Aight y'all. Let's get started with this Yandex thing. First thing, I want to give props and a shout out to @benwills who was the first to tell me about the leak and did a lot of initial leg work to make sense of where things live. He's the real MVP.

8:18 PM ∙ Jan 27, 2023

---

341Likes84Retweets

https://searchengineland.com/yandex-search-ranking-factors-leak-392323

Analysis on how search at Yandex is done

https://russiansearchnews.com/articles/yandex-data-leak-what-weve-learned-about-the-search-algorithms/

-

Subscribe now

-

EU has some genius ideas about mandating that software be secure. It is gonna kill open source if they don’t change it.

https://blog.nlnetlabs.nl/open-source-software-vs-the-cyber-resilience-act/

-

My Year Of Dicks (2022)

-

Man...those cows know how to party!

gcaptain.comSpain Seizes Cocaine Worth $114 Million From Livestock ShipMADRID, Jan 28 (Reuters) – Spanish police seized 4.5 tonnes of cocaine with an estimated street value of 105 million euros ($114 million) after raiding a cattle ship off the Canary Islands...

3:18 PM ∙ Jan 30, 2023

---

104Likes16Retweets

-

Runa:

I looked at a bunch of court records to learn more about how police in the U.S. use digital data to prosecute abortions. Here’s what I found.

https://techcrunch.com/2023/01/27/digital-data-roe-wade-reproductive-privacy/ https://mastodon.social/@runasand/109763026717020372

-

A paralegal has been going after the AI-lawyer company “DoNotPay.” She is destroying them, and the CEO is looking worse and worse the longer it goes on. It’s glorious!

-

-

What's your excuse? https://t.co/yc24hOiGtq

3:14 PM ∙ Jan 30, 2023

---

11,282Likes1,012Retweets

-

Let’s continue our tour of my public @github@infosec.exchange projects.

https://github.com/0xdea/tactical-exploitation

Even though I’m a prolific #exploit #developer, I’ve always been a big proponent of a tactical approach to #pentesting and #redteaming that does not focus on exploiting known software vulnerabilities, but relies on #oldschool techniques such as information gathering and brute force.

While being able to appreciate the occasional usefulness of a well-timed #0day, as a veteran penetration tester I favor an exploit-less approach. #Tactical #exploitation provides a smoother and more reliable way of compromising targets by leveraging process vulnerabilities, while minimizing attack detection and other undesired side effects.

Sooner or later I’ll present my talk on this subject: “Empty Phist Style - Hacking Without Tooling” (h/t @thegrugq@infosec.exchange for the title) 🤘

https://infosec.exchange/@raptor/109783172507630600

-

-