Also, I dropped out of bsky before most of infosec twitter joined, so my feed is quite empty (or flooded by US politics...); are there any lists of cybersec nerds I'm missing?
tomchop
@tomchop.me
Cybersecurity nerd; #DFIR @ Google by day; FOSS, threat intel and malware analysis by night. Investigator, coder, terrible sense of humor. https://yeti-platform.io and more (github.com/tomchop) views are my own • he/him • tomchop.me
I rarely post here, but when I do... I just updated my Volatility autoruns plugin to be compatible with Volatility 3 (long overdue!) Here's the goodies: github.com/tomchop/vola... #dfir #forensics #cybersecurity
GitHub - tomchop/volatility3-autoruns: Autoruns plugin for the Volatility3 framework
Autoruns plugin for the Volatility3 framework. Contribute to tomchop/volatility3-autoruns development by creating an account on GitHub.
github.com
Using Timesketch for timeline analysis? We recently added a new feature: LLM summaries of up to 500 events in view. Example below uses Gemini Flash, but you can just as easily use a local Ollama model. Setup guide: timesketch.org/guides/user/...
Great stuff from @tomchop.me! Memory analysis and Yara support in #OpenRelik #DFIR
tomchop@tomchop.me · 2y agoI had a look at #OpenRelik last year and wrote a couple workers that might be useful: * github.com/tomchop/open...: Scan memory images using @volatilityfoundation.org plugins. Supports Yara rules * github.com/tomchop/open... - Run Yara rules on a directory. Supports third-party systems like #Yeti!
I had a look at #OpenRelik last year and wrote a couple workers that might be useful: * github.com/tomchop/open...: Scan memory images using @volatilityfoundation.org plugins. Supports Yara rules * github.com/tomchop/open... - Run Yara rules on a directory. Supports third-party systems like #Yeti!
New #OpenRelik release. Task metrics (queue length, completion, failures etc) & new Prometheus exporter. Plus, a new task dashboard for deep dives into task performance. 📝 openrelik.org/changelog/ 🔗 discord.gg/hg652gktwX #DFIR
This is also the reason I never talk publicly about my dog, any favorite foods, or the season we were in < 3 months ago
Catrina, CEO of Ventress@ohcatrina.bsky.social · 2y agoWhen i see trends that ask me to post about movies that came out the year i was born or photos from the city i was born in or anything asking for information that could be used to crack a password I remember the golden rule: Don't share any information Ron Swanson wouldn't share
Probably the most riveting incident report I've read in a long time. I would've so much liked to be part of this investigation! Kudos to @volexity.com for going into so much detail on this novel network attack technique. www.volexity.com/blog/2024/11...
The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access
In early February 2022, notably just ahead of the Russian invasion of Ukraine, Volexity made a discovery that led to one of the most fascinating and complex incident investigations Volexity had ever w...
volexity.com
This incredible investigation is worth the time you’ll spend reading it #dfir www.volexity.com/blog/2024/11...
The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access
In early February 2022, notably just ahead of the Russian invasion of Ukraine, Volexity made a discovery that led to one of the most fascinating and complex incident investigations Volexity had ever w...
volexity.com
if you have a @github.com profile, can i ask you to update it with your @bsky.app handle? 🙏 👉 it enables some very cool integrations, like auto curated feeds and starter packs for contributors and tech
Thinking of coming up with a Bluesky #DFIR Starter Pack with @the4711.org... who should we include?
I'm watching some folks reverse engineer the xz backdoor, sharing some *preliminary* analysis with permission. The hooked RSA_public_decrypt verifies a signature on the server's host key by a fixed Ed448 key, and then passes a payload to system(). It's RCE, not auth bypass, and gated/unreplayable.
Filippo Valsorda@filippo.abyssdomain.expert · 2y agoThis might be the best executed supply chain attack we've seen described in the open, and it's a nightmare scenario: malicious, competent, authorized upstream in a widely used library. Looks like this got caught by chance. Wonder how long it would have taken otherwise.
Today, we published this Field Guide to incident response for civil society and media, which I’ve been working on for the past year or so and which I am pretty excited about internews.org/resource/fie...
This has been years in the making, literally. @Sebdraven and I are happy to announce the release of #Yeti 2.0 (after we promised an EOM release at @hack_lu last month) Website: yeti-platform.io Release: github.com/yeti-platform/yeti mini-🧵👇🏻 #DFIR #infosec #CTI #cybersec
The talk I have at @hack_lu about Yeti and our vision of the future of forensics intelligence is online! We're already getting lots of FRs, which we'll do our best to implement before our official release EOM. Hope I made @Sebdraven proud 🥹 #dfir #infosec
Hack.lu 2023: Yeti: Old Dog, New Tricks - Sébastien Larinier and Thomas Chopitea
youtube.com
I haven't had time to talk about it, but @sebdraven and I are giving a talk this week at #HackLu about some cool new changes coming to Yeti: pretalx.com/hack-lu-2023... It's going to be fun to talk about this project that has been on my todo list for 10+ years! 😅 #DFIR #infosec #CTI
My team just released dfiq.org, which is "a collection of Digital Forensics Investigative Questions and the approaches to answering them." The idea came from the will to organize investigative approaches to similar cases to increase consistency across response efforts. #dfir #infosec
Home - DFIQ (Digital Forensics Investigative Questions)
dfiq.org
VirusTotal announces Yara netloc, to extend Yara's capabilities to VT network sandbox results (domains, IPs, URLs), and not only file bytes. Looks promising! #infosec #cti https://blog.virustotal.com/2023/07/actionable-threat-intel-iv-yara-beyond.html
For 25+ yrs police, military, intel agencies and critical infrastructure around the world relied on the TETRA radio standard to secure critical communications. But now Dutch researchers have examined secret algorithms used in TETRA and found something startling - an intentional backdoor, and more
Code Kept Secret for Years Reveals Its Flaw—a Backdoor
A secret encryption cipher baked into radio systems used by critical infrastructure workers, police, and others around the world is finally seeing sunlight. Researchers say it isn’t pretty.
wired.com
Never take file paths for granted in digital forensics. New blog post by Joachim Metz: https://osdfir.blogspot.com/2023/07/whats-in-file-path.html
What’s in a (file) path?
What’s in a (file) path? Background For the experienced reader this might seem a very basic topic, however file paths are things we easily...
osdfir.blogspot.com
Hey DFIR folks: we released a new version of Timesketch today. - OpenSearch queries in DFIQ - Preserve user defined filters - Support event list sorting - Rework comments - Analyzer results in the CLI - Sketch attributes in the CLI https://github.com/google/timesketch/releases/tag/20230721
Release 20230721 · google/timesketch
What's Changed fixes #2809 UI bug by @jkppr in #2810 Timeline and Scenarios fixes + small UI fixes by @berggren in #2808 Show selected event in context view by @berggren in #2811 Consitent forms a...
github.com
This is very exciting, and comes (in part) from direct pushback from the infosec community. Well done to everyone who was vocal about this!! #infosec https://www.microsoft.com/en-us/security/blog/2023/07/19/expanding-cloud-logging-to-give-customers-deeper-security-visibility/
ICYMI, yesterday Microsoft reported on CVE-2023-36884 a vulnerability which myself and @r00tbsd.bsky.social reported earlier on this month. At the time we put together a nice infographic which explained our understanding of the execution chain that led to the installation of the malware involved.
