https://blog.doesthispersonexist.com/Notes on threat intelligence, making things, and the occasional long run.en-ushttps://blog.doesthispersonexist.com/posts/the-mistaken-powdesk-malware/https://blog.doesthispersonexist.com/posts/the-mistaken-powdesk-malware/Fri, 22 Dec 2023 12:00:00 GMTHow legitimate software was mistaken for malware, and how that attribution spread through threat intelligence.securityhttps://blog.doesthispersonexist.com/posts/golang-detection-notes/https://blog.doesthispersonexist.com/posts/golang-detection-notes/Sun, 01 Oct 2023 12:00:00 GMTExperiments with Go binaries, string storage, and YARA signatures across platforms and CPU architectures.securityhttps://blog.doesthispersonexist.com/posts/how-to-do-good-work-in-cyber-threat-intelligence/https://blog.doesthispersonexist.com/posts/how-to-do-good-work-in-cyber-threat-intelligence/Tue, 16 May 2023 12:00:00 GMTFour ideas for producing defensible, useful intelligence and helping an entire team do better work.securityhttps://blog.doesthispersonexist.com/posts/omnipotent-adversary-fallacy-should-you-give-up-your-asymmetric-advantages-in-cyber-threat-intel/https://blog.doesthispersonexist.com/posts/omnipotent-adversary-fallacy-should-you-give-up-your-asymmetric-advantages-in-cyber-threat-intel/Thu, 11 May 2023 12:00:00 GMTWhat defenders give up when they assume an adversary can see and do everything.securityhttps://blog.doesthispersonexist.com/posts/common-cyber-threat-intel-biases/https://blog.doesthispersonexist.com/posts/common-cyber-threat-intel-biases/Mon, 08 May 2023 12:00:00 GMTRecognizing the habits and assumptions that can quietly distort an intelligence assessment.securityhttps://blog.doesthispersonexist.com/posts/the-life-lessons-of-faceplanting/https://blog.doesthispersonexist.com/posts/the-life-lessons-of-faceplanting/Fri, 28 Apr 2023 12:00:00 GMTA lesson from the trail, learned the hard way.runninghttps://blog.doesthispersonexist.com/posts/yara-hunting-in-ancient-civilizations/https://blog.doesthispersonexist.com/posts/yara-hunting-in-ancient-civilizations/Wed, 26 Apr 2023 12:00:00 GMTEarly YARA detection work, sharing analyst knowledge, and why a readable rule language mattered more than technical superiority.securityhttps://blog.doesthispersonexist.com/posts/do-fake-accounts-on-twitter-affect-stock-prices/https://blog.doesthispersonexist.com/posts/do-fake-accounts-on-twitter-affect-stock-prices/Sat, 12 Nov 2022 12:00:00 GMTAn experiment in fake accounts, market signals, and the difficulty of drawing a useful conclusion.analysishttps://blog.doesthispersonexist.com/posts/pragmatic-detection-of-gan-profiles/https://blog.doesthispersonexist.com/posts/pragmatic-detection-of-gan-profiles/Sun, 20 Feb 2022 12:00:00 GMTPractical techniques for identifying synthetic profile photos, with examples and limitations.securityhttps://blog.doesthispersonexist.com/posts/linkedin-gan-network-analysis/https://blog.doesthispersonexist.com/posts/linkedin-gan-network-analysis/Thu, 10 Feb 2022 12:00:00 GMTFollowing connections through a network of likely inauthentic LinkedIn profiles.securityhttps://blog.doesthispersonexist.com/posts/how-accurate-are-ihme-models-in-sweden/https://blog.doesthispersonexist.com/posts/how-accurate-are-ihme-models-in-sweden/Sun, 07 Jun 2020 12:00:00 GMTExamining Sweden’s COVID-19 data and the accuracy of early IHME projections.analysishttps://blog.doesthispersonexist.com/posts/stonecat-race-report-first-50-miler/https://blog.doesthispersonexist.com/posts/stonecat-race-report-first-50-miler/Sun, 04 Nov 2018 12:00:00 GMTNotes from a first 50-mile race at Stonecat.runninghttps://blog.doesthispersonexist.com/posts/mullingsecurity-captchas-to-defeat-ssh-brute-force/https://blog.doesthispersonexist.com/posts/mullingsecurity-captchas-to-defeat-ssh-brute-force/Tue, 14 Mar 2006 21:06:00 GMTIn between the 6,000 ssh brute force attacks I receive everyday I try to come up with some clever countermeasure.archivehttps://blog.doesthispersonexist.com/posts/mullingsecurity-php-email-injection-step-by-step-part/https://blog.doesthispersonexist.com/posts/mullingsecurity-php-email-injection-step-by-step-part/Wed, 15 Feb 2006 14:06:00 GMTI recently got to have a little fun with a colleague (who will remain nameless) who was using a PHP script for a contact form.archivehttps://blog.doesthispersonexist.com/posts/mullingsecurity-cisco-botnets/https://blog.doesthispersonexist.com/posts/mullingsecurity-cisco-botnets/Fri, 10 Feb 2006 17:08:00 GMTI've never heard of a Cisco botnet but I suppose it's possible.archivehttps://blog.doesthispersonexist.com/posts/mullingsecurity-you-are-weakest-link/https://blog.doesthispersonexist.com/posts/mullingsecurity-you-are-weakest-link/Mon, 06 Feb 2006 17:13:00 GMTThird-party browser plugins, ActiveX controls, and the limits of patching only Windows and Internet Explorer.archivehttps://blog.doesthispersonexist.com/posts/mullingsecurity-update-on-ddabxdll/https://blog.doesthispersonexist.com/posts/mullingsecurity-update-on-ddabxdll/Thu, 26 Jan 2006 12:57:00 GMTI get a ton of hits to my blog from search engines for the string "ddabx.dll".archivehttps://blog.doesthispersonexist.com/posts/mullingsecurity-paper-anatomy-of-phish-iii/https://blog.doesthispersonexist.com/posts/mullingsecurity-paper-anatomy-of-phish-iii/Mon, 23 Jan 2006 19:56:00 GMTNotes on Michael Ligh’s Anatomy of a Phish III and the phishing tools and techniques examined in the report.archivehttps://blog.doesthispersonexist.com/posts/mullingsecurity-snort-sigs-for-latest-java-malware/https://blog.doesthispersonexist.com/posts/mullingsecurity-snort-sigs-for-latest-java-malware/Mon, 23 Jan 2006 19:05:00 GMTHere are some snort signatures to detect a couple of recent pieces of Java malware.archivehttps://blog.doesthispersonexist.com/posts/mullingsecurity-more-information-on-java-exploit/https://blog.doesthispersonexist.com/posts/mullingsecurity-more-information-on-java-exploit/Fri, 13 Jan 2006 18:19:00 GMTI've come across some additional information on the java exploit story.archivehttps://blog.doesthispersonexist.com/posts/mullingsecurity-old-java-bug-exploited-from-ukraine/https://blog.doesthispersonexist.com/posts/mullingsecurity-old-java-bug-exploited-from-ukraine/Fri, 13 Jan 2006 15:28:00 GMTIt's nothing new to see pages that use two or more browser vulnerabilities to infect innocent browsers.archivehttps://blog.doesthispersonexist.com/posts/mullingsecurity-moving-browsing-to-edge/https://blog.doesthispersonexist.com/posts/mullingsecurity-moving-browsing-to-edge/Fri, 06 Jan 2006 12:00:00 GMTThe latest 0-day exploit for Windows caused me to reflect a bit on how we do "browsing".archivehttps://blog.doesthispersonexist.com/posts/mullingsecurity-help-wanted-identify-these-security/https://blog.doesthispersonexist.com/posts/mullingsecurity-help-wanted-identify-these-security/Tue, 03 Jan 2006 12:00:00 GMTI've recently come across a couple of incidents with some odd data.archivehttps://blog.doesthispersonexist.com/posts/mullingsecurity-howto-getting-remote-access-to-windows/https://blog.doesthispersonexist.com/posts/mullingsecurity-howto-getting-remote-access-to-windows/Tue, 03 Jan 2006 12:00:00 GMTThere are several services available to get remote access to your Windows PC such as gotomypc.com, logmein.com and many others.archivehttps://blog.doesthispersonexist.com/posts/mullingsecurity-new-java-exploit-site-in-ukraine/https://blog.doesthispersonexist.com/posts/mullingsecurity-new-java-exploit-site-in-ukraine/Wed, 28 Dec 2005 12:00:00 GMTEvery day I come across new sites hosting exploits and it's always tough to tell if it's something new or just a rehash of an old exploit.archivehttps://blog.doesthispersonexist.com/posts/mullingsecurity-even-experts-get-hacked/https://blog.doesthispersonexist.com/posts/mullingsecurity-even-experts-get-hacked/Mon, 19 Dec 2005 12:00:00 GMTIn a somewhat disturbing incident the Washington Post reports that digital forensics company Guardian software was hacked in November.archivehttps://blog.doesthispersonexist.com/posts/mullingsecurity-opening-door-to-security/https://blog.doesthispersonexist.com/posts/mullingsecurity-opening-door-to-security/Thu, 15 Dec 2005 12:00:00 GMTThis story just goes to show that good security isn't always about the latest high-tech flashy security devices, sometimes a little more is needed.archivehttps://blog.doesthispersonexist.com/posts/mullingsecurity-vmware-presentation-on-security/https://blog.doesthispersonexist.com/posts/mullingsecurity-vmware-presentation-on-security/Tue, 13 Dec 2005 12:00:00 GMTVmware has a great presentation on security from VMWorld 2005.archivehttps://blog.doesthispersonexist.com/posts/mullingsecurity-php-email-injection/https://blog.doesthispersonexist.com/posts/mullingsecurity-php-email-injection/Mon, 12 Dec 2005 12:00:00 GMTSecurePHP is carrying an article on email injection in the php mail() function.archivehttps://blog.doesthispersonexist.com/posts/mullingsecurity-resources-for-vmm-based-security/https://blog.doesthispersonexist.com/posts/mullingsecurity-resources-for-vmm-based-security/Wed, 07 Dec 2005 12:00:00 GMTWhile I'm working on some new research on practical implications of VMM security I thought I'd share some of the resources I've been working with.archivehttps://blog.doesthispersonexist.com/posts/mullingsecurity-update-on-virtualizing-overflows/https://blog.doesthispersonexist.com/posts/mullingsecurity-update-on-virtualizing-overflows/Mon, 05 Dec 2005 12:00:00 GMTI had some great feedback and discussion with a number of individuals on the Virtualizing Buffer Overflows post.archivehttps://blog.doesthispersonexist.com/posts/mullingsecurity-job-benefits-identity-theft-assistance/https://blog.doesthispersonexist.com/posts/mullingsecurity-job-benefits-identity-theft-assistance/Fri, 02 Dec 2005 12:00:00 GMTIt's always nice when your employer has benefits that help you with the little things in life.archivehttps://blog.doesthispersonexist.com/posts/mullingsecurity-new-gmail-feature-false-security/https://blog.doesthispersonexist.com/posts/mullingsecurity-new-gmail-feature-false-security/Thu, 01 Dec 2005 12:00:00 GMTOn Wednesday Google added virus scanning to their gmail service.archivehttps://blog.doesthispersonexist.com/posts/mullingsecurity-security-using-virtualization/https://blog.doesthispersonexist.com/posts/mullingsecurity-security-using-virtualization/Thu, 01 Dec 2005 12:00:00 GMTIn the course of some light research for Virtualizing buffer overflows I came across some interesting research from a couple of researchers at Stanford on using virtual machine monitors…archivehttps://blog.doesthispersonexist.com/posts/mullingsecurity-virtualizing-buffer-overflows/https://blog.doesthispersonexist.com/posts/mullingsecurity-virtualizing-buffer-overflows/Wed, 30 Nov 2005 12:00:00 GMTExploring the security implications of a virtualization host’s ability to modify a guest’s memory and execution.archive