Just spent the last 7 days on the front lines of the vulnpocalypse fending off an active cyber attack on one of our products.
Some thoughts:
- Software factories are going to be required equipment for everyone. There’s just no way to keep up with the pace of highly automated adversaries without one.
- We were lucky because we had spent the last few months getting our software factory running well. It is nice to have for product development but proved to be absolutely essential this week.
- At the minimum you need to have a coding server in the cloud pre-provisioned with read only access to all your logs and all the services you depend on for observability. With that in place you are a prompt away from reasonably good situational awareness, ongoing monitoring with loops, and ability for coding agents to validate fixes against your actual, observed attack patterns.
- Shared coding server also unlocks multiplayer incident response where everyone can see every session and jump in as needed. Sharing session links that can be forked is much higher bandwidth than re-explaining things.
- You don’t need to be Ramp/Stripe/Uber scale to have a working software factory in the cloud. We are a team of 3. Ours is built with an @opencode server (thanks @thdxr!), a forked version of compound engineering optimized for automated workflows (thanks @kieranklaassen!) and a multiplayer agent in slack that handles crons (we have our own harness but pick your favorite here).
- To get our software factory up and running well, we had to stop all new product development for ~6 weeks and just focus on getting the validation systems working that enabled us to reliably shipping PR without human code review. This felt very painful in the moment but was totally worth the eventual speedup in velocity.
- KYC for @AnthropicAI & @OpenAI cyber programs is now easy and quick (at least for defensive access), but a day felt like a lifetime this week. Submit your app now before you really need it.
- Getting Mythos access unlocked a deeper level of analysis that helped us shift from reactive mitigation to proactive patching. Wish we had done this a few weeks earlier. Get started now!
19
18
669
23,231
Just found a zero day
If you right click on an executable on Windows, select run as administrator, it will run as administrator
I'm calling it Program2Shell
If you right click on an executable on Windows, select run as administrator, it will run as administrator
I'm calling it Program2Shell
176
475
10,508
184,365
I'm syncing a bunch of stuff to vx-underground, got lots of stuff working on, and my son has mastered the art of opening doors. He will now open the door when you're pooping.
More silly stuff coming next week. Please keep me in your prayers
More silly stuff coming next week. Please keep me in your prayers
6
5
375
15,859
Yeah, so pretty much I've scrapped a bunch of YouTube ideas because sometimes I can be a perfectionist about stuff.
I ended up telling myself, "nah, don't be a sissy, just choose a random goop and release the video".
Anyway, the random goop I selected, by what I believe may be divine intervention, is UNC6910 CURLYGATE
I ended up telling myself, "nah, don't be a sissy, just choose a random goop and release the video".
Anyway, the random goop I selected, by what I believe may be divine intervention, is UNC6910 CURLYGATE
18
13
598
22,744
Lots of arguments online surrounding who truly discovered PHP2Shell, who gets the clout, etc.
I am the person who found. I found it in like 2013, or something, whatever. Trust me, bro. I'm hardcore and 1337.
Now give me lots of monies and clout. Don't be a hater
I am the person who found. I found it in like 2013, or something, whatever. Trust me, bro. I'm hardcore and 1337.
Now give me lots of monies and clout. Don't be a hater
70
75
2,255
36,888
Tbh bro I keep seeing new apparent 14.5320/10 CVEs every other post online and idec anymore
Whatever man just fuck the shit up
Whatever man just fuck the shit up
31
48
1,422
48,993
> wake up
> don't shit the bed
> wow a good day
> open xibbler on phone
> "For You" timeline
> first video
> dude ties himself to sofa
> flicking lighter
> "tf is this?"
> lights himself on fire
> suicide by self-immolation
> mfw
> don't shit the bed
> wow a good day
> open xibbler on phone
> "For You" timeline
> first video
> dude ties himself to sofa
> flicking lighter
> "tf is this?"
> lights himself on fire
> suicide by self-immolation
> mfw
48
25
1,346
30,951
I can't keep up with all of the banger cybersecurity memes
Every time I have whimsical thought I see someone else posted it first
GOD DAMN YOU, LET ME MAKE A FUNNY POST
Every time I have whimsical thought I see someone else posted it first
GOD DAMN YOU, LET ME MAKE A FUNNY POST
36
43
1,609
27,539
Today silly shenanigans:
- PHP2shell, leak, bad stuff
- Something about Railway?
- The number 4 is a valid cert
- NodeJS and something about broccoli?
- LiteLLM supply chain attack
- GitLab CVSS 10
- OpenCode leaking API keys
What does this all mean? Idk
- PHP2shell, leak, bad stuff
- Something about Railway?
- The number 4 is a valid cert
- NodeJS and something about broccoli?
- LiteLLM supply chain attack
- GitLab CVSS 10
- OpenCode leaking API keys
What does this all mean? Idk
83
220
2,621
51,922
Chat, we've gone big league
Last time on Dragon Ball Z, a few weeks ago I made a crappy little video of me bonking goop (malware) with a stick. In the video I mentioned I use IDA Pro, I believed it to be the best on the market, and said as an independent researcher I can easily d version).
Following this silly video, I got an e-mail from the people who make IDA (Hex-Rays). I immediately believed they were going to yell at me, hit me over the head with a cinder block, or sue me, for using a cracked version of their very expensive product and displaying it in the video.
Instead they told me they liked my goop video and they liked my goop posts. They also said they like vx-underground because they value the goop.
So anyway, so instead of beating me over the head with a cinder block, they gave me IDA Pro Expert for free.
wtf i love hex-rays
Last time on Dragon Ball Z, a few weeks ago I made a crappy little video of me bonking goop (malware) with a stick. In the video I mentioned I use IDA Pro, I believed it to be the best on the market, and said as an independent researcher I can easily d version).
Following this silly video, I got an e-mail from the people who make IDA (Hex-Rays). I immediately believed they were going to yell at me, hit me over the head with a cinder block, or sue me, for using a cracked version of their very expensive product and displaying it in the video.
Instead they told me they liked my goop video and they liked my goop posts. They also said they like vx-underground because they value the goop.
So anyway, so instead of beating me over the head with a cinder block, they gave me IDA Pro Expert for free.
wtf i love hex-rays
87
85
2,939
37,635
> be me
> get on xibbler
> group of nerds do php exploit poc thingie
> make sassy repost
> nerd fight ensues
> forgot dont like nerd fights
> delete post
> get off xibbler
> eat sandwich
> get back on xibbler
> "i wonder if its calmed down"
infosec xibbler:
> get on xibbler
> group of nerds do php exploit poc thingie
> make sassy repost
> nerd fight ensues
> forgot dont like nerd fights
> delete post
> get off xibbler
> eat sandwich
> get back on xibbler
> "i wonder if its calmed down"
infosec xibbler:
38
80
1,599
132,675
anyway, im gonna go to bed early tonight. im gonna wait until this whole php thing clams down a bit
3
3
317
10,620
> wake up
> take a shit
> get out of bed
> check beep boop
> everyone saying ooga booga PHP
> wtf why
> look inside
> ultra mega fuck off exploit coming
> php2shell
> so bad PHP devs begs nerds to patch tomorrow
> proof of concept video released
> pwn website easily
> video has dancing anime lady?
> nobody explains wno one even asks why proof of concept has dancing anime lady
> ok
> cybersecurity nerds bamboozled
> some saying will be up there with Log4J in severity
> goopocalypse
pic unrelated
> take a shit
> get out of bed
> check beep boop
> everyone saying ooga booga PHP
> wtf why
> look inside
> ultra mega fuck off exploit coming
> php2shell
> so bad PHP devs begs nerds to patch tomorrow
> proof of concept video released
> pwn website easily
> video has dancing anime lady?
> nobody explains wno one even asks why proof of concept has dancing anime lady
> ok
> cybersecurity nerds bamboozled
> some saying will be up there with Log4J in severity
> goopocalypse
pic unrelated
143
458
8,255
197,759
I stepped away from my beep boop to go potty
Came back to see my Windows VM restarted because Windows decided to force update
Yeah, my OS was really out of date, I had to restore a snapshot, so you FORCE install an update?
Microsoft, what the actual fuck is your problem?
Came back to see my Windows VM restarted because Windows decided to force update
Yeah, my OS was really out of date, I had to restore a snapshot, so you FORCE install an update?
Microsoft, what the actual fuck is your problem?
45
34
1,123
23,846
Dawg, I got an e-mail from a student at FSU (Florida State University) jokingly asking if they're attending the University of Goop.
They received an e-mail from a student (who has surely had their e-mail compromised) telling them they need to review the Universities conduct policy, or something, and they must install "Zoho Assist"
Zoho Assist is a legitimate tool for remotely assisting people. But, some dorky ass Threat Actor is sending out these goofy social engineering e-mails hoping a student will install Zoho on their devices
My question for the Threat Actor: what if the student isn't running Windows? Many students use Apple products, or are running the infamous LINUX OPERATING SYSTEM, so what is your plan then?
Secondly, what's the plan then? Remotely access some broke ass college kids device and steal their $13 from their bank account?
I don't get it
They received an e-mail from a student (who has surely had their e-mail compromised) telling them they need to review the Universities conduct policy, or something, and they must install "Zoho Assist"
Zoho Assist is a legitimate tool for remotely assisting people. But, some dorky ass Threat Actor is sending out these goofy social engineering e-mails hoping a student will install Zoho on their devices
My question for the Threat Actor: what if the student isn't running Windows? Many students use Apple products, or are running the infamous LINUX OPERATING SYSTEM, so what is your plan then?
Secondly, what's the plan then? Remotely access some broke ass college kids device and steal their $13 from their bank account?
I don't get it
56
24
1,051
46,220
There has been a glitch in the matrix. @smica83 shared a heavily obfuscated .vbs which was first identified in Morocco, initially named "nouveau_cv_pdf.vbs".
I wasn't going to statically deobfuscate the piece of shit, so I emulated it. During emulation it catches it pulling a tps://qmlab1(.)com/assets/img/katyusha2
I curl the payload, look inside, and you're never going to believe it.
It's the exact same fucking binary I just discussed. It is the Go malware labeled internally as "EasyAgent"
I've never accidentally stumbled upon the same malware campaign, with different delivery methods, back to back like this. This is very silly
I wasn't going to statically deobfuscate the piece of shit, so I emulated it. During emulation it catches it pulling a tps://qmlab1(.)com/assets/img/katyusha2
I curl the payload, look inside, and you're never going to believe it.
It's the exact same fucking binary I just discussed. It is the Go malware labeled internally as "EasyAgent"
I've never accidentally stumbled upon the same malware campaign, with different delivery methods, back to back like this. This is very silly
> be me
> get dm
> "smelly, i found goop"
> wtf i love goop (malware)
> "Someone in South Korea received a Fortinet installer, except the "ipfilter" binary looks suspicious"
> ok
> download
> look inside
> goop malware left pdb intact
> "E:\dropper_cpp\dropper\dropper"
> ...
> image 1
> lolwtf bro
> downloads "in74.54.75/storage/install.exe
> install.exe is malware written Go
> registers itself as a service
> "EasyAgent"
> unobfuscated
> everything visible
> "Easyagent_connection_Connect"
> shows connecting to wss://52.74.54.75
> Image 2
dawg, if you're going to try to masquerade as a fortinet client thingie, and target large companies for initial access, you really need to up your goop game. this took me literally like, 2 minutes to reverse engineer and identify what you're doing.
8
22
662
20,052