Recent content on andpalmier's blog
Introduction # While working on the post “Interview preparation for a Cyber Threat Intelligence role” , I realized that a lot of CTI tools need a subscription or a license in order to be used. That could be an issue, especially for small companies or people trying to enter the field. To give back to the community and highlight the potential of community-driven platforms, I decided to…
Introduction # I first read about KawaiiGPT in a blog post from Unit 42 , where it was described as “an accessible, entry-level, yet functionally potent malicious LLM” . In brief, KawaiiGPT is a command-line AI chat client with an anime aesthetic, marketed to pentesters and people interested in offensive security to provide an “uncensored” LLM that can “help with the…
Introduction # I didn’t find any interview guide for Cyber Threat Intelligence (CTI) roles that satisfied me (I’m not interested in AI slop ), so I decided to write one! I figured writing this post might help me organize my ideas, and - hopefully - help others preparing for their interviews. The goal is to refresh some topics some of you probably already know, and collect useful links,…
Introduction # Lately, my feed has been filled with posts and articles about jailbreaking Large Language Models. I was completely captured by the idea that these models can be tricked into doing almost anything but only as long as you ask the right way, as if it were a strange manipulation exercise with a chatbot: “In psychology, manipulation is defined as an action designed to influence or…
The following paragraph was added on June 15, 2024. The rest of the blog remains unchanged from its original publication on March 8, 2024. Thanks to the incredible feedback from the community on seads , I am working on updates and developing new features. As a result, this blog post seems somewhat outdated, and it doesn’t cover some of the new features the project now includes, such as…
In this technical blog post, we will examine the components of a stalkerware app designed for Android devices and marketed towards Italian customers. By analyzing the various components of this type of software, hopefully we can gain a deeper understanding of how these apps operate and develop strategies for detecting and removing it from infected devices. What is stalkerware? # Stalkerware is a…
I started hunting and reporting phishing websites on Twitter: follow me here if you are interested! In this series of posts I am going to analyze and discuss some of the phishing kits found online. Let’s start from the beginning # I found this kit while analyzing the phishing sites reported by @illegalfawn . The zip was left exposed in the page, I believe the malicious actor forgot to remove…
Introduction # If you use Twitter to stay up to date with the latest security news, you may have noticed a community of researchers reporting phishing websites and scam pages every day (if you want to follow them, phishunt.io have a good list of profiles in their community section ). Unfortunately, reporting these websites is not always very effective. In many cases the phishing pages are removed…
Introduction # During 2020, the Emotet malware distribution was silent between the beginning of February and the middle of July; this was the longest known break for Emotet. After this pause, the email campaigns started again, with multiple vendors reporting that hundreds of thousands of messages were detected every day 1 2 . There is a long list of security researchers on Twitter that are…
Introduction # This is a blog post about my last project: andpalmier/goransom A proof of concept of a super simple ransomware written in Go Go 9 4 which is a proof of concept for a simple ransomware written in Go. The purpose of the project is purely educational; I wanted to get a bit more familiar with the language and its patterns. I am not responsible for the use you make of this tool. Do not…
I started hunting and reporting phishing websites on Twitter: follow me here if you are interested! In this series of posts I am going to analyze and discuss some of the phishing kits found online. Let’s start from the beginning # The kit was created to steal LinkedIn credentials: How this phishing kit looks like when deployed At a first look, we can notice some characteristics of this page…
I started hunting and reporting phishing pages on Twitter, follow me here if you are interested! After some digging, I have decided that it would be interesting to use this topic to refresh my memory around the basics of Machine Learning. Introduction # In the last post of this series, we analyzed how some of the parameters of a decision tree could improve the accuracy of the model when…
I started hunting and reporting phishing websites on Twitter: follow me here if you are interested! In this series of posts I am going to analyze and discuss some of the phishing kits found online. Let’s start from the beginning # Here is my tweet containing some information about this instance of the kit: #phishing #onedrive hxxps://www.bonatura.com/ok.co/u/ exf: macdon161@gmail reg:…
Last week I started hunting and reporting phishing websites on Twitter (follow me here if you are interested). After some digging, I have decided that it would be interesting to use this topic to refresh my memory around the basics of Machine Learning. In this series of posts I am going to use a smaller variant of this dataset to create machine learning models which (hopefully) will be able to…
I am trying to acquire some knowledge on malware analysis by using ‘Practical Malware Analysis’ (by Sikorski, Michael, and Andrew Honig, 2012 ). I will publish my solutions of the exercises as soon as I complete them. You can find all the executables for the labs here: mikesiko/PracticalMalwareAnalysis-Labs Binaries for the book Practical Malware Analysis null 1440 378 NOTE: I will try…
What is F-Droid? # F-Droid is a community-maintained software repository for Android devices; or - to make it simpler - an alternative store for Android apps. Similarly to the Google Play Store, F-Droid allows searching, installing and updating apps. What makes F-Droid different from the Google Play Store (and other alternative stores, such as Aptoide) is the fact that its entire list of…
My name is Andrea Palmieri . I am interested in everything cyber-security related, machine learning, and reverse engineering. I am passionate about books, movies and art in general. Also, I am a die-hard AS Roma fan. Here is a non-updated version of my resume. For a more recent version, you can send me an email at andpalmier [at] gmail [dot] com or contact me on LinkedIn . Here are some of my…