Stu @securitystu

Security Architect London, England Joined September 2017

Tweets

149
Followers

33
Following

373
Likes

174

James Forshaw @tiraniddo

2 years ago

My next book is finally in early-access at @nostarch, with the goal for release at the end of 2023. More details are available at nostarch.com/windows-securi…

19 202 906 74K 139

Download Image

Stu @securitystu

2 years ago

The on-going game of cat and mouse between features and security

PortSwigger Research @PortSwiggerRes

2 years ago

The on-going game of cat and mouse between features and security

4 97 378 45K 115

Download Image

0 0 0 40 0

David Weston (DWIZZZLE) @dwizzzleMSFT

2 years ago

Token binding is a "game changer" for zero trust. Bearer token exportation is something I identified as a major impediment to ZT in my Blackhat talk in 2018. In 2023 we finally have tokens bound to the hardware in Windows (using a TPM and VBS of course)…

6 73 343 111K 145

Download Image

Stu @securitystu

2 years ago

This is superb, although I’d like an ELK version too

Mauricio Velazco @mvelazco

2 years ago

This is superb, although I’d like an ELK version too

14 299 984 84K 487

Download Image

0 0 0 46 0

Stu @securitystu

2 years ago

Neat AV evasion, reminds me of user mode debugging tricks. googleprojectzero.blogspot.com/2019/04/window…

Grzegorz Tworek @0gtweet

3 years ago

Neat AV evasion, reminds me of user mode debugging tricks. googleprojectzero.blogspot.com/2019/04/window…

21 221 768 150K 204

Download Image

0 0 1 37 0

Stu @securitystu

3 years ago

ICMP RCE! 😱 well, only if you have an application bound to a raw socket 😅 I wonder the number of apps out there using raw sockets, other thank nmap etc perhaps some games or real-time apps maybe? msrc.microsoft.com/update-guide/v… #CVE #msrc #CVE_2023_23425

0 0 0 85 0

Alex Martin @AlexMartin

3 years ago

An interesting ad on the way to the ExCel this morning for #BlackHatEurope.

24 16 159 0 4

Download Image

Stu @securitystu

3 years ago

*walks in to a pub* Me: Hi how are you? Barman: Not bad, I’ve got a cold though *proceeds to cough all over the bar* 🤧 Me: Ah that’s a shame, bye then!

0 0 0 0 0

Stu @securitystu

3 years ago

Great community spirit in the #solderingskillsvillage and the #hardwarehackingvillage. Everyone helping each other out to get their projects done. #DEFCON

0 0 0 0 0

Download Image

Ken Munro @TheKenMunroShow

3 years ago

The A320 sim is flying, Otto the autopilot is on hand to assist. Come fly with us & learn about hacking electronic flight bags at @defcon @SecureAerospace

5 5 54 0 1

Download Image

Stu @securitystu

3 years ago

It’s hard to wrangle software to support multi-tenancy managed service environments when it wasn’t designed for this use case. Great presentation about managed PostgreSQL cross tenant vulnerabilities from @nirohfeld and @shirtamari #BlackHat2022 #BlackHat

0 0 2 0 0

Stu @securitystu

3 years ago

Secure your hardware/software supply chain and protect your management interfaces. ‘Do not trust the ASA, Trojans!’ by @Junior_Baines demonstrates why very nicely. #BlackHat2022 #BlackHat

0 0 0 0 0

Steve YARA Synapse Miller @stvemillertime

3 years ago

"Oh sweet, these IOCs are in a PDF!" exclaimed no one ever.

16 23 144 0 3

Stu @securitystu

3 years ago

“Defaults are an attackers best friend” from @ErmeticSec talk ‘IAM the one that knocks’ at #blackhat2022. The balance between frictionless dev and security is tricky but defaults need work.

0 0 0 0 0

Joel M. Baldwin @qumqats

3 years ago

defcon.outel.org "The ONE!", a combined schedule of DEFCON villages, all speaking events @defcon plus more on one page, HTML, PDF, google calendar 41 villages, 773 events 777 speakers #defcon30 #defcon @girlshackvllg @DC_BHV @VillageIDIOTLab @toool @AppSec_Village

0 2 2 0 0

Orange Tsai 🍊 @orange_8361

3 years ago

My favorite bug among the vulnerabilities I presented today! 😆 The original intent was to compare the password. However, the developer copy-and-pasted the code but forgot to replace the variable name. That leads to the Authentication Bypass on IIS.

47 511 3K 0 211

Download Image

Stu @securitystu

3 years ago

My take away from @C_C_Krebs Keynote: We need to sell our industry to new talent to help fix the skills shortfall. Cyber security is fun, lucrative, durable, interesting and has an important mission. Also “Don’t work for an arsehole” #blackhat

0 0 0 0 0

Stu @securitystu

3 years ago

My take on @rubin_mor AAD lateral movement talk. NegoEx (docs.microsoft.com/en-us/openspec…) offers a new lateral movement technique for AAD joined machines. Mitigation: SMB signing! Excellent from Mor here: medium.com/@mor2464/azure…. Great tools also released including Wireshark dissector.