With my book launching in the US + Canada I joined @patrick.risky.biz & @metlstorm.risky.biz on the RiskyBiz pod. I've listened to these guys for 8yrs so it was an honour to chat through cyber news and explain why I decided to write a book about teenage hackers and the Vastaamo case. risky.biz
dont give the slash-fic writers ideas, mang 🤦
It’s true for those that _do_ office with him too 🫣
Curating the list after I solicited for additions;
* 802.11 WEP
* NSA md5 hash colliding windows updates
* admiral yamamoto in ww2 as well
* everyone who copies and pastes CBC mode (or ecb, lol) code off stack overflow
I am mad about @jags.bsky.social 's cat on the pod. Why does't Riskybiz have a pod-kitty?! 😾
🤦 of course it is.
I feel sorry for the masto devs, having poured your energy into working on open source and then seeing it get used to build... _that_.
I try not to be too resistant to change for no reason old-man-yells-at-cloud.gif*, but it really just gives big Windows Media Player for XP energy, and its gonna age about as well as that i fear.
*i mean, I use systemd! instead of just sulking about init.d and pining for rc.local
when we met him IRL at our first RB company get-together i think we were all expecting 3 infosec racoons in a trenchcoat, but he is in fact but one man after all!
I posted this quality meme back in 2021 when he was still at The Record; he was like 80% of our input for RB main show
Lol its been a whlie since I last hit the "please write your card name, number, expiry and cvv in this pdf and email it back" ecommerce checkout flow. Such PCI! Very DSS. 🤦
Paging a QSA and an acquiring bank, cleanup aisle my card data
MAGA be like...
Well, yeah. We're going to let our "kernel bug" description of Crowdstrike's mass murder of Windows systems stand
Maybe we should stagger newsletter releases in ringed deployments so we can catch these egregious errors... you know, like they should have done with their shitty content update that wiped out 8.5m boxes!
A Crowdstrike PR exec has written to us (twice) to demand we change some phrasing in one of our newsletters. We said a bug in their kernel driver caused their meltdown when it was actually a bad update file that caused a kernel panic. Huge mistake!
well you sure won the day with yama ptrace ha ha, took my toys away :D good times good times
It is that time! Call for Participation (CFP) time!
Got a talk in mind? Done some cool research? Want to do something for hallway con? Want to be able to summon sparkle pots on cue?
Submit to our CFP! Closes eventually, so just get your submission in now! kawaiicon.org/cfp/
yeah its a fun cat'n'mouse game, for sure. I take at least partial responsibility for the existence of yama/ptrace_scope, after @damienmiller.bsky.social and @keescook.bsky.social got sick of my bullshit 🤣😘
Cool! I love me some unix-tricks root-kittery!
I did a con talk once about non-root root-kits. Used SCTP/DCCP as you do for sockets, process hollowing/thread-injection for code, and inotify-racing to hide files (by detecting incoming traversal, opening an fd, unlinking, and linking it back after)
Its true, they could be so much more efficient at getting things owned if they'd just `curl | sh`
Omg, how is the webdav CVE-2025-33053 so dumb?! You make a .url shortcut file to run a local binary, with working-dir set to a webdav path, and if the binary happens to fork out to another bin without an absolute path, cwd is first in the search path... oh no? Is it.. is the bug really that stupid?!
The most recent episode of Wide World of Cyber w @thekrebscycle.bsky.social and @stamos.org is back in our podcast feed... it was offline for a week(ish) due to the recent unpleasantness
So yeah, it's back. If you missed it, here it is
VIDEO: www.youtube.com/watch?v=JPYt...
AUDIO: risky.biz/WWC8/
I have cancelled our planned trip to the RSA Conference in San Francisco later this month. @metlstorm.risky.biz and I were headed over to record some live shows and see everyone. Unfortunately I have received advice that crossing the border into the United States right now would be a bad idea.
I've pulled down the most recent episode of Wide World of Cyber with Chris Krebs and Alex Stamos at the request of their employer SentinelOne, the sponsor of the series. I will say more about this in next week's Risky Business, but I want to make one thing clear: SentinelOne is not the bad guy here
@metlstorm.risky.biz @patrick.risky.biz looks like rapid7 found a nice exploit strategy for that Ivanti BOF you discussed in the recent ep:
attackerkb.com/topics/0ybGQ...
If you've ever run into your ios exploit dev mate at the pub after work and they seem a lil crazy-eyed, you can kinda see why:
googleprojectzero.blogspot.com/2025/03/blas...
This is real handy to have in the pocket when some family/acquaintance asks about a service or platform you yourself don't use. "Just click about and see if anyone has logged in as you" makes sense to us nerds, but for normies, this is helpful as! Thanks Lorenzo!
Yeah, at least it wasn't TELEGRAM:
Totally
Encrypted
Lol
Everything
Gets
Recorded
At
Moscow
(we're here all week, try the fish)
