ax0n

@ax0n

Buy it. Use it. Break it. Fix it. Husband. Tabby Wrangler. Bot Hunter. SecOps. DFIR. SysAdmin. When in doubt, use BSD. Hard NOCs Class of '06. Tweets my own.

Kansas
h-i-r.net/ax0n
Joined April 2008
1,011 Photos and videos Photos and videos

Tweets

You blocked @ax0n

Are you sure you want to view these Tweets? Viewing Tweets won't unblock @ax0n

  1. Retweeted
    May 19

    Rabbit Hole by -badges

    1 reply . 2 retweets 3 likes
    Undo
  2. Feb 23

    Thread AF.

    I've had 3 calls so far today (it's not even 10) about defending against Russian cyber ops I'm tired of having the same call... so... here's what I've told everyone. This is the playbook you need... but it's not going to be what you think it will be. Ready? Lets go! 1
    Show this thread
    4 likes
    Undo
  3. Retweeted
    Feb 11

    Today, the Cole County prosecutor declined to file charges against me over my discovery of a flaw in a public website. This decision is a relief. But it does not repair the harm done to me and my family. Here is my personal statement on these matters:

    111 replies . 824 retweets 3,499 likes
    Show this thread
    Show this thread
    Undo
  4. Retweeted
    Jan 22

    It's time for all of us in , to stop blaming and take responsibility. To look at hiring differently. To take risks on people. To focus on growing grassroots talent. And ultimately to . I am so thankful every day for all the leaders in my past /11

    4 replies . 4 retweets 137 likes
    Show this thread
    Show this thread
    Undo
  5. Jan 23

    Last night, the "K2 Stresser" control panel had thousands of infected systems shown.

    Show this thread
    Show this thread
    Undo
  6. Jan 23

    C2/Payloads: 107[.]189.12.110 Payloads: http port 80 C2: TCP port 6969 Panel: http port 666 C2 check-in text: "educatia e ca erectia, de o ai se vede" I posted many related file hashes in this "Discussion" on VirusTotal:

    1 reply .
    Show this thread
    Show this thread
    Undo
  7. Jan 23

    The remaining 3 are part of a "Stresser" style DDoS toolchain. The downloader, C2 and binaries are all hosted on the same machine. I found the (unauthenticated) "K2 Stresser" HTTP control panel running on an alternate port on the C2 system. Anyhow here are some IOCs 3/?

    1 reply .
    Show this thread
    Show this thread
    Undo
  8. Jan 23

    Each platform (Targeting amd64 FreeBSD, amd64, i386, i686, mips, arm and arm64 Linux) downloads 4 binaries: "main" "TCP-HTTP", "HTTP-Basic" and "UDP-Basic". All four appear to have been written in Go. The "main" binary checks in to c2 by sending some humorous Romanian text. 2/?

    1 reply .
    Show this thread
    Show this thread
    Undo
  9. Jan 23

    Last week, my honeypot snagged a mundane "Downloader" that does the old "detect platform, download binaries" dance. I've caught 3 iterations of the loader, they're only detected by a few on . The dozens of bins? All of them reporting clean. 1/?

    1 reply . 5 likes
    Show this thread
    Show this thread
    Undo
  10. Retweeted
    Jan 21

    I get asked about 10 times a week about blocking traffic based on geolocation in our various tools that can do it. Let me say this again for those in the back: Blocking by geo will not save you. It’s just as easy for them to attack you from a compromised host in your country or

    42 replies . 26 retweets 206 likes
    Show this thread
    Show this thread
    Undo
  11. Retweeted
    Jan 17

    Spent my weekend busting my butt to get new folks into our industry, and come back to more gatekeeping. Know this: You can succeed in and enjoy cybersecurity. Regardless of gender, race, background... Society and life may throw hurdles, but lots of us want to help you succeed.

    46 replies . 245 retweets 1,987 likes
    Show this thread
    Show this thread
    Undo
  12. Retweeted
    Jan 16

    As a high school dropout my unpopular opinion is... Any route a person manages to take to get to the place they are at is valid. So those able to attend college for the specialization they are passionate about is beneficial and does not take away or devalue all other routes! 🧐

    Unpopular opinion: cyber security degrees shouldn't exist. It should be a specialisation within computer science.
    Show this thread
    12 replies . 43 retweets 431 likes
    Undo
  13. Retweeted
    Jan 17

    I've found this on VT

    25 replies . 69 retweets 519 likes
    Undo
  14. Retweeted
    31 Dec 2021

    Sometimes I notice people trying for hours to evade one of my signatures and finally succeed for a moment - until they notice that their evasion triggers a different signature 😂 Oh boy, I love my job.

    3 replies . 30 retweets 335 likes
    Undo
  15. 28 Dec 2021

    Axon's corollary to The Third Law: Any sufficiently antiquated technology is indistinguishable from magic.

    1 retweet 3 likes
    Undo
  16. Retweeted
    13 Dec 2021

    Restored a TRS-80 CoCo model 2. Was in pretty bad shape with multiple cable burns and yellowing Interesting fact is that this this computer ran at 880kz which was the same frequency as our home town AM radio station KWIP Fond memories of playing games with my friend Mike on it

    28 replies . 8 retweets 222 likes
    Undo
  17. Retweeted
    9 Dec 2021

    Good news! Thanks to everyone’s support Dan Kaminski will be inducted into the Internet Hall of Fame during a December 14th ceremony. The livestream will happen 06:00-08:00 Pacific Time Zone (14:00-16:00 UTC):

    23 replies . 286 retweets 1,091 likes
    Undo
  18. 1 Dec 2021

    Uhh this is bad. And awesome. 😈

    Using o365 mail online ? try this link; You may be an admin to Azure ! Stumbled into this last night. Effing Crazy. thank you for verifying !!!!
    Show this thread
    2 likes
    Undo
  19. 25 Nov 2021

    Adjective Noun Adjective Club. 🤡

    3 likes
    Undo
  20. 17 Nov 2021

    Do you know how to use the ed(1) line editor in a pinch? I reformatted a shared Windows 11 and partition from FAT32 to ExFAT but forgot to edit my fstab entry. Whoops. (cc )

    4 replies . 3 retweets 18 likes
    Undo

@ax0n hasn't Tweeted yet.

Loading seems to be taking a while.

Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.

    You may also like

    ·