
Director @OrionSecConsult | legally a person | (probably) not a fed | probably your threat actor
127.0.0.1
Joined September 2013
- Tweets32.2K
- Following872
- Followers7.1K
- Likes54.1K
I migrated NATO and various EU agencies from SNMP to a proper protocol.
I sold the directors:
"SNMP = Simply Not My Problem"
We migrated 8 months later :)
Adversaries may gain access to NSS and DIB network devices through SNMPv1 and SNMPv2c read-write community strings. Keep your networks secure by upgrading to SNMPv3 which includes encryption and authentication. media.defense.gov/2022/Jun/1…
Couldn't have said it better tbh
AI-developed malware is fucking amazing because it leaves us a shit ton of comments in the code, so whenever I search for strings, I get exactly what it's doing and why 🙃
You should update your .md accordingly.
..."the incident response playbook offers little solace against the tide of incoming alerts. Yet, we hold the line"...
Absolutely underappreciated post imho
Dearest Mother,
I write to you from the cold, glowing trenches of the Operations Center, my knuckles weary from the unending cadence of keypresses. The front lines are in total disarray. A dark day has fallen upon the territory: a great vulnpocalypse has breached our defenses, and the enemy marches through unpatched zero-days with relentless malice.
Earlier this morning, Captain Harrison received word that the perimeter firewall had collapsed. A foul exploit, disguised as a harmless web request, swept through our flanks. Before our brigade could deploy the emergency patches, half our domain controllers were captured, their secrets locked behind a cruel ransom note.
The battle rages on multiple fronts. Corporal Jenkins fought valiantly to revoke elevated privileges before he was isolated by a sea of phishing emails, while young Private Miller spent three grueling hours attempting to restore the active directory from a tape backup that was, alas, corrupted six moons ago.
We are low on provisions. The coffee rations have been depleted since mid-day, and the incident response playbook offers little solace against the tide of incoming alerts. Yet, we hold the line. We have severed the external VPN, fortified our remaining subnets with local firewalls, and declared a state of zero trust across the camp.
If the server racks hold through the night, we may yet push back the threat actors and compile a post-mortem report before Sunday break. Give my fondest regards to the neighborhood. Tell them that though the packets fall heavy around us, your son remains uncompromised.
Your faithful servant,
- Captain Tib3rius
Daniel W. retweeted
UK retail giant Tesco appears to have decided to replace VMware with Proxmox in its stores.
More here: theregister.com/virtualizati…
Daniel W. retweeted
CISO: We need to defend against agent swarms!
Meanwhile…Suzie in accounting, with admin on the finance server where a scheduled task is running as a Domain Admin, runs her 7th clickfix payload of the day.
> wake up at 3:45 am
> make cup of tea
> moto2 & moto3 cancelled
> motogp delayed 2hrs
Yeah i'm going back to bed 😅

















