Tim (Wadhwa-)Brown :donor: on Nostr: Interesting links of the week: Strategy: * - weeding out the undesirables, if we're ...

Interesting links of the week:

Strategy:

* https://www.youtube.com/watch?v=WXL6K1lhvt0 - weeding out the undesirables, if we're not calling out this kind of shit, we're absolutely part of the problem
* https://www.ncsc.gov.uk/collection/problem-book/ai-cyber - NCSC turns the page and finds more problems
* https://cert.cyber.gouv.fr/dur/CERTFR-2025-DUR-003/ - more fun with water, this time in .fr

Threats:

* https://elkentaro.github.io/jp_incidents/ - .jp having a bad day^Wweek^Wtime of it with baddies
* https://emudhra.we-have-a-problem.com/ - did you just get a shitty certificate which means nothing?
* https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/ - is it simulation or emulation if the TA is using pen testing tools? 🤖
* https://blog.nviso.eu/2026/10/16/keystrokes-in-disguise-forensic-analysis-of-a-digispark-hid-device/ - key logging in the wild

Detection:

* https://righteousit.com/2026/10/20/mtt-sh-mounting-linux-images/ - [@hal_pomeranz](https://infosec.exchange/@hal_pomeranz ) on the pain that is "mount"

Bugs:

* https://hackyboiz.github.io/2026/10/17/millet/cve-2026-58222/ - let's all do the Samba
* 4 - important contribution to cyber awareness month
* https://calif.io/php2shell/ - another important contribution to cyber awareness

Exploitation:

* https://www.netcraft.com/blog/how-attackers-get-into-your-calendar-the-easy-way - when you're offered a date, be careful where you put it....
* https://0xrefs.github.io/ - interactive cheat sheet
* https://blog.trailofbits.com/2026/10/14/package-managers-have-an-integrity-problem/ - not sure I'd refer to language specific tooling as package management, given their varying capability levels, but it's certainly true that they often lag behind distros' traditional package management
* https://blackfield.ch/blog/defeating-enforced-smb-signing/ - is SMB signing al that it promised to be?

Hard hacks:

* https://www.usenix.org/system/files/usenixsecurity24-lisowski.pdf - fun with SIMs
* https://www.usenix.org/system/files/woot26-lisowski.pdf - more fun with SIMs

Crypotography:

* https://emudhra.we-have-a-problem.com/ - the story of 4

Hardening:

* https://ghuntley.com/patch/ - can AI help us mitigate threats?

#security, #research