
212/NYC chapter of @defcongroups , formed in the wake of @defcon 26. RTs not endorsements.
New York, NY
Joined July 2017
- Tweets2.2K
- Following1.1K
- Followers662
- Likes1.9K
DC212 retweeted
Security asked me to identify every unauthorized SaaS tool employees are using.
Our discovery software found 14.
I didn't trust it.
So I sent a company-wide email:
“SAAS AMNESTY WEEK: If you're paying for a work tool on your personal card, submit it here and IT may move it to centralized billing. No questions asked.”
By lunch I had 73 submissions.
Six CRMs.
Nine AI meeting tools.
Four different project-management platforms.
A personal Dropbox containing customer contracts.
And one $899/month “competitive intelligence” tool being used exclusively by an intern.
Security asked how I found all of this.
I said people become extremely honest when they think they're about to get reimbursed.
Finance then noticed the phrase “may move it to centralized billing.”
Not “will reimburse you.”
Correct.
Nobody was promised anything.
Our $80,000 security platform found 14 shadow apps in three months.
The possibility of free money found 73 before lunch.
Sometimes the best network scanner is greed.
One of the wildest things about Windows security is how far the cheat vs anti-cheat arms race has pushed low-level research.
It basically became:
User mode
↓
Kernel
↓
Vulnerable drivers
↓
Page table manipulation
↓
Custom hypervisors
↓
Hyper-V hijacking
↓
VMEXIT + EPT hooks
↓
UEFI bootkits
↓
VMProtect / Themida devirtualization
Aftermath Labs' archive is almost a timeline of that evolution.
They've published research on:
• EasyAntiCheat exploitation
• EQU8 kernel reversing
• VDM vulnerable driver abuse
• PTM user-mode page table manipulation
• Unsigned kernel driver mapping
• Hidden address spaces
• Hyper-V hijacking
• AMD-V hypervisors
• VMProtect internals
• Themida devirtualization
• Tencent VM devirtualization
• Custom binary obfuscation
• Ring-1's UEFI -> Hyper-V -> EPT architecture
And the Ring-1 research is especially insane: a Themida-protected UEFI implant hooks the Hyper-V launch path, maps itself into Hyper-V, intercepts VMEXITs and uses EPT to hide executable memory from the guest.
All of this because cheat developers and anti-cheat vendors kept trying to get underneath each other.
Whatever you think about game cheating, this arms race has produced some seriously deep Windows internals, reverse engineering, hypervisor and kernel research.
Full archive:
aftermathlabs.net/blog/
Credit: @aftermath_labs and most underrated & talented reverse engineer @_xeroxz
#WindowsInternals #ReverseEngineering #GameSecurity
BREAKING NEWS: Riot just announced Vanguard On-Demand. Vanguard no longer needs to start at boot.
If you enable Secure Boot, TPM 2.0, VBS, HVCI, and IOMMU, Vanguard will only run while you play. Microsoft built a Runtime Driver Attestation Report that lets Vanguard verify driver integrity without needing to be present at boot.
For everyone who complained about Vanguard running at startup, this is the answer. Enable your hardware security features and it goes away.
The blog also breaks down every cheat vector in detail: kernel exploits, BYOVD, DMA hardware cheats, bootkits, hypervisors, and pixelbots. With real data showing cheaters deliberately downgrade to older Windows to avoid security features.
riotgames.com/en/news/vangua…
Some of the best security engineers in the industry working on one of the hardest problems in gaming. Massive respect for publishing this level of detail publicly.
@deteccphilippe @nickeverdox @aidankhoury
#AntiCheat #Vanguard #GameSecurity
DC212 retweeted
An open letter for a global surge in cyber defense, signed by over 100 organizations including Anthropic, AWS, Google, Microsoft, OpenAI, and Oracle.
@signalapp's Contact Discovery Service (CDSI) lets you securely discover which of your contacts are on Signal.
It's on by default, and the app sends your full contacts list every 48h.
Queries run inside an SGX enclave, so even Signal's servers can't see them.
SGX encrypts the enclave's memory, so the host can't read the queries directly, and uses ORAM to hide the access pattern.
DC212 retweeted
Forget lidar.
One single camera.
Runs in real time & is open source:
A streaming 3D model that reconstructs scenes live, at ~20 FPS, over long sequences.
End-to-end.
Optimization tricks, cleanup steps?
Nope.
And it beats both streaming and even some offline methods.
Perception is becoming software-first.
Closer to machines that see and understand the world as it unfolds.
Thanks for sharing, @YinghaoXu1
📍Models: huggingface.co/robbyant/ling…
Project page: technology.robbyant.com/ling…
Code: github.com/Robbyant/lingbot-…
Paper: arxiv.org/abs/2604.14141
——
Weekly robotics and AI insights.
Subscribe free: 22astronauts.com
The Redump preservation project, responsible for documenting and gathering metadata for over 132 000 video game-related discs, has finally moved to a new website: redump.info
It's maintained by the same staff and now on an updated web server with modern technologies!
DC212 retweeted
TIL ssh added keystroke timing obfuscation in 2023. Sends garbage packets to avoid revealing what you may be typing based on timing patterns.
Another great blog post by @itseieio
eieio.games/blog/ssh-sends-1…
Just a reminder that we're having a meetup on the 19th at 7pm. Among other things, we'll be talking about CTF stuff
meetu.ps/e/Q4Vfx/Hq0dP/i
DC212 retweeted
Comedy of AI errors: Lawyers on both sides of a case misuse AI, cite fake hallucinated cases.
At the show-cause hearing, "each of the attorneys expressed embarrassment and apologized to the Court."
"Neither of them verified the legal authority output by AI before filing their briefs."
In other words, there were two clients who basically were paying for ChatGPT (or whatever LLM) to argue against itself.
Neither of them realized this until the court issued the OSC!
Fines all around (between $1,000 and $3,500), other sanctions include pro hac status revoked, disqualified from practicing in the district for 2 years, among other things:
DC212 retweeted
🚨🇺🇸BREAKING: The CIA officer caught with $40 million in gold bars allegedly invented an entire fake top-secret spy program to steal the money.
As if this story couldn't get and wilder:
-David Rush allegedly built a sham "special access program," the blackest box in U.S. intelligence, so secret even top-clearance officials couldn't look inside without authorization
-The fake program posed as "continuity of government" work, the doomsday planning that keeps Washington running after a nuclear war
-He allegedly read in two colleagues as unwitting accomplices and used a made-up government contract to funnel millions, persuading a defense contractor to buy huge amounts of gold
-The FBI raid on his home seized 303 gold bars worth roughly $40 million, $2 million in cash, and 35 luxury watches
-Investigators say he lied about his college degrees, faked being a Navy pilot, and still sailed through the CIA's notoriously brutal vetting
-A judge ordered him held as a flight risk, and several CIA officials are now on leave as the probe widens
The scheme worked because of the system, not in spite of it.
The secrecy walls built to hide operations from China and Russia hid the fraud from the CIA itself.
A man with a fake résumé ran a fake doomsday program inside the most paranoid institution in America, and for years nobody noticed...
Source: Washington Post
DC212 retweeted
There’s a famous Usenet story about a programmer (Mel) who refused higher level abstractions.
It was the late 1950s, and even in that era, Mel was…well today we’d call him a boomer.
Mel only wrote in raw hexadecimal. He didn’t approve of compilers, and refused to use optimizing assemblers.
"You never know where it's going to put things”, he said.
Everyone else in the company was moving on to FORTRAN, and they didn’t understand why Mel was so stubborn about using new tools. He *loved* self-modifying code.
“If a program can’t rewrite its own code”, he asked, “what good is it?”
Mel eventually left the company, and other engineers were tasked with understanding what was left.
Mel’s hand-optimized routines always beat the assemblers; but some of it looked absolutely bizarre.
One engineer took ~2 weeks to understand why there were loops with no exit condition…yet the program worked fine.
I won’t spoil all the details, you should really read it, it’s short. But it’s a fantastic piece on “what defines a real programmer?”…which is becoming increasingly relevant in this vibe-coded era.
I strive to understand computers as deeply as Mel! If we aren’t careful, we’re going to lose the “Mels” of this world to time.
That’s part of why I go so deep in my youtube videos. I hope that younger viewers are genuinely fascinated by the inner workings of our machines, instead of handing everything off to higher abstractions.
Interesting article on treating agent output like compiler output (and why)
skiplabs.io/blog/codegen_as_…
you never think this will happen to you, but this happened to me today.
a DPRK actor posed as somebody i previously worked with at the arbitrum foundation to have a catchup call. they reached out via telegram, in a channel where we had an existing messaging history.
the DPRK actor sent me what looked to be a legitimate teams link, but when i opened it, it said a software update was necessary, which entailed downloading and running a malicious file. in the group call, there was video of everybody on the call, including the person i had previously worked with.
stay vigilant and be safe! don’t be afraid to send out your own video conferencing links if you see something suspicious.
🚨 WARNING (AGAIN)
DPRK threat actors are still rekting way too many of you via their fake Zoom / fake Teams meets.
They're taking over your Telegrams -> using them to rekt all your friends.
They've stolen over $300m via this method already.
Read this. Stop the cycle. 🙏
DC212 retweeted
i built a site that explores which books are most popular across the brooklyn public library system!
+ see what's most popular borough-wide or by select neighborhoods
+ compare book tastes across neighborhoods
+ see ratings on goodreads + NYT best sellers
borrowed-brooklyn.vercel.app…
DC212 retweeted
Important free resource that teaches you how to rotate secrets on lots of different platforms.
Seems we're in the everyone leaking secrets phase of supply chain attacks lately. Keep this handy.
Thanks @trufflesec!
howtorotate.com/
GOOGLE BUILT A VULNERABILITY SCANNER AND OPEN-SOURCED IT
most devs ship code without knowing half their dependencies are ticking time bombs
osv-scanner fixes that
it scans your entire project lockfiles, containers, even vendored c/c++ code and maps every dependency against the osv.dev database
supports 11+ ecosystems. npm, pip, cargo, maven, go modules, gem. all of it.
the guided remediation feature is the real unlock... it doesn't just tell you what's broken.... it tells you exactly which version upgrades fix the most issues with the least risk
call analysis built in. so you only get alerts for vulnerable functions your code actually calls. no noise
works offline too. download the db once, scan without internet
one command to scan your whole directory:
osv-scanner scan source -r ./
github.com/google/osv-scanne…
DC212 retweeted
The FBI cut the phone lines during the 1977 disability rights sit-in. Then they turned off the hot water.
They locked the doors from the outside. One hundred and fifty people were trapped on the fourth floor. Half of them used wheelchairs. The government assumed they would leave.
Kitty Cone was thirty-three. She had muscular dystrophy. Her muscles were failing, but her logistics were flawless. She knew how to organize people.
The federal government had promised to sign regulations protecting disabled Americans from discrimination. The policy was known as Section 504. They printed the promise on paper. Then they stalled. Without a signature, it was just typography.
The protesters entered the regional Health, Education, and Welfare building in San Francisco on a Tuesday morning. They took the elevators to the director's office. They brought sleeping bags and catheters. They informed the staff they were not leaving until the law was signed.
By sunset, the police surrounded the exits. Kitty sat near the windows. She organized the floor plan. She assigned committees for security and sanitation. She kept her medication in a small cooler.
According to federal memorandums released decades later, the strategy to end the occupation relied on medical attrition. The building was not equipped for long-term habitation. The FBI calculated that a population requiring ventilators, specialized diets, and daily medical aides would voluntarily evacuate if the environment became sufficiently hostile. They instituted a blockade.
The blockade went into effect immediately. No food deliveries allowed. No medical supplies permitted through the lobby. Guards stood at the main doors checking identification.
Kitty's muscles deteriorated faster under the physical strain. She couldn't walk. When the phone lines went dead, the fourth floor lost contact with the press. The government waited for the quiet.
Kitty dropped to the floor. She realized the barricades were designed for standing adults. The police had blocked the hallways at waist height. They hadn't blocked the linoleum.
The floors were covered in cigarette ash and spilled coffee. She dragged her body through it. She crawled under the barricades to reach the restricted elevator shafts and unguarded offices.
She carried notes in her pockets. She found a single working payphone the FBI missed. She called the local news desks. She called the mayor's office.
She crawled back. When her arms failed, someone pulled her by her ankles. The Black Panthers heard the news reports. They crossed the police lines with hot meals. The FBI could not stop them without a riot.
They shut off the elevators, so she crawled.
The occupation lasted twenty-five days. It remains the longest non-violent occupation of a federal building in American history. On April 28, the Secretary of HEW signed the regulations without a single alteration.
The protesters left the building the next morning. They went back to their apartments. The Rehabilitation Act regulations laid the groundwork for every accessibility law that followed. The HEW building still stands on United Nations Plaza. The elevators run on a schedule. The doors are heavy glass.
Kitty Cone: the woman who crawled under the barricades.
idk how else to say this, but... build your dream projects now.
I feel like all the tools are giving away a LOT for free/cheap now. It's only gotten more pricey over time, and will keep getting more expensive. Your ideas are subsidized now, think of it as a fire sale and build!
A Russian hacker made $5 MILLION A DAY faking ad views from his apartment
Aleksandr Zhukov ran a company called Media Methane out of a Bulgarian apartment
On paper it was a real ad agency that placed video ads for companies like Nestle, Comcast, and The New York Times
Except he wasn’t placing them anywhere real
He built 6,000 fake websites that looked exactly like ESPN, CNN, Vogue, and Fox News
Then rented 2,000 servers in Dallas and Amsterdam, bought 650,000 IP addresses, and registered them to Verizon and Comcast so the traffic looked like regular Americans
He coded a fake web browser that scrolled pages, clicked ads, moved the mouse and solved CAPTCHAs like a real person
His bots watched 300 million video ads a day
Advertisers paid $13 per thousand views
At peak he was pulling $5 million a day while he slept
Got caught because he got into a fight with a client and spammed their inventory so hard it tripped every fraud alarm at a cybersecurity firm
FBI arrested him in Bulgaria, extradited him to the US, 10 years in federal prison
When he got to court he told the judge: “I’m a weaponless soldier in front of a tank with name FBI”













































