Legacy code to keep supporting corporate MITM weakens the security of the internet as a whole.
Pinned Tweet
Follow
slipstream/RoL
@TheWack0lian
slipstream / raylee / Rye / Rai-chan [of Ring of Lightning]
Reverser, coder, beta collector, security researcher.
Mastodon: mastodon.social/@slipstream
slipstream/RoL’s Tweets
Technical analysis of FSLabs' Chrome stealer thing.
Spoiler alert: C2 comms used plain HTTP. Hope you're not being MITM'd!
21
4
46
And here's some insight on what the "OfflineDeviceUniqueID" is a SHA256 hash *of*:
1
1
17
Show this thread
A quick proof-of-concept of clipc!GetOfflineDeviceUniqueID:
1
1
14
Show this thread
"system-unique tracking identifiers that persist across reinstalls by storing them in the TPM or UEFI firmware variables"
2
22
28
Show this thread
Topics to follow
Sign up to get Tweets about the Topics you follow in your Home timeline.
Carousel
Getting the PEB pointer for every architecture NT was ported to and where a build was leaked/released for that port:
9
18
#TwitterEvacuationDay is already tomorrow, 12/31. Join a decentralized, non-profit social network: joinMastodon.org
Better anti-harassment tools, approachable moderators who care, custom emojis, animated avatars, no ads, this list is too long to fit.
11
185
125
More Chinese malware, and a case of perhaps implementing a crypto specification *too* well?
5
#PowerShell display case has a new addition - first hardware to ever run PowerShell on an ARM architecture. Thx and
4
22
118
Chinese skids seem equal to Western skids at coding shitty malware. Haven't laughed this hard in a long time.
3
7
even if it means *patching* ntoskrnl/winload/bootmgr so you can debug that pesky protected process :)
Quote Tweet
Often it's better to reverse that Windows API you are unsure how it works than reading MSDN. Even whit it means going to ntsokrnl.exe.
5
"i downloaded this trainer to reverse it and all i got was a lousy silent miner"
4
My friend David just had his ID stolen.
Now we just call him Dav
13
39
137
Dear $website,
When you say "I see you're using an ad blocker, whitelist our site" you're missing the point. It's a safety issue first and foremost. If you infect me, I'll be stuck with the cleanup, not you. Control your ad network and I'll think about whitelisting.
#Kthxbye
29
886
1,626
My hobby: going to cryptocurrency forums and talking enthusiastically at length about cryptography topics.
2
6
16
Show this thread
TIL one of my posters helped to find a 0 day.
6
35
My immediate thought is attackers using this to ransom Google accounts like when iOS devices were remotely locked. mastodon.social/@slipstream/98
Quote Tweet
With "Advanced Protection" Gmail is now, by far, the most secure email provider you can get. motherboard.vice.com/en_us/article/
2
4
The only thread I've ever really enjoyed on Twitter.
Quote Tweet
Since ancient times, members of the #infosec tribe have adhered to a set of rigid Rules of Branded Vulnerabilities across the cybersphere.
Show this thread
9
25
How you get pwned by KRACK: email arrives purporting to be latest patch for your WiFi protecting you from KRACK.
You click on it.
Pwned.
48
67
Just so you're aware, I'm going to be using a lot of [INSERT VENDOR NAME] on KRACK jokes today.
Quote Tweet
Google on KRACK: "We're aware of the issue, and we will be patching any affected devices in the coming weeks." forbes.com/sites/thomasbr
1
6
13
hi dad i'm just calling cause you need to patch your router
oh you're using it without a password
ok never mind
8
801
2,446
"...consent-based services are always optional, meaning you still receive data from the Payfone APIs even if consent is not provided..."
4
16
Bad cryptocurrency pitch: Proof-of-work based on untangling headphone cables and balls of yarn.
1
4
9
Periodic PSA: On the modern web, ad blocking is basic security hygiene, full stop.
4
43
63
I put this reference into something I built at work, no-one understood the reference.🙃 Wasted!
1
4
11
Looked into this briefly at lunch. Looks like Equifax use SDK by , who maybe are delivering malvertising arstechnica.com/information-te
6
34
37
Show this thread
The most responsible form of encryption is when no government can subvert it. That's all there is to say about the matter. DOJ is silly.
2
7
18
Show this thread