network security assessment, 3rd edition. done and dusted 👌 shop.oreilly.com/product/063… – at Rio de Janeiro, Brazil

The #Log4j #Log4Shell exploit vector using JavaScript WebSockets requires 3 conditions: 1. User browses to site hosting malicious JS 2. Vulnerable Log4j web application exists 3. Exploit triggered through URL content (e.g. "/login?user={jndi..." versus HTTP headers or POST data)

Later this week if you're attending Black Hat >> blackhat.com/us-21/sponsored… #blackhat2021 #BHUSA

"922. A lie." by @hirst_official via @HENIGroup >> currency.nft.heni.com/item/9… #TheCurrency #NFT

Guessing it's a red team and Inverness Counsel is a client? @pmelson @James_inthe_box @JAMESWT_MHT >> virustotal.com/gui/ip-addres…

The fact that these three were able to compromise that environment with such little resources demonstrates how systematically broken things are. These kids aren't the problem, but a symptom >> justice.gov/usao-ndca/pr/thr…

Please, please have your BDRs calm down @erikgoldman @christinacaci? It's obnoxious, and I can only imagine how many other folks are getting spammed by you.

Doing great work takes A LOT of time and effort. VCs tend to be time-sensitive and in-turn cajole teams into doing substandard work, i.e. ship a product quickly that the "RevOps" organization with an army of BDRs can shill to hit ARR targets (versus actually helping customers)

the sunken place ↘️

#LetsGoGiants #SuperBowlLIV #SplashBros

this quote sums up the state of affairs with heavily capitalized cyber security companies and their customers >>

When Google's @chroniclesec starts serving adwords on your trademark / brand name, you know you're doing something right 🚀

Just finishing writing a short piece on @Medium about the cyber job shortage that's not showing any signs of slowing >> medium.com/alphasoc/understa…