@spoofyroot
Account based inUnited States
About this account
- Account based in
- United States
- Connected via
- Web
Account-level information from X, not a live location or the device used for a specific post.
Security research and engineering lead at @microsoft. on mastodon: https://xitter.cf/t.co/YfJkktByFv and @spoofy.bsky.social not posting here anymore.
Redmond, WA
Joined December 2009
- Tweets4.4K
- Following333
- Followers4.4K
- Likes2K
I'm hiring again -> infosec.exchange/@spoofy/117…
We get lots of questions about about admin protection in Windows. So we decided to provide some context and details. Part 2 will be out shortly... techcommunity.microsoft.com/…
Johnathan Norman retweeted
WILD: actual photo of Musk-hired door knockers being driven around #Michigan.
This group of mostly-black workers were driven in the back of a truck with no seats.
They say they were flown in, given unrealistic goals, and threatened with their lodging being cut off & being forced to pay their own way home if they couldn't meet them.
Some didn't even know which candidate they were working for.
Article by @JakeLahut
wired.com/story/elon-musk-am…
Johnathan Norman retweeted
Put up the slides for my @MSFTBlueHat 2024 presentation on improvements to OleView.NET github.com/tyranid/infosec-p… You can also grab v1.15 of OleView.NET from the PS Gallery which has the new features to generate proxy clients on the fly.
Johnathan Norman retweeted
NEW: @X is pushing partisan content, most of it supporting Trump & sowing election doubt.
@WSJ reporters created new accounts with interests in things like crafts, then observed what content the accounts got recommended.
Their "for you" feeds showed pro-Trump content at double the rate of pro-Harris content.
By @jackgillum @AlexaCorse & Adrienne Tong
wsj.com/politics/elections/x…
Johnathan Norman retweeted
It’s wonderful to see what @XenoKovah and his collaborators have built for the community. I always recommend OST2 for my new hires and other juniors, or just anyone trying to get started on a new topic. The courses are excellent. It’s an honor to sponsor the Windows Security Path
Thanks to Winsider Seminars & Solutions (@yarden_shafir & @aionescu) for Sponsoring #OST2 at the Gold🥇 level!
Learn more about them here: windows-internals.com/
Johnathan Norman retweeted
Here's a time lapse video showing my 360 hypervisor exploit triggering in ~18.5 minutes. This is a pretty average time for the exploit with about 40% success rate. People asked if it works on winchester and I don't think there's any reason it won't but I don't have one to test on
The new account type for services finally landed in WIP. Now when running Windows Protected Print (WPP) the service will run as "Restricted Service" and no longer SYSTEM. There will be a SYSTEM process, but it basically just launches the worker.
This update will land in non-WIP builds (GA) likely in January. Big thanks to @tiraniddo who gave us early feedback on the design... and shoutout to @Grimdoomer who did the prototype. It was really fun working with the Print team.
Johnathan Norman retweeted
Microsoft has open sourced its new cross-platform virtual machine layer written in Rust: github.com/microsoft/openvmm From many of the same team who created WSL, including @benhillis.
suggest the thing people currently have is less secure. So nobody wants to talk about it.
The net result is people rather say "we support SHA-3 now!" instead of discussing how something like NTUser will have less bugs.
One thing that sucks about reducing attack surface. Nobody knows how to speak about it to the public and often people don't want to do it. Marketing/Comms people prefer to speak about what new thing is added. When you mention removing or replacing something, you implicitly
Hello everyone, fun fact, UAC bypasses = bounty money when Administrator Protection is enabled. We checked many but we fully expect we missed some. You could simply dig up old research, try it and if it works make some cash. This feature is in an early stage, help us improve it.
Administrator Protection, introduced in the latest Windows Insider Canary build, is a solid security enhancement... uhh.. really?? can be bypassed with @splinter_code's clever SspiUacBypass tool. Check it out here: github.com/antonioCoco/SspiU…
I've been hiring across multiple countries non-stop for a few months now. Only down to a few spots remaining and i plan to sleep for like a month.
last one i think jobs.careers.microsoft.com/g…