Nostr notes by Adrian —dangerously-skip-permissions Sanabria

So I came across this on LinkedIn yesterday. It made me angry and ...

2026-10-28T15:46:56Z

So I came across this on LinkedIn yesterday. It made me angry and I've been trying to work out why that is and if my anger is justified, so bear with me as I dump my thoughts here. Would love some feedback/conversation on this.

I had three advisory calls yesterday, before I saw these posts. They were all focused on vulnerability management. The vibe of each call was, "we're tired of getting punched in the face."

Then I see this post, and the vibe struck me as, "here's more face punches, isn't that amazing? You're welcome!"

I feel like vulnerability discovery isn't as valuable as a lot of people think it is. Or to put it another way, it doesn't hold the same level of value for every party.

If you're the one finding a vulnerability, it's a thrill! It's resume fodder. A feather in your cap. Good for you.

But if you're a defender, and it's a vulnerability that isn't useful to an attacker, but it still has a 9.8 CVSS even though its LPE and you collectively decide to trigger rapid response to get it patched ASAP *even though you know it isn't a real emergency because no attacker will be interested in using it*, it kinda sucks.

It was a waste of the defenders time. They could have been working on hardening, or better mitigations, or finding and fixing configuration issues, or improving asset management coverage - any number of other things. But they lost a whole day to rolling out yet another Linux Kernel patch for yet another Linux LPE.

Maybe I'm wrong and these will all be super serious RCEs that actually matter. We'll see.

HEY, LET'S SEE WHERE I HAVE PHP IN MY ENVIRONMENT OH WAIT I ...

2026-10-21T17:44:22Z

HEY, LET'S SEE WHERE I HAVE PHP IN MY ENVIRONMENT

OH WAIT I CAN'T BECAUSE THEY USE PHP AND SHUT DOWN THEIR SERVICE AS A PRECAUTION

#WTAF #DOBETTER

So I encountered some interesting fraud today and wanted to get ...

2026-10-14T05:23:11Z

So I encountered some interesting fraud today and wanted to get some feedback on how it might have happened and advice on what to do next.

The Rocket Money app is the MVP in this story, as it notified me of a large transaction as suspicious less than an hour after it occurred.

A $600 Ubiquiti order that I had supposedly just placed.

As much as I'd like to, I did not order $600 of Ubiquiti stuff today at 4:13pm.

I checked my email, and sure enough, there was an order for an 8-port switch, made from MY Ubiquiti account, with MY primary card that I buy stuff like this with.

Except it was bound for an address I didn't recognize in Madisonville, TN.

I quickly logged into my Ubiquiti account and cancelled the order. Since the charge was still pending, it immediately disappeared and returned the funds to my account.

Crisis averted, but HOW DID THIS HAPPEN?

I reset passwords, logged off sessions, and did all the other things in the Ubiquiti app, but I have no saved payments in the Ubiquiti account - how did they hit my card then?

I keep looking and notice something else interesting - a Link verification code at 4:13pm - the same time as the Ubiquiti order. That answers the question of how my card was accessed.

This code went to my Google Voice number, so no SIM-swapping would have gave someone access to this code. They were somehow able to create the order without the code.

So now I'm going into Link (Stripe's consumer-facing app that makes it super easy to buy stuff) and deleting all my payment options. The only login option was passkey.

I also froze my card, since I'm still unable to figure out how someone was able to create this order in my Ubiquiti account via Link, with my card, but send it to a different address.

I started looking for breaches and this is writeup on compromised Stripe API keys from Hudson Rock my current best guess as to how this fraud happened: https://www.infostealers.com/article/analyzing-stripe-breach-confirmed-vendor-exposure-and-claims-of-20000-compromised-apis/

I currently have no other theories. What have I missed? Does this sound plausible? I'm not sure compromised Stripe APIs can explain the Link piece of the puzzle.

have any theories emerged as to how they managed to collect so ...

2026-10-09T20:10:48Z

In reply to nevent1q…wlh5
_________________________

have any theories emerged as to how they managed to collect so many creds?

I've analyzed some breaches where MSPs will use the same credentials in network infrastructure across all their customers, but even with that angle, it boggles the mind to get to 70k-80k.

I know people in the industry who compulsively collect data leaks ...

2026-09-30T17:48:47Z

In reply to nevent1q…rcnx
_________________________

I know people in the industry who compulsively collect data leaks and now I wonder if it has occurred to them that they’re putting a target on their backs

I had a Jaguar in my collection for a while and “clownshoes” ...

2026-09-21T02:56:10Z

In reply to nevent1q…tqmp
_________________________

I had a Jaguar in my collection for a while and “clownshoes” is the right word. The drugs someone must have been on to approve that controller design!

Remember when @npub1525…3vrv discovered you could compromise ...

2026-09-15T21:42:48Z

Remember when Tavis Ormandy (npub1525…3vrv) discovered you could compromise Symantec's secure email gateway with an email, because their AV engine was using a 7 year old, vulnerable unpacker?

I remember, and it makes me feel tired and old

https://www.theregister.com/security/2026/09/15/cisco-email-security-boxes-can-be-rooted-by-an-email/5296604

This wiring project is killing me. I don’t know how old this ...

2026-08-15T20:08:20Z

This wiring project is killing me. I don’t know how old this work is, but who both says “fuck grounding things” and then SOLDERS the unused wires together???

This is very “I don’t know the person that will have to deal with this next, but fuck them” energy

I will admit, I wish there were a world where the opportunities ...

2026-08-14T14:34:03Z

In reply to nevent1q…9dx9
_________________________

I will admit, I wish there were a world where the opportunities for abuse for this technology weren’t so bad, because I went through Black Hat, BSides Las Vegas, and DEF CON struggling to put names to faces every 5 minutes

Of course, the flip side is that “struggling” to remember things is one of the best things you can do for learning, memory, and brain health, so I guess it’s a good outcome for everyone if facial recognition never makes it into the product.

I like how the guy wearing the Meta glasses is labeled as ...

2026-08-14T14:30:29Z

In reply to nevent1q…9dx9
_________________________

I like how the guy wearing the Meta glasses is labeled as “502”, because HTTP code 502 is “bad gateway”

RE: https://cyberplace.social/@GossiTheDog/117082934696297430 You ...

2026-08-12T20:27:41Z

RE: https://cyberplace.social/@GossiTheDog/117082934696297430

You could cross your fingers that attackers have hard drives too small to extract the 153GB RAR and can't afford larger drives because AI made storage expensive

but I wouldn't count on it
nostr:note13esqw2kxdsddzcc2l07g593rws46t6hreplvp0fmhws90afz2czsg8l9lw

My thoughts on 1Password’s latest research ...

2026-08-11T15:59:05Z

My thoughts on 1Password’s latest research https://www.defendersinitiative.com/p/reviewing-initial-research-on-using

Hear me out What if we ENCRYPTED the drone? With quantum ...

2026-07-29T22:56:42Z

In reply to nevent1q…w8xs
_________________________

Hear me out

What if we ENCRYPTED the drone?

With quantum encryption

Would people still be able to hear it?

you had one job

2026-07-21T15:26:14Z

In reply to nevent1q…3484
_________________________

you had one job

there have been unauthorized clones since the very first days of ...

2026-07-14T18:15:56Z

In reply to nevent1q…kvjn
_________________________

there have been unauthorized clones since the very first days of gaming. I forget how many versions of pong were created and sold by different companies

Unlicensed clones of popular Sega and Nintendo games have existed for decades

The higher quality, more thoughtful version will always win though. Have to ignore the vibe oded garbage that isn't even worth trying out

employees figured out tool use for effective problem solving long ...

2026-06-30T13:03:25Z

In reply to nevent1q…d6w5
_________________________

employees figured out tool use for effective problem solving long ago - we call it "Shadow IT"

do we know if malvertising or served from Gizmodo’s own domain?

2026-06-20T12:53:51Z

In reply to nevent1q…lj98
_________________________

do we know if malvertising or served from Gizmodo’s own domain?

that's not surprising, so what's the point of setting ...

2026-06-12T03:27:20Z

In reply to nevent1q…msum
_________________________

that's not surprising, so what's the point of setting unrealistic SLAs?

Why not require remediation in 3 hours? 3 minutes?

I'm constantly talking to enterprises and they struggle to ...

2026-06-11T17:29:04Z

In reply to nevent1q…u2ln
_________________________

I'm constantly talking to enterprises and they struggle to meet their 7-day SLAs, so when CISA comes out with 3 days, my eyes are popping

Do you know if there is any data on how well federal agencies ...

2026-06-10T23:47:26Z

In reply to nevent1q…fmf0
_________________________

Do you know if there is any data on how well federal agencies keep up with KEV’s remediation directive?

some deep drinking of the kool-aid going on across the pond Does ...

2026-06-09T02:57:29Z

In reply to nevent1q…j94w
_________________________

some deep drinking of the kool-aid going on across the pond

Does the UK have kool-aid?

OH, and the li-ion battery that absolutely should not go into the ...

2026-04-05T16:34:33Z

In reply to nevent1q…uw9f
_________________________

OH, and the li-ion battery that absolutely should not go into the trash and will burst into flames if punctured.

Im betting 99% of these Cisco video pamphlets, like most disposable vapes, went straight into the trash.

The magnet on the right hand side turns the device on and off ...

2026-04-05T16:31:54Z

In reply to nevent1q…pgx4
_________________________

The magnet on the right hand side turns the device on and off when a corresponding magnet in the cover makes contact with it.

Pretty much what you’d expect, SBC with a lot of hot glue, a ...

2026-04-05T16:30:42Z

In reply to nevent1q…mt60
_________________________

Pretty much what you’d expect, SBC with a lot of hot glue, a speaker, buttons, and the USB port.

Alright, let’s start tearing open this paperboard glue sandwich ...

2026-04-05T16:28:31Z

In reply to nevent1q…as5y
_________________________

Alright, let’s start tearing open this paperboard glue sandwich and see what’s inside.

I don’t know what I was expecting, but Antarctica wasn’t it.

Plug it in and it shows up as USB storage With… 220MB of total ...

2026-04-05T16:25:58Z

In reply to nevent1q…u4cl
_________________________

Plug it in and it shows up as USB storage

With… 220MB of total space?

Can I put a different video on it? Why, yes. Yes I can. ...

2026-04-05T16:24:48Z

In reply to nevent1q…d9e3
_________________________

Can I put a different video on it? Why, yes. Yes I can.

At RSA, when you’re at one of the main hotels, vendors leave ...

2026-04-05T16:16:34Z

At RSA, when you’re at one of the main hotels, vendors leave marketing stuff at your door or in your room.

Cisco distributed full-on video players with built-in li-ion batteries and I just now found time to dig into it.

anyone know a good alternative for Proton? Their products are so ...

2026-03-05T20:46:09Z

In reply to nevent1q…58sa
_________________________

anyone know a good alternative for Proton? Their products are so good, it’s painful seeing them cave to this sort of stuff.

Or is this already the best option, and the reality is just that the best option also sucks for reasons?

Interesting, looks like most are periodic events, like “every ...

2026-01-24T00:17:57Z

In reply to nevent1q…lchk
_________________________

Interesting, looks like most are periodic events, like “every 3rd Saturday, 1-5pm”

I may be starting one of these up. Twice a month, I set up vintage video games at my favorite bar/brewery. Why not fix stuff while people are playing games?

love the idea of a repair Cafe! Would like to learn more about ...

2026-01-23T15:34:40Z

In reply to nevent1q…hk9a
_________________________

love the idea of a repair Cafe! Would like to learn more about how that works and what it looks like

same here - hopefully it doesn't impact the lower end of the ...

2026-01-22T03:04:43Z

In reply to nevent1q…4flx
_________________________

same here - hopefully it doesn't impact the lower end of the market.

It wouldn't make sense for it to - AI datacenters and GPU manufacturers shouldn't have any interest in tech 3+ generations old.

The enshittification of computer repair is happening. AI has ...

2026-01-20T00:37:23Z

The enshittification of computer repair is happening.

AI has amazingly managed to make repairable computers practically worthless.

The increase in memory and storage pricing is destroying the second-hand market for computing hardware and this makes me sad. I watched a video from someone that runs a repair shop, and this is what's happening:

The memory/storage alone is worth more than the rest of the computer, so people are stripping them out to sell separately.

The second hand market is now flooded with computers that have no memory or storage. Buying new memory or storage to put in these used computers is now more expensive than buying a new computer.

So we now suddenly have a giant e-waste problem PLUS a giant problem for repair shops that want to stay in business.

In the video, he was basically saying that they have to pivot to the only computers that folks aren't stripping RAM and storage out of - computers that have those things soldered on. The irony here is that repair shops now have to ignore the most repairable computers and focus on the least repairable computers instead.

https://www.youtube.com/watch?v=T6eiFyJMWgM

cc Cory Doctorow (npub1fdr…lvhs) iFixit (npub1ulc…x3hg)

it might have been quicker to watch the video, but for me, it was ...

2026-01-01T18:50:32Z

In reply to nevent1q…ct72
_________________________

it might have been quicker to watch the video, but for me, it was worth every minute spent going through this thread.

We've covered a lot of the pieces and parts of this on my podcast, but it was great to see it all tied together - the cloud act, anticircumvention, alternative app stores, John Deere, BMW heated seat subscriptions...

And the opportunity for countries to repeal anticircumvention laws never occurred to us, but it gives me hope.

It still feels like alternatives to the hyperscalers is so far in the future though, especially seeing a German hosting company killing people's accounts without notice

But watching Proton slowly build out a full replacement to Google/Microsoft mail/calendar/drive/apps services has given me hope as well.

It reads like, “hey, there was some detail missing from the ...

2025-12-08T14:43:48Z

In reply to nevent1q…0mgp
_________________________

It reads like, “hey, there was some detail missing from the first CVE, so here’s a new CVE with extra details”

This would kill entire market segments if true. Bitsight, ...

2025-11-07T04:08:51Z

In reply to nevent1q…wu60
_________________________

This would kill entire market segments if true. Bitsight, Security Scorecard, Upguard, Censys, and a few dozen other security vendors would have to cease operations immediately

I still maintain they'll end up giving it away for free. No ...

2025-11-06T00:21:41Z

In reply to nevent1q…qenu
_________________________

I still maintain they'll end up giving it away for free. No one wants to pay for it, the value just isn't there.

this would make a great post, I'd love to hear more of your ...

2025-11-05T18:36:09Z

In reply to nevent1q…ujlz
_________________________

this would make a great post, I'd love to hear more of your thoughts on this - particularly around what such a device would be designed to protect against.

Something that I feel has never been sufficiently explored or discussed is the amount of digital "exhaust" that comes out of our devices. Particularly all the information our smartphones and bluetooth devices can leak about us to anyone listening.

And we've all heard how Target knows who you are and what aisle you spent 30 seconds in, as long as you leave your phone turned on while you're in the store.

automated clickfarm

2025-10-24T23:01:09Z

In reply to nevent1q…7wts
_________________________

automated clickfarm

This Korean data center fire keeps getting more and more tragic. ...

2025-10-14T21:27:47Z

This Korean data center fire keeps getting more and more tragic. Here’s what I know, to catch you up.<li>Back in 2017, S.Korea built “G Drive” for government officials to store all their files (no relation to Google drive, the ‘G’ stands for Government)</li><li>They were told to store all their stuff in G Drive, not on their local systems.</li><li>They were concerned about battery backups causing a fire, so decided to move half the li-ion batteries to the basement.</li><li>One of the li-ion batteries exploded as it was being unplugged, setting the building on fire. Several floors of datacenter were affected.</li><li>They’ve recovered roughly a third of the data.</li><li>none of it was backed up, because 1 petabyte was “too large to back up”</li><li>In 2017, one AWS Snowmobile 18-wheeler held 100 petabytes, so “too big to back up” doesn’t make a lot of sense</li><li>125,000 government employees lost all their data</li>

This is WILD. Go to any failing mall in America and choose a retailer at random. Spencer’s Gifts? They probably do backups. Jamba Juice? Backups. The CBD vape store? Okay, maybe they don’t do backups, but everybody else does.

One of the most technologically advanced 1st world nations in the world DOESN’T BACK UP government data? I’m still floored by this.

went through the thread here, but didn't find a clear answer ...

2025-10-14T21:25:24Z

In reply to nevent1q…r7qc
_________________________

went through the thread here, but didn't find a clear answer - do we know how attackers got their initial foothold into JLR?

Sounds like, if no, the obvious guess would be the same way M&S and Co-Op got hit since they were also using TCS?

they might want to reduce Hegseth’s currently prescribed dose ...

2025-09-30T16:12:14Z

In reply to nevent1q…6h4w
_________________________

they might want to reduce Hegseth’s currently prescribed dose of cocaine

fuck me, seriously?

2025-09-10T19:32:58Z

In reply to nevent1q…t2j2
_________________________

fuck me, seriously?

there’s no fixing hallucinations, but grounding data can help ...

2025-09-10T19:29:03Z

In reply to nevent1q…mta6
_________________________

there’s no fixing hallucinations, but grounding data can help (ie let it search the web)

But then, the grounding data will be wrong or potentially out of context a good percentage of the time

Ultimately, the answer lies in transparency- show me the thinking and where you got your answers, and I can make a call on whether to trust it

good to see everyone involved go to jail, but it still ...

2025-09-09T04:12:00Z

In reply to nevent1q…gcxy
_________________________

good to see everyone involved go to jail, but it still doesn't seem like enough, given all the damage they did - all the lives they destroyed

is this a new attack vector? Typically, I've seen attackers ...

2025-09-08T16:29:34Z

In reply to nevent1q…hhk9
_________________________

is this a new attack vector? Typically, I've seen attackers use the NPM install scripts to put malware on systems, and they typically leave the package code itself alone, right?

What's worse? How bad these prompts are? Or that I doubt ...

2025-08-18T16:04:00Z

In reply to nevent1q…wcnj
_________________________

What's worse? How bad these prompts are? Or that I doubt anyone will be surprised?

Every cybersecurity firm pitching vendor press releases to me: ...

2025-06-21T15:25:00Z

Every cybersecurity firm pitching vendor press releases to me: "Attackers are getting more advanced and sophisticated"

The news:

but keep in mind, the only reason they’re even considering ...

2025-06-19T11:59:32Z

In reply to nevent1q…p9kx
_________________________

but keep in mind, the only reason they’re even considering adding GenAI is because buyers are brainwashed into believing they shouldn’t buy anything without AI

good question, I think we’d need an example to understand what ...

2025-06-19T11:58:02Z

In reply to nevent1q…cyjj
_________________________

good question, I think we’d need an example to understand what they mean here

A refreshingly sober take on AI + SOC (and AI hype in general) ...

2025-06-19T04:40:21Z

A refreshingly sober take on AI + SOC (and AI hype in general)

https://staging.wirespeed.co/posts/2025-type-one-decisions

it looks like she is saying that it only posts things publicly if ...

2025-06-13T16:10:03Z

In reply to nevent1q…ue4l
_________________________

it looks like she is saying that it only posts things publicly if you ask it to

so more of a situation where people don’t understand what the share button does

activist implies biased reporting, so I can see why they’d call ...

2025-06-06T23:15:02Z

In reply to nevent1q…z9wp
_________________________

activist implies biased reporting, so I can see why they’d call you that

trying to discredit a journalist is almost always a Streisand move though, it’s positive feedback that your reporting strikes a nerve

short of winning a prize for your coverage, I can’t imagine a better form of feedback

to be fair, IIRC, Coop Sweden went down because their payment ...

2025-05-16T19:08:17Z

In reply to nevent1q…5fjw
_________________________

to be fair, IIRC, Coop Sweden went down because their payment provider used Kaseya.

So, it was ransomware on a fourth party, nothing Coop Sweden had any direct control over

if you’re on a box, can’t you just do the equivalent of ...

2025-04-25T21:07:44Z

In reply to nevent1q…4t9c
_________________________

if you’re on a box, can’t you just do the equivalent of Recall with malware? It definitely makes the job of an attacker easier and more streamlined, but not sure it adds up to a massive increase in risk.

Also, anyone that figures out how to eliminate that one hour every day the planet spends trying to find stuff on their computer could maybe add 10% to global GDP. How much risk is that worth?

(not that Recall is that solution, but it could be, right?)

people already screenshot stuff constantly, Recall is just ...

2025-04-25T20:52:24Z

In reply to nevent1q…6rgh
_________________________

people already screenshot stuff constantly, Recall is just drawing extra attention to an existing issue

please don’t tell me they were converting cash into crypto to ...

2025-04-04T21:05:40Z

In reply to nevent1q…l45l
_________________________

please don’t tell me they were converting cash into crypto to pay a ransom

That’s like, incident turducken

tl;dr - not a threat, you’ll update it anyway, probably don’t ...

2025-03-29T05:01:51Z

In reply to nevent1q…g8mg
_________________________

tl;dr - not a threat, you’ll update it anyway, probably don’t need special tools since we’ve been updating crypto forever

doing a webinar in a few weeks, working on the slides ...

2025-03-29T04:57:39Z

In reply to nevent1q…tf7e
_________________________

doing a webinar in a few weeks, working on the slides

that name rings a bell - I think he built and sold a ...

2025-03-09T16:16:31Z

In reply to nevent1q…ffc4
_________________________

that name rings a bell - I think he built and sold a cybersecurity startup. Air-something. It was a “secure cloud web browser”, competing with companies like Authentic8

I feel like the Switch is the best way to play classic Nintendo ...

2024-12-16T01:07:44Z

In reply to nevent1q…j76m
_________________________

I feel like the Switch is the best way to play classic Nintendo games, they've done a great job with emulation there, you get access to the whole library across half a dozen consoles with one subscription.

I'm pretty happy with my Analogue consoles for high-quality HDMI output, but that 1) requires you have the physical cartridges and 2) duplicate each classic console with an expensive, standalone, new piece of hardware.

It just occurred to me that maybe you're talking about current games that are available on PC + Xbox + Playstation and I 100% agree with your conclusion. PS Pro will not get my money.

LOL, I just downloaded that. Haven't dug in yet though, ...

2024-12-16T01:03:50Z

In reply to nevent1q…5mzg
_________________________

LOL, I just downloaded that. Haven't dug in yet though, because deliverables

laser measuring tape

2024-12-15T22:43:49Z

In reply to nevent1q…pama
_________________________

laser measuring tape

and 2 slides into "how to fix it", I've quoted you ...

2024-09-29T16:54:25Z

In reply to nevent1q…3ltc
_________________________

and 2 slides into "how to fix it", I've quoted you

Again, really hoping they record your talk, so I have some new quotes from when I update these slides 😅

okay, let's see... Why is it so hard?<li>so many old ...

2024-09-29T16:52:43Z

In reply to nevent1q…0fhc
_________________________

okay, let's see...

Why is it so hard?<li>so many old problems don't have good solutions (e.g. BYOD), but we keep getting new shit thrown at us (IoT, privacy frameworks, GenAI, SaaS, supply chain attacks)</li><li>we've gone from protecting a corporate network to protection a corporate network PLUS remote workers PLUS contractors PLUS four different clouds, etc</li><li>no good guide to maturity (lots of attempts tho)</li><li>device types are so heterogeneous (noone is 100% windows or mac, android or iOS these days, tons of IoT everywhere</li><li>Noisy security products (fill-in -blank fatigue from all the things)</li><li>inherited problems (tech debt, abandoned infra, previous security leaders' dumb pet projects/strategies, hiring issues)</li>

Summing the "problem statement" section of this old presentation up, I was focused on how it seems like there's too much of everything. Security has to cover such a broad landscape of stuff, it's almost an impossible job.

AI Safety and Post Quantum migrations are the latest things I've seen added to the CISO's to-do list, and there are just no extra cycles for this stuff (unless you drop other stuff)

love talks like this! I hope it is being recorded? I did one in ...

2024-09-29T05:18:59Z

In reply to nevent1q…928w
_________________________

love talks like this! I hope it is being recorded?

I did one in Bogota titled, “Still Crazy After All These Years”. That talk is now half a decade old, I wonder how much of it is still true today…