
Insomniac security & tech geek. Lancashire lass in The Netherlands, via Brighton, London, and 🇨🇭. Tweeting in a personal capacity. @vickyjo@mastodon.social
The Netherlands
Joined June 2007
- Tweets38.7K
- Following1.7K
- Followers1.8K
- Likes33.5K
Victoria Walberg retweeted
A Microsoft 365 credential belonging to ConnectWise Cloud Backup (formerly SkyKick) has been compromised, and Huntress has confirmed it is being used to gain unauthorized access to customers’ M365 environments: huntress.com/blog/vendor-cre…
Victoria Walberg retweeted
Our Welsh cousins, BSides Aberystwyth, are not on any social media channels, but they currently have their Call for Paper open until the 31st Oct.
Their event is on Saturday 21st Nov, if you can get there, go & support it!
bsidesaberystwyth.org/call-f…
#Wales #BSidesAberystwyth #CFP
Victoria Walberg retweeted
Today would have been the birthday for Thomas Fischer (@FVT)
Thomas, was a director of #BSidesLondon, and largely responsible for making the event the success is is today
We would invite you to consider making a donation to one of the following charities in his memory
#FVT
Also sending best wishes to @BSidesAth and @bsidesporto on their events today.
If you're over on BSky and/or Mastodon, please say.
Best of luck today to @BSidesVienna and @BSidesMaribor. Please look out for your fellow hacker and be sure to hydrate.
Victoria Walberg retweeted
On the 21st May, a wake for Thomas Fischer (@FVT) has been organised in London to remember, share and celebrate his life.
Please only claim an attending ticket if you can attend, there is also a live stream if you wish to pay your respect from afar.
eventbrite.co.uk/e/thomas-fi…
Victoria Walberg retweeted
Today, after a long battle with cancer, we lost @FVT
His wife asked that we share the news of his passing, "His love for the community that he was in (as a curmudgeon). His joy for being involved with every thing that he & any team that he worked with. He fought to the very end."
Infosec folks, some of you might have taken a @SANSInstitute / @SANSEMEA with him, sorry to share the sad new of @markjx01's passing.
I was lucky to count him as a colleague for 3 years.
He is missed.
RIP, @markjx01...
paulyoungfuneralhome.com/obi…
If you knew this man, and many of us in #Cincinnati #infosec circles and beyond did, you were better off for it. He is missed already!
Victoria Walberg retweeted
Reminder that the mortal remains of Twitter are no longer monitored by the global team, making it more important than ever to follow the simple, foundational rule that events teams stay in touch with info@bsides.org with event dates and other updates.
Victoria Walberg retweeted
You've got till Friday 3rd to submit your talks and workshops. We've got plenty of talks but could do with a few more workshops, so if you've got an idea, but aren't sure, submit it anyway and let us decide
forms.gle/hLXt1dibQrA6CUSM6
Victoria Walberg retweeted
"Why does our top performer get the worst reviews?" the boss asked.
I was reviewing their annual performance data.
"Show me," I said.
She pulled up the ratings.
Diana: 2.8 out of 5.
Below average on "collaboration."
Low marks for "team player."
"What's her actual performance?" I asked.
"Exceeded every target.
Landed our biggest client.
Trained three new hires."
"So why the low scores?"
"Her peer reviews are dragging her down."
I scanned the comments.
"Too direct."
"Challenges ideas too much."
"Not supportive enough."
"Let me talk to Diana," I said.
"I used to give honest feedback," Diana told me.
"Said our pricing model was broken.
Got dinged for 'negativity.'"
"What happened with the pricing?"
"They finally fixed it six months later.
After we lost two major accounts."
"What else?"
"I questioned why we needed
eleven approvals for a simple contract change.
Manager said I wasn't being collaborative."
"Are you still giving feedback?"
"No. I learned my lesson.
Now I smile. Nod. Say everything's great.
My reviews are improving."
"But nothing's actually improving?"
"We're making the same mistakes.
Just with better vibes." She chuckled.
I went back to the boss.
"Your review system doesn't measure performance," I said.
"It measures compliance."
"That's not true."
"When was the last time someone
got promoted for challenging bad ideas?"
Silence.
"When did someone get rewarded for preventing a mistake?"
More silence.
"You've trained your best people to stay quiet.
And your mediocre people to stay nice."
A few months later, they redesigned the system.
Added a category: "Constructive Challenge."
Points for identifying problems early.
Rewards for preventing costly mistakes.
Diana got promoted.
"What changed?" I asked the boss.
"We stopped confusing agreement with alignment.
Stopped mistaking silence for harmony."
"And?"
"Turns out our 'difficult' people
were our most valuable.
They actually cared enough to speak up."
Here's the truth about performance reviews:
Most companies don't reward performance.
They reward performance theater.
The person who says the meeting was great
beats the person who says it wasted an hour.
The person who agrees with bad ideas
beats the person who prevents disasters.
You think you're measuring contribution.
You're measuring conformity.
And your best people?
They've already figured out the game.
They're just deciding whether to play it
or find somewhere that values truth over comfort.
Victoria Walberg retweeted
I wrote a Tool to detect MongoBleed exploitation in MongoDB logs 🩸
The detection logic is based on @eric_capuano's excellent research: the exploit makes thousands of connections but never sends client metadata. Legit drivers always do.
github.com/Neo23x0/mongoblee…
Features:
- Pure bash/jq/awk - no agents, runs via SSH or on forensic copies
- Streams large logs without loading into memory
- Handles compressed .gz rotated logs
- IPv4 & IPv6 support
- Configurable thresholds
- Risk levels: HIGH/MEDIUM/LOW/INFO
- a Python based wrapper that takes a host list as an input and runs the script on a set of remote systems
The sub folder ./example-logs contains a Mongod.log of an exploited system
Victoria Walberg retweeted
So your defense is “others are doing it too”? “contributory infringement” exists. You know the act of contributing to the infringement of copyright. You don’t have to be the one who posted the book online. Look to Napster, Grokster, Viacom, there is a long list of cases on this
Victoria Walberg retweeted
If you have one of the #BSidesLDN2025 teddy bears, we would like to offer a ticket for #BSidesLDN2026 for the most travelled and long distance picture of our bear.
Victoria Walberg retweeted
There have been many posts asking about whether the #BSidesLDN2025 talks were recorded.
Yes they were!
They will be available on our YouTube channel youtube.com/channel/UCXXNO…
Please subscribe, we only upload once a year, and you’ll be notified when the videos are available!
Victoria Walberg retweeted
This is the news we need and want
NEW: Raccoon gets drunk at an ABC liquor store in Ashland, Virginia, and passes out in the bathroom.
Hanover County Animal Protection says the raccoon "ransacked" the store before passing out next to the toilet.
"Officer Martin safely secured our masked bandit and transported him back to the shelter to sober up before questioning," Hanover County Animal Protection and Shelter said in a statement.
"After a few hours of sleep and zero signs of injury (other than maybe a hangover and poor life choices), he was safely released back to the wild, hopefully having learned that breaking and entering is not the answer."
Video: WAVY TV 10.
Victoria Walberg retweeted
Microsoft is adding Sysmon directly into Windows. The Sysinternals utility will make it easier for security teams to detect and respond to threats theverge.com/news/822023/mic…
Victoria Walberg retweeted
The CVSS score for the CVE has been adjusted to a 10.0 it appears 👀
msrc.microsoft.com/update-gu…
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-global…























