Mathieu D. @_mdeous_

Random infosec worker / Coffee addict / Rum lover github.com/mdeous Paris, France Joined April 2010

Tweets

9K
Followers

851
Following

745
Likes

965

Laurent Cheylus @lcheylus

9 months ago

Google is working on a new feature called Shielded Email that lets users create unique email aliases for signing up for services, which helps protect their privacy and reduce spam. #Privacy #Mail androidauthority.com/google-shielde…

0 4 2 358 1

nixCraft 🐧 @nixcraft

10 months ago

19 352 3K 95K 90

Download Image

yan @bcrypt

10 months ago

reminder that the bcrypt hash function ignores input above a certain length! so if you do bcrypt(username || password) for some reason, a sufficiently long username will make it accept any password. to fix this you can sha256 the input first.

Kinnaird McQuade 💻☁️💥 @kmcquade3

10 months ago

37 382 2K 997K 460

Download Image

63 1K 6K 745K 2K

Trail of Bits @trailofbits

12 months ago

AWS Nitro Enclaves offer strong isolation for sensitive workloads but require careful security implementation. Learn how to avoid common pitfalls and harden your enclave deployments. blog.trailofbits.com/2024/09/24/not…

2 6 16 2K 10

Hacking the Cloud @HackingthCloud

a year ago

Discover how to determine the AWS account ID associated with access keys using sts or by decoding the key itself. Learn these effective techniques for better AWS environment assessments. Dive into the details here: buff.ly/3RXkPwU

0 4 5 495 3

Synacktiv @Synacktiv

a year ago

Following on from our #GitHub action exploitation series, @hugow_vincent discovered a new exploitation technique that allowed us to push arbitrary code onto the spring-security project using the Dependabot GitHub app. synacktiv.com/publications/g…

1 26 71 8K 22

Mobile Hacker @androidmalware2

2 years ago

Bluetooth LE spam attack is now ported to dedicated Android app to push notifications for Android and Windows For Android, is can advertise over 170 devices github.com/simondankelman…

16 321 1K 169K 568

Download Video

Arvind Narayanan @random_walker

2 years ago

OpenAI's security team noticed that a group reverse engineered and was abusing ChatGPT's internal API. Instead of shutting them down, they quickly replaced ChatGPT with CatGPT… and then lurked in the attackers' Discord to watch the chaos. Absolute legend. youtube.com/watch?v=PeKMEX…

51 668 5K 1.4M 2K

Download Image

Kévin GERVOT (Mizu) @kevin_mizu

2 years ago

Excited to launch my first browser extension, DOMLogger++! Now available for both Firefox and Chromium! 🎉 DOMLogger++ allows you to monitor, intercept, and debug JavaScript sinks based on customizable configurations 🔥 Check it out 👇 github.com/kevin-mizu/dom… 1/5

9 106 341 42K 208

Matthew Green is on BlueSky @matthew_d_green

2 years ago

PS If a viral report goes around saying there’s a vulnerability and you should turn off link previews, there’s really not a lot of cost to being cautious for a day or two. It’s not like someone is asking you to inject chlorine into your veins.

4 3 16 7K 0

hackerfantastic.x @hackerfantastic

2 years ago

If you dont know why @xillwillx and #sub7 is trending in hacker land because you weren't born, this retrospective review by @DarkCoderSc is a good summary. It was the 1999 hackers preferred RAT tool that inspired the likes of DarkComet. darkcodersc.medium.com/a-malware-retr…

12 61 166 36K 37

ᅟ𝖎𝖑𝖑𝖜𝖎𝖑𝖑 @xillwillx

2 years ago

I'm dumping this before my talk at @BSidesCT so I don't get distracted. Enjoy fuckers. gitlab.com/illwill/sub7 cc: @vxunderground

22 99 357 74K 65

Edznux @Edznux

2 years ago

My team just released a Kubernetes attack path tool named KubeHound! Release blog post (with examples) securitylabs.datadoghq.com/articles/kubeh… Website / docs: kubehound.io :D Should be able to handle large k8s env! Feedback welcome!

6 110 266 24K 75

ESET Research @ESETresearch

2 years ago

#ESETresearch uncovered a #Lazarus attack against an aerospace company in 🇪🇸, deploying several tools, most notably a publicly undocumented and sophisticated RAT we named LightlessCan. The attack is part of Operation DreamJob. @pkalnai welivesecurity.com/en/eset-resear… 1/6

4 116 227 45K 40

Bob ArdKor @bobardkor

2 years ago

Haha mon dieu c'est absolument parfait (Non je sais pas qui c'est, si quelqu'un a la source...) #tchoupi #hiphop

120 2K 11K 1.5M 1K

Download Video

Christian Blichmann 🇺🇦 (on bksy and Mastodon) @AdmVonSchneider

2 years ago

In the spirit of "this talk could've been a tweet", I just pushed a button: #BinDiff is now open source. - Snapshot release, no major new functionality - Release binaries later today or tomorrow - This is my 20% and I won't we able to act on PRs until end of Q4 (OOO traveling)

9 348 1K 209K 164

Download Image

Jake Williams @MalwareJake

2 years ago

Repeat after me: no amount of security awareness training will solve the social engineering problem. You might as well be relying on ancient chants and sacred crystals if this is the plan. Thank you for coming to my TED talk...

53 89 768 171K 36

Joseph Cox @josephfcox

2 years ago

New: I tracked the precise movements of an NYC subway rider. Saw what specific time they got on and at what station. It became obvious which station was nearest to their home. This was all because of a 'feature' on the MTA website Wide open to abuse 404media.co/i-tracked-nyc-…

23 492 1K 289K 153

🥝🏳️‍🌈 Benjamin Delpy @gentilkiwi

2 years ago

Just published a little presentation "ST25TB series NFC tags for fun in French public transports" 🥝 It demonstrates why it's not a good idea to use chips without authentication (like SRT512 & ST25TB512-AT) for convenience transport tickets > 1drv.ms/b/s!AlQCT5PF61…