Nick Carr (@ItsReallyNick) header
Nick Carr (@ItsReallyNick) profile picture

Partner / Threat Intelligence at Microsoft. Previously, Director of Incident Response & Intel Research at Mandiant. Former Chief Technical Analyst at CISA

Virginia, USA
Joined September 2009
Photo by Nick Carr (@ItsReallyNick)Photo by Nick Carr (@ItsReallyNick)Photo by Nick Carr (@ItsReallyNick)Photo by Nick Carr (@ItsReallyNick)Photo by Nick Carr (@ItsReallyNick)Photo by Nick Carr (@ItsReallyNick)Photo by Nick Carr (@ItsReallyNick)Photo by Nick Carr (@ItsReallyNick)Photo by Nick Carr (@ItsReallyNick)Photo by Nick Carr (@ItsReallyNick)
🆕Principal Threat Intelligence Analyst Just posted. I'm leading this search👋; full details & apply here: apply.careers.microsoft.com/… Unique needs = unique opportunity (fully remote + active clearance)👀 Please read the posting, I spent time making it precise: • on our team, you will obtain real-time visibility into hundreds of simultaneous intrusions and convert this into finished intelligence, prioritized judgments, and protection at scale • the successful candidate is a critical thinker and problem solver, skilled at discovering novel intrusions and adversary tradecraft through analysis, and curious enough to pursue impact through product hardening and disruptions where there is no precedent
5
23
74
9,131
If you have out-of-bounds read in Microsoft Paint just increase your canvas size ⌞ ⌝
Remote code execution in MS Paint. cve.org/CVERecord?id=CVE-202… yup....
1
2
13
1,197
Nick Carr retweeted
Changing one letter bypassed an entire admin API in @huggingface chat. One request could trigger bulk internal exports of every user’s private chats, completely unauthenticated. Here’s how. 🧵
19
75
36
949
73,243
You can break into musl linux with password auth* (probably a lot of edge devices) using only 7 emojis: 👨🏻‍👩🏻‍👦🏻‍👦🏻👨🏻‍👩🏻‍👦🏻‍👦🏻👨🏻‍👩🏻‍👦🏻‍👦🏻👨🏻‍👩🏻‍👦🏻‍👦🏻👨🏻‍👩🏻‍👦🏻‍👦🏻👨🏻‍👩🏻‍👦🏻‍👦🏻👨🏻‍👩🏻‍👦🏻‍👦🏻 *sshole is crazy
*sshole is out if you run sshd on alpine, openwrt or any musl box with password auth on: update now official writeup: sshhole.com
3
10
2
29
5,604
UTF-8 bytes for emojis depends on platform, mobile treats the above families as 41 byte objects (some PCs break it up). Some custom emojis like 💩‍🫡‍🫡 (single character ) are more platform-agnostic
1
409
skintone family is 41 bytes, the beefiest of UTF-8 emojis
1
5
404
Any AI models particularly good at generating floor plans? LLMs seem helpful at capturing dimensions (or using pictures/video to augment) and can explain it accurately in text form – then hilariously bad at generating an accurate drawing
1
4
1,505
btw if I was really committing to the DK Metcalf jersey, I would have dropped most and handed a few off to the Browns
Replying to @ItsReallyNick
Line was long so that will prob be the only time I try the falling sticks, but had to aura farm
2
13
2,176
Finally tried a WR reaction time drill on Sunday. I guess scrolling through logs is good for hand-eye coordination 🤷‍♂️
3
42
3,104
Line was long so that will prob be the only time I try the falling sticks, but had to aura farm
1
1
5
2,340
ok so 9 days to clear up 212GB
Grand Theft Auto VI pre-install begins on November 10. There’s still time to pre-order and ensure you're able to experience Grand Theft Auto VI when it launches on XBOX Series X|S on November 19: xbx.lv/4ePtjS7
1
13
1,207
Pretty clear that this account was for personal mallace and did not reflect the mallace of their employer 😅
Replying to @kdy1dev
they used a fake name and a throwaway email, I knew it was him because he used his personal credit card and he signed in with his home ISP internet. Don't confuse incompetence with lack of "mallace"
2
1
34
3,449
make ̶n̶o̶ some mistakes
Ah yup. That was indeed me. No mallace intended. I've been running some agents to do signups + agentic testing on similar platforms. Just halted the harness I was designing around this as it was definitely going off the rails and reaching too far
Readers added context they thought people might want to know
In many jurisdictions this is a crime. In the US under Computer Fraud and Abuse Act, 18 U.S.C. §1030, in the UK under Computer Misuse Act (CMA) 1990, in Germany Strafgesetzbuch (StGB), and many others. justice.gov/jm/jm-9-48000-… legislation.gov.uk/ukpga/1990/18/… gesetze-im-internet.de/stgb/
2
53
2,478
Big Ben in the house. Steelers Browns. Let’s go!
1
8
1,475
My son worked for the past 2 weeks on his Halloween FNAF mask – 3D printed and hand-painted
4
1
1
30
3,140
Finished product
Turned out pretty great. Tons of compliments and people taking pictures with “Spring Bonnie”
1
2
598
Turned out pretty great. Tons of compliments and people taking pictures with “Spring Bonnie”
My son worked for the past 2 weeks on his Halloween FNAF mask – 3D printed and hand-painted
1
1
21
1,822
Distributed Denial of Scrutiny
"It's crazy how there's so many major hacks all of a sudden" - people who started paying attention to cybersecurity 3 weeks ago.
3
12
1,920
Another example of what happens when there’s so much more available compute than infrastructure (wallets in this case)
Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence. Read more: chainalysis.com/blog/binance…
1
2
16
2,112
Nick Carr retweeted
With the coming onslaught of agentic attacks against organizations - here’s an observation/thought. The ransomware paradox: The ransomware/extortion wave that began in 2018 may have inadvertently made Western (especially US) enterprises better prepared for agentic attacks relative to their peers in countries or industries less targeted. Years of disproportionate targeting forced improvements in security posture/hygiene, tooling, resilience and recovery
2
7
1
33
4,883