the grugq's newsletter
Twitter avatar for @0xdea
raptor@infosec.exchange @0xdea
@buffaloverflow See also this writeup by @thezdi

Part 1: The ProxyShell Path Confusion for Every User (CVE-2022-41040)

Part 2: PowerShell Remoting Objects Conversions – Be Careful or Be Pwned (CVE-2022-41082)

thezdi.com/blog/2022/11/1…

8:34 AM ∙ Dec 26, 2022
1Retweet

-

Twitter avatar for @dcuthbert
Daniel Cuthbert @dcuthbert
If strange signals, unexplained Russians talking numbers and other oddities found lurking in the kHz bands gets you excited, then the European Numbers Information Gathering & Monitoring Association (ENIGMA) newsletter is very good and worthy of a visit signalshed.com/nletter05.html#
A picture of a VGDSh dipole above Russian Embassy in The Hague, Netherlands
8:47 AM ∙ Dec 26, 2022
1Retweet

-

Twitter avatar for @lukOlejnik
Lukasz Olejnik (@LukaszOlejnik@Mastodon.Social) @lukOlejnik
LastPass breach is much more serious than the official Breach Notice wants you to know. It is, however, very smartly crafted. Essentially cybersecurity/privacy PR. Decrypted here. palant.info/2022/12/26/wha…
Image
Image
Image
Image
6:45 PM ∙ Dec 26, 2022
78Retweets

-

Twitter avatar for @IwriteOK
Robert Evans (The Only Robert Evans) @IwriteOK
everybody always talks about who they'd give advanced weapons to if they had a time machine. but the fun would be in dispensing inconsequential tech at random. fog machines for Han China. Yankee Candles for ancient Polynesia. Fake dog poo for the Roman Empire.
2:32 AM ∙ Dec 26, 2022
291Retweets

-

Twitter avatar for @AthertonKD
Kelsey D. Atherton @AthertonKD
NIEN [speaking fluent Kikuyu]: The chains of galactic imperialism can only be broken through the collective struggle of a colonial proletariat, united by resistence and bound through brotherhood

LANDO: What's that, little buddy, looking for a way to make some quick credits?

Twitter avatar for @sidhubaba
Siddhartha Mahanta @sidhubaba
An ‘Andor’-like show for Nien Nunb called ‘Nunb’
3:10 AM ∙ Dec 27, 2022
18Retweets

-

Twitter avatar for @lasq88
Lasq @lasq88
I finally managed to update my Malware Analysis resources list. Removed dead links, and added a lot of new ones:
github.comLearingMaterials/MalwareAnalysis.md at main · lasq88/LearingMaterialsDifferent learning materials. Contribute to lasq88/LearingMaterials development by creating an account on GitHub.
9:03 PM ∙ Dec 26, 2022
95Retweets

-

Twitter avatar for @ManieshNeupane
It's Me ! @ManieshNeupane
Mindmaps for bug bounty Hunters, pentesters, and offensive/defensive security Professionals !

github.com/imran-parray/M…

Image
2:40 PM ∙ Dec 26, 2022
238Retweets

-

Twitter avatar for @mathemagic1an
Jay Hack @mathemagic1an
The 'data engine' idea of defensibility in AI may not be as defensible as we thought:

In SELF-INSTRUCT, authors get GPT-3 to generate it's own dataset for instruction tuning, outperforming vanilla GPT-3 and comparable to InstructGPT.

arxiv.org/pdf/2212.10560…

Here's how 👇

Image
2:34 PM ∙ Dec 26, 2022
174Retweets

-

Twitter avatar for @bscarvell
brendan @bscarvell
Here's my advisory and exploit for an unauthenticated remote code exeuction vulnerability I discovered in the new Netcomm NF20MESH Cloud Mesh routers.
github.comadvisories/2022_netcomm_nf20mesh_unauth_rce.md at main · scarvell/advisoriesContribute to scarvell/advisories development by creating an account on GitHub.
6:15 AM ∙ Dec 27, 2022
30Retweets

-

Twitter avatar for @zbreeves
zack reeves @zbreeves
losing my mind at this sticker on the bhagavad gita in the DFW airport chapel
Image
Image
1:47 PM ∙ Dec 25, 2022
615Retweets

-

Twitter avatar for @evacide
Eva @evacide
2022 was a big year for fighting tech-enabled abuse, from physical trackers to stalkerware.
eff.orgFighting Tech-Enabled Abuse: 2022 in ReviewNo year that includes tech-enabled abuse can be said to be a good year. But 2022 has certainly been an eventful year for the technologies used as instruments of coercive control domestic abuse situations, ranging from stalkerware to physical trackers. In February, EFF called for the FTC to...
7:37 AM ∙ Dec 27, 2022
32Retweets

-

FACTS ABOUT MASTODON

If you are curious about leaving the cooked turkey site and going to the elephant site, here are some important tips:

1. It sucks. But then, so does every site.

2. You can still shitpost. Take great glee.

…

David Gerard: "FACTS ABOUT MASTODON If you are curious about le…" - GSV Sleeper Service

FACTS ABOUT MASTODON If you are curious about leaving the cooked turkey site and going to the elephant site, here are some important tips: 1. It sucks. But then, so does every site. 2. You can still shitpost. Take great glee. 3. Picking your server instance is super important. Ideally you should start at a large instance, and leave because it's full of white suburban NIMBY reactionaries who joined in November because they were promised 0 uncomfortable experiences in their lives and lash out whenever this turns out not to be the case. Then you move to a smaller server where suddenly you can't talk to your friends because the admin of your instance is feuding with the admin of their instance. Then you wait a month before you can move again. In this regard, the feudal structure of Mastodon instances is very like early 2000s message boards, whenever the admin got drunk and deleted the site. 4. You can work around the feudalism by running Mastodon yourself. It's the size of a mastodon and costs a fortune. You can run Pleroma, which is smaller, and is also favoured by Nazis by unfortunate historical accident. Pleroma is perfectly good software that fulfils a need for something smaller than Mastodon, but also the devs are definitely not Nazis but are the other ten guys at the table. There was a hilarious moment where the guy behind Spinster was so obnoxious he got kicked out of Pleroma and started his own fork called Soapbox/Rebased. He is now known as Soapbox Terf. The nice people went to Pleroma fork Akkoma, which Soapbox Terf calls the "try server", a review I understand they were delighted by. Try that. There's also Misskey, which is a bit weird and Japanese, and supports cat ears right there in the protocol. 5. Any bozo who complains about your posts with assertions about the Fediverse that assume it all runs on the rules of mastodon.social is one of the suburban NIMBYs and invariably joined in November. Block and don't look back. 6. If anyone annoys you about your posting, you can improve their feed for them by blocking them from ever seeing your posts. The blocking tools are marvellous. 7. There are NO QUOTE TWEETS on Mastodon and anyone who wants QUOTE TWEETS is an invader, pollutant and corrupting influence despoiling the suburban vistas of Mastodon who only wants quote tweets so they can wreak EVIL. So quote-tweeting is well supported in Akkoma and Misskey (and forks thereof), is in the Treehouse fork of Mastodon, and will be coming to more Fediverse software soon. 8. In Mastodon, Eugen Rochko has achieved the creation of something greater than himself. And he will never forgive it. 9. The Fediverse interprets Website Boy as damage and routes around him. 10. Mastodon is yet another demonstration that worse is better. So come onto Mastodon, and be that worse. ==== EDIT: this post is attracting some very dumb reply guys. Consider not* posting debate club fatuity.

-

Twitter avatar for @ollieatnowhere
Ollie Whitehouse @ollieatnowhere
In Jan 2018 a Subreddit was created and in August 2021 it was joined by a Substack.

'Building a social cyber community of interest part II - further lessons from the field'

or how 40,000 members and 4,000 subscribers came together for meta analysis.

cybercto.substack.comBuilding a social cyber community of interest part II - further lessons from the field14 months of growth continues and meta analysis wins..
7:55 AM ∙ Dec 27, 2022
3Retweets

-

Twitter avatar for @vxunderground
vx-underground @vxunderground
.@vx_herm1t, the creator of vxHeaven, the website which serves as the inspiration to vx-underground, was recently interviewed. herm1t now serves as Press Secretary of the Ukrainian Cyber Alliance and is the founder of RUH8

Watch the video here:

youtube.comХто захищає Україну у кібервійні? Український кіберальянс та його діяльність | HackYourMomХто захищає Україну у кібервійні? Український кіберальянс та його діяльність | HackYourMom🔔 Підписуйся на канал, щоб бути у інформаційній безпеці, та дізнав...
5:31 PM ∙ Dec 27, 2022
2Retweets

The Info Op is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

Don't miss what's next. Subscribe to the grugq's newsletter:
Find the grugq's newsletter elsewhere: Twitter