Tilter of windmills. Fetcher of rocks. Sisyphus respector. 11B BadMuthers - Blue team cyber
Land of the Lost
Joined November 2025
- Tweets13.4K
- Following629
- Followers656
- Likes139K
Pinned Tweet
For my fellow vets that have transitioned or are about to transition, A few helpful resources:
For the Batt Boys: threerangersfoundation.org
An aside - If you've been out for a while - Contact them and volunteer to be a mentor. It doesn't matter the industry you can help.
I've had an amazing career in technology, and despite everything going on with Ai there are a ton of technology professionals needed, especially in security.
Resources for Military, Vets, and spouses:
milmentor.com/best-informati…
Finally - I've been volunteering at the Microsoft Software and Systems Academy for a few years, mainly with the cybersecurity program. 17 weeks of free tech training. Even if you have been out for a while you can still apply:
military.microsoft.com/mssa/
Bob retweeted
Criminals may attempt to leverage the Outlook outage to phish you. You may receive emails once it’s back up asking you to change your password to prevent further disruption, texts/calls that claim they are IT & need your creds/codes to get you back online. Stay politely paranoid.
Microsoft Outlook is down. Microsoft 365 issues are cutting people off from their email, as well as Microsoft Teams, SharePoint Online, and Microsoft 365 Copilot theverge.com/tech/1032226/mi…
Today the US Army corrected an Error.
14 years ago my friend and Brother Ranger was killed.
The Army Posthumously awarded him a Bronze star. The issue is that he saved his radio operator which is a valorous act and should have resulted in his award of a V device for Valor.
Today at 2/75 his Wife, Mother, and Son received his upgraded award.
Nehl lived that creed with his dying breath.
I miss him every day.
He motivates me to always try to better myself, my family, and my community.
2
10
266
A huge thank you to Alice Jones Webb. Her article was the catalyst for the upgrade.
outdoorlife.com/hunting/kuiu…
9
214
Ham Radio nerd stuff.
Got my birthday present to work last night. First time checking into a digital net. They use C4FM so Yaesu it was. I do love the display.
Now I need to clamber out on the roof to install a Diamond X50 and hope my HOA doesn’t notice (so far the discone scanner rig has not drawn their ire). Then I need to install an End Fed Half wave disguised as party lights.
4
1
103
Bob retweeted
What did people think “focus on security” meant? It meant this. It meant finding all these problems (of which there are so many more) and fixing them.
The goal isn’t to have an easy day at the office. It’s to make sure people don’t die. It’s to stop truly horrible cyber attacks.
Bob retweeted
Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
Bob retweeted
🚨 BREAKING: Microsoft's October 2026 Patch Tuesday is MASSIVE!
Microsoft has fixed a record-breaking 1,411 security vulnerabilities, including 70 critical flaws and 3 zero-days, one of which is actively exploited in attacks.
🔥 317 remote code execution flaws
⚠️ 677 privilege escalation flaws
🛡️ 40 security feature bypass flaws
💻 Time to get patching!
Bob retweeted
Since January 2026, Microsoft has observed Russian state actor Star Blizzard evolve their detection evasion capabilities via large-scale phishing campaigns, the use of accounts on compromised websites, and a new malware delivery technique called RedFlick. msft.it/6010actya
RedFlick can enable CosmicPulse malware installation after a single user interaction, reducing friction in the compromise process. Combined with the actor’s updated tactics, techniques, and procedures (TTPs), these changes improve Star Blizzard’s ability to reach more targets and increase the likelihood of successful compromise
These developments reflect the actor’s continued efforts to streamline malware deployment and scale operations to support ongoing cyberespionage objectives. Get detections, indicators of compromise (IOCs), and hunting guidance from this Microsoft Threat Intelligence blog post.
Bob retweeted
A teenager found a path to 17 trillion Microsoft records. Between homework.
The bug: the API checked every claim in the JWT… and never checked the signature.
{"alg":"none"} + "upn":"admin" = admin.
If you build APIs or ISV apps on Entra ID, don't assume your code is fine. Your API might have the same bug. I ran the prompt below on my apps using Claude Code. In minutes it:
→ found every place our apps accept a token, across 3 apps
→ confirmed signatures are verified everywhere ✅
→ still found 2 hardening gaps I'm fixing now
What might surprise many folks:
🌀 MSAL does NOT protect your API. It gets tokens; it doesn't validate them.
🌀 ValidateIssuerSigningKey = true does NOT turn on signature checks.
🌀 Multitenant apps must tie iss to tid, or any tenant can pretend to be yours.
Paste this into Claude Code (or any coding agent) in your repo 👇
-----------
Read this write-up of a JWT signature-bypass vulnerability:
blog.faav.net/how-i-couldve-…
Then audit this codebase for the same class of bug:
1. Find every place we accept a token or identity: API bearer auth, custom JWT handlers, webhooks, platform auth headers (e.g. x-ms-client-principal / EasyAuth), and any dev/test auth bypass.
2. For each one, verify: signature (reject alg:none and unknown keys), issuer, audience, expiry, tenant (tid), scopes/roles, and calling app (azp/appid). For multitenant apps, check that iss is bound to tid and that the signing key's issuer is validated.
3. Explain what our libraries (MSAL, Microsoft.Identity.Web, JwtBearer, etc.) handle for us and what's left to our own code.
4. Compare against Microsoft's guidance:
learn.microsoft.com/en-us/en…
learn.microsoft.com/en-us/en…
Don't change any code yet. Write a report with a table of every place we accept a token, findings ranked by severity with file:line references, and a suggested fix order.
-----------
Full credit to @efaav. The write-up is excellent.
PS: This is a whole family of bugs, and it isn't new. In 2023 it was nOAuth: apps trusting the email claim as identity. Microsoft wrote up the pattern here: techcommunity.microsoft.com/…
Entra ID is secure. Your app's token validation might not be.
Share this with your dev team today.
How I Could've Accessed 17 Trillion Microsoft Records
blog.faav.net/how-i-couldve-… :)
Apples newly announced “Audio Intelligence” is going to be an absolute nightmare.
Recap and Live rewind transcribing conversations? Just begging for a lawsuit in 2 party convent states.
And a knuckle sandwich in all the others.
Nice to see that Apple decided to have a “recall” moment. Welcome to the club!
RLTW!
August 24–25, 1950: As the Pusan Perimeter neared collapse, volunteers formed the Eighth Army Ranger Company—the first U.S. Army Ranger unit since WWII.
Led by 2LT Ralph Puckett, these men had little time, gear, or margin for error. They became the tip of the spear in Korea through recon, raids, and grit. Months later on Hill 205, Puckett’s 51 Rangers held against wave after wave of Chinese assaults under overwhelming odds. Most became casualties, but they never broke.
That fighting spirit lives in every Ranger who wears the scroll in the 75th Ranger Regiment.
From Rogers’ Rangers to Darby’s boys to Merrill’s Marauders to these 1950 heroes, the lineage is unbroken.
Rangers Lead The Way!
#RLTW #ArmyRangers #ThisDayInHistory #75thRangerRegiment #KoreanWar
1
11
344
For folks interested in a cyber security career - Mike is putting on free training.
It is time - registration is now open for our free Threat Intelligence Support Unit (TISU) training course.
We talk about basics of attack and defense, @MITREattack, CIS18 controls, SOC/IR, and then feature guest speakers with fun topics including game hacking, Appsec, Cloud, and so on.
This is a fundamentals course that we intend to be basic to get people started on their cyber/tech journey, although we do layer in some fun Easter Eggs and discussions for more experienced practitioners who sometimes join in the fun.
Special thanks to @NotNordgaren, @christian_tail, @Shammahwoods, @whereduck, @syntaxish and many others who contribute to this.
Also, we regularly discuss recent things shared by @techspence, @UK_Daniel_Card, @threathuntergrl, and other great researchers in our warm up topics.
1/🧵
eventcreate.com/e/tisu9
Puppies…
Last Friday the dog counter surfed and grabbed 1/4 of onion I was chopping. $90 dollar call to poison control tells me the exact thing that Grok did. Wait - if she gets sick take her to the vet. She’s fine.
Last night we hear a crash and I go to investigate. Doggo found the grease trap on my flat top. She puked last night. Runny poop today.
She is absolutely committed to making sure I put the Vets kids through college.
Vizslas are listed as problem solvers. I would like her to start solving problems instead of creating them 😂.