@SwiftOnSecurity
Account based inUnited States
About this account
- Account based in
- United States
- Connected via
- United States App Store
Account-level information from X, not a live location or the device used for a specific post.
computer security person. former helpdesk.
Cyber, USA
Joined April 2014
- Tweets182K
- Following9.3K
- Followers416K
- Likes162K
SwiftOnSecurity retweeted
practically speaking we have been running on security by obscurity with binaries considered impenetrable, and that is 10000x less true. there are new provable sandboxes and stuff like that, but when we're talking about software deployed to the internet, local nets, IoT, and more, there's so much that's probably wide open.
i do not know how we get from here to secure in a paced, gradual way. chain vulns are going to puncture cloud services like punctuated equilibrium.
SwiftOnSecurity retweeted
You've gotta patch your dependencies super fast because they're full of vulns (PHP, Node, eMudhra, etc), but not _too_ fast because they're full of backdoors (LiteLLM). Good luck!
Hey, you know that part of the roller coaster where you just barely start picking up speed after a long climb to the top, facing the ground
Swiftfender bypasses Powershell wrapper for the Defender performance tooling, since it hides multiple fields. I also use WPR to extract additional context from ETL performance traces. Including command line. (!)
No tool like this in the world, correlating many forensic hints.
SwiftOnSecurity retweeted
One hopes the industry moves to a world in which local SMBs do not need to know what card testing is.
SMBs will not frequently succeed at stopping it themselves and they will be negatively impacted if turned off. Processors are in much better position to intervene.
Hey, you know what, now that I'm developing software I actually don't care about controlling RAM usage at all. You should just buy more.
SwiftOnSecurity retweeted
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
The biggest SwiftOnSecurity-enabled tech announcement since sysmon-config is coming soon
Swiftfender: An enterprise AV optimization engineer in your pocket
Certificate pinning ultimately proved largely unworkable on the web, but it is unfortunate and we did try like in HPKP. Pinning is used in many software update mechanisms, however it's spotty.
Link to @ThomasVrhydn's cool tool, that you can use to help delegate Defender troubleshooting to L1/L2 server admins (and make it easier for you)
github.com/v3rtho/MDE-troubl…
Defender antivirus admins: I'm building an even better Get-MpPerformanceReport GUI to contribure to @ThomasVrhydn's project, to make high-impact identification of exceptions and interesting issues easier.
Any requests or advice? How do you approach this? DM's welcome if private.
MDE-Troubleshooter v3.0 is open for the public !
Third version of the Swiss army knife for Microsoft Defender For Endpoint troubleshooting. It’s for security engineer who wants a central place on the endpoint to troubleshoot MDE
link: lnkd.in/exh7tEjR
"So you put plastic film on your car to protect it?"
"Yeah. It's like a shield."
"Okay, great. So now you don't have to worry about your car?"
"Haha. You fool. Now you have two things to worry about."
SwiftOnSecurity retweeted
More application control rollouts have been veto’d due to poor communication and lack of planning than for technical reasons. The same can be said for many other controls. The lesson in this is, nail the plan and nail the communication and the rest will be much easier.
