Will Dormann is on Mastodon @wdormann.bsky.social · 18/08/2026I will be presenting at THREATCON1 in October, explaining how I figured out how a non-admin user could get code execution as SYSTEM on Windows 11 by way of playing a MIDI file. 😂 threatcon1.org/agenda 020
Will Dormann is on Mastodon @wdormann.bsky.social · 13/04/2026The masses don't need those features. 😂 010
Will Dormann is on Mastodon @wdormann.bsky.social · 12/04/2026Yeah, I'm pretty sure that Adobe Reader only exists for when somebody has a PDF that they need to sign. 😂 100
Will Dormann is on Mastodon @wdormann.bsky.social · 11/04/2026"Adobe Reader is still a thing" is what surprises me more. 😂 100
Will Dormann is on Mastodon @wdormann.bsky.social · 11/04/2026I suspect that the function has been removed. 🤷♂️ 000
Will Dormann is on Mastodon @wdormann.bsky.social · 11/04/2026Yes, that's the vulnerability at play here. The JavaScript is able to self-bless itself as privileged. 110
Will Dormann is on Mastodon @wdormann.bsky.social · 10/04/2026I have wonders about official documentation for Adobe Reader JavaScript. For example, Collab.collectEmailInfo() is definitely a function, as it was part of CVE-2007-5659. However, if you look for documentation about this: Nada. www.google.com/search?q=Col...google.comGoogle Search 110
Will Dormann is on Mastodon @wdormann.bsky.social · 10/03/2026It is much more difficult to stock it when it's locked, yes. 000
Will Dormann is on Mastodon @wdormann.bsky.social · 17/12/2025Social media user swipes left on a picture in a post with multiple pictures in their web browser... Twitter, Mastodon: Swipes to next picture. BlueSky: Do nothing. I get that when Twitter doused itself in gasoline and lit a match, BlueSky had potential. But seriously. How is the web app SO BAD? 🤦♂️ 000
Will Dormann is on Mastodon @wdormann.bsky.social · 15/12/2025Social media user double taps image in their web browser... Twitter, Mastodon: Zoom in. BlueSky: Close image, re-open it. 🤦♂️ 200
Will Dormann is on Mastodon @wdormann.bsky.social · 12/10/2025There is nothing that distinguishes a CVE that is disputed because it's fake and one that is disputed because the vendor didn't want to acknowledge it. This is a problem. 000
Will Dormann is on Mastodon @wdormann.bsky.social · 05/06/2025Did one really need to look any further than hearing that it used "bitcoin style encryption"? 040
Will Dormann is on Mastodon @wdormann.bsky.social · 01/05/2025Eh, I just enabled passwordless for my 20-year-old hotmail account. And RDP still accepted my old password. (No Microsoft Authenticator required) 🤷♂️ 010
Will Dormann is on Mastodon @wdormann.bsky.social · 01/05/2025When you log in to windows using a Microsoft account (eg hotmail), you can use that account's credentials to RDP in. No RDS AAD or web view here. 110
Will Dormann is on Mastodon @wdormann.bsky.social · 01/05/2025I don't know what RDS AAD is. Simple repro: 1) Log in to Windows 11 with a Microsoft account (eg hotmail) 2) Enable RDP 3) Connect to Windows via RDP using hotmail account 4) Change hotmail password 5) Connect to Windows via RDP using old hotmail password 120
Will Dormann is on Mastodon @wdormann.bsky.social · 28/04/2025I'm using a web browser for this website. 010
Will Dormann is on Mastodon @wdormann.bsky.social · 28/04/2025Testing GIF upload from an iPhone... 100
Will Dormann is on Mastodon @wdormann.bsky.social · 28/04/2025With BlueSky, animated GIFs are uploaded with the video icon. Because GIF89a files are clearly videos and not images. Cross-posting apps don't recognize this silly behavior. (Yet??) 200
Will Dormann is on Mastodon @wdormann.bsky.social · 12/03/2025If the desire is to implement your own homemade WDAC block policies, tread lightly. If you simply apply a "block this thing" policy, you might very well end up preventing Windows from booting, as a "block this thing" without a corresponding "allow this", well... WDAC will only block and not allow.😬 000
Will Dormann is on Mastodon @wdormann.bsky.social · 12/03/2025If you wish to inspect an on-device (binary) policy file, you'll need WDACTools: github.com/mattifestati... With this, you can run ConvertTo-WDACCodeIntegrityPolicy to get a stripped-down human-readable XML policy.github.comGitHub - mattifestation/WDACTools: A PowerShell module to facilitate building, configuring, deploying, and auditing Windows Defender Application Control (WDAC) policiesA PowerShell module to facilitate building, configuring, deploying, and auditing Windows Defender Application Control (WDAC) policies - mattifestation/WDACTools 131
Will Dormann is on Mastodon @wdormann.bsky.social · 12/03/2025If you enable HVCI and then run: ApplyWDAC -auto -enforce you'll be good to go, as it will pull the more-complete online list. github.com/vu-ls/applyw... If you can't enable HVCI, you'd need to wait for MS to fix WDAC to get complete coverage. But that's not going to happen if I am to believe MSRC.github.comGitHub - vu-ls/applywdacContribute to vu-ls/applywdac development by creating an account on GitHub. 100
Will Dormann is on Mastodon @wdormann.bsky.social · 09/01/2025You've made both of these statements: - Threat actors are manipulating the ICT to bypass detection - Run the ICT checker Doesn't the former sort of invalidate the latter? 🤔 Or is hope that you've got one of the not-so-good attackers that result in an ICT flagging something? 010
Will Dormann is on Mastodon @wdormann.bsky.social · 26/12/2024I suppose my gripe about the wording is that electricity itself has no sound. *Physical objects* energized by electricity can emanate sound by vibration. 😀 140
Will Dormann is on Mastodon @wdormann.bsky.social · 26/12/2024Electric vehicles run on DC. Not AC. 280
Will Dormann is on Mastodon @wdormann.bsky.social · 26/12/2024"they can hear electricity circulating but not enough to power anything else" I'm curious what electricity sounds like? 5260
Will Dormann is on Mastodon @wdormann.bsky.social · 25/12/2024Sounds about right for the person who left the Superbowl early because Biden's Tweet got more attention than his. 😂 But heck, drawing attention to your and @kateconger.com 's book is surely a good idea. Everybody should read it! 090
Will Dormann is on Mastodon @wdormann.bsky.social · 02/12/2024No, I don't have a Facebook or Reddit account. I suppose I was referring to Twitter and Mastodon. With either of those you can upload a media thing (image, animated, GIF, MP4, etc.), and the trigger to do that is you click a single "media" button. Separate buttons is completely unnecessary. 000
Will Dormann is on Mastodon @wdormann.bsky.social · 02/12/2024BlueSky is the first social media app I've ever used that has a different icon to pick depending on what file type the media is. This seems unnecessarily complicated. 000
Will Dormann is on Mastodon @wdormann.bsky.social · 02/12/2024The fact that BlueSky decides to take the GIF I uploaded and convert it to MP4 does not change the fact that what I'm loading is a GIF file and not a movie file. 🤷♂️ 010
Will Dormann is on Mastodon @wdormann.bsky.social · 02/12/2024Wait... Animated GIF images maybe need to be uploaded using the "Movie" icon, because GIF89a's are clearly not images? 🤔 120
Will Dormann is on Mastodon @wdormann.bsky.social · 18/11/2024There goes my hopes for a viable post-Twitter platform where we all hang out. 😡 010
Will Dormann is on Mastodon @wdormann.bsky.social · 18/11/2024Oh, BlueSky doesn't even support uploading animated GIFs. FFS why is this platform so slow to improve? 230
Will Dormann is on Mastodon @wdormann.bsky.social · 18/11/2024So you have to use BlueSky directly to get animated GIFs? Lame... 110
Will Dormann is on Mastodon @wdormann.bsky.social · 18/11/2024Testing multi-posting app Croissant... 210
Will Dormann is on Mastodon @wdormann.bsky.social · 16/11/2024Eventually your client will get throttled with an HTTP 429 (Too many requests), or the site will otherwise fail. If you have a lot of posts to delete, it's going to take a while. But is worth it, IMO. 010
Will Dormann is on Mastodon @wdormann.bsky.social · 16/11/2024You'll note that what you get is not just a blob of text that you'll have to grep through, but a FULLY FUNCTIONAL website including search! And all uploaded media will be there in the form that it was in on the Twitter website. Delete away, friends! 110
Will Dormann is on Mastodon @wdormann.bsky.social · 16/11/20242) Delete your posts. e.g. by pasting in this javascript to your authenticated web browser session's JavaScript console. gist.github.com/nsuan/a2e42d... Obviously closely inspect what you're about to paste, as pasting JavaScript into a web browser session can be VERY DANGEROUS.gist.github.comDelete all <s>anime.exe</s> tweetsDelete all <s>anime.exe</s> tweets . GitHub Gist: instantly share code, notes, and snippets. 120
Will Dormann is on Mastodon @wdormann.bsky.social · 16/11/2024To those who still have posts remaining on the Nazi site for the sole purpose of being able to search through things that you've said in the past: 1) First download an archive of your data. (There might be a 1-day delay before you get it) x.com/settings/dow...x.comx.com 1102
Will Dormann is on Mastodon @wdormann.bsky.social · 16/11/2024Did everybody enjoy that video streaming marvel that was the Mike Tyson fight last night? 1153
Will Dormann is on Mastodon @wdormann.bsky.social · 15/11/2024Maybe. That's the time that I decided to pick Mastodon instead of here. We'll see how things look when the dust settles. I'm not married to any particular platform. It just would be nice for everybody to be in one place (LOL). 120
Will Dormann is on Mastodon @wdormann.bsky.social · 15/11/2024The first time I had at it, my conclusion was that BlueSky was relatively pleasant to use but there were zero infosec people here. Or at least, anything I posted got nearly zero interaction. So I settled on Mastodon. We'll see how this plays out... 200
Will Dormann is on Mastodon @wdormann.bsky.social · 14/02/2024Yeah, thanks. My OP was a touch misleading. I've posted a follow-up clarification to the best that I can with the small amount of characters that they allow on this site for some reason. 😕 010
Will Dormann is on Mastodon @wdormann.bsky.social · 14/02/2024PDD is a company that makes Pinduoduo and Temu. The former is the version of the store for the Chinese market, made available in Chinese app stores. The latter is for the rest of the world, available in the Google Play Store. The company that runs Pinduoduo and Temu decided to use an 0day exploit. 001
Will Dormann is on Mastodon @wdormann.bsky.social · 14/02/2024Did you notice that Temu dropped the bucks for *several* superbowl ads? Turns out that their Android app was utilizing an 0day exploit to achieve an advantage over their competition. Totally normal stuff going on here. arstechnica.com/information-... 264
Will Dormann is on Mastodon @wdormann.bsky.social · 13/02/2024Every Patch Tuesday I'm reminded that in Microsoft's world, "No thanks" means "Ask me again later". 050
Will Dormann is on Mastodon @wdormann.bsky.social · 11/02/2024Dear documentation authors, You... You do know that people can't click buttons on paper, right? 040
Will Dormann is on Mastodon @wdormann.bsky.social · 09/02/2024watchTowr: Ivanti Connect Secure CVE-2024-22024 - Are We Now Part Of Ivanti? labs.watchtowr.com/are-we-now-p... 031
Will Dormann is on Mastodon @wdormann.bsky.social · 05/02/2024Just to clarify, when I say "on a current Ivanti VPN box", this is what comes with the VMware version of the appliance that Ivanti provides for download, which is a 2023 version of the software. There may be some upgraded packages with newer versions of the Ivanti software. YMMV. 000
Will Dormann is on Mastodon @wdormann.bsky.social · 05/02/2024This is just a spot check of a few execuables on the system. I didn't even look at any of the libraries. If customers knew what they were purchasing, do you think they'd go through with the purchase? Imagine a complete SBOM for *everything* on the box... 100
Will Dormann is on Mastodon @wdormann.bsky.social · 05/02/2024Things on a currrent Ivanti VPN box: curl 7.19.7 2009-11-04 (14 years) openssl 1.0.2n-fips 2017-12-07 (6 years) perl 5.6.1 2001-04-09 (23 years) psql 9.6.14 2019-06-20 (5 years) cabextract 0.5 2001-08-20 (22 years) ssh 5.3p1 2009-10-01 (14 years) unzip 6.00 2009-04-29 (15 years) 100