_] KC3GST

Avenger's Compound, New Jersey شامل ہوئے Mayıs 2009
1K فالونگ3.4K فالوورز
Tennessee Valley Authority
Big progress at Browns Ferry Nuclear Plant! 💪 Last week, our team successfully removed the 425,000-pound generator rotor, marking a major milestone in Unit 3's maintenance and refueling outage. This rotor will be replaced following additional maintenance within the turbine generator, helping us stay focused on safe, reliable, breaker-to-breaker performance. 🙌
Tennessee Valley Authority tweet mediaTennessee Valley Authority tweet mediaTennessee Valley Authority tweet media
English
3
6
47
2K
Mɪᴄʜᴀᴇʟ Tᴏᴇᴄᴋᴇʀ ری ٹویٹ کیا
Riley Walz
Riley Walz@rtwlz·
Payphones are strangely still licensed in California, so I filed a FOIA request and got the full list. Naturally I made a game you can now play:
Riley Walz tweet media
English
143
1.1K
20.5K
729.2K
Mɪᴄʜᴀᴇʟ Tᴏᴇᴄᴋᴇʀ ری ٹویٹ کیا
LaurieWired
LaurieWired@lauriewired·
You can send a single smartphone to any point in human history. No instructions. Winner is whoever advances human progress the most. When + where do you send it?
LaurieWired tweet mediaLaurieWired tweet media
English
298
28
1.3K
417.9K
Mɪᴄʜᴀᴇʟ Tᴏᴇᴄᴋᴇʀ ری ٹویٹ کیا
MG
MG@_MG_·
I’m a bit concerned about the non-inquisitive celebration from infosec on this. Where is the “what does keystroke latency even mean?” Without that, you can’t implement it for yourself, nor can you identify weaknesses. ~3yrs I was privately proposing similar options. So, AS SOMEWHAT OF A KEYBOARD EXPERT MYSELF 🤔💅, let’s look… First, this is most likely NOT a direct measure of network latency. This machine was physically located in Arizona. DPRK started off with shipping corp laptops overseas, but the network latency was a dead giveaway. So they started colocating them in the USA and remotely controlling them. First with remote control software, which is easy to identify if the company has security software on the machine. And then with hardware like IP-KVMs. There are sometimes a few tells that an IP-KVM is in use, but a well tuned one will identify exactly like a normal external keyboard/mouse/monitor. Unless… This is where you have to start looking beyond device identity and instead look at input anomalies. Keyboard/mouse input being sent halfway across the world via network packets to an IP-KVM can look… weird. Think bursts of input. This looks very weird with mouse data that is normally smooth. But even keystrokes start to stand out when you have a big enough dataset to compare against. So, of course, you could improve the IP-KVM to smooth out and “humanize” the inputs before relaying them to the host. But… You can also present some real time control surfaces. I don’t want to blow anyone’s defense tradecraft here. So let’s just imagine the employee needs to play a 5sec game of flappybird each day. Or maybe it’s an overt “DPRK Detector” step during login. The visual input has to travel halfway across the globe, then the input has to come all the way back. That’s a massive delay for response to visual stimulus. Certainly anomalous enough to warrant investigation. How do you beat that? Maybe an AI process running on the IP-KVM that plays DPRK Detector for you? The arms race will continue. And it’s mostly because HR and Hiring Managers don’t want to do deeper background checks needed to identify fake/stolen identities. 🤷‍♂️ And for anyone not familiar with these hunts, the detection techniques are NOT definitive proof of wrong doing. They are simply turning a mountainous hay stack into a fistful of hay that a human can quickly sift through to look for other indicators. Note: there are environment-specific detections as well. But I tried to stay in territory that’s applicable to everyone who has this risk in their threat model.
MG tweet media
English
35
125
1K
126.2K
Mɪᴄʜᴀᴇʟ Tᴏᴇᴄᴋᴇʀ
One of the coolest things about Kurowski's show is seeing her actually sit down with the client on camera with a pen and paper. This isn't about performing, it's about working, and listening.
Magnolia Network@magnolianetwork

Lindsey Kurowski helps a property owner rediscover his passion for his struggling motel in the charming city of Tombstone, Arizona. Watch a new episode of #MotelRescue tonight at 8/7c on #MagnoliaNetwork on TV, @streamonmax, and @discoveryplus.

English
0
0
1
137
Tyler Norris
Tyler Norris@tylerhnorris·
Surprising data center fact: most don’t come anywhere close to max potential power draw. No real data on this, so it’s notable to hear Verrus’ CTO weigh in (I’ve heard even lower figures) in this must-listen interview:
Tyler Norris tweet media
English
18
14
130
31.8K
Mɪᴄʜᴀᴇʟ Tᴏᴇᴄᴋᴇʀ
They would not let me leave with these shirts, and worked out how to get me new shirts that worked best for the suit, that fit, and that I could be comfortable in. 4/4
English
0
0
0
80
Mɪᴄʜᴀᴇʟ Tᴏᴇᴄᴋᴇʀ
I was impressed, and bought a very nice suit, vest, and custom shirts. Fast forward a few weeks, I'm trying on the suit l, and the shirts are just wrong. Too much material in one place, too little in another. 3/4
English
1
0
0
85
Mɪᴄʜᴀᴇʟ Tᴏᴇᴄᴋᴇʀ
BLUF: SuitSupply at Tysons is dedicated to quality and service. Would and will buy again. Hi folks, wanted to share a story really quick. I needed a suit for an upcoming wedding, and wanted it to be a nice one that I could wear for lots of occasions. 1/4
English
1
0
0
189