teafour [t4] (@llt4l) header
teafour [t4] (@llt4l) profile picture

teafour [t4]

@llt4l

Security Researcher. Cyber Security PG Student. Stuck in a revolving door between red and blue. OSCP.

 A land far, far away
Joined October 2014
  • Tweets1.1K
  • Following0
  • Followers481
66Media
Photo by teafour [t4] (@llt4l)Photo by teafour [t4] (@llt4l)Photo by teafour [t4] (@llt4l)Photo by teafour [t4] (@llt4l)Photo by teafour [t4] (@llt4l)Photo by teafour [t4] (@llt4l)Photo by teafour [t4] (@llt4l)Photo by teafour [t4] (@llt4l)Photo by teafour [t4] (@llt4l)
🚨 NEW: CVE-2020-12812 🚨 An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the se... (click for more) fortiguard.com/psirt/FG-IR-1…
2
2
Yay one less security tooling option for those that want control over their data and don't want to ship it all to somebody else's cloud 😑
This Post is from an account that no longer exists. Learn more
teafour [t4] retweeted
Tim Tomes (@LaNMaSteR53) profile picture
Tim Tomes@LaNMaSteR5321 Jul 2020
I haven't built the registration page yet, but #PWAPT [at]Home will be the week of August 24th. I plan on having the registration page up in the next 24 hours. I'll tweet here and send to the mailing list, but seating is limited and I expect to sell out fast.
2
1
11
teafour [t4] retweeted
Rasta Mouse (@_RastaMouse) profile picture
Rasta Mouse@_RastaMouse19 Jul 2020
I wrote a short primer for transitioning from P/Invoke to D/Invoke in offensive tooling. Shoutout to @TheRealWover and @FuzzySec rastamouse.me/blog/process-i…
3
151
3
306
NOT a #twitter hot take but a #mindmap for detection and response in #AWS from the team @expel_io How to interpret 🤔: - Based on #CloudTrail logs - ATT&CK cloud matrix technique - Mapped to AWS service(s) - Mapped to common API calls we've seen used by #redteam and attackers
Image from Jon Hencinski (@jhencinski)
13
249
9
617
We are thrilled to welcome Pavel Yosifovich, the co-author of Windows Internals 7th edition to our team! We will be launching his first course "Windows Process Injection Fundamentals for Red-Blue Teams" next week on PentesterAcademy! Super excited! cc: @zodiacon
Image from Vivek Ramachandran (@vivekramac)
21
84
5
440
Replying to @svblxyz
We're lucky that they're just greedy and not trying to spark WW3.
3
19
3
98
July 2020 Security Update includes a fix for a wormable RCE vulnerability in Windows DNS Server affecting all versions of Windows server running the DNS Server role. This should be patched quickly. For more information, see: msrc-blog.microsoft.com/2020…
8
342
75
364
Looks like the same threat actor behind Taidoor is also using Covenant - wonder what makes them choose to continue to use the same domain FE burned in 2013 (hpc[.]tw) 🤔.. shodan.io/host/195.123.245.1… fireeye.com/blog/threat-rese…
teafour [t4] (@llt4l) profile pictureteafour [t4]@llt4l13 Jul 2020
Any Taiwanese security researchers/malware analysts around I can ping?
1
Any Taiwanese security researchers/malware analysts around I can ping?
1
1
teafour [t4] retweeted
Mudge (@dotMudge) profile picture
Mudge
@dotMudge10 Jul 2020
I’m being a bit cheeky, but they are real problems. Most security product companies that I’ve seen lack meaningful SDLCs for their own security products. And Their business models are usually for recurring revenue, not actually removing the underlying security problem(s).
3
12
1
63
If you're just writing attack signatures you're essentially building an in-house antivirus. The real power is in building signatures and knowledge for your systems.
1
5
If your org's AV implements an AMSI provider you may want to consider better leveraging that capability by rolling out .NET 4.8 in the environment. Some (many) attackers are still relying on there being time before 4.8 is common sight.
This Post is from an account that no longer exists. Learn more
Here I was thinking all the recent noise about PAN-OS was that SAML bug.. Pre-auth RCE.. 🙃
This Post is from an account that no longer exists. Learn more
1
Nasty (nice) bug!
TrendAI Zero Day Initiative (@thezdi) profile pictureTrendAI Zero Day Initiative
@thezdi9 Jul 2020
CVE-2020-1300 - Remote code execution via #Windows CAB files. Our colleagues from Trend Micro Research bring all the details about this recently patched bug. Read them at bit.ly/2ZXbQjm
1
2
Anyone looked into abusing log parsing for defense evasion? Maybe it's just the old xss hunter in me that feels that there's potential for some interesting-ness there 🤔..
2
teafour [t4] retweeted
Aatif Khan (@0x007c) profile picture
Aatif Khan@0x007c9 Jul 2020
OSWE/AWAE Preparation z-r0crypt.github.io/blog/202…
5
10
teafour [t4] retweeted
Moxie Marlinspike (@moxie) profile picture
Moxie Marlinspike
@moxie8 Jul 2020
Replying to @matthew_d_green
Based on the feedback we've gotten about PINs, we're working on shipping an option to disable PINs for advanced users who are alright with losing their Signal contacts on reinstall.
28
88
30
391
teafour [t4] retweeted
chad (@duff22b) profile picture
chad
@duff22b8 Jul 2020
Restricting SMB based lateral movement in a #Windows environment. Lessons learned from work with the @SpecterOps team; drawing from previous posts by @mattifestation, @Haus3c, @cryps1s, @harmj0y & Mr SMB himself @NerdPyle bit.ly/SMB-lateral-movement #redteam #blueteam #infosec
Restricting SMB-based Lateral Movement in a Windows Environment

Restricting SMB-based Lateral Movement in a Windows Environment

Palantir’s recommendations for defending your network

blog.palantir.com
7
467
22
966
teafour [t4] retweeted
CERT/CC (@certcc) profile picture
CERT/CC@certcc7 Jul 2020
Citrix vulnerabilities in Citrix ADC (formerly known as NetScaler ADC), Citrix Gateway (formerly known as NetScaler Gateway) and Citrix SD-WAN WANOP. Impacts include system compromise by an unauthenticated user on the management network. support.citrix.com/article/C…
7
3
Load more