If you've got cybersecurity knowledge to share and are new to conference presenting, I'd heartily encourage you to consider applying to present at ComfyConAU. I've attended and have to say it's the most wonderful, diverse online conference I've attended with a warm, inclusive community. The presentations I've seen there range from highly technical and tools-based hacking and defence, through to broad concepts to auditing and compliance to community topics.

Give it a go and never mind the timezone - you can get up early or stay up late!

#security #conference2025 #infosec #cybersecurity #ICS #blueteam #purpleteam

@ComfyConAU

37]a`/@CsV%1#!;HdyIq

GustoDiscolor2Manned

This dumb password rule is from Bloomingdale's.

16 characters maximum, no `.` `,` `-` `|` `/` `=` or `_` allowed.

https://dumbpasswordrules.com/sites/bloomingdales/

Is there some world map of all the countries that do shit to your phone or demand access to it before you can get into their paranoid and unpleasant land?

I'm so old that I remember when fishing fraud was lying about the size of your fish!

In strange #fintech #infosec #privacy news, an Estonian bank, the LHV Bank, is claiming 247.5M€ from the government's money laundering regulator over the regulator having accessed banking secrecy protected data from the bank in a roundabout way — through the judicial enforcement register, a practice that the Justice Chancellor has recently opined to be unconstitutional. Other banks may follow.

It appears that there is a vulnerability in the legal framework, in that it takes a specific and narrowly tailored court order for the money laundering regulator to get detailed transaction and/or account data directly from a bank, but the judicial enforcement register, having been built on the assumption of functioning in the world of already enforceable court orders, has procedural direct access to banking data, but no procedural safeguards to actually check for a court order existing as a precondition for such access, and the money laundering regulator seems to have been using this loophole for large-scale surveillance for about five years.

LHV bank's general term of service specify 100k€ in contractual damages per unlawful query, and I surmise they have found 2475 of such roundabout queries in their audit logs.

Source: https://www.err.ee/1609754001/lhv-nouab-rahapesu-andmeburoolt-pangasaladuse-asjas-247-miljonit

kZ$tr?$(z\]-d^M4B`l'

MonitorVarious6Freeway

New blog post!

Ints Aren’t Integers and Floats Aren’t Real

Some musings on x86 flags, the CMP instruction, floating point quirks, and why 0.1 + 0.2 might actually break a bridge

Also: CTF fun, more TPM stuffssess, and a reminder that breaking stuff on purpose is still the best way to learn

Read here: https://dreaming-of-dragons.blogspot.com/2025/07/ints-arent-integers-and-floats-arent.html

SashAlert:
I JUST GOT GOOSEBUMPS. (Not that you can tell through my fabulous plumage.)

My friend @Tarah Wheeler is keynoting BSidesChicago 2025 with a talk titled:

“Me and What Army: Civilian Defenders vs Foreign Military Cyberattacks”

UM, EXCUSE ME?! ICONIC.

Because let’s be real—while some governments are still figuring out how DNS works, it’s us holding the line.
The night-shift SOC analyst.
The patch-before-panic blue teamer.
The flamingo with a firewall and a dream.

This talk is going to shake feathers.
And I will be front row, sipping Red Bull and polishing my talons.

Tickets:https://events.humanitix.com/bsideschicago-2025
Nov 1, 2025

The Flamingo Uprising has found its battle cry.

Wish I knew more when I was younger before deciding on the “career”. Kinda wanna know more about nursing , wish I could go back to school for it cause screw #infosec and all things IT related :)

Brigham Young University reports data breach

Brigham Young University (BYU) suffered a data breach between April 25-27, 2025, when unauthorized actors accessed servers and compromised names and Social Security numbers of university-affiliated individuals. The number of affected individuals is not disclosed.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/brigham-young-university-reports-data-breach-d-d-x-c-8/gD2P6Ple2L

Want to stay anonymous while doing OSINT?

This guide breaks down how to create effective sock puppets — fake identities used for secure investigations.

VM setup
Email & phone tips
Profile creation
Building credibility
https://hackers-arise.com/sock-puppets-creating-fake-accounts-for-osint-operations/
#osint #infosec #technology #cybersecurity

QztN.7Efg77<"/(>n_6O

JigsawUnethical4Slighted

Saw advert for @mullvadnet on the side of a SEPTA bus here in the Philly Suburbs. Intrigued enough to check them out. Pretty reasonable pricing too.

For those attending @defcon the special edition of Casey Erdmann's Red Team Engineering will be available at our booth! Many resources out there focus on either tooling or infrastructure, but rarely both in practical detail.

This book aims to bridge that gap, providing hands-on instruction for writing custom offensive tools and then engineering the infrastructure to use them effectively.

I share the same common view of online ID verification as most other #infosec people: it's a ludicrous situation that *increases* risk to everybody, handing data over to a mish-mash of organisations with very little transparency or rigour.

But I am enjoying the particular absurdity of seeing it in implementation. I hit a site that requires ID verification, I tell my Tailscale/Headscale config to route through one of my servers in Europe, and no more need to provide ID.

WPA3's Dragonfly protocol changed Wi-Fi security forever!

No more offline password cracking. Every attack attempt must happen live with the access point, making mass attacks noisy and detectable.

But there are nuances...
https://hackers-arise.com/wi-fi-hacking-inside-dragonfly-the-wpa3s-next-gen-wireless-authentication-protocol/
#wpa3 #wifi #infosec #cybersecurity #hacking #technology

This dumb password rule is from GoDaddy SFTP.

Max 14 characters for the most important password in your shared hosting environment.

https://dumbpasswordrules.com/sites/godaddy-sftp/