Curt Wilson, human

@curtw

Exploring systems security since 1985. Malware+{cybercrime/espionage} analysis, threat intelligence + full-spectrum security research. Personal account.

Earth
Vrijeme pridruživanja: kolovoz 2008.
105 fotografija ili videozapisa Fotografije i videozapisi

Tweetovi

Blokirali ste korisnika/cu @curtw

Jeste li sigurni da želite vidjeti te tweetove? Time nećete deblokirati korisnika/cu @curtw

  1. proslijedio/la je Tweet
    4. velj

    Cybercriminals selling access to an MSP for $600? It’s real. Check out how we worked with and to discover, social engineer, and expose an attacker on the dark web.

    57 proslijeđenih tweetova 108 korisnika označava da im se sviđa
    Poništi
  2. proslijedio/la je Tweet
    1. velj

    The Hacker Factor Blog: Deanonymizing Tor Circuits

    8 proslijeđenih tweetova 10 korisnika označava da im se sviđa
    Poništi
  3. proslijedio/la je Tweet
    prije 9 sati

    2020-02-05: [Breaking]🔥🆕 "🇷🇺Pro-Russian CyberSpy Intensifies Ukrainian 🇺🇦 Security Targeting" 🔦The 'Fifth Domain': Gamaredon Wages Silent War with Ukranian Military & Law Enforcement ➡️5k Victim Scope in Ukraine Along 'Separation Line'

    30 proslijeđenih tweetova 45 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  4. proslijedio/la je Tweet
    30. sij

    It should be -2019-1367 rather than -2020-0674, and seems targeting from group.

    Possible CVE-2020-0674
    29 proslijeđenih tweetova 48 korisnika označava da im se sviđa
    Poništi
  5. proslijedio/la je Tweet
    4. velj

    If you have agile continuous deployment for your flagship app, but not for OS patching, stop saying “devops” like you know what it means.

    Every. Single. Organization.
    16 proslijeđenih tweetova 39 korisnika označava da im se sviđa
    Poništi
  6. proslijedio/la je Tweet
    prije 23 sata

    Backdoor is basically: - Enable Telnet on HiSilicon chips via 9530/tcp - Use one of six hardcoded root accounts to log in A PoC to test if your device uses HiSilicon SoCs and is vulnerable is available here:

    1 reply 37 proslijeđenih tweetova 76 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  7. proslijedio/la je Tweet
    4. velj

    Brilliant Dilbert meme describing every IT manager lol

    28 replies 1.048 proslijeđenih tweetova 3.137 korisnika označava da im se sviđa
    Poništi
  8. proslijedio/la je Tweet
    4. velj

    Every foreign nation that has ever been lectured on electoral transparency by American officials is owed an apology.

    NEW statement from -- "While the app was recording data accurately, it was reporting out only partial data. We have determined that this was due to a coding issue in the reporting system."
    151 reply 1.375 proslijeđenih tweetova 5.294 korisnika označavaju da im se sviđa
    Poništi
  9. proslijedio/la je Tweet
    29. sij

    1\ I've written a little compiler to ship ML models as standalone Yara rules, and done proof of concept detectors for Macho-O, RTF files, and powershell scripts. So far I have decision trees, random forests, and logistic regression (LR) working.

    15 replies 104 proslijeđena tweeta 253 korisnika označavaju da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  10. proslijedio/la je Tweet
    29. sij

    I've transformed the expressions from my "Top Base64 Encodings" learning aid into a YARA and Sigma rule and published them in the respective repos Learning Aid YARA Sigma

    7 replies 120 proslijeđenih tweetova 299 korisnika označava da im se sviđa
    Poništi
  11. proslijedio/la je Tweet
    28. sij

    [Educational] One of the best blog posts that I ever read about going from 0 to unauth RCE in f**king Mikrotik OS step by step:

    396 proslijeđenih tweetova 937 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  12. proslijedio/la je Tweet
    29. sij

    Capture NTLM Hashes using PDF (Bad-Pdf)

    1 reply 110 proslijeđenih tweetova 320 korisnika označava da im se sviđa
    Poništi
  13. proslijedio/la je Tweet
    28. sij

    NEW: With 30 million card details put up for sale on Joker's Stash, the Wawa card breach may rank as one of the biggest of all times, second to the Home Depot and Target breaches only

    6 replies 84 proslijeđena tweeta 119 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  14. proslijedio/la je Tweet
    28. sij

    Windows Defender got you feeling down? Here is a simple trick to load your meterpreter payloads past Windows Defender

    6 replies 157 proslijeđenih tweetova 422 korisnika označavaju da im se sviđa
    Poništi
  15. proslijedio/la je Tweet
    28. sij

    PInjectra’s Stack Bombing Process Injection example was only the beginning. I wrote a practical implementation of it that performs process migration using shared Memory, self-loading/linking DLLs, and an RWX ROP chain. Also included: a detection for it

    43 proslijeđena tweeta 61 korisnik označava da mu se sviđa
    Poništi
  16. proslijedio/la je Tweet
    28. sij

    Wish more ISACs shared via MISP rather than commercial TIPs or email distros.

    If you are a new ISAC and want to start a sharing community, don't forget we have a document made with X-ISAC "Guidelines to setting up an information sharing community such as an ISAC or ISAO"
    Prikaži ovu nit
    13 proslijeđenih tweetova 44 korisnika označavaju da im se sviđa
    Poništi
  17. proslijedio/la je Tweet
    28. sij

    tip: use logman.exe with -b, -rf, -s, and -rc to create highly-privileged local, and remote scheduled tasks. They are deeply hidden in the Task Scheduler GUI, especially as the actions are masked under "Custom Handler". And no one looks for attackers in Perfmon/DCS.

    150 proslijeđenih tweetova 359 korisnika označava da im se sviđa
    Poništi
  18. proslijedio/la je Tweet
    28. sij

    NYTimes journalist targeted w/ mobile spyware Pegasus from NSO Group; evidence also suggests an NSO Group operator may have been infecting targets while impersonating the Washington Post in the weeks leading up to and after Khashoggi’s killing in 2018

    134 proslijeđena tweeta 133 korisnika označavaju da im se sviđa
    Poništi
  19. proslijedio/la je Tweet
    27. sij

    For more on all of this, check out the multiple reports on both sets activity by the teams at and which are well worth your time

    1 reply 21 proslijeđeni tweet 32 korisnika označavaju da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi
  20. proslijedio/la je Tweet
    27. sij

    Maldoc dropping and running OSTAP. Splash page almost got the natural English thing right. VBA uses CallByName, embedded table, Spanish language print statements to obfuscate and appear benign. 5cde4a660fae1ae13198ff5b83244a5a21bd0afdaa905ccd3b9e2202243afa22

    4 proslijeđena tweeta 7 korisnika označava da im se sviđa
    Prikaži ovu nit
    Prikaži ovu nit
    Poništi

@curtw još nije objavio nijedan Tweet.

Čini se da učitavanje traje već neko vrijeme.

Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.

    Možda bi vam se svidjelo i ovo:

    ·