Scott Treacy (@AppSecMan) header
Scott Treacy (@AppSecMan) profile picture

Application Security and Web Application Firewalls. Talking about WAF-as-a-Service, Bots, AppSec & InfoSec in general. Treacy Consulting Services Ltd.

United Kingdom
Joined April 2017
Photo by Scott Treacy (@AppSecMan)Photo by Scott Treacy (@AppSecMan)Photo by Scott Treacy (@AppSecMan)Photo by Scott Treacy (@AppSecMan)Photo by Scott Treacy (@AppSecMan)Photo by Scott Treacy (@AppSecMan)Photo by Scott Treacy (@AppSecMan)Photo by Scott Treacy (@AppSecMan)Photo by Scott Treacy (@AppSecMan)Photo by Scott Treacy (@AppSecMan)
Scott Treacy retweeted
The critical PHP security issue highlights the importance of understanding your organisation’s attack surface. The NCSC’s guidance can support your organisation to navigate a vulnerability patch wave and respond with greater confidence. Learn more: ncsc.gov.uk/blogs/prepare-fo…
11
37
6
153
12,716
Scott Treacy retweeted
The NCSC has issued an update to the PHP alert reflecting the release of mitigations. We encourage UK organisations to take immediate action. For more information on the issue as well as our guidance, head to⬇️ ncsc.gov.uk/news/critical-se…
19
205
25
416
78,083
Scott Treacy retweeted
30 years of arguing about lawful access to encrypted comms, almost entirely in adjectives. So I tried to put numbers on it. Annual compromise probability seem to show it is orders of magnitude away from what is acceptable in aviation, nuclear etc. substack.com/home/post/p-212…
1
6
2
11
2,716
Scott Treacy retweeted
The British public were asked, and they spoke - they oppose secret surveillance and want strong protection from encryption cdt.org/press/british-public…
3
9
685
Scott Treacy retweeted
Introducing HTTP/2 Bomb: a remote DoS in nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora. A single client pins 32GB of server memory in 10s. Found by Codex. Blog post: blog.calif.io/p/codex-discov… PoCs: github.com/califio/publicati…
25
427
30
1,974
189,891
You might think it's just a game, but it's so much more! Minesweeper was included to teach users how to right-click. Solitaire was included to get people familiar with drag and drop. Cardfile was included to familiarize people with MDI applications. Paint was included for mouse dexterity, range selection, and more advanced mouse use. Pinball was included just because it was cool. Credit to @dsobeski for pointing it out!
107
440
31
5,090
243,440
The number of attacks targeting web applications and APIs has increased significantly and shows no sign of slowing 📈 See what Barracuda CPO Neal Bradbury has to say regarding the reasons why web applications are attractive targets for attackers. bit.ly/4fewbH1 #AppSec
2
4
238
I wrote this Format dialog back on a rainy Thursday morning at Microsoft in late 1994, I think it was. We were porting the bajillion lines of code from the Windows95 user interface over to NT, and Format was just one of those areas where WindowsNT was different enough from Windows95 that we had to come up with some custom UI. I got out a piece of paper and wrote down all the options and choices you could make with respect to formatting a disk, like filesystem, label, cluster size, compression, encryption, and so on. Then I busted out VC++2.0 and used the Resource Editor to lay out a simple vertical stack of all the choices you had to make, in the approximate order you had to make. It wasn't elegant, but it would do until the elegant UI arrived. That was some 30 years ago, and the dialog is still my temporary one from that Thursday morning, so be careful about checking in "temporary" solutions! I also had to decide how much "cluster slack" would be too much, and that wound up constraining the format size of a FAT volume to 32GB. That limit was also an arbitrary choice that morning, and one that has stuck with us as a permanent side effect. So remember... there are no "temporary" checkins :) Follow me for more random code musings!
572
3,889
517
26,242
2,464,755
Did you know that denial of service, social engineering, and credential theft were the most prevalent attack vectors in 2023? Stay informed by reading our new Cybernomics 101 report bit.ly/3I2sdS9 #cybercrime
3
3
191
How are you combatting attacks and preventing costly breaches? fal.cn/3yKsA #ApplicationSecurity
1
1
232
Don’t miss this @insights_expert podcast about cyber resilience with Barracuda CTO Fleming Shi fal.cn/3yBXN #CyberResilience
1
2
287
How is your company dealing with bot attacks, web application vulnerabilities, and flawed API security? fal.cn/3yDsm #ApplicationSecurity
1
3
305
Don’t miss these new insights about app security fal.cn/3yf6d #ApplicationSecurity #APISecurity
2
1
278
How are you protecting your apps from today’s most sophisticated cyberthreats? fal.cn/3ybAk #ApplicationSecurity #APISecurity
1
3
219
How are you protecting against API security vulnerabilities? fal.cn/3ydgJ Join Barracuda for a look at the state of API security #APISecurity
1
1
252
What kind of visibility do you have into application traffic? What about bad traffic? fal.cn/3wYMT #ApplicationSecurity
1
1
114
This new blog post covers the 2023 OWASP top 10 API security risks fal.cn/3wZgs #APISecurity #OWASPTop10
1
1
175
Scott Treacy retweeted
The recent WhatsApp accounts takeover is simple and genius. This is how it works: You're sleeping. A "hacker" tries to login to your account via WhatsApp. You get a text message with a pincode that says "Do not share this". You don't share it, yet you still get hacked. How?
109
1,829
309
4,627
1,276,394
[Webinar] A look back at high-impact application vulnerabilities from 2022 fal.cn/3uSju Save your spot right now #ApplicationSecurity
1
3
281
Last night I captured an incredibly difficult shot: ISS transiting the moon, while gently kissing Tycho crater as it flies by at 5 miles per second. That crater is 53 miles wide, so while the station almost looks like it's orbiting the moon it's actually 1000x closer to us.
917
7,998
679
76,570
7,099,851