Jake Williams

Breaker of software, investigator of incidents | GSE #150 | Faculty at IANS Research | Stuff: jake at malwarejake dot com | He/him

Public Key

npub1tdhytknt93um3pympngl3jqkd8k9ma7meuj6n4p3clz3amztxyes23m87v

NIP-05 Address

malwarejake_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqs9kmj9mf4jc7dcsjdse50ceqtxnmza7ldu7fdf6scu03g7a39nzvcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsf0wvdh

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1tdhytknt93um3pympngl3jqkd8k9ma7meuj6n4p3clz3amztxyes23m87v

Show more details

Last Notes

2026-07-02 16:16:43 UTC

Words to live by...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/851/276/294/097/240/original/4f2325f455d8a4d5.png

2026-06-22 20:06:40 UTC

Apple fumbled the implementation of its USB controller on A12 and A13 devices so it's possible to compromise the boot loader. Exploit code has been published. This can't be patched with a software update.
https://ps.tc/pages/blog-usbliter8.html

2026-06-15 19:30:19 UTC

Anthropic having Fable be export controlled is a self-inflicted wound. If you spend a bunch of time telling people how dangerous your technology is, don't be surprised when some of them agree with you.

2026-05-26 19:21:03 UTC

Dear app developers,
I have never had the desire to review an app. Prompting me to leave a review doe not make me want to do it any more. Making me click multiple times to dismiss your "nudge" and get back to using the app just makes me want to uninstall it.
Sincerely,
Every smartphone user ever

2026-04-01 17:16:15 UTC

ICE was checking IDs at the Atlanta airport today. The.guy said "your DL photo is super light, so facial recognition might not work."
I snapped back "that's so you know not to illegally deport me."
His buddy said "we can find a reason" and NOTHING could be more on-brand for an encounter with ICE.

2026-03-06 16:40:57 UTC

That Iranian Navy ship we torpedoed had no ammunition on board because that was a requirement to participate in the MILAN 2026 exercise (organized by the Indian Navy).
The US Navy knew this because IT ALSO PARTICIPATED IN THE EXERCISE. What a national embarrassment.
https://newrepublic.com/post/207429/us-attack-iran-naval-ship

2026-02-28 20:15:00 UTC

RE: https://infosec.exchange/@malwarejake/116149477150967871
It's confirmed that Khamenei is dead. Intentionally killing a country's sitting leader, especially the religious leader in a theocracy, is NOT how you go about regime change.
This will NOT end well.
https://www.reuters.com/world/iran-crisis-live-explosions-tehran-israel-announces-strike-2026-02-28/
#note10jj…wy5n

2026-02-28 17:39:31 UTC

Given reports that Israeli intelligence assesses Khamenei was killed, I assess with high (extreme) confidence that cyber was used to:
1. Confirm his location and direct the attacks.
2. Using collection on Iranian gov officials (e.g., email) reactions of the strike.

2026-02-28 15:07:33 UTC

The administration is getting US service members killed over the fucking Epstein files. I am livid. I hope to live to see Hegseth and every other member of the administration enabling this hanging on a wall.
This is so triggering for my PTSD. Fuck man. This is not okay. I am not okay.

2026-02-20 19:37:18 UTC

Surround yourself with good people. Pay it forward. Hug your friends every chance you get. Purge toxic people from your life.

2026-02-07 19:44:35 UTC

RE: https://infosec.exchange/@malwarejake/116030962813436488
To be vey clear, I do not agree with Snowden's actions.
However, it is now more than a decade later and the whistleblower process is STILL terribly broken. If the whistleblower is a contractor, there are no real protections. It's hard to conclude this isn't by design.
#note17p2…dkyx

2026-02-07 19:19:46 UTC

Regardless of the details of this phone call, there's no question Gabbard broke the law here. Everyone involved in covering this up broke the law.
The whistleblower is killing a career and honestly is risking their safety bringing this forward. It isn't nothing.
https://www.theguardian.com/us-news/2026/feb/07/nsa-foreign-intelligence-trump-whistleblower

2026-02-03 13:03:01 UTC

RE: https://mas.to/@carnage4life/116006745291970990
That, my friends, is the sound of a bubble popping.
#note1kf7…mvdu

2026-01-31 18:44:58 UTC

The hackers had to be "bread in" to the operational details since everything was on a "knead to know" basis.
But they rose to the occasion - it was the yeast they could dough. Things were touch and go until they got on a roll - they'll do butter next time...
https://therecord.media/cyberattack-russian-bread-factory-supply-disruptions

2025-12-05 18:11:06 UTC

Bubble? What bubble?!
https://arstechnica.com/ai/2025/12/microsoft-slashes-ai-sales-growth-targets-as-customers-resist-unproven-agents/

2025-11-26 14:09:12 UTC

The day is rapidly approaching when we're going to learn that one of the big AI companies has been taking money to align their LLMs to recommend certain brands (or criticize their competitors).
It won't be anywhere near as obvious as Grok and Elon. I'd like to see laws prevent this. I know better.

2025-09-11 10:51:45 UTC

Live your life and conduct yourself so that if you're gunned down in public nobody feels the need to tell others that it's inappropriate to celebrate your death.

2025-08-22 14:04:31 UTC

After all the hype, I cannot believe how objectively bad GPT-5 is. In my experience, it is an objective step backwards in most tasks.
It's pretty clear why OpenAI repeatedly delayed shipping it. Calling it now: OpenAI is toast.

2025-07-14 22:58:28 UTC

Don't tie your identity to your job. Jobs are temporary, often ending unpredictably. When your identity is your work, your mental health is impacted horribly when your job security is at risk or you get let go.
I've seen multiple folks in cyber suffer from this, some barely surviving the ordeal.

2025-06-22 14:12:09 UTC

If you're an enterprise worried about your exposure to pro-Iran hacktivists, real talk: you're doing security wrong.
Hacktivists lack sophisticated tools. They employ DDoS and hack-and-leak as their primary techniques. APTs they are not.

2025-06-22 13:27:45 UTC

I'm just glad that as we face increased terrorism risks in retaliation for bombing Iran that there's a steady hand on the wheel for preventing terrorism in the US.
Or mowing my yard. Or running a Model UN club. Or whatever he's actually qualified to do...
https://www.propublica.org/article/trump-dhs-thomas-fugate-cp3-terrorism-prevention

2025-06-06 18:43:40 UTC

I will never understand who at Microsoft thought this was okay. It's a profoundly gross UX pattern.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/637/886/667/060/741/original/3b9d836567ba8c80.png

2025-05-23 19:14:32 UTC

The article doesn't really address the fact that Claude is only mimicking behaviors in its training data set.
Still, it's a great highlight of how quickly dystopian fiction in a training data set can become dystopian reality when AI agents are given too much access.
https://techcrunch.com/2025/05/22/anthropics-new-ai-model-turns-to-blackmail-when-engineers-try-to-take-it-offline/

2025-04-08 10:59:21 UTC

If you're using Ivanti at the perimeter, I have to presume at this point that you enjoy incident repsonse. There's no other rational explanation...

2025-04-03 14:49:55 UTC

Again, Microsoft - unsolicited advertisements for games have NO PLACE in Windows 11 Professional. Please slap whoever decided this was appropriate.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/274/578/765/130/611/original/b08bbf66e58e3b48.png

2025-04-02 14:23:45 UTC

Remember the part of required federal records management training that says "it's okay to use Gmail for work as long as you cc government accounts?"
Yeah, me neither...

2025-04-02 12:56:09 UTC

It's 2025 - please stop using the terms whitelisting and blacklisting. Yes, I know many of these terms were acceptable when you were growing up.
Continuing to use them today shows you're unable to adapt to change, which particularly in high-change environments like cybersecurity, is NOT a good look.

2025-03-29 18:07:21 UTC

I want to find the Microsoft engineer behind this and beat them with dimensional lumber...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/247/049/560/234/685/original/24b6dbc0565761f8.png

2025-03-10 13:58:40 UTC

Fortra doing a victory lap claiming they've cut illicit Cobalt Strike usage by 80% is one thing.
CTI analysts uncritically parroting this ridiculous claim is quite another. Cobalt Strike usage is down because EDRs got better at identifying it specifically. Fortra is AT BEST a minor contributor here.

2025-03-04 19:29:56 UTC

Yet again, I remind you that if you work in cybersecurity, you will never not benefit from learning packet analysis. Yes, there are tools for that. But when they fail (and oh buddy do they fail), your ability to perform independent analysis is critical.

2025-03-02 15:00:50 UTC

I wrote an article outlining why the directive to stop tracking Russian cyber threat actors is impractical and frankly dangerous, outlining some second order effects of the directive. Enjoy.
https://www.linkedin.com/pulse/stop-tracking-russian-cyber-thats-how-anything-works-jacob-williams-ixdkc/

2025-02-26 17:54:29 UTC

Technology is inherently political. Anyone who says otherwise is either being disingenuous or is ignorant of history.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/071/467/063/645/584/original/31fc0de7503ea5bc.png

2025-02-24 13:53:06 UTC

I predict cloud providers run by US companies are going to see some transitioning off their platforms, regardless of where the datacenters are located.
I've talked to several international clients in the last two weeks asking about de-risking, accelerating after Patel was confirmed.

2025-02-15 19:09:20 UTC

"Help help" - I feel you DHS, I feel you...
https://www.linkedin.com/jobs/view/transformation-team-lead-program-manager-at-u-s-department-of-homeland-security-4144567289/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/009/475/859/231/658/original/f605ea0316952b43.png

2025-02-12 16:01:00 UTC

If you're a leader in tech, take this to your stakeholders and explain the implications. Many of the AI-enabled apps your users are integrating into their workflows (or outright relying on) could literally cease to exist with a single court ruling.
https://www.wired.com/story/thomson-reuters-ai-copyright-lawsuit/

2025-02-11 20:42:43 UTC

DOGE is a bigger threat to US federal government information systems than China. If you find this statement controversial, I'm going to question your IT and cybersecurity credentials.

2025-02-11 00:39:10 UTC

Only those wanting to scam consumers are threatened by the existence of the CFPB.
I said what I said.

2025-02-05 20:25:13 UTC

When dealing with aircraft delays (as I am now), I'm always reminded of what an old CW4 pilot told me:
"It's better to be on the ground wishing your were in the air than in the air wishing you were on the ground."

2025-01-16 23:18:49 UTC

There is no generative AI today without flagrant abuse of copyright law.

2024-12-26 14:06:44 UTC

Hot take: the cybersecurity industry wastes an incalculable amount of effort "remediating vulnerabilities" in code because a library used has some "vulnerability" that can't actually be exploited in the way it's used in the application.

2024-12-25 14:40:10 UTC

Find yourself someone who buys you a life size metal Sword of Omens from Thundercats for Christmas.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/713/977/521/693/415/original/12ffcc4cf90bcbd2.jpg

2024-12-17 15:35:30 UTC

Never, EVER, do anything that might create personal legal liability for yourself on behalf of your org.
No matter what anyone says, you are not "family." You are not "in this together." And most importantly they do NOT "have your back."

2024-12-07 14:27:02 UTC

One day I'm going to meet the person who decided the port option in ssh is -p and in scp it's -P.
They will not enjoy this meeting...

2024-12-05 16:12:11 UTC

Hot take: by being actively hostile to end to end encryption apps, FBI and DOJ has created the playing field on which Salt Typhoon now operates.
They're every bit as culpable for texts being intercepted as FCC is for the robocall epidemic.

2024-11-07 17:15:23 UTC

The amount misogyny on display in the cybersecurity field is absolutely wild.
If you're not seeing it, ask "am I part of the problem?"
If you are seeing it, call out the offenders when you see it. Sure, it's uncomfortable. It's WAY more uncomfortable for the victims.

2024-10-25 13:55:58 UTC

Dark web monitoring is a high cost activity that most teams aren't ready for. Most alerts are aggregations from previously identified compromises, and most of those are "employee used their email on some janky site that got popped."
TL;DR: Know how you'll action your alerts.

2024-10-22 16:40:21 UTC

To the random person contacting my employer with vague accusations of domestic violence (while calling me "a GD fscking antisocial psychopath") - thanks for reminding me we need better mental health safety nets in the US.
I just made a donation to NAMI.org in your honor.

2024-09-15 11:20:07 UTC

We have a fundamental breakdown of the social contract in the US.
I don't have the answers for how to fix it. But I've read enough history books to know what happens if we don't - and it's not great.

2024-09-11 16:01:27 UTC

Publicly declaring "I will give you a child" to someone you have no consenting relationship with is a threat of sexual assault, full stop.

2024-08-27 15:57:40 UTC

It will never be a thing that I answer the phone and am willing to "verify my personal information for my security."
If you have legitimate business processes built around this, you're screwing your customers teaching them to be victimized by scams and should feel bad about it.

2024-08-27 13:19:09 UTC

My favorite thing about the Telegram arrest is that "normies" are asking me if this is why I've been refusing to use it for comms and moving them to Signal instead.
Yes. Yes it is...

2024-08-27 13:00:34 UTC

Just a quick reminder that you can't trust what the government tells you.
https://gizmodo.com/donald-trump-homeland-security-report-antifa-portland-1849718673