Adrian —dangerously-skip-permissions Sanabria

🎙️ Enterprise Weekly Podcast
🤝 Founder BSides Knoxville (npub1edq…0uq4)
🗣️ Faculty @IANS_Security
🕵️ Security Research
🍳 Cooking
⛰️ Hiking
🏎️ F1

"I rant with data!"

🤝 BSides Knoxville: https://bsidesknoxville.com
🎙️ Enterprise Security Weekly: https://securityweekly.com/esw
📚️ Cybersecurity Canon: https://cybercanon.org
💣️ Destroyed by Breach Dataset: https://docs.google.com/spreadsheets/d/15CTPcgZQenWKDLDTQ2ibveUM4i7Of_n20TzdTi23xcg/edit?usp=sharing

Public Key

npub19vvjtrp3pk6kpcd6lq8q9m6svpyns7nwsvezd0ensp0z7atjmhusqmd56q

NIP-05 Address

sawaba_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqszkxf93scsmdtquxa0srszaagxqjfc0fhgxv3xhuecqh30w4edm7gprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmnt6pln38

Publishing to

relay.momostr.pink

Author Public Key

npub19vvjtrp3pk6kpcd6lq8q9m6svpyns7nwsvezd0ensp0z7atjmhusqmd56q

Show more details

Last Notes

2026-07-14 18:15:56 UTC

- reply

there have been unauthorized clones since the very first days of gaming. I forget how many versions of pong were created and sold by different companies
Unlicensed clones of popular Sega and Nintendo games have existed for decades
The higher quality, more thoughtful version will always win though. Have to ignore the vibe oded garbage that isn't even worth trying out

2026-06-30 13:03:25 UTC

- reply

employees figured out tool use for effective problem solving long ago - we call it "Shadow IT"

2026-06-20 12:53:51 UTC

- reply

do we know if malvertising or served from Gizmodo’s own domain?

2026-06-12 03:27:20 UTC

- reply

that's not surprising, so what's the point of setting unrealistic SLAs?
Why not require remediation in 3 hours? 3 minutes?

2026-06-11 17:29:04 UTC

- reply

I'm constantly talking to enterprises and they struggle to meet their 7-day SLAs, so when CISA comes out with 3 days, my eyes are popping

2026-06-10 23:47:26 UTC

- reply

Do you know if there is any data on how well federal agencies keep up with KEV’s remediation directive?

2026-06-09 02:57:29 UTC

- reply

some deep drinking of the kool-aid going on across the pond
Does the UK have kool-aid?

2026-04-05 16:34:33 UTC

- reply

OH, and the li-ion battery that absolutely should not go into the trash and will burst into flames if punctured.
Im betting 99% of these Cisco video pamphlets, like most disposable vapes, went straight into the trash.

2026-04-05 16:31:54 UTC

- reply

The magnet on the right hand side turns the device on and off when a corresponding magnet in the cover makes contact with it.

2026-04-05 16:30:42 UTC

- reply

Pretty much what you’d expect, SBC with a lot of hot glue, a speaker, buttons, and the USB port.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/353/046/275/700/806/original/49444d3e7c6f4182.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/353/046/289/715/438/original/de4d78f18ca9b52d.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/353/046/289/464/494/original/de2e7a13648db488.jpeg

2026-04-05 16:28:31 UTC

- reply

Alright, let’s start tearing open this paperboard glue sandwich and see what’s inside.
I don’t know what I was expecting, but Antarctica wasn’t it.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/353/040/074/516/010/original/42877bfd4f890f1f.jpeg

2026-04-05 16:25:58 UTC

- reply

Plug it in and it shows up as USB storage
With… 220MB of total space?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/353/030/758/003/512/original/0b28dc65dc0cf5b3.jpeg

2026-04-05 16:24:48 UTC

- reply

Can I put a different video on it? Why, yes. Yes I can.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/353/026/000/039/115/original/6e4d78fe03a66c95.mp4

2026-04-05 16:16:34 UTC

At RSA, when you’re at one of the main hotels, vendors leave marketing stuff at your door or in your room.
Cisco distributed full-on video players with built-in li-ion batteries and I just now found time to dig into it.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/352/990/683/844/042/original/3272b084a852de04.mp4

2026-03-05 20:46:09 UTC

- reply

anyone know a good alternative for Proton? Their products are so good, it’s painful seeing them cave to this sort of stuff.
Or is this already the best option, and the reality is just that the best option also sucks for reasons?

2026-01-24 00:17:57 UTC

- reply

Interesting, looks like most are periodic events, like “every 3rd Saturday, 1-5pm”
I may be starting one of these up. Twice a month, I set up vintage video games at my favorite bar/brewery. Why not fix stuff while people are playing games?

2026-01-23 15:34:40 UTC

- reply

love the idea of a repair Cafe! Would like to learn more about how that works and what it looks like

2026-01-22 03:04:43 UTC

- reply

same here - hopefully it doesn't impact the lower end of the market.
It wouldn't make sense for it to - AI datacenters and GPU manufacturers shouldn't have any interest in tech 3+ generations old.

2026-01-20 00:37:23 UTC

The enshittification of computer repair is happening.
AI has amazingly managed to make repairable computers practically worthless.
The increase in memory and storage pricing is destroying the second-hand market for computing hardware and this makes me sad. I watched a video from someone that runs a repair shop, and this is what's happening:
The memory/storage alone is worth more than the rest of the computer, so people are stripping them out to sell separately.
The second hand market is now flooded with computers that have no memory or storage. Buying new memory or storage to put in these used computers is now more expensive than buying a new computer.
So we now suddenly have a giant e-waste problem PLUS a giant problem for repair shops that want to stay in business.
In the video, he was basically saying that they have to pivot to the only computers that folks aren't stripping RAM and storage out of - computers that have those things soldered on. The irony here is that repair shops now have to ignore the most repairable computers and focus on the least repairable computers instead.
https://www.youtube.com/watch?v=T6eiFyJMWgM
cc @npub1fdr…lvhs @npub1ulc…x3hg

2026-01-01 18:50:32 UTC

- reply

it might have been quicker to watch the video, but for me, it was worth every minute spent going through this thread.
We've covered a lot of the pieces and parts of this on my podcast, but it was great to see it all tied together - the cloud act, anticircumvention, alternative app stores, John Deere, BMW heated seat subscriptions...
And the opportunity for countries to repeal anticircumvention laws never occurred to us, but it gives me hope.
It still feels like alternatives to the hyperscalers is so far in the future though, especially seeing a German hosting company killing people's accounts without notice
But watching Proton slowly build out a full replacement to Google/Microsoft mail/calendar/drive/apps services has given me hope as well.

2025-12-08 14:43:48 UTC

- reply

It reads like, “hey, there was some detail missing from the first CVE, so here’s a new CVE with extra details”

2025-11-07 04:08:51 UTC

- reply

This would kill entire market segments if true. Bitsight, Security Scorecard, Upguard, Censys, and a few dozen other security vendors would have to cease operations immediately

2025-11-06 00:21:41 UTC

- reply

I still maintain they'll end up giving it away for free. No one wants to pay for it, the value just isn't there.

2025-11-05 18:36:09 UTC

- reply

this would make a great post, I'd love to hear more of your thoughts on this - particularly around what such a device would be designed to protect against.
Something that I feel has never been sufficiently explored or discussed is the amount of digital "exhaust" that comes out of our devices. Particularly all the information our smartphones and bluetooth devices can leak about us to anyone listening.
And we've all heard how Target knows who you are and what aisle you spent 30 seconds in, as long as you leave your phone turned on while you're in the store.

2025-10-24 23:01:09 UTC

- reply

automated clickfarm

2025-10-14 21:27:47 UTC

This Korean data center fire keeps getting more and more tragic. Here’s what I know, to catch you up.<li>Back in 2017, S.Korea built “G Drive” for government officials to store all their files (no relation to Google drive, the ‘G’ stands for Government)</li><li>They were told to store all their stuff in G Drive, not on their local systems.</li><li>They were concerned about battery backups causing a fire, so decided to move half the li-ion batteries to the basement.</li><li>One of the li-ion batteries exploded as it was being unplugged, setting the building on fire. Several floors of datacenter were affected.</li><li>They’ve recovered roughly a third of the data.</li><li>none of it was backed up, because 1 petabyte was “too large to back up”</li><li>In 2017, one AWS Snowmobile 18-wheeler held 100 petabytes, so “too big to back up” doesn’t make a lot of sense</li><li>125,000 government employees lost all their data</li>
This is WILD. Go to any failing mall in America and choose a retailer at random. Spencer’s Gifts? They probably do backups. Jamba Juice? Backups. The CBD vape store? Okay, maybe they don’t do backups, but everybody else does.
One of the most technologically advanced 1st world nations in the world DOESN’T BACK UP government data? I’m still floored by this.

2025-10-14 21:25:24 UTC

- reply

went through the thread here, but didn't find a clear answer - do we know how attackers got their initial foothold into JLR?
Sounds like, if no, the obvious guess would be the same way M&S and Co-Op got hit since they were also using TCS?

2025-09-30 16:12:14 UTC

- reply

they might want to reduce Hegseth’s currently prescribed dose of cocaine

2025-09-10 19:32:58 UTC

- reply

fuck me, seriously?

2025-09-10 19:29:03 UTC

- reply

there’s no fixing hallucinations, but grounding data can help (ie let it search the web)
But then, the grounding data will be wrong or potentially out of context a good percentage of the time
Ultimately, the answer lies in transparency- show me the thinking and where you got your answers, and I can make a call on whether to trust it

2025-09-09 04:12:00 UTC

- reply

good to see everyone involved go to jail, but it still doesn't seem like enough, given all the damage they did - all the lives they destroyed

2025-09-08 16:29:34 UTC

- reply

is this a new attack vector? Typically, I've seen attackers use the NPM install scripts to put malware on systems, and they typically leave the package code itself alone, right?

2025-08-18 16:04:00 UTC

- reply

What's worse? How bad these prompts are? Or that I doubt anyone will be surprised?

2025-06-21 15:25:00 UTC

Every cybersecurity firm pitching vendor press releases to me: "Attackers are getting more advanced and sophisticated"
The news:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/722/038/407/509/591/original/e31abb0e2bb394c5.png

2025-06-19 11:59:32 UTC

- reply

but keep in mind, the only reason they’re even considering adding GenAI is because buyers are brainwashed into believing they shouldn’t buy anything without AI

2025-06-19 11:58:02 UTC

- reply

good question, I think we’d need an example to understand what they mean here

2025-06-19 04:40:21 UTC

A refreshingly sober take on AI + SOC (and AI hype in general)
https://staging.wirespeed.co/posts/2025-type-one-decisions

2025-06-13 16:10:03 UTC

- reply

it looks like she is saying that it only posts things publicly if you ask it to
so more of a situation where people don’t understand what the share button does
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/676/924/274/583/138/original/e2f0383f425627d9.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/676/924/275/747/623/original/d8afb9dea22ced34.jpeg

2025-06-06 23:15:02 UTC

- reply

activist implies biased reporting, so I can see why they’d call you that
trying to discredit a journalist is almost always a Streisand move though, it’s positive feedback that your reporting strikes a nerve
short of winning a prize for your coverage, I can’t imagine a better form of feedback

2025-05-16 19:08:17 UTC

- reply

to be fair, IIRC, Coop Sweden went down because their payment provider used Kaseya.
So, it was ransomware on a fourth party, nothing Coop Sweden had any direct control over

2025-04-25 21:07:44 UTC

- reply

if you’re on a box, can’t you just do the equivalent of Recall with malware? It definitely makes the job of an attacker easier and more streamlined, but not sure it adds up to a massive increase in risk.
Also, anyone that figures out how to eliminate that one hour every day the planet spends trying to find stuff on their computer could maybe add 10% to global GDP. How much risk is that worth?
(not that Recall is that solution, but it could be, right?)

2025-04-25 20:52:24 UTC

- reply

people already screenshot stuff constantly, Recall is just drawing extra attention to an existing issue

2025-04-04 21:05:40 UTC

- reply

please don’t tell me they were converting cash into crypto to pay a ransom
That’s like, incident turducken

2025-03-29 05:01:51 UTC

- reply

tl;dr - not a threat, you’ll update it anyway, probably don’t need special tools since we’ve been updating crypto forever
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/243/958/918/570/454/original/04ed93080380c7fb.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/243/961/234/517/271/original/16ab0b8b1b907bcf.jpeg

2025-03-29 04:57:39 UTC

- reply

doing a webinar in a few weeks, working on the slides
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/243/944/143/499/981/original/1f2135b681b429cf.jpeg

2025-03-09 16:16:31 UTC

- reply

that name rings a bell - I think he built and sold a cybersecurity startup. Air-something. It was a “secure cloud web browser”, competing with companies like Authentic8

2024-12-16 01:07:44 UTC

- reply

I feel like the Switch is the best way to play classic Nintendo games, they've done a great job with emulation there, you get access to the whole library across half a dozen consoles with one subscription.
I'm pretty happy with my Analogue consoles for high-quality HDMI output, but that 1) requires you have the physical cartridges and 2) duplicate each classic console with an expensive, standalone, new piece of hardware.
It just occurred to me that maybe you're talking about current games that are available on PC + Xbox + Playstation and I 100% agree with your conclusion. PS Pro will not get my money.

2024-12-16 01:03:50 UTC

- reply

LOL, I just downloaded that. Haven't dug in yet though, because deliverables

2024-12-15 22:43:49 UTC

- reply

laser measuring tape

2024-09-29 16:54:25 UTC

- reply

and 2 slides into "how to fix it", I've quoted you
Again, really hoping they record your talk, so I have some new quotes from when I update these slides 😅
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/221/882/270/387/881/original/12e37b6ed70ea542.png

2024-09-29 16:52:43 UTC

- reply

okay, let's see...
Why is it so hard?<li>so many old problems don't have good solutions (e.g. BYOD), but we keep getting new shit thrown at us (IoT, privacy frameworks, GenAI, SaaS, supply chain attacks)</li><li>we've gone from protecting a corporate network to protection a corporate network PLUS remote workers PLUS contractors PLUS four different clouds, etc</li><li>no good guide to maturity (lots of attempts tho)</li><li>device types are so heterogeneous (noone is 100% windows or mac, android or iOS these days, tons of IoT everywhere</li><li>Noisy security products (fill-in -blank fatigue from all the things)</li><li>inherited problems (tech debt, abandoned infra, previous security leaders' dumb pet projects/strategies, hiring issues)</li>
Summing the "problem statement" section of this old presentation up, I was focused on how it seems like there's too much of everything. Security has to cover such a broad landscape of stuff, it's almost an impossible job.
AI Safety and Post Quantum migrations are the latest things I've seen added to the CISO's to-do list, and there are just no extra cycles for this stuff (unless you drop other stuff)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/221/836/342/042/935/original/39fe0a1e075440da.png

2024-09-29 05:18:59 UTC

- reply

love talks like this! I hope it is being recorded?
I did one in Bogota titled, “Still Crazy After All These Years”. That talk is now half a decade old, I wonder how much of it is still true today…