WP (@wepIV) profile picture

WP

@wepIV

Currently @blackthornellc Entrepeneur, startup advisor, angel investor, CEO, CTO, red team / Frmly CEO @icebrgio before @Microsoft @DeptofDefense @dartmouth

 Redmond, WA
blackthorneconsulting.com
Joined March 2009
  • Tweets2.8K
  • Following1.4K
  • Followers991
27Media
Photo by WP (@wepIV)Photo by WP (@wepIV)Photo by WP (@wepIV)Photo by WP (@wepIV)Photo by WP (@wepIV)Photo by WP (@wepIV)Photo by WP (@wepIV)Photo by WP (@wepIV)Photo by WP (@wepIV)Photo by WP (@wepIV)
WATCH: Whistleblower Rev. Robert Schenck describes how his decades-long influence campaign, aimed specifically at Supreme Court justices, successfully and intentionally exploited the high court’s lack of meaningful ethics and transparency rules.
125
1,322
213
2,148
Demonstrating CVE-2022-37958 RCE Vuln. Reachable via any Windows application protocol that authenticates. Yes, that means RDP, SMB and many more. Please patch this one, it's serious! securityintelligence.com/pos…
68
989
57
3,484
AI art isn’t theft? Pump some Disney and Nintendo in there. See what happens.
238
5,285
147
67,428
Kimsuky organization's APT attack sample on South Korea。 name:paypal.docx MD5:7b27586c4b332c5e87784c8d3e45a523 remote template http://k22012.c1[.]biz/paypal.dotm 历史攻击韩国报道 blog.alyac.co.kr/3228 fortinet.com/blog/threat-res… @williamlong @malwrhunterteam @ShadowChasing1
Image from zhixiang hao (@HaoZhixiang)
Image from zhixiang hao (@HaoZhixiang)
Image from zhixiang hao (@HaoZhixiang)
Image from zhixiang hao (@HaoZhixiang)
2
16
1
41
It's actually two back door and a command injection
1
1
8
In the photo: back doors
Image from Amit Serper (@0xAmit)
7
6
1
47
Reminder for all the folks using YARA or regular expressions to find byte patterns in malware or other binaries - thou shalt use single line mode \0d\0a occurs way more than you would think (?s) at the start of your regex /s at the end of your YARA regex
1
7
22
Replying to @ItsReallyNick @stvemillertime
I like this analogy because it conveniently lets me rebrand my wild analysis distractibility intermixed with ADHD hyperfocus as “interval training”
1
2
14
Replying to @stvemillertime @vxunderground
Then go grab a free Windows VM and use 7zip to unzip it into a directory tree for easy testing on goodware nitter.cf/stvemillertime/status/…
Steve YARA Synapse Miller (@stvemillertime) profile pictureSteve YARA Synapse Miller@stvemillertime7 Apr 2022
Did you know that 7zip can "unzip" VMware VMDKs? Quickly build a ~"goodware" repo for testing your #100DaysofYARA rules w/ a free Windows 10 VM developer.microsoft.com/en-u… Unzip and uze 7zz to extract the VMDK 7zz x ~/MSEdge-Win10-VMware/MSEdge-Win10-VMware-disk1.vmdk -oMSEdge-vm
Image from Steve YARA Synapse Miller (@stvemillertime)
4
8
Huh all I get now on Twitter is steady crypto bot spam. Where did infosec decide we were all gonna move to? Discord? Back to IRC?
2
2
Microsoft now offers the ability to link Azure Active Directory accounts to personal Microsoft accounts. It will be enabled by default, so Threat Actors can compromise both your business and your home life, essentially doubling the capabilities of Threat Actors. Very cool
Image from vx-underground (@vxunderground)
26
292
48
1,229
The activities in the report include illegal & legal attempts to steer US foreign policy by exploiting vulnerabilities in American governance, including its reliance on campaign contributions, susceptibility to powerful lobbying firms and lax enforcement of disclosure laws – at Washington, DC
29
249
34
886
BREAKING: FTX had a “backdoor” built into its accounting software by SBF, which he used to move billions without triggering alerts to other staff, auditors etc - Reuters
1,362
7,900
1,712
41,182
.@redcanary if you're going to use a vx-underground meme to convey a message in your marketing advertisement, you should 200% donate to us.
Image from vx-underground (@vxunderground)
3
13
1
172
Halo's Gate is (almost) dead, Long live ShellWasp! "Weaponizing Windows Syscalls": youtube.com/watch?v=ME7IGHPc…
DEF CON 30 - Tarek Abdelmotaleb, Dr. Bramwell Brizendine - Weaponizing Windows Syscalls

DEF CON 30 - Tarek Abdelmotaleb, Dr. Bramwell Brizendine - Weaponizing Windows Syscalls

Windows syscalls, while increasingly trendy in red team efforts, ha...

youtube.com
3
77
218
Billie wants you to vote Nov 8 You should vote.
132
377
14
1,470
Video games are a gateway drug to hacking, reverse engineering, and malware development
80
245
29
1,639
On Windows, the new "raw-dylib" feature allows crates to import symbols from a DLL without making use of an import library (a .lib file). See the RFC for details: rust-lang.github.io/rfcs/262… 9/10
#[link(name = "example.dll", kind = "raw-dylib")] extern "C" { #[link_ordinal(3)] fn ExampleApi(); }

ALT #[link(name = "example.dll", kind = "raw-dylib")] extern "C" { #[link_ordinal(3)] fn ExampleApi(); }

1
8
1
135
Replying to @anton_chuvakin
I had to search (because clearly I repeat myself) but it seems to be from my @BlackHatEvents keynote (where I was actually quoting my own tweet¹ ) 🙄 youtu.be/ExMuk_Vdyac __ ¹ nitter.cf/haroonmeer/status/6535…
Image from haroon meer (@haroonmeer)
haroon meer (@haroonmeer) profile pictureharoon meer
@haroonmeer12 Oct 2015
The honest question I have is: How can an industry that so prides itself on social engineering, also claim that "management don't get it" ?
3
13
Load more