Tim (Wadhwa-)Brown :donor: on Nostr: Interesting links of the week: In honour of infodox: * * * Strategy: * - Phil ...

Interesting links of the week:

In honour of infodox:

* https://github.com/infodox
* https://github.com/darrenmartyn
* https://github.com/fullspectrumdev

Strategy:

* https://www.philvenables.com/post/a-cisos-ideal-management-tool - Phil Venables (npub1v5f…wgxn) discussed modern CISO needs
* https://thomasdullien.github.io/about/slides/An-age-of-experimentation-BlueHat-Asia-2026.pdf - [@HalvarFlake](https://mastodon.social/@HalvarFlake ) ponders on experimentation 🤖
* https://graemedownie.com/wp-content/uploads/2026/10/PUTIN-TAX-FINAL-COMPLETED.pdf - estimating the cost of Vlad
* https://blog.zsec.uk/regulating-red-teams/ - [@zephrfish](https://bladerunner.social/@zephrfish ) discusses regulated red teams
* https://anarc.at/blog/2026-10-08-dst-warning - anarcat (npub1atw…rz53) ponders on the nature of time
* https://www.npl.co.uk/news/the-future-of-timekeeping - some changes take time...

Threats:

* https://medium.com/mitre-attack/attack-v20-9701dd75ffb4 - ATT&CK v20 is out \o/
* https://cwe.mitre.org/news/archives/news2026.html#October05_CWE_5_0_Schema_8_0_Release_Date_28_October_2026 - changes to the way that [@CWE_Program](https://mastodon.social/@CWE_Program ) manages weaknesses
* https://opsectechniques.com/ - tracking opsec techniques
* https://cert.pl/en/posts/2026/08/incident-follow-up-report-energy-sector-2025/ - how baddies breached a private APN
* https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/ - j’ai un mot de passe faible et la pression s’est intensifiée 🇫🇷 🧊🔥
* https://www.virlabs.ai/blog/knock-outd/ - T1205.002 ++
* https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/ - [@citizenlab](https://mastodon.social/@citizenlab ) on when you're the product
* https://blog.confiant.com/p/adint-weaponized-ad-tech-for-zero-click-spyware-and-mass-identity-vacuuming - weaponised adverts
* https://blog.report-uri.com/abandoned-analytics-domain-funnels-store-visitors-to-darksword-iphone-exploits/ - Scott Helme (npub1xql…ayrn) reports on some interesting iOS malware lurking on long since expired domains

Detection:

* https://ifritnoises.org/articles/the-lucifer/ - spotting a compromised MikroTik
* https://blogs.cisco.com/industries/cisco-and-the-disa-stig-turning-zero-trust-policy-into-repeatable-practice-part-2-cisco-sna - using SNA for OT visibility
* https://www.halkynconsulting.co.uk/a/2026/10/linux-file-attributes/ - Taz Wake (npub123l…wmzz) and friends explain file properties in Linux

Bugs:

* https://gist.github.com/lkloliver/46a88c7d619e487327a1122c20ff8e32 - gotta love a good $PATH bug
* https://vulnerability.circl.lu/kev-catalogs - a circl (npub143x…w0tp) of KEVs
* https://quentinkaiser.be/security/2026/10/16/one-parser-two-bugs/ - when the airwaves contain a howler

Exploitation:

* https://sec-consult.com/blog/detail/from-anyoneicloudcom-spoofing-arbitrary-apple-icloud-identities/ - fake it until you make it :)

Hard hacks:

* http://rfidiot.org/ - RFIDIOt gets an update
* https://www.pentestpartners.com/security-blog/you-dont-need-a-nation-state-to-warm-up-a-fridge/ - cybergibbons (npub1ne0…087a) on fridges... global warming isn't a myth and anyone can do it
* https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers - Claroty (npub1yc3…zd6y) chart the frozen wastelands that are fridges
* https://www.tibane.net/research/ledger-nano-x-implant - in-line attacks on hardware security features
* https://www.fullspectrum.dev/the-sangoma-inquisition-a-summary/ - a stack of SP infra bugs in Sangoma
* https://cn0xroot.wordpress.com/2026/09/19/root-tesla-os-on-qemu-part-1-unpacking/ - crashing and rooting a Tesla
* https://adepts.of0x.cc/eufy-doorbell-hacking/ - Adepts of 0xCC (npub1p2v…gc4k) poke the eufy doorbell

Hardening:

* https://www.kernelconfig.io/search?kernelversion=7.2.9&page=1&q=security - Linux kernel security config options
* https://onlineservices.epicgames.com/news/introducing-easy-anti-cheat-linux-v2 - games as ZT

Cryptography:

* https://www.mayrhofer.eu.org/talk/lets-talk-about-cryptographic-attack-surfaces/ - mind your Ps and Qs with [@rene_mobile](https://infosec.exchange/@rene_mobile )

Data:

* https://people.kernel.org/monsieuricon/creepy-crawlies - K. Ryabitsev-Prime 🍁 (npub1vg2…lxfp) gives us some numbers on just how much AI costs https://git.kernel.org/

Nerd:

* https://www.youtube.com/watch?v=1Vyzla9mx4g - [@kde](https://lemmy.kde.social/c/kde ) at 30, the story
* https://minesweeper.mikelacher.com/ - bang!
* https://archives.phrack.org/dl/73/halvar-flake-prophile.pdf - phrack profile [@HalvarFlake](https://mastodon.social/@HalvarFlake )
* https://decoded.legal/blog/2025/02/sim-farms-gsm-gateways-comugs-and-the-crime-and-policing-bill/ - Neil Brown (npub1huw…c5x7)'s analysis of the law on SIM farms

#security, #research