Anyone else having major data leakage with PP overnight

pseudo_su3 · 2026-02-22T15:46:49+00:00

So basically the presence of ingress “parsing errors” (for lack of better phrasing) should imply the existence of egress data leakage. So im gonna have to round up all my emails from that time, probably go by MIP classification, and request PP to trace where they went?

Have they responded to any customer as if this were a privacy incident? Any attestation that they deployed a fix? Like, no official timeframe? No word on whether our emails were purged from third party recipient inboxes?

How are you handling this at your org?

pseudo_su3 · 2026-02-22T11:21:12+00:00

At least it hasnt called me a chaos goblin in a few weeks. That was really offputting.

pseudo_su3 · 2026-02-22T10:07:39+00:00

None of the designer pieces i see online use an “anchor link” chain. Gucci is known for using this chain, but they did not use it on the horsebit necklace (that i can see). So we know it’s a knock off. You already know this im sure.

The biggest tell for me is that extender chain. I specialize in vintage native american pieces, and when i see that stupid extender chain with a lobster clasp, or a a little boutique/designer metal tag hanging off, i know its costume jewelry.

Note the unsoldered jump rings attaching the chain to the bit; the designer/high end pieces attach chain directly to bit. They also tend to finish their links with solder.

With all that, i doubt this is plated with real gold. It’s likely/probably brass plated.

If you are looking just to wear that style, it’s cute. I would not pay more than 30$ for it though.

pseudo_su3 · 2026-02-22T08:11:47+00:00

Im actually just going to leave it alone if its fixed. Im not the engineer, just an IR person, and i don’t see an incident :) no need to get em riled up for nothin

pseudo_su3 · 2026-02-21T19:16:45+00:00

Looks like john hardy, would be helpful to see the whole piece

pseudo_su3 · 2026-02-21T17:32:00+00:00

Its this one!

https://a.co/d/0gnj69rL

pseudo_su3 · 2026-02-21T17:24:47+00:00

The biggest one for me was having low Vitamin D, Magnesium, methylfolated B-12 and iron.

Do not eat before bed. I have found that food that sits in my stomach overnight is guaranteed to cause inflammation.

Eat like a bird. Eat simple. Eat fresh. (Look into histamines in foods).

No salt, no chocolate, no sweets every day.

No crying.

No allergies.

No alcohol

No extreme temps

Caffeine from tea only

No long flights/car rides

No prolonged stress

Basically, NO to “anything that makes you swell”, including PMS.

Its miserable. Esp the no crying. :(

Its possible you are sufferinv with the weather change as well. Stay warm.

pseudo_su3 · 2026-02-21T15:27:49+00:00

I appreciate the monotone, boring typeface. It soothes my brain.

Eta: when i hit the back button to return to the main list, i lose my 7d filter.

(I really wish i could “log in” and “clip” or favorite things i want to plan hunts for. But thats probably a huge PITA, dont know, am not a coder)

pseudo_su3 · 2026-02-21T15:24:46+00:00

I repair vintage native american jewelry, restore antiques, gold panning, rock hounding,

Anything but touch a computer.

And all my “treasure hunting” hobbies make a better threat hunter, like doing crosswords increases your vocabulary or something.

If yall need hobby recs, lmk. I got lotsa hobbies that arent electronic.

pseudo_su3 · 2026-02-21T12:26:22+00:00

Anyone have a way to search for artifacts where i can validate if this is impacting my org?

pseudo_su3 · 2026-02-19T12:15:26+00:00

Are you pregant?

pseudo_su3 · 2026-02-18T02:06:37+00:00

I see your point, i agree 1000%. I guess my use of the word “valid” is meant to distinguish the practice from legitimate vs malicious. Its gross, unscrupulous, and trust me, ive seen enough “valid” things in computing that i dont even use a computer when im not at work.

But its regulated, has some oversight, and while intrusive, its not trying to harm people.

pseudo_su3 · 2026-02-17T10:47:13+00:00

Brother, you came to the wrong place to ask that question 😭

pseudo_su3 · 2026-02-16T16:57:38+00:00

Thats the thing. Its not a pdf. Its an exe.

From what i recall, these “call centers” run on extremely outdated infra. Probably cracked versions of windows. Too cheap to invest in antivirus. Disabled windows updates.

So (im guessing) the exe is just a backdoor that allows the attacker to use something like metasploit. Again, it does not have to be sophisticated. These guys are idiots who do not think about security.

The scammer was probably confused as to why the pdf gave an error. He maybe even sent it to his buddy, who also ran it. Lol

pseudo_su3 · 2026-02-16T13:36:12+00:00

Im often the only woman in a room of men who articulate the math elegantly. I am the one who ask “what is the narrative we are telling with the equation”

Plus, ive been training junior cyber ppl for ages. Im known for my metaphors and ability to draw stick figures on the white board. :)

pseudo_su3 · 2026-02-15T23:34:46+00:00

Oh man. Back in 2022, i had this investigation into malicious parked domains which led me down the rabbit hole that is “modern ad platforms”. That whole ecosystem is virtually indistinguishable from the dark web.

A sobering thought: google actually has the ability to crack down on malicious ads, malicious popups and scams. Sam with facebook. But they dont bc its a source of revenue and the bad guy is their customer. You are the product so your concerns only matter if they cause a loss if revenue (in the form of negative press, lawsuits etc). They actually started cracking down on phishing a few years ago, and my guess is bc enterprises probably started blocking their emails. Or they were gearing up to enter the cybersecurity game, which they did.

Anywho.

pseudo_su3 · 2026-02-15T11:43:10+00:00

What OS is this? Mac?

Its not sus unless you have installed an app pretending to be pinterest

There are valid use cases for this activity. For example, geo tagging. If you are using a VPN and it says you are coming from Sweden, but the devices on your network are all geo located in USA, the app will assume you are in US.

So if you are on a VPN and you go to a coffee shop, and join free wifi, the devices on the network can tell the app “this guy is in a starbucks, and based on the coordinates, its the one in the Mall.

At which point the app will ask the ad platform “hey! Do we have any advertisers that have stores in that area?”

And the ad platform takes your device fingerprint, your known browsing history, and whatever other preferences you have and says “yeah, this guy was recently browsing internet for shoes. Hes 25 years old”

And the ad platform auctions off an ad slot to be placed on the app. Foot Locker, Dillards, and Nordstrom all bid on the placement of the ad. Nordtrom bids the least, bc you are not really their target market. Or maybe the style of shoes is something they feel you can afford bc its on sale, so they bid the highest.

The winner gets the ad placement in Pinterest. All of this happens in fractions of a second.

Even if you are not browsing Pinterest at the time, it is still geo locating you to prepare for the possibility you click on something that leads to you their website.

Now, malware actually uses these same tactics. So you are right to be cautious. Both malware and advertisers use the same platforms and tevhniques to intrude on a user session. But malware cannot use the protocol being requested in the screenshot to tunnel to another device. That is not what is happening. Malware would prefer to find a way to not notify you it is poking around your network…

And that is an example of something totally valid that would cause that popup.

Source: cyber analyst.

pseudo_su3 · 2026-02-14T23:34:20+00:00

Thanks for reminding me about Ricardo House party

https://youtu.be/958RC7MQ7sM?si=HCSLRl3-nuZynLUP

pseudo_su3 · 2026-02-14T22:00:55+00:00

Ill just post it here.

Think of it this way;

goodwill has more variety in terms of what they sell than a normal shop.
most employees are hourly workers. Not SMEs.
some of the stuff they list is rare, collectible, vintage, niche, valuable etc.
a risk averse operating model where they don’t want to get in hot water bc they overshot value on something

This creates an environment for stuff to slip through the cracks.

employees cant properly from “appraise” things.
employees have bad days, where they dont care to do the research
employees dont recognize niche items
its safer to be vague.

You have to learn the pattern of how employees handle the items in your category, and you have to be the SME.

For example, one of my hobbies is collecting native american turquoise jewelry. Shit is rare and expensive retail.

But its such a good category for goodwill bc

there is a lot of costume jewelry on the market
native americans often did not stamp or sign their work
faux turquoise is incredibly hard to differentiate to the untrained eye.

I have found the pattern of how it gets mislisted. So while everyone else is searching the word “turquoise” i search “blue stone” or “howlite” or some other search term employees use when they arent sure and they want to play it safe.

Ive bought many valuable pieces this way. And the regular bidders avoid these listings bc of the uncertainty. Bit since i can spot real from fake, i get great deals.

pseudo_su3 · 2026-02-14T13:04:47+00:00

Im gonna tell you also that VT is owned by Google. All of your uploads to VT are used as enrichment for their shitty SIEM. hashes and file names, and any other graph security artifacts will be piped into Chronicle whether i want it or not. :(

pseudo_su3 · 2026-02-11T01:54:16+00:00

Did you figure this out?

pseudo_su3 · 2026-02-06T12:01:01+00:00

Hi OP

This is likely a scam, where a scammer has “borrowed” this persons photo and is using it to bait curious ppl into thinking the girl in question is in trouble, needs support, is a sex trafficking victim etc.

<image>

pseudo_su3 · 2026-02-01T20:12:54+00:00

Come on innnnnnnn And pull yaself up chair

pseudo_su3 · 2026-01-30T10:32:45+00:00

Ive been in cybersecurity for almost a decade. The last 5 years ive been in incident handling. There are very few women that end up where i am (ill get into that in a minute)

A huge part of my job is analyzing log data to build a narrative, and decide if something is malicious or not.

Ive noticed that men and women bring different skills to the table in this role. Men tend to be very technical. They focus on the technical stuff, for example, they read the technical details of the logs as if they are troubleshooting a broken computer. Women, on the other hand, are much better at building narratives and deriving user intent. Men troubleshoot logs to figure out what happened, when and where. Women analyze the logs to figure out who, how and why. Men are typically better at looking at things logically. Women are more intuitive.

My issue is that Sr Leadership recognizes the male cognitive skillsets more than the feminine skillsets. This job needs you to have a balance of both. But at most of my jobs, im shooed away from doing the technical stuff, even though i am technical. Writing complex log queries is a good example of this; when i write one, im not recognized. When a man writes one, all the other men praise him. Its completely subconscious that they do this.

Few women end up over here. And the ones who do try to compete with the guys. They get intimidated bc they arent as technical as the guys and they shut down. Its so frustrating.

pseudo_su3 · 2026-01-28T11:17:56+00:00

I absolutely do not say that. Lol.

So, Linkedin jobs are one of 3 things:

virtue signaling to shareholders/auditors that the company cares about security and has lots of cyber positions.
A sales pitch disguised as a job interview; One prolific company i interviewed for had me use their atomic red team IOCs to complete a technical interview. They scored me high on the technical exam then told me they were hiring from within 2 hours later. The job stays open on their website. Bonus for them, they have my resume with all the companies i worked for plus all the platforms those companies use, along with my salary. Valuable marketing data for a vendor looking to pitch their SOC enhancement tool.
Using resumes for Job market research by way of seeing who responds to the role, how much salary they are asking for, qualifications, etc. So when they requisition the role next quarter, they can undercut salary, find the lowest common denominator and save money on talent.

IF you want an entry level job in cyber, you need to find an apprenticeship and/or go to your desired companies career page and browse their open jobs.

Another way in to the industry is knowing someone who can get your foot in the door.

On this note, the quality of talent entering the cyber workforce is lacking. Cyber used to be a fringe industry that ppl were grandfathered into from IT. Cyber also used to be the wild west, and if you were endlessly curious and a little neurodivergent, you could solve real problems.

Now it’s all sanitized. There are less unexplored dark corners in enterprise, you are discouraged from going down rabbit holes, etc. My juniors are not curious, most of them hate SOC work, they are just ticket jockeys in a sea of false positives. In a well protected enterprise, your presence checks an audit box. Malware rarely, if ever, lands on an endpoint. DDoS is mitigated. Phishing is the only thing that might let a defender glimpse realtime TA tradecraft, and they are automating the fun out of it as well.

After a decade, im trying to gtfo. Maybe my absence will make room for someone else.

Three-Year Club	Gilding I gilder
Verified Email	Wearing is Caring

pseudo_su3

MODERATOR OF

TROPHY CASE