Ryan NaraineVerified account

@ryanaraine

Podcast + newsletter at . Columns at

tinyletter.com/naraine
Joined August 2007
1,167 Photos and videos Photos and videos

Tweets

You blocked @ryanaraine

Are you sure you want to view these Tweets? Viewing Tweets won't unblock @ryanaraine

  1. 16 hours ago

    Microsoft expressly identified nation-state backed hacking teams from China, Iran, North Korea, and Turkey among APTs exploiting the Log4j flaw

    2 replies 4 retweets 5 likes
    Undo
  2. 17 hours ago

    Is anyone keeping a list of these?

    PSA: don’t forget to make sure your security vendors are patched against the log4j bug!
    3 replies
    Undo
  3. Retweeted
    Dec 15

    UEFI Firmware Vulnerabilities: Past, Present and Future by and

    17 retweets 42 likes
    Undo
  4. Retweeted
    Dec 14

    For those of you traveling next week to do family tech support (also apparently there’s a holiday?):

    Patch Tuesday mayhem: - Microsoft (incl 0day exploited by Emotet) - Adobe (60 vulns) - Apple (iOS/macOS) - Chrome (0day) - Log4j disables JNDI by default
    1 reply 2 retweets 5 likes
    Undo
  5. 22 hours ago

    I'll be moderating a SecurityWeek panel discussion today on the intersection of third-party risk management and internal cybersecurity practices Catch the conversations here at 1P EST <- presented by

    2 retweets 1 like
    Undo
  6. Dec 14

    The internet sure is a resilient beast ✊

    1 reply 6 likes
    Undo
  7. Dec 14

    Patch Tuesday mayhem: - Microsoft (incl 0day exploited by Emotet) - Adobe (60 vulns) - Apple (iOS/macOS) - Chrome (0day) - Log4j disables JNDI by default

    77 retweets 134 likes
    Undo
  8. Dec 14

    Tweaking those defaults

    1 retweet 3 likes
    Undo
  9. Dec 13

    💥

    Just wrapped up my first day as Lead Security Architect for ! Can’t understate how excited I am to be part of this team.
    Show this thread
    3 likes
    Undo
  10. Dec 13

    Memory safety

    iOS 15.2 security content addresses 38 vulns. 8: out-of-bounds access 7: buffer overflow 5: input validation 4: race condition 4: logic issues 3: memory corruption 3: state machine 2: use after free 1: type confusion 1: misc permission issue
    Show this thread
    1 retweet 9 likes
    Undo
  11. Dec 13

    If you really need something patch, iOS 15.2 is out with band-aids for at least 42 documented vulns

    1 reply 5 retweets 6 likes
    Undo
  12. Dec 13

    Also

    US federal agencies have until Christmas Eve (Dec 24) to patch that you-know-which vuln
    1 retweet
    Undo
  13. Dec 13

    US federal agencies have until Christmas Eve (Dec 24) to patch that you-know-which vuln

    1 reply 3 retweets 14 likes
    Undo
  14. Dec 13

    Guess what, tomorrow is Patch Tuesday.

    6 replies 8 retweets 62 likes
    Undo
  15. Retweeted
    Dec 11

    Found my tweet from 2017

    I always used to joke that if there was an RCE in Log4J all hell might break lose. Yikes !
    25 replies 345 retweets 2,094 likes
    Show this thread
    Show this thread
    Undo
  16. Retweeted
    Dec 10

    Ghidra reportedly vulnerable to Log4Shell exploitation is best argument that there were no gov tricks in that tool. Would not have been bugdoor, as almost certainly would have been VEP'd if known due to scope of impact. But Threatneedle likely now frantically trying to bootstrap

    1 reply 14 retweets 18 likes
    Show this thread
    Show this thread
    Undo
  17. Dec 11

    "The second critical risk -- the one that concerns us here -- is cascade failure. It is the forest fire of the net- worked world, the epidemic of the computer age. Cascade failure is, like calculus, the infinite sum of infini- tesimals. Cascade failure fundamentally matters."

    Somewhere, someone’s started writing an update to the Dan Geer “software monoculture” paper (or should be).
    2 retweets 9 likes
    Undo
  18. Dec 10

    🏆

    Small java webserver that will log the request params (via log4j) if you want to test your log4j things: Just include the log4j version in the class path you want to run with
    4 likes
    Undo
  19. Dec 10

    OH: "wait until the log5j experts start showing up"

    15 likes
    Undo
  20. Dec 10

    ❤️✊🏽

    2 likes
    Undo

@ryanaraine hasn't Tweeted yet.

Loading seems to be taking a while.

Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.

    You may also like

    ·