If we analyzed Microsoft Patch Tuesday using the same assumptions industry analysts use with market growth

Apologies for the boring conclusion, but after I froze my card, they attempted two more transactions, and this time there's no link to Stripe. One of the businesses I've never ordered from directly, and the other, I haven't ordered from in over a decade.

Looks like just a boring stolen card situation.

I'm still confused as to why the Ubiquiti transaction appeared to have come from my Ubiquiti account though, and the request for Link code. Maybe just because they were using a card associated with both accounts?

So I encountered some interesting fraud today and wanted to get some feedback on how it might have happened and advice on what to do next.

The Rocket Money app is the MVP in this story, as it notified me of a large transaction as suspicious less than an hour after it occurred.

A $600 Ubiquiti order that I had supposedly just placed.

As much as I'd like to, I did not order $600 of Ubiquiti stuff today at 4:13pm.

I checked my email, and sure enough, there was an order for an 8-port switch, made from MY Ubiquiti account, with MY primary card that I buy stuff like this with.

Except it was bound for an address I didn't recognize in Madisonville, TN.

I quickly logged into my Ubiquiti account and cancelled the order. Since the charge was still pending, it immediately disappeared and returned the funds to my account.

Crisis averted, but HOW DID THIS HAPPEN?

I reset passwords, logged off sessions, and did all the other things in the Ubiquiti app, but I have no saved payments in the Ubiquiti account - how did they hit my card then?

I keep looking and notice something else interesting - a Link verification code at 4:13pm - the same time as the Ubiquiti order. That answers the question of how my card was accessed.

This code went to my Google Voice number, so no SIM-swapping would have gave someone access to this code. They were somehow able to create the order without the code.

So now I'm going into Link (Stripe's consumer-facing app that makes it super easy to buy stuff) and deleting all my payment options. The only login option was passkey.

I also froze my card, since I'm still unable to figure out how someone was able to create this order in my Ubiquiti account via Link, with my card, but send it to a different address.

I started looking for breaches and this is writeup on compromised Stripe API keys from Hudson Rock my current best guess as to how this fraud happened: https://www.infostealers.com/article/analyzing-stripe-breach-confirmed-vendor-exposure-and-claims-of-20000-compromised-apis/

I currently have no other theories. What have I missed? Does this sound plausible? I'm not sure compromised Stripe APIs can explain the Link piece of the puzzle.

I needed AI to express my experience at Washington Dulles airport

I have seriously never encountered so many escalators at one time, and I've been in probably over 100 airports

RE: https://mastodon.social/@404mediaco/117361538616335870

Judges are not messing around when attorneys are out here handing in hallucinated briefs generated by ChatGPT

This judge let him HAVE IT

RE: https://infosec.exchange/@josephcox/117362102543498649

Yes, forget real people suffering, let’s talk about how a giant file full of weights feels, this is a good use of time and bandwidth

What about welfare for Sims? Or Tamagotchis? Or those innocent NPCs that some players choose to kill in video games?

What about people who shoot at the dog in NES Duck Hunt when he laughs at them, let’s talk about how terrible they are

Looking to get stickers made, suggestions that aren't StickerMule?

RE: https://cyberplace.social/@GossiTheDog/117292965860486399

When I hear of people still trusting MoveIT with their data in 2026, I imagine they’re also still driving around in a 1992 Ford Explorer, still equipped with the original Firestone show floor tires

Random intrusive thought: why was scary spice scary? I never understood that.

All the other Spice girls’ names were descriptive of how they looked or dressed. Did Mel B have a history of chunkla tossing?

There are many more that I missed the day of the event and look forward to checking out now that they're all published!

https://www.youtube.com/@BSidesKnoxville

Follow @bsidesknoxville here and on YouTube!

My friend Stephen Hilt, a researcher at Trend, always has some interesting research to share. Words of the Wicked: How Language Divides and Unites Cybercriminals gives a rare look into how language influences groups and communities of cybercriminals.

https://www.youtube.com/watch?v=83nDf9MeDNo

Friend and repeat BSides Knoxville speaker Chris Craig delighted me with his presentation, titled Stacking the Deck.

It was not only chock full of useful, actionable information on how to use AI for offensive security and how he builds harnesses, but was also highly successful in using a deck-building game metaphor.

Not only was the metaphor fun, Chris decided that instead of using AI-generated images for his slides, he'd draw them himself, which was chef's kiss for me.

I wish more people put this level of thought and love into the talks they give.

https://www.youtube.com/watch?v=I4CuKbP0oo4

My friend and mentor, @wendynather, keynoted the event and also sat front row for my talk - always lovely to have support in the front row!

Her keynote, Brother can you spare a token explores how AI affects the security poverty line.

https://www.youtube.com/watch?v=mzEotI8a2I0

BSides Knoxville just released this year's videos and I'm excited to share not just my talk, but some of the others I enjoyed the day of the event and have been wanting to share!

My talk, Rebuilding security strategy from breach lessons, shares some of the most interesting insights I've gleaned from studying breaches over the past decade.

https://youtu.be/nyXP7lRwhPA?t=96

thread continues

@taviso except this Cisco vuln is due to SQL injection! Something that everyone knew how to fix over TWENTY years ago.

@taviso it was over a decade ago, here's the link if you want to feel super old and tired along with me

https://projectzero.google/2016/06/how-to-compromise-enterprise-endpoint.html

Remember when @taviso discovered you could compromise Symantec's secure email gateway with an email, because their AV engine was using a 7 year old, vulnerable unpacker?

I remember, and it makes me feel tired and old

https://www.theregister.com/security/2026/09/15/cisco-email-security-boxes-can-be-rooted-by-an-email/5296604

Thanks to a lighter workload in August, I've been able to spend more time on breach analysis!

The latest writeup is the British Library breach.

What this breach lacks in technical details, it makes up for in details on process, priorities, and culture! It's an interesting one.

https://www.defendersinitiative.com/p/breach-lessons-the-2023-british-library

#Breaches #BreachAnalysis #Ransomware

Awww, they matched the inside of the mug to the outside!

And of course, my portable soldering iron’s battery is dead