iiinova — where your digital self keeps evolving

Reposted by metlstorm

Kawaiicon @kawaiicon.bsky.social · 04/05/2026

Kawaiicon is back for 2026 and while we get a lot done with volunteer help, Wellington City Council don't accept venue payment in high fives 🙏. The 2026 Kawaiicon Call for Sponsors is open! If you want a copy of our sponsor pack, throw us an email at kiwicon@kiwicon.org.

01618 18

Reposted by metlstorm

Joe Tidy BBC News @joetidy.bsky.social · 22/01/2026

With my book launching in the US + Canada I joined @patrick.risky.biz & @metlstorm.risky.biz on the RiskyBiz pod. I've listened to these guys for 8yrs so it was an honour to chat through cyber news and explain why I decided to write a book about teenage hackers and the Vastaamo case. risky.biz

1112 11

metlstorm @metlstorm.risky.biz · 23/11/2025

dont give the slash-fic writers ideas, mang 🤦

010 1

metlstorm @metlstorm.risky.biz · 11/11/2025

It’s true for those that _do_ office with him too 🫣

040 4

metlstorm @metlstorm.risky.biz · 08/11/2025

Curating the list after I solicited for additions; * 802.11 WEP * NSA md5 hash colliding windows updates * admiral yamamoto in ww2 as well * everyone who copies and pastes CBC mode (or ecb, lol) code off stack overflow

031 3

metlstorm @metlstorm.risky.biz · 03/11/2025

I am mad about @jags.bsky.social 's cat on the pod. Why does't Riskybiz have a pod-kitty?! 😾

381 8

metlstorm @metlstorm.risky.biz · 16/10/2025

🤦 of course it is. I feel sorry for the masto devs, having poured your energy into working on open source and then seeing it get used to build... _that_.

130 3

metlstorm @metlstorm.risky.biz · 01/10/2025

I try not to be too resistant to change for no reason old-man-yells-at-cloud.gif*, but it really just gives big Windows Media Player for XP energy, and its gonna age about as well as that i fear. *i mean, I use systemd! instead of just sulking about init.d and pining for rc.local

040 4

metlstorm @metlstorm.risky.biz · 01/10/2025

when we met him IRL at our first RB company get-together i think we were all expecting 3 infosec racoons in a trenchcoat, but he is in fact but one man after all! I posted this quality meme back in 2021 when he was still at The Record; he was like 80% of our input for RB main show

130 3

metlstorm @metlstorm.risky.biz · 12/09/2025

Lol its been a whlie since I last hit the "please write your card name, number, expiry and cvv in this pdf and email it back" ecommerce checkout flow. Such PCI! Very DSS. 🤦 Paging a QSA and an acquiring bank, cleanup aisle my card data

0110 11

Reposted by metlstorm

Patrick Gray @patrick.risky.biz · 20/08/2025

MAGA be like...

2385 38

Reposted by metlstorm

Patrick Gray @patrick.risky.biz · 04/07/2025

Well, yeah. We're going to let our "kernel bug" description of Crowdstrike's mass murder of Windows systems stand

0151 15

Reposted by metlstorm

Patrick Gray @patrick.risky.biz · 04/07/2025

Maybe we should stagger newsletter releases in ringed deployments so we can catch these egregious errors... you know, like they should have done with their shitty content update that wiped out 8.5m boxes!

3491 49

Reposted by metlstorm

Patrick Gray @patrick.risky.biz · 04/07/2025

A Crowdstrike PR exec has written to us (twice) to demand we change some phrasing in one of our newsletters. We said a bug in their kernel driver caused their meltdown when it was actually a bad update file that caused a kernel panic. Huge mistake!

5251 25

metlstorm @metlstorm.risky.biz · 21/06/2025

well you sure won the day with yama ptrace ha ha, took my toys away :D good times good times

010 1

Reposted by metlstorm

Kawaiicon @kawaiicon.bsky.social · 19/06/2025

It is that time! Call for Participation (CFP) time! Got a talk in mind? Done some cool research? Want to do something for hallway con? Want to be able to summon sparkle pots on cue? Submit to our CFP! Closes eventually, so just get your submission in now! kawaiicon.org/cfp/

media.tenor.com

a cartoon panda bear is holding a notebook and a pencil .

Alt: a cartoon panda bear is holding a notebook and a pencil .

0138 13

metlstorm @metlstorm.risky.biz · 13/06/2025

yeah its a fun cat'n'mouse game, for sure. I take at least partial responsibility for the existence of yama/ptrace_scope, after @damienmiller.bsky.social and @keescook.bsky.social got sick of my bullshit 🤣😘

130 3

metlstorm @metlstorm.risky.biz · 13/06/2025

Cool! I love me some unix-tricks root-kittery! I did a con talk once about non-root root-kits. Used SCTP/DCCP as you do for sockets, process hollowing/thread-injection for code, and inotify-racing to hide files (by detecting incoming traversal, opening an fd, unlinking, and linking it back after)

130 3

metlstorm @metlstorm.risky.biz · 13/06/2025

Its true, they could be so much more efficient at getting things owned if they'd just `curl | sh`

110 1

metlstorm @metlstorm.risky.biz · 12/06/2025

Omg, how is the webdav CVE-2025-33053 so dumb?! You make a .url shortcut file to run a local binary, with working-dir set to a webdav path, and if the binary happens to fork out to another bin without an absolute path, cwd is first in the search path... oh no? Is it.. is the bug really that stupid?!

2210 21

Reposted by metlstorm

Patrick Gray @patrick.risky.biz · 22/04/2025

The most recent episode of Wide World of Cyber w @thekrebscycle.bsky.social and @stamos.org is back in our podcast feed... it was offline for a week(ish) due to the recent unpleasantness So yeah, it's back. If you missed it, here it is VIDEO: www.youtube.com/watch?v=JPYt... AUDIO: risky.biz/WWC8/

youtube.com

Wide World of Cyber: How the Trump admin is changing the cybersecurity landscape

YouTube video by Risky Business Media

1284 28

Reposted by metlstorm

Patrick Gray @patrick.risky.biz · 11/04/2025

I have cancelled our planned trip to the RSA Conference in San Francisco later this month. @metlstorm.risky.biz and I were headed over to record some live shows and see everyone. Unfortunately I have received advice that crossing the border into the United States right now would be a bad idea.

1615329 153

Reposted by metlstorm

Patrick Gray @patrick.risky.biz · 11/04/2025

I've pulled down the most recent episode of Wide World of Cyber with Chris Krebs and Alex Stamos at the request of their employer SentinelOne, the sponsor of the series. I will say more about this in next week's Risky Business, but I want to make one thing clear: SentinelOne is not the bad guy here

7716 71

metlstorm @metlstorm.risky.biz · 26/03/2025

If you've ever run into your ios exploit dev mate at the pub after work and they seem a lil crazy-eyed, you can kinda see why: googleprojectzero.blogspot.com/2025/03/blas...

googleprojectzero.blogspot.com

Blasting Past Webp

An analysis of the NSO BLASTPASS iMessage exploit Posted by Ian Beer, Google Project Zero On September 7, 2023 Apple issued an out-...

191 9

metlstorm @metlstorm.risky.biz · 26/03/2025

This is real handy to have in the pocket when some family/acquaintance asks about a service or platform you yourself don't use. "Just click about and see if anyone has logged in as you" makes sense to us nerds, but for normies, this is helpful as! Thanks Lorenzo!

0163 16

metlstorm @metlstorm.risky.biz · 24/03/2025

Yeah, at least it wasn't TELEGRAM: Totally Encrypted Lol Everything Gets Recorded At Moscow (we're here all week, try the fish)

0170 17

Reposted by metlstorm

Patrick Gray @patrick.risky.biz · 21/03/2025

We’re stoked to say Amberleigh Jack has joined Risky Biz full time as a producer and editor. Amberleigh has mountains of experience as a journalist and editor and she’s already such an important part of the team. She also has a deep connection to security via her (sadly departed) brother Barnaby

3533 53

metlstorm @metlstorm.risky.biz · 19/03/2025

You can't have a Huawei mobile network if you dont trust China, and you cant have an F-35 if you dont trust America. At least if you buy some New Zealand lamb at the supermarket, we cant reach out and give you botulism after the fact... OR CAN WE 🤨

0150 15

metlstorm @metlstorm.risky.biz · 12/03/2025

as you can see, this week we googled "how to make yt thumbnail face" too

0110 11

metlstorm @metlstorm.risky.biz · 12/03/2025

you're thinking of LanMan (LM) hashes, the predecessor to NTLM, which was comprised two 7 char halves hashed separately (and upper-case only, lol). You could brute the entire keyspace of those in longer than it took for ld.so to load and link /usr/bin/john

280 8

metlstorm @metlstorm.risky.biz · 20/02/2025

Kinda makes me wanna go scrounge up something that runs IOS-XE and then email Cisco TAC and see how it goes. $20 says they have no idea wtf I or that patch announcement are on about. And then I'd just have a shitty linux box with too many network interfaces... yay?

030 3

metlstorm @metlstorm.risky.biz · 19/02/2025

Why you gotta be like this Cisco? Quote the url to get your "entitlement to a free upgrade" for a CVSS 10/10 bug in your product? Really? Thats where we're at with product security in 2025AD? SMDH. 🖕🌉🖕

3325 32

metlstorm @metlstorm.risky.biz · 17/02/2025

some days, working for an Aussie media outlet has its perks.

0150 15

metlstorm @metlstorm.risky.biz · 28/01/2025

So young and fresh faced. Back then RSA got hacked by China ("It's episode 187, the homicide edition, and RSA conveniently falls victim to a drive by.") we had NSA's Brian Snow on the show, HBGary got popped, Lulzsec was cranking... We _have_ been doing this for a long-ass time my fren.

170 7

metlstorm @metlstorm.risky.biz · 20/01/2025

pfffft hex editor? LUXURY! I make the bits by licking two paperclips shoved into the PCI connector (yes my tongue bus masters, thanks for asking). Uphill both ways.

1110 11

metlstorm @metlstorm.risky.biz · 19/12/2024

all my years of speed 'shopping meme images for Insomnia work chat has finally paid off. I did not think there was another job out there that needed my special el8 combination of hacking, sysadmin, talking-bollocks, and danque-memelord skillz

0140 14

metlstorm @metlstorm.risky.biz · 18/12/2024

There was a thing where http-not-s feeds were cached, so feed-consumers that wern't proper-browsers were getting old content. I have done the sysadinly needful 😞

media.tenor.com

a cartoon cat is holding a wrench in its mouth .

ALT: a cartoon cat is holding a wrench in its mouth .

140 4

metlstorm @metlstorm.risky.biz · 16/12/2024

Yeah, build processes are cobbled together early in a project, and do lotsa risky stuff interacting with the filesystem and shell. Then no one thinks about untrusted input. I popped a public cloud with my insomniasec.com/downloads/pu... bug, which was malicious tarball consumed by build process...

insomniasec.com

031 3

metlstorm @metlstorm.risky.biz · 13/12/2024

Still mad at Microsoft for killing Nokia, and for what?!

110 1

metlstorm @metlstorm.risky.biz · 13/12/2024

I had a 12 mini whose battery chemistry was basically sadness and pocket lint too. The 16 is a giant top-heavy stone slab by comparison. But watcanyadoo? The apple deal is you eat the nutritional kale-greens that it puts on your plate, or you go to bed hungry and sulk[1] [1] "use Google Play"

110 1

metlstorm @metlstorm.risky.biz · 12/12/2024

I had a mini 'til like a week ago too. They're the right size for a phone, imo. If i wanted to put a whole-ass ipad in my pocket, i would :<

240 4

metlstorm @metlstorm.risky.biz · 22/11/2024

man i show up on bsky and of course its just @jpdanner.com on his bullshit again...

171 7