Spanky
@spankowitz.bsky.social
I like threat intel, purple team, and turtles.
Apropos of nothing, I think it's past time for risks.txt to go alongside robots.txt and security.txt on websites. risks.txt would declare the contents of the organization's risk acceptance log so the $baddies know not to use those issues in attacks.
intrusiontruth.wordpress.com/2026/07/27/d...
Dear Diary, Today I found a Ghost in the Network
A hidden seller Guangdong Chanming. If you were looking for them, you’d be disappointed. No public website, no storefront, and certainly no obvious product line to speak of. It made us wonder what …
intrusiontruth.wordpress.com
U.S. Mint Unveils Series Of Gold Coins Commemorating President’s Extramarital Affairs
U.S. Mint Unveils Series Of Gold Coins Commemorating President’s Extramarital Affairs
WASHINGTON—Touting the new line of currency as an important way to recognize the many babes bagged by the commander-in-chief over the years, the U.S. Mint announced plans Wednesday to release a series...
theonion.com
Roughly 70% of hosts running ICS devices and services globally are consistently found on consumer and mobile networks for the last 2.5 years.
Censys@censys.bsky.social · 2w agoEvery year, Censys scans the Internet and publishes what we find. This year's State of the Internet Report is almost here. The full report drops this fall. https://bit.ly/44JNRGq
Celebrate 10 years of Binary Ninja! For the first time ever, we’re offering a 35% discount! Join us for 10 full days of giveaways including licenses, merch, and more. Join in on the celebration: binary.ninja/10years
A reminder that we have a MISP feed! misp.ifin.network/feed (`/manifest.json` for validation)
misp.ifin.network
I will hold an online session of the Paralus LLC Applied #CyberThreatIntelligence course from 27-31 July, 1400-1600 US Eastern/2000-2200 Central European time. Focused, to the point training, two hours per day for five days. Register your interest at the following form: forms.gle/M1LgQTomJGek...
Paralus LLC: Applied Threat Intelligence
Hello and thank you for your interest in a workshop focusing on Applied Threat Intelligence! Scheduling: 27-31 July 2026 (Five Days) 1400-1600 US Eastern/2000-2200 Central European (Two Hours/Day) C...
forms.gle
A developer made a browser extension called "Knockoff" that shows what a wasteland Amazon truly is by filtering out brands like "GODONLIF" "EHEYCIGA," ROTTOGOON," and sponsored products. Useful and illustrative even if you don't use Amazon www.404media.co/knockoff-bro...
'Knockoff' Browser Extension Hides Sketchy Brands on Amazon
"Sorry to brands like WNPETHOME, EHEYCIGA, YXYL, LU&MN, JOYIN, TOMY, GODONLIF, YOOJEE, LINGTENG, LANEIGE, VISCOO, BIODANCE, COOFANDY, BALENNZ, TOSY, and LUENX."
404media.co
It does not fill me with optimism about the general quality or completeness of this disclosure that it gives the wrong name for the firm via which Trump made $635 million last year.
Molly White@molly.wiki · last mo.Trump’s most recent financial disclosure reveals more than $1.4 billion in income from his crypto-related ventures alone, and even that’s an incomplete picture.
No Three Buddy Problem this week. My disappointment is immeasurable. What am I supposed to listen to on my dog walkies?!?? Oh right, Between 2 Nerds. 🙌
1/ NEW RESEARCH: We find that Russian authorities used Cellebrite to gain access to activist Andrey Pivovarov’s phone. Full brief: citizenlab.ca/research/rus...
Russia Breaks Into Human Rights Activist's Phone With Cellebrite - The Citizen Lab
We analyzed Russian activist Andrey Pivovarov’s phone, finding that Russian authorities used forensic extraction tools made by Cellebrite to gain access to his device. A document prepared by Russian a...
citizenlab.ca
A newly discovered spider species from Australia uses its silk to craft a spring-loaded, cone-shaped death trap, which catapults its prey into the spider’s main web. https://cnn.it/4w3n6Ip
Thanks @halvarflake.bsky.social -- it's so good / must read (and it's not even finished yet!)
@halvarflake.bsky.social · last mo.In the last years, I spent some of my scarce free time writing up what I had learnt starting and running two companies, zynamics and optimyze The article is still work-in-progress, but I thought it's best to publish it now and iterate in public: thomasdullien.github.io/guides/entre...
AI may have inherited the em-dash addiction from hordes of writers -- but it can pry them from our cold, dead hands.
Jack Jenkins@jackjenkins.me · 2mo agoIf people ever think my use of em-dashes is somehow evidence of AI, I would simply direct them to everything I have ever written ever, and also all of my tired editors and former professors.
NEW POD UP: Microsoft threatens legal action against researchers who drop zero-days. We debate whether it’s a fair line against extortion, or amateur-hour PR from a company that already torched its own research community? #threebuddyproblem youtu.be/E5rIJ9nGOUo
Microsoft Threatens Vuln Researchers; Shadow Brokers Revisited
YouTube video by Three Buddy Problem
youtu.be
Google explains how it will infuse ads into AI answers
Google explains how it will infuse ads into AI answers
Just like in The Truman Show
theregister.com
NEW POD UP! We discuss the disappearing art of Windows APT paleontology, the absence of complex malware documentation, and why so much threat-intel research has slipped behind paywalls and into private rooms. - Spotify open.spotify.com/episode/0eh4... - Apple podcasts.apple.com/us/podcast/t...
www.faz.net/premium/digi... I wrote a FAZ guest article.
Thomas Dullien zu Anthropics Mythos: Software war nie auf perfekte Sicherheit ausgelegt - das rächt sich
Schwachstellen in Computern wurden lange hingenommen. Denn sie auszunutzen war technisch komplex und teuer. KIs ändern das nun. Damit zwingen sie uns, Altlasten schneller anzugehen.
faz.net
NEW: Google is rolling out a new feature for Android called Intrusion Logging, designed specifically to help researchers investigate attacks done with spyware and forensic tools. Amnesty says this is “a fundamental shift in the amount and quality of forensic data available on Android devices.”
Google launches new Android security feature to help uncover spyware attacks | TechCrunch
Intrusion Logging is a new part of Android’s Advanced Protection Mode, which aims to help protect human rights activists, journalists, and dissidents from government spyware attack and law enforcement...
techcrunch.com
- YouTube youtu.be/jIr6QdgUodU - Spotify (with video) open.spotify.com/episode/4zDJ... - Apple Podcasts podcasts.apple.com/us/podcast/c... - Transcript docs.google.com/document/d/1...
Cracking the Fast16 sabotage malware mystery
YouTube video by Three Buddy Problem
youtu.be
Create a folder called (calc). Shift+Right click « Open PowerShell Window here » and boom you have a command injection. @podalirius.bsky.social found two command injection vulns hiding in Windows Explorer's built-in context menus, both that went undetected for 9 years. https://ghst.ly/42ImlI6
Shift Happens - Uncovering Two Built-in Command Injections in Windows Context Menus
Two long-standing Windows Explorer vulnerabilities lets attackers execute arbitrary PowerShell commands using crafted folder names, affecting Windows 10 and 11 since 2017.
specterops.io