SecByT̷͔̼̯̖̟͔͎͑̽o̶͚̠̰͚̩̻̝̰͂̿̔̄̊́͘m̷̡̟̍́̏̔ @GrrCon

HEY EVERY VENDOR. Remember all those times I was a HUGE PITA because you wanted a non-redacted copy of my ID? Yeah, this is why.

Mandate more age verification, and shovel off responsibility to more and more 3rd parties

This, your company shouldn’t store this in email, ticketing, or ANYWHERE for any amount of time, ever.

Catching @mr-minion.bsky.social’s talk at GrrCon this morning!

A little OpenGraph POC for mapping PE header imports of all .dll and .exe files in a fresh Windows install. These are all the binaries that have some kind of import chain leading to kernel32.dll

Where’s this from? That looks like actual data.

Nobody asked for it. We did it anyway.

If you ever used Winamp during the later years, it had an awesome, awesome visualizer called Milkdrop. The Webamp people implemented a workalike called Butterchurn.

Internet Archive now supports Webamp and Butterchurn. Just click on the llama!

No, the settlement is $1 of store credit. 😂

I think something that is incredibly hard to balance is both looking up to people who you strive to compete with someday, but also recognizing how far you’ve come so far. I get a ton of motivation from the pursuit of being the best. But I’m not the best at this thing (yet?).

Teaching the wife Diffie-Hellman exchange tonight.

LA County moves to limit license plate data sharing amid ICE raids State law prohibits local police from assisting federal immigration enforcement in California

ALPRs can still be abused given the sheer volume of data collected and the lack of transparency in who can request it. “What we actually need, if we want these laws to mean something, are robust oversight measures,” EFF’s @maassive.bsky.social told Spectrum News 1.
spectrumnews1.com/ca/southern...

RunDll Exporters

www.hexacorn.com/blog/2025/09...

Check for 9-8-25 NPM Supply Chain Compromised packages (bash) Check for 9-8-25 NPM Supply Chain Compromised packages (bash) - check-npm-compromise.sh

I put together a script to verify that your linux/mac install didn't get a compromised npm package. This, unlike some other checks out there, looks through your prior installed packages to make sure an update didn't obscure the compromise.

gist.github.com/TechByTom/5f...

Sadly, I won't be there, but this looks great already.

Some say write-ups are too OP. I dressage. We love seeing the work.

Way to go!

I'm one of the 37 targeted below by DNI Tulsi Gabbard. I haven't had a clearance nor worked in government since 2013. This is political theater & a dangerous example of government abusing its powers to punish private citizens for openly exercising their 1st Amendment rights. My full statement:

This is both funny and horrifying.

Horrifying because people are using and trusting this tool to be reliable and wrecking careers when it's wrong.

A medical doctor sign is displayed with a WhatsApp number. This sign is in Bali, where HIPPA obviously does not apply.

/me cries in HIPPA

2025 State of the Internet: Digging into Residential Proxy Infrastructure In-depth analysis of the PolarEdge botnet (first reported on by Sekoia in early 2025) a suspected ORB targeting edge devices since mid-2023. This blog covers infrastructure patterns, profiles current ...

PHENOMENAL work by @censys.bsky.social w/special shout out to one of the best cyber researchers out there (Himaja, who is smartly not on social media).

They discovered sophisticated proxy infra designed for long-term espionage operations, & most victims probably have no idea they're compromised.

Unique *certificate per client

I definitely left that part out, but in my head the mTLS layer is at C2 channel level, not as part of the protocol it’s embedded in. mTLS with unique certain per client means we get knowledge of where and when it was delivered when the server starts to communicate.

Sorry for the complete and total tangent, but I’m curious. There are obvious opsec downsides to mtls, but why is it not more common in c2 tooling?

Last thought: while I'm on a tradecraft+capability separation kick, I intend Crystal Palace as an open-ended object/PIC stitching sandbox. Keep playing with it. Try different ideas. It's really cool. This is what organic cross-inspiration and conversation looks like. I pivot when inspired too.

Oh hey, the first video is now available!

Check out Steve Shelton’s keynote for #BSides312, the abstract for which had me sobbing.

Maximum echo please.

Astronomers may have just discovered the third interstellar object passing through the Solar System!

ESA’s Planetary Defenders are observing the object, provisionally known as #A11pl3Z, right now using telescopes around the world.

This is 100% going into my private C2 www.procustodibus.com/blog/2024/04...

I’m proud of you all. GG.

Do not sleep on my blue team 💪🏻