Dr Nestori Syynimaa
Dr Nestori Syynimaa
@drazuread.com
Principal Identity Security Researcher @Microsoft. Ex-Secureworks (PhD, MSc, MEng, CITP, CCSK). And yes, opinions are my own ;)
2.2K followers346 following91 posts
Huge thanks to @johnlatwc.bsky.social, Tim Burrell, Elia Florio and the team, it’s been a fantastic ride! I’ll also miss working with the @msrc.microsoft.com folks, although I have no doubt our paths will cross again 😉 What's next? Stay tuned!
3. OST developers do consider ethical questions, and they tend to view the positive consequences as outweighing the negatives.
Full paper available here (requires registration): www.scitepress.org/Link.aspx?do...
Summary of findings: 1. There is no single path to becoming an OST developer; educational background does not necessarily matter. However, university studies have helped some in their research.
2. OST developers are motivated by the positive consequences of publishing their tools (see the picture). In essence, they are not primarily interested in money, although publishing OSTs can make them well known in the industry.
The paper is titled "Inside Hackers' Minds: A Qualitative Study of Offensive Security Tool Developers", and it seeks to understand people behind OSTs used by thousands globally every day.
Finally, I decided to monetize #AADInternals and created an OnlyFans account! If you like to see some really cool content and give support, take a look and subscribe here: onlyfans.aadinternals.com
Got some great news last week! My research paper titled "Inside Hackers' Mind: A Qualitative Study of Offensive Security Tool Developers" was accepted to be presented at the iceis.scitevents.org conference at the end of May 🎉
Recording available here: youtu.be/6MoV7SEEkJg
Folks, there's an interesting security community call next week on Mon Feb 23rd at 8am PST (I'll be speaking too): "Identity Control Plane Under Attack: Consent Abuse and Hybrid Sync Risks" Register now 👉 aka.ms/securitycomm...
Folks, there's an interesting security community call next week on Mon Feb 23rd at 8am PST (I'll be speaking too): "Identity Control Plane Under Attack: Consent Abuse and Hybrid Sync Risks" Register now 👉 aka.ms/securitycomm...
Hey peeps, anyone attending Disobey.fi next month?
Catching up with @tiraniddo.dev and @fromsteph2u.bsky.social #MSRCBlackHat researcher celebration party!
One of the best sessions I've seen for years! A deep-dive to Entra architecture, high availability, etc. 🤯 Must see for all Entra enthusiasts!
What happens when Microsoft's own apps launch a DDoS attack against Entra during a major outage? 😱 We just dropped a new podcast spilling the internal "war stories" behind some of the past outages & the incredible resilience tech born from them Listen to the latest at entra.news/p/inside-...
Dr Nestori Syynimaa reposted
You know you want to speak at Disobey 2026. And now is your chance to do that! Our CfP is open at: cfp.disobey.fi/disobey-2026/ Check the guidelines from the link and send your proposal by Sep 30th!
Updated to include RomHack: www.identitysummit.cloud orangecon.nl www.mcttp.de www.brucon.org romhack.io www.blackhat.com/sector/2025/
My Central Europe / Canada tour looks like this, looking forward to seeing excellent presentations and having inspiring discussions 🔥 See you in September! www.identitysummit.cloud orangecon.nl www.mcttp.de www.brucon.org www.blackhat.com/sector/2025/
My Central Europe / Canada tour looks like this, looking forward to seeing excellent presentations and having inspiring discussions 🔥 See you in September! www.identitysummit.cloud orangecon.nl www.mcttp.de www.brucon.org www.blackhat.com/sector/2025/
Slides from my @wearetroopers.bsky.social talk are available at aadinternals.com/talks
nOAuth revisited by @ericonidentity.com at @wearetroopers.bsky.social
And so it begins.. First @wearetroopers.bsky.social conference day! I've got some rare #AADInternals challenge coins with me and this one goes to first one who asks for it
✅️ slide deck ✅️ demos ✅️ stickers ✅️ challenge coins ✅️ running shoes All ready for the TROOPERS 2025 @wearetroopers.bsky.social
Dr Nestori Syynimaa reposted
New video: Had a cool run through with @lukasberancz into the kind of gaps DART identify commonly in incident response, then a deeper dive on hardware based credential providers like macOS Platform SSO. WATCH: youtu.be/qZV3IeWsRd0
Checked out the first gig of @durandurancom.bsky.social summer tour with wifey at Nokia Arena @tampere.fi 😎
Happy to share that my talk "The Ultimate Guide for Protecting Hybrid Identities in Entra ID" was accepted to #TROOPERS! troopers.de/troopers25/t...
Dr Nestori Syynimaa reposted
Read about our progress on securing Microsoft in our Secure Future Initiative update:
Token Protection allows getting tokens with PRT and session key. As tokens are encrypted, they can't be stolen with AitM (sorry @mrgretzky.breakdev.org)