eastside mccarty @eastsidemccarty

Founder of OpenSourceMalware. Researcher, startup founder, Software Supply Chain Threat Intel opensourcemalware.com Australia Joined September 2012

Tweets

1K
Followers

634
Following

668
Likes

671

eastside mccarty @eastsidemccarty

13 hours ago

It's kind of a strange thing to add as most EDR isn't going to detect novel JavaScript malware anyhow.

0 0 0 22 0

View Details

eastside mccarty @eastsidemccarty

13 hours ago

I went deep on the latest Miasma malware and noticed some new upgrades. It now detects EDR tools, including @CrowdStrike , @SentinelOne , @qualys , @Microsoft Defender, @CarbonBlack , @Tanium , Cylance, @trendaisecurity , and @Trellix . If it detects they are present, the malware will exit. This is behaviour that software supply chain malware is stealing from traditional malware patterns. Interestingly, it also aborts if it sees that Osquery is present. @ossmalware #research

1 0 1 115 0

View Details

eastside mccarty @eastsidemccarty

2 days ago

I'm excited to be delivering a workshop at @defcon with @AdversaryVillag entitled "Hunting in GitHub to Identify Adversary TTPs in the Wild".

0 1 5 228 2

View Details

eastside mccarty @eastsidemccarty

3 days ago

@1336_0ff_by_0ne @_Kofin And so my DEFCON shirt buying begins even before the con...

0 0 1 47 0

View Details

eastside mccarty @eastsidemccarty

6 days ago

Heya @Gizmodo, you need to do a better job of vetting your ads, because you are currently serving up a ClickFix ad to millions of people.

1 2 7 1K 0

View Details

eastside mccarty @eastsidemccarty

3 weeks ago

Uh, you know it's trivially easy to make a GitHub activity graph say anything you want, right? Git commit timestamp, author, and email address are all 100% fakeable. #GITSMASH

0 0 0 69 0

View Details

eastside mccarty @eastsidemccarty

3 weeks ago

@ramimacisabird Thanks mate, we are at 73 repos and holding right now.

0 0 1 189 0

View Details

eastside mccarty @eastsidemccarty

3 weeks ago

@vortexau I’ve given up on MSRC/github/etc. itsca sinking ship

0 0 0 48 0

View Details

eastside mccarty @eastsidemccarty

4 weeks ago

Wanna gain some visibility into what bad guys might be targeting in your software supply chain? Use the free @ossmalware alerts feature, which will notify you if a malicious software component is targeting something you care about.

0 0 1 89 0

View Details

eastside mccarty @eastsidemccarty

a month ago

DPRK is evolving quickly. In addition to changes you note while they are still using Vercel for c2, they are also using IPs behind short.gy shorteners, as well as new surge of custom domains. Biggest change: they have pivoted to hiding payloads in pre-commit and post-checkout git hooks.

1 0 1 130 0

View Details

eastside mccarty @eastsidemccarty

a month ago

Famous oxymorons:

0 0 4 107 0

View Details

eastside mccarty @eastsidemccarty

2 months ago

Link to announcement: airwallex.com/newsroom/airwa…

0 0 2 83 0

View Details

eastside mccarty @eastsidemccarty

2 months ago

Heya @airwallex, this is not a good look. Discriminating against people older than 25 is crazy and probably illegal. Do you follow this same practice in your hiring or procurement policies?

1 0 3 166 0

View Details

eastside mccarty @eastsidemccarty

2 months ago

@0xLupin @CharlieEriksen @adnanthekhan They are learning and evolving. They saw the success of DPRK use of VS Code tasks files and pivoted to that pretty quickly

1 0 2 50 0

View Details

eastside mccarty @eastsidemccarty

2 months ago

@vxunderground If the TA really exfil'd PII via a leaky API, then @Polymarket is at fault here. Guessing they are silently wrapping those endpoints with auth as we speak.

0 0 0 695 0

View Details

eastside mccarty @eastsidemccarty

2 months ago

@PolymarketDevs So, to clarify, the user PII and associated wallets were all meant to be public?

0 0 2 598 0

View Details

eastside mccarty @eastsidemccarty

2 months ago

This is crazy! @wiz_io researchers found that you could get remote code execution by sending a malicious payload via a git push command like this: "git push -o <malicious-payload>" Boom! That's it! Like, I said CRAZY! wiz.io/blog/github-rc…

0 0 0 70 1

View Details

eastside mccarty @eastsidemccarty

2 months ago

0 0 1 121 0

View Details

eastside mccarty @eastsidemccarty

2 months ago

Dear @Lovable, The recent changes you've made to your AI function UI are a disaster. The older way, where I could just hit Ctrl-J and edit inline, was simple, but it worked. The recent changes make things soooo much more complicated: 1. The sidebar on the right is disjointed from the inline experience. Am I editing the whole doc? Am I editing the highlighted section? I dunno! Fuck me, this is dumb. 2. When you perform AI edits, you don't get the simple "Accept inline" or "Insert below" options you used to get. Now, you get a non-intuitive "Show Changes" or a symbol that could be "return key" or "go back". I dunno which. When the user doesn't know how to accept edits, you know the UX has failed. You have created an overly complex AI UX, and frankly, it feels like you just decided to ship stuff. You didn't really test these changes; you just yolo'd some complicated shit and ruined what was a simple, effective UI. And this is the problem with vibe-coding: the speed and ability to ship quickly lure people into thinking they NEED to push shit, when maybe, really, they shouldn't. Maybe spend more time triaging your bug bounty program and overseeing your pull requests, and less yoloing UI changes?!