August 17, 2022
-
-
-
A post that goes into the details of some cyber criminal infrastructure.
https://medium.com/csis-techblog/inside-view-of-brazzzersff-infrastructure-89b9188fd145-
blog.electrovolt.io/posts/element-… This involves usage of v8 n-day exploit to bypass certain Electron Framework restrictions.
-
VPNs on iOS are a scam, apparently.
https://www.michaelhorowitz.com/VPNs.on.iOS.are.scam.php-
-
I said, YOUNG DEV! ♪ ♫ ♬ With Python, Ruby, or Go You can WRITE IT! And I'm sure you will face So many. Ways. To. Fuck. Up. Whitespace... ♪ ♫ ♬ It's fun to write config in Y.A.M.L! ♪ ♫ ♬
-
-
-
As @dinodaizovi said, “breaches are primitives” chained to gain access to the actual target.
I know that more advanced groups have been doing this for years, decades really, but it is nice to see it entering the public sphere. As some people will be aware, one of my quotes on security is is “trust is the root of all compromise.” These ‘supply chain’ attacks are exploitation of trust relationships. Trust relationships are more powerful than memory corruption. Once you gain access you are a legitimate user as far as the system is concerned. And they’re everywhere (see Halvar’s comment below)
Here is the original post from Digital Ocean, the thing to read if you’re more curious about the details.
https://www.digitalocean.com/blog/digitalocean-response-to-mailchimp-security-incidentAnd @HalvarFlake’s take on the incident.
-
-
-
-
-
FizzBuzz101's challenge shows a novel leakless + data-only technique to pwn Linux with a 6 byte overflow: willsroot.io/2022/08/revivi… D3v17's CoRJail shows a novel technique used on kctf to achieve arb free with poll_list :
