Profile picture
Robᵇᵉᵗᵒ Graham
@ErrataRob
, 3 tweets, 1 min read Read on Twitter
So I've posted both Windows and macOS binaries (self-contained, statically linked) for scanning for CVE-2019-0708 bluekeep. Just click on the badge at the top of the readme.
github.com/robertdavidgra…
'rdpscan' runs at the speed of a few hundred targets per second. If you need faster speeds (for larger networks), run 'masscan' first to scan the network for port 3389, then send the results to 'rdpscan'.
You Linux types only get source and no binaries because that's the bed you've made for yourselves.
:-)
Missing some Tweet in this thread?
You can try to force a refresh.

Like this thread? Get email updates or save it to PDF!

Subscribe to Robᵇᵉᵗᵒ Graham
Profile picture

Get real-time email alerts when new unrolls are available from this author!

This content may be removed anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

More from @ErrataRob see all

Profile picture
Robᵇᵉᵗᵒ Graham
@ErrataRob
No.
For one thing, while sometimes phishing emails are obvious, other times they aren't. Good phishing emails are indistinguishable from real emails.
If you are going to fire anybody over phishing, fire HR employees who send out legitimate emails that are indistinguishable from phishing.

"We are partnering with Super401k.com, just login there with your company username password to see your account info".
Seriously, though, employee inboxes are flooded with obvious phishing attempts that they are already successfully fending off. Falling for phishing means they can only be 99% successful instead of 100%.
Read 3 tweets
Profile picture
Robᵇᵉᵗᵒ Graham
@ErrataRob
Yup. My "SPECTRE" analogy for the Sony attack holds up well. Compare it to how the "Internet Research Agency" was involved in influencing US elections. It was not an agency of the government, but of an oligarch with ties to the government.
In the U.S., all government hacking is top down through official channels. In Russia, Iran, North Korea, government is involved in sponsoring largely independent hacking groups.
There are many "asymmetric and unrestricted warfare" manuals that describe the process. It's just hard for us to understand since we describe threats only through our symmetric model, that if North Korea was involved in the Sony hack, it must've been top-down the way we'd do it.
Read 3 tweets
Profile picture
Robᵇᵉᵗᵒ Graham
@ErrataRob
1/ This "Lessons from Crippling Ransomware Attack" gives no lessons. It's like:

me: My friend just died in the hospital.
them: He should've dieted and exercised more.
me: He was hit by a bus.
2/ The lesson to learn from "crippling ransomware" is "fix your Windows permissions". That's it. That's ONLY it. There is no other lesson.
3/ Ransomware attacks are common, usually as part of a phishing attack. It's a regular task of IT departments everywhere to wipe an infected user's machine and reinstall Windows. That's non-crippling ransomware.
Read 10 tweets

Related threads

Profile picture
PlaneOnSwift
@SwiftOnSecurity
WARNING: Per our threat team, there is backdoored “Proof-of-Concept” exploit code floating around for #BlueKeep CVE-2019-0708.

Make sure your red teams are NOT running arbitrary code and trying to be a hero. Attackers know orgs are panicking trying to assess their network.
Trusted #BlueKeep scanner by
by @JaGoTu & @zerosum0x0

github.com/zerosum0x0/CVE…
UPDATE: Fully vetted #BlueKeep vulnerability scanner is now in @metasploit.
Great work @JaGoTu & @zerosum0x0.

As always, probing production networks must be done with caution. Do not go around scanning factory control equipment with brand-new modules.

Read 4 tweets
Profile picture
Kevin Beaumont
@GossiTheDog
CVE-2019-0708 RDP vulnerability megathread, aka BlueKeep.

Going to nickname it BlueKeep as it’s about as secure as the Red Keep in Game of Thrones, and often leads to a blue screen of death when exploited.
If you want a quick and dirty mitigation for Windows 2008 and 7, turn on NLA. en.wikipedia.org/wiki/Network_L…
There are no public PoCs yet, and no sign of exploitation in wild.

Joke PoCs are already appearing on Github. Don’t run random PoCs you find online; they will often be malicious.
Read 46 tweets
Profile picture
Matthew Willemsen
@mwill_crypto
0/ Hot start to the week in the #crypto/#blockchain ecosystem! Successful fundraising rounds. New records set. Several products launched. Below is a 34-part thread on events that took place between Monday and Tuesday.

Enjoy!
1/ 🆕 @Guesserio launches today! Built on @AugurProject [ $REP ], the California-based #crypto project promises their release “will fundamentally change the way you participate in Augur prediction markets.”

Invest in the outcome of real-world events at your fingertips!
2/ 🔧 #Ethereum- and #IPFS-powered #blockchain platform for decentralized marketplaces, @OriginProtocol, unveiled its 'Marketplace Creator' tool.

This allows users to construct a decentralized marketplace in just a matter of minutes! medium.com/originprotocol…
Read 38 tweets
Profile picture
Matthew Willemsen
@mwill_crypto
0/ The level of daily activity that takes place in the #crypto and #blockchain space never ceases to amaze me.

Below, a 22-part thread full of project announcements and other ecosystem events from the past ~24 hours. Enjoy!
1/ 🚀 @DharmaProtocol- and @CompoundFinance-powered @Bloqboard introduced its 'Offers to Lend' feature!

Now, lenders can offer to lend $BAT, $DAI, $REP, $WETH and $ZRX in a P2P-manner from their @MetaMask_io wallet. Can be done in under a minute!
2/ 🙋‍♂️ Hong Kong-headquartered @CryptoCom appointed Tyson Hackwood (@tysonius) to its leadership team as senior vice president and head of global merchant acquisition.

Previously, Tyson led @PaypalHereAU and @Braintree's Asia-Pacific region. Big hire! prnewswire.com/news-releases/…
Read 25 tweets
Profile picture
Jordan Morgan
@JordanMorgan10
A fun bit of #macOS development history I stumbled upon today, Apple Tech Note 2034.

Essentially it included a bunch of guidelines and tips on macOS development but contained such inflammatory assertions that Apple straight up *pulled* it down (2033/5 are still there)!
Among some of the the things that didn't sit very well with devs in the note:

- Positing Objective-C as being a more portable cross-platform language than C++
- Promoting hard-coded pathname APIs for accessing files over traditional Mac APIs
Reading over it, quite a bit of the punch is lost on me since I started in this industry in a professional sense in 2012. But the same conversations happen today - Objective-C vs Swift being a similar parallel in that it garners hot opinions, fast.
Read 5 tweets
Profile picture
🔥 Josh Branchaud 🕺🏼
@jbrancha
Day 12: Using ANSI escape sequences to make things printed to the terminal a bit more colorful. Learned that @ReasonML wants escape sequences in decimal (i.e. \027). #100DaysOfCode #ReasonML buff.ly/2ubnrf0
Still need to mess around with background colors and modifiers (e.g. bold, italics, underline).
Day 13: An iteration on yesterday's -- I'm using @ReasonML's variant type to create `foreground_color` which I switch on to get the color codes; hopefully improving readability. #100DaysOfCode #ReasonML github.com/jbranchaud/ter…
Read 70 tweets

Trending hashtags

#UFC232 #academia #Winning #ExecutiveOffice #trumphotel #crypto #AcademicTwitter #mobile #QDrops #Zcash #RDF #badumching #PatriotPrayer #Github #GDPR #FBI #zkERC20 #testnet #AraCon2019 #erc1056 #cryptocurrency #TheAwakening #sdk #NewYork #ASGA18
Follow Us on Twitter!

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3.00/month or $30.00/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!