John Z Black
Brunswick, ME • (207) 245-1010 • contact@johnzblack.com
Mostly security stuff...
Make sure you check out my main blog at https://gnerdsec.com/blog
Thirty Seconds. That Is All FAUX#ELEVATE Needs to Own an Enterprise Machine.
FAUX#ELEVATE skips consumer targets entirely, checks for corporate domain membership first, then steals Chrome credentials and starts mining Monero in about 30 seconds.
Read More
It Was a Good Week to Be a Federal Prosecutor
Two cybercrime sentences landed in the same week: 81 months for the access broker who sold entry into Yanluowang's victims, and 2 years for the operator of the Mario Kart botnet that extorted more than 70 US companies.
Read More
The People Who Built America's Cyber Arsenal Say We're Losing. They're Probably Right.
Four former NSA directors told RSAC that America has failed to deter adversaries in cyberspace, and a federal whistleblower's thumb drive allegation shows what that failure looks like from the inside.
Read More
AI Code Gets CVEs Now.
The UK's NCSC called AI-generated code an 'intolerable risk,' researchers found all seven major MCP clients vulnerable to attack, and 35 CVEs in March alone traced directly back to AI-written code.
Read More
Your MFA Isn't Enough. (And Most Places Don't Even Have That.)
A phishing campaign bypassed MFA at 340+ organizations using legitimate OAuth flows, while 76% of companies are still relying on passwords in the first place.
Read More
Healthcare Had a Bad Week. A Really, Really Bad Week.
Three healthcare breaches in one week, all tracing back to the same problem: third-party vendors with access to patient data and not enough security around it.
Read More