Matt Johnston @MattInformed

New threat advisory posted for Essentials Members at PractiveSecurity.com There is an active email campaign circulating right now that spoofs party invitations from the legitimate service Greetings Island. Full report linked below: practivesecurity.com/advisories/thr…

I may have been a little unfair in my comments on this interview yesterday. Seeing Kevin and thinking about the Mandiant journey along with some of the milestones they discussed in this interview brings back so many memories. Some good, some bad. Successes and failures. Peaks and valleys. There simply aren’t very many of us who have careers in this stuff that goes back so far and for those who do, our history is shared…even the working the same incidents and investigations. I’m glad the story is getting some attention. As I mentioned yesterday, we did some crazy stuff over the years and most of it was intentionally buried or hidden from view. The Cyber Security industry is like many others a massive world within our world that operates in the shadows and the effects are taken for granted. Cheers to my fellow practitioners. Cheers to the proverbial plank owners of our industry. Cheers to Kevin and the Mandiant crew. Cheers to the APT Working Group (APTWG), the DIB, DSIE…and the others. And hello to the intel analysts and spies reading this because it was flagged by the ever diligent analytics platforms of your respective nation state. Maybe we should do a war stories podcast and share our reflections on the silent battles that we fought in the cyber space over the years. It might blow your mind and change the way you think about the Internet. I bet many of us have surprises yet to the told. #CyberSecurity #InfoSec

Shawn Ryan @ShawnRyan762

21 hours ago

The OFFICIAL preview with my next guest, Kevin Mandia. “We had an agent go out to the dark web and go to a bunch of password brokers. All we did was try all of them at human speed, not AI speed. We logged in, tried all the accounts it found, and it got in seven times. On one of

25 79 814 104K 156

@roddreher This election cycle is going to be absolute madness.

I fear this political cycle will be a clash of two flavors of totalitarianism. The Dems and GOP are effectively gone. This will be a battle of the extremes of the left and the right. Fundamentally animated by the same spirit: anti everything, tear it all down, use force to get things done, centralized power and control. Wowza. I think the AI tyrants might try to emerge with the “wisdom” of the so-called super intelligent machines to break the divide and walk us to enlightenment. We are in for a ride. Buckle up.

Rod Dreher @roddreher

3 hours ago

This is EXACTLY the reason why, according to Arendt, totalitarian movements attract people in a highly atomized society in which many have lost faith in institutions. Like ours. #WeimarAmerica

2 9 77 6K 11

This post is getting so much attention that I might write an extended version and dive into more details, but for now here’s where I make the case for digital privacy and how to protect it (written and audio formats): practivesecurity.substack.com/p/digital-priv… I cover online privacy in multiple ways in additional articles as well.

Matt Johnston @MattInformed

a day ago

I’m very surprised how fast this is sweeping through our country. Privacy is a matter of dignity, respect, and security. It matters because you matter. And it is part of the core values of our nation. Have we lost much of our privacy online through data collection and

2 122 212 5K 31

I have several works in progress which I’m trying to finish up over the coming weeks. Always adding more knowledge and resources to the @PractiveSec library. But here’s a preview of what’s to come. Never too late to sign up. Draft articles in progress: Shepherding Kids Online: practical ways to be the firewall. Guarding Our Attention. How to Recover from a Hacked Account. Threat Advisory: Fake Invitations in Email. Updates on Age-Based Access Controls: KOSA, zero-knowledge, legislating vices and more. Other works in progress: Re-recording my digital health and online security workshop for parents (the live CHEA recording is terrible quality). Recording audio versions of recent written articles (will be available on Spotify or through the website and Substack). Livestream - a live walkthrough of our Essentials Membership with Q&A (maybe Friday). And I have two major projects I’m keeping under wraps for now…they will be big.

@futurism Let me help westbowpress.com/en/bookstore/b…

@BeeGuyTravis Impressive. Very nice. My local grocery store has the world’s finest wine. Not bad eh?

Alas this is not what it was made for though it is precisely what it is marketed to be used for which is exactly why it fails to meet expectations and falls far short of the model: you. A data analysis tool that can find patterns and relationships within text, overlay descriptions of meaning based on pre-defined dictionaries, and then summarize the total based on discovered themes and expand the summaries based on common use of language. That’s what AI can do, and it does it well. So long as it is properly trained and the algos are properly tuned. Beyond that we exceed its purpose and thus find its failures and when encapsulated in agentic form, we rob mankind of human agency and replace it with…the un-man. And nearly 2 years after we were told “it is here,” it still doesn’t do what they tell us it is superior at. Yet even that is just a mask, or rather a lure for investment and participation to normalize the transfer of power required to bring and end…and a new beginning…wrapped in promises of coming prosperity and eternal bliss. All it will cost us, is our property, our agency, our liberty, and our very souls. Other than that it’s fine. I should write more about this ;-)

@BMcGrewvy Job safety in the age of AI has nothing to do with truth. Jobs and careers are being ended to create a narrative based on lies. So says I.

Again…too much in my head, not enough time to get it written, but I need to write it to fully flush it out, but I’ll offer this raw material: If we are going to day that age-based restrictions to Internet-based services is a precedent already passed with age-based laws governing vices (drinking, smoking, gambling etc), then we need to think of the root of the vice and it’s not limited to the socials and the machine brain, but rather the whole of the Internet as well as the device that most teens use to access it. So perhaps if we are going to legislate access to the vice, why not just ban possession of Smartphones and tablets for minors? The internet was not made for minors and it is inherently dangerous for them. Rather than layering complicated tech on top of tech and giving more power and control to the government, why don’t we just cut this off at the source? No smartphones for minors. Done.

But I am glad the story of the cyber security domain is being told. :-)

Funny how some of us remember some of these details differently. :-) I remember when the APT-1 paper was first shared privately. I was excited to read what they were going to disclose, but bummed it was just a summary of the comment gang. It wasn’t news. In fact, it was a spark that fizzled quickly. Lived history. No question about this though: Mandiant has been a power house and shaper of the industry. Props for that.

Shawn Ryan @ShawnRyan762

21 hours ago

The OFFICIAL preview with my next guest, Kevin Mandia. “We had an agent go out to the dark web and go to a bunch of password brokers. All we did was try all of them at human speed, not AI speed. We logged in, tried all the accounts it found, and it got in seven times. On one of

25 79 814 104K 156

When the APT-1 paper was released, there was a lot of chatter in the intel world about wanting to expose nation states publicly for their espionage and related cyber threat activity. As a community, we were sick and tired of nothing being done to hold those accountable for their intrusions, even though we had very detailed and positive attribution. The APT-1 report, we thought, might be what broke the mold. We were hoping it would disclose something new and would set the precedent of more to follow. While Mandiant and others did begin disclosures and reports of APT activity, it was never really what we had hoped it would be: a force for accountability. Actually CrowdStrike was initially formed as another expression of that same frustration. Dimitri Alperovich was big on public naming and shaming…again, because no one in or outside of government was doing anything about it. Others were trying to take matters into their own hands. CrowdStrike formed to use the power of that crowd to strike back offensively. That’s a history the leadership vehemently denies today. But I was there. I remember. Some freaked out about that idea, worried that if we retaliated privately against China or Russia then they would strike back harder or would protest in some other way. I always thought that unlikely, since their response would be an admission of guilt, and I think both the US and our enemies wanted the cyber war to continue on in the shadows. Heck, I even recall a time when there was consideration of designating us as “war fighters” so we had authorization to strike back in retaliation. And while public reporting on APT activity did increase after the Mandiant APT-1 report, we never really did what we had wanted to do as an intel community, largely because our employers and our government refused to acknowledge publicly what they could absorb or sweep under the rug privately, using classifications and NDAs to keep the records secret. Victims never wanted to come forward and attempts to measure the impact to our businesses and economy were looked down upon. At least at first. That has changed in recent years. But the APT-1 report did do this: it took a bold step when others were afraid to. It did give us the opportunity to act in kind. But as an industry, we didn’t take it. Everyone wanted the truth buried. As for Solar Winds. Yeah, the discovery of that, to my knowledge, remains undisclosed. I was there too.

@TheBabylonBee He’s like the parent who counts to the toddler but never reaches the dreaded number of doom. 1. 1 1/2. 2. 2 1/2. 2 3/4. 2 5/16. 2 and a metric number…

@TheOptimisticC3 It was spot on. So well done. Standing O from me in my office all alone.

xAI has already been chosen. The rest is theatre (for now).

Once again, our nation’s economy has bet all the chips on the promises of the AI Revolution. Politically we’re all-in as well. One way or another, this attempt by mankind to achieve transcendence via our own power and effort, is the crescendo of the scientific age. This tower won’t reach heaven, and it’s going to hurt when it falls. Sigh.

Polymarket @Polymarket

a day ago

JUST IN: Microsoft, Meta, Oracle, Amazon, & Alphabet have now locked in $1,090,000,000,000.00 in future AI data center lease payments.

190 211 2K 377K 217

You might want to know this: use of psychedelics is ubiquitous among the men leading the AI Revolution and across the leaders of Big Tech. Peter Thiel has been funding businesses to produce the drugs and he has funded attempts to legalize them. The same Peter Thiel who is the mentor of our Vice President. But seriously, this light blow your mind. practivesecurity.substack.com/p/the-darkness…

I believe this is why Trump did the Genesis project and gave it to the Department of Energy: no visibility, no accountability. He’s been against AI regulation from the start…and as you noted…that’s a major problem in the context of a revolution that is attempting to change everything.