iiinova — where your digital self keeps evolving

Tim Medin @timmedin.bsky.social · 06/01/2026

I decided to chat with a spammer/scammer. I found them to be pretty honest and forthcoming.

140

Tim Medin @timmedin.bsky.social · 06/01/2026

Apple's Liquid Glass was cool for like 1 minute.

110

Tim Medin @timmedin.bsky.social · 11/12/2025

My "Death by Dashboards" talk from WWHF is up!

022

Tim Medin @timmedin.bsky.social · 11/12/2025

Months of battling, and I won. Inbox zero. ... for now.

130

Tim Medin @timmedin.bsky.social · 10/12/2025

Microsoft created Get-KerbEncryptionUsage.ps1 (see link in article) to query the event log to see which encryption types Kerberos used within your environment. Run this, find the ones that MUST use RC4, and burn the rest. Then figure out how to upgrade the others from RC4 or pick a great password.

020

Reposted by Tim Medin

WinterKnight @winterknight.net · 29/11/2025

The ones here are obnoxious. But there’s a charm about Wisconsin alcoholics that Minnesota alcoholics just don’t have.

041

Tim Medin @timmedin.bsky.social · 10/12/2025

I can't spell that stupid word correctly... ever

020

Tim Medin @timmedin.bsky.social · 10/12/2025

"By mid-2026, ... Windows Server 2008 and later to only allow AES-SHA1 encryption. RC4 will be disabled by default and only used if a domain administrator explicitly configures an account or the KDC to use it." www.microsoft.com/en-us/window...

microsoft.com

Beyond RC4 for Windows authentication

As organizations face an evolving threat landscape, strengthening Windows authentication is more critical than ever.

000

Tim Medin @timmedin.bsky.social · 29/11/2025

I love WI airports. Concourse beers are not only legal, but it’s encouraged with signs all over the airport.

290

Tim Medin @timmedin.bsky.social · 18/11/2025

“Killer” lol So bad. ;)

140

Tim Medin @timmedin.bsky.social · 14/11/2025

I'm home after teaching Offense for Defense at NineStart Connect. They offered free (yes, free) training to whomever wanted to attend. I can't thank them enough for offering this to our community! The class is available here: training.redsiege.com (affordable, not free... sorry you missed out 😉)

040

Tim Medin @timmedin.bsky.social · 06/11/2025

Wrapping up @defcon.bsky.social Bahrain at the ICS Village. Not my best picture, but excellent photo bomb.

070

Tim Medin @timmedin.bsky.social · 25/10/2025

Damn. I’m never going to find this room.

728041

Tim Medin @timmedin.bsky.social · 10/10/2025

Two days of teaching Pen Testing: Beyond the Basics ✅ Two hour Kerberos workshop ✅ Talk ✅ Tomorrow, time to be a full time booth babe.

080

Tim Medin @timmedin.bsky.social · 09/10/2025

Last year at @wildwesthackinfest.bsky.social a few packages arrived late (not mine). The maintenance staff regularly receives packages and thought it was theirs. They opened it, found a pack of stickers. They have been putting them on their stuff and the hotel. "We wondered who that guy was"

141

Reposted by Tim Medin

Red Siege @redsiege.com · 09/10/2025

Senior Security Consultant Justin Palk tells you everything you need to know about getting started with proxy chains in this blog 🔗 redsiege.com/proxychains #hacking #infosec #cybersecurity

011

Tim Medin @timmedin.bsky.social · 09/10/2025

The booth is hopping! Stop by to get tons of stickers, a shirt, and get entered to win a framed autographed picture from Hackers.

010

Tim Medin @timmedin.bsky.social · 30/09/2025

I think about this often. What is a real world bad guy's level of effort for cracking? How long do they spend? How big is their cracker? Do they have multiple crackers? How do they distribute the load?

161

Tim Medin @timmedin.bsky.social · 26/09/2025

Join me next week on the Thursday Defensive (thursdef.com) next Thursday at 1:30 ET on Offensive for Defense - How defenders can use offensive tools to test themselves.

thursdef.com

Thursday Defensive Webcast - Recon InfoSec

Unscripted, commercial-free discussions between seasoned cybersecurity professionals, streamed live.

130

Tim Medin @timmedin.bsky.social · 24/09/2025

Couldn't agree more. How many high/crit PHP findings in your vuln scan reports that are meaningless because that function isn't used (or used with user input). Teams work hard remediate issues that have 0 impact, largely because it shows up in a dashboard, metrics, or KPIs... not because it matters.

060

Tim Medin @timmedin.bsky.social · 18/09/2025

Really cool to be interviewed and quoted in this article.

140

Tim Medin @timmedin.bsky.social · 16/09/2025

RC4 used with Kerberos isn't the fundemental flaw we think. Yes, RC4 is deprecated, but the real issue is the key generation for AES v RC4 for cracking (Kerberoasting). With RC4 the key = password hash. With AES it is 4096 rounds of hashing of hash+username+domain. The 4096 rounds matters, a lot!

172

Tim Medin @timmedin.bsky.social · 12/09/2025

I'm looking forward to @wildwesthackinfest.bsky.social. I also have a Kerberos workshop there, so check that out. Oh, and we'll have tons of swag at the @redsiege.com booth, so stop by if you're in-person!

042

Tim Medin @timmedin.bsky.social · 11/09/2025

In response to Senator Ron Wyden's letter to the FTC, I have put together my comments on Kerberoasting and RC4. redsiege.com/blog/2025/09...

redsiege.com

1103

Tim Medin @timmedin.bsky.social · 10/09/2025

A senator talking about Kerberoasting was not on my bingo card!

191

Tim Medin @timmedin.bsky.social · 10/09/2025

The issue isn't as much RC4 as it is bad passwords. While RC4 isn't good, other encryption does *not* prevent Kerberoasting. AES128 and AES256 just slow down the attack by ~100-170x. If the password is really bad, 170x is meaningless. @matthewdgreen.bsky.social arstechnica.com/security/202...

arstechnica.com

Senator blasts Microsoft for making default Windows vulnerable to “Kerberoasting”

Wyden says default use of RC4 cipher led to last year’s breach of health giant Ascension.

141

Tim Medin @timmedin.bsky.social · 16/08/2025

“Always go for more sparkles!” Words of wisdom from a 9 yo at Heathrow when I asked if I should get the more and less sparkling water. Such a valuable life lesson there. She also said, “trust the diva”. Another valuable lesson.

0140

Tim Medin @timmedin.bsky.social · 15/08/2025

I love KC. BBQ capital of world! Had some fantastic Gates BBQ!

130

Tim Medin @timmedin.bsky.social · 14/08/2025

After some fantastic KC BBQ at Gates last night, Molly and I are at INTERFACE KC 2025. Great group and I'm thankful for the opportunity to present! If you're here, come stop by the @redsiege.com booth!

021

Tim Medin @timmedin.bsky.social · 03/08/2025

Day 1 of Red Team Tactics in the bag! And we got the best named room at @blackhatevents.bsky.social!

171

Tim Medin @timmedin.bsky.social · 29/07/2025

I watched Happy Gilmore 2 with my boys last night. It was fantastic and so much fun. Loved all the fan service and cameos. It was actually funny too. Loved it!

020

Tim Medin @timmedin.bsky.social · 24/07/2025

Got to the gate three minutes before boarding. What do I do with all this extra time?

000

Tim Medin @timmedin.bsky.social · 22/07/2025

Back in studio recording another class!

040

Tim Medin @timmedin.bsky.social · 15/07/2025

.@blackhatevents.bsky.social just expanded the number of seats in our class, so there is (new) room available! Come join us!

001

Tim Medin @timmedin.bsky.social · 14/07/2025

The most listened to song of all time is not from the Beatles. It's this banger. That said, no one wanted to listen to it. www.youtube.com/watch?v=IAjY...

youtube.com

Tim Carleton & Darrick Deel — Opus No. 1 (Opus Number One) 1080p (Cisco Default Hold Music)

YouTube video by jack7cat

001

Tim Medin @timmedin.bsky.social · 08/07/2025

Wow, it's been a year since we went our own way on training. I couldn't be happier where things have ended up. We now have 4 classes! One is running at Black Hat. Two are running at WWHF. One more will be ready for on-demand very soon. The price point for the direct classes is more affordable too!

0104

Tim Medin @timmedin.bsky.social · 02/07/2025

I’ve been reading Fox in Sox to my kids for 16 years and I *finally* had a perfect reading with no mistakes or stumbles! Sorry, but the world now ends tomorrow.

050

Tim Medin @timmedin.bsky.social · 01/07/2025