Twitter上关注度最高的前26位网络安全专家

New release: #TinyTracer v2.3 : https://t.co/Ajq09c2TUQ – with improved syscalls tracing support – now syscalls are automatically mapped to corresponding functions names pic.twitter.com/GIll3P28wO

— hasherezade (@hasherezade) March 20, 2023

Multiple Internet to Baseband Remote Code Execution Vulnerabilities in Exynos Modems (Google urges Android phone users to switch off Wi-Fi calling
it found multiple security flaws that could allow hackers access into the devices) : https://t.co/TjP9NOVSFG pic.twitter.com/0ni7ppN1GP

— Binni Shah (@binitamshah) March 21, 2023

BlackLotus Malware Hijacks Windows Secure Boot Process https://t.co/RfZvsc8BHu

— Schneier Blog (@schneierblog) March 8, 2023

Today is the day! Join @HackingLZ and I got a AMA – gonna be awesome! #TrustedSec https://t.co/q0C2BLafDV

— Dave Kennedy (@HackingDave) March 15, 2023

5 simple, digestible keynotes to keep repeating at meetings until senior management gets the message that #cybersecurity should be taken seriously 👉 https://t.co/p2KNZR4b57 pic.twitter.com/JaEUwEOXdn

— Eugene Kaspersky (@e_kaspersky) January 31, 2023

I regret to inform you that crime does not, in fact, pay: https://t.co/6hcUTwPmfE

— Eva (@evacide) February 24, 2023

Join me, with experts from @AbnormalSec, @wiz_io, @rubrikInc and @NonameSecurity, for an online fireside chat about how cybersecurity companies protect against cloud vulnerabilities…https://t.co/Ey73Sd2H3u pic.twitter.com/K3wPETyWyp

— Graham Cluley 🐘 @[email protected] (@gcluley) March 23, 2023

Please, new bug bounty hunters and hackers:

If you contribute to the community or iterate on research I applaud you 👏👏👏

BUT

If your research/tool/list is taken from another place;

⚠️CITE THEM IN YOUR PROJECT. ⚠️

Give a quick shoutout. SOMETHING.

— Jason Haddix (@Jhaddix) April 15, 2022

The main reason we need to prioritize vuln remediation is because it's way too difficult (ie expensive), and dangerous, to patch everything automatically. The more ways we can automate remediation the less we’ll need remediation prioritization. /2

— Jeremiah Grossman (@jeremiahg) December 6, 2022

@reliaquest is always hiring for a variety of cybersecurity roles.

Entry-level SOC analysts are always available at several locations, including Tampa, FL, and Las Vegas, NV.https://t.co/wib6lJ03rX

— Marcus J. Carey (@marcusjcarey) December 22, 2022

My Arm Reversing & Exploitation Training at #OBTS kicked off today!

So exciting. This is the first public training I’ve given in 3 years. 🥹 pic.twitter.com/3bq4Cf25mq

— Azeria (@Fox0x01) October 3, 2022

I have a lot of respect for the folks at Meta/WhatsApp who are building encrypted systems. This is tempered by some of the other things that Meta does with data. Google occasionally does good things too, but I don’t trust them to do them reliably in the future (sorry friends.)

— Matthew Green (@matthew_d_green) March 18, 2023

Anyone can set up a ticketing system with a bug bounty scope & call it a day.
What, except for a budget line that grows every year, do you expect to show for it in a year? In 5 years?

What specific, measurable *security* goals do you have & is your bug bounty set up to deliver?

— Katie🌻Moussouris (she/her) (@k8em0) March 19, 2023

🌏🌏 Congrats to our @KnowBe4 team for reaching 50,000 customers worldwide!
What a huge accomplishment.
Had a great time keynoting with our CIO Colin Murphy at our annual user conference. pic.twitter.com/vIJZHcMMTU

— Kevin Mitnick (@kevinmitnick) May 13, 2022

The hacker / infosec Mastodon servers have really reached critical mass to contain useful community and information. If you haven't tried it out yet, I really recommend it. There's enough intel and news to be viable at this point.

— Lesley Carhart (@hacks4pancakes) November 9, 2022

Good write-up of the latest Outlook exploit. It's nuts that you can send a calendar invite via email to anyone, include an alert for the event and Outlook will helpfully load the sound file for the alert from anywhere on the internet. https://t.co/GI8P8Ih5Zs

— @mikko (@mikko) March 17, 2023

I hate browser plugins as I believe they are not well sandboxed and present a supply chain threat. However, for those with ADD the Postlight Reader is a game changer when trying to read articles and not be distracted: https://t.co/KIwRuLAnmg

— Paul Asadoorian @[email protected] (@securityweekly) March 21, 2023

More bugs fixed year over year is a good thing. Bugs exist in every piece of software out there, so if you think less bug fixes = more security, a lot of folks on my team would love to have a word 👀 (4/4)

— Parisa Tabriz (@laparisa) October 7, 2022

Some say they feel nervous to use a password manager — if that feeling is leading you to be less safe & reuse passwords (which btw is the easiest way for me to hack you bc that pw gets breached), then try this trick:
🧂Salt your password manager passwords🧂
Here's the trick: https://t.co/V6VvGxZPGr

— Rachel Tobac (@RachelTobac) March 16, 2023

I was invited to give testimony/commentary to the CSRB during their work on Log4j. It was absolutely the right call for them to focus there and I found the entire process and team involved incredibly professional, astute, well equipped to handle it – and it was a success https://t.co/1pHoZb8ukp

— Robert M. Lee (@RobertMLee) November 17, 2022

A year and a half after @Microsoft wrote that politicians, human rights activists, journalists were targeted with Candiru’s spyware, we still know shockingly little about the victims. https://t.co/SgQTphgwVm

— Runa Sandvik (@runasand) February 21, 2023

Had opportunity to collab w/@gregoryvish & @BenSeri87 of @ArmisSecurity, releasing NAT Slipstreaming v2, an upgraded technique that allows attacker to remotely access any TCP port bound to *any system* behind victim's NAT just by victim visiting a website. https://t.co/UlOnJPftTv pic.twitter.com/yvQJPcRCXX

— samy kamkar (@samykamkar) January 26, 2021

If you want a launchable index of all OS, NirSoft, Sysinternals, and other tools available for Windows administration, KLS WSCC is pretty incredible as it will get all the software for you.
!Again, some might be detected as a virus on corporate machines!https://t.co/srhDZArHqQ pic.twitter.com/CFXnPBT5Au

— SwiftOnSecurity (@SwiftOnSecurity) July 25, 2020

Interesting question for exchange admins! There's a discussion about whether a heavily redacted video of an email is authentic. In the video (3:47), part of a Thread-Index is briefly visible. The timestamp is a week later than the Date header, is that possible? pic.twitter.com/oYmlvYFpu4

— Tavis Ormandy (@taviso) October 16, 2022

You are going to be phished long before you are going to be hit with CIA 0days. Enable 2FA and get a password manager.

— thaddeus e. grugq [email protected] (@thegrugq) March 8, 2017

What’s the point of putting a question in an FAQ and then not answering the question? pic.twitter.com/s1eCZzNKHV

— Troy Hunt (@troyhunt) March 16, 2023