January 11, 2024
January 11, 2024
"My" CVE-2024-20692 has just been fixed by Microsoft. TLDR: Network secrets can be stolen from the Local Security Authority Subsystem (LSASS) by convincing, or waiting for, a user to connect to an #ActiveDirectory Domain Controller (MITM attack).https://t.co/pL9UH3uyuD
— 📔 Michael Grafnetter (@MGrafnetter) January 10, 2024
Two of my recent tweets have been about optimization, one about the US postal service (USPS) and one about effective altruism (EA). Here's why I defend the USPS and criticize EA.
— John D. Cook (@JohnDCook) January 9, 2024
The fact that USPS routing is sometimes counterintuitive is not necessarily a reason to think it's…
How I pwned half of America’s fast food chains, simultaneously
MrBruh's Epic Blog
How I pwned half of America’s fast food chains, simultaneously. Also checkout Eva’s blogpost of this event. With an upbeat pling my console alerted me that my script had finished running, to be precise it was searching for exposed Firebase credentials on any of the hundreds of recent AI startups. This was achieved through a public list of sites using the .ai TLD and parsing the site data (and any referenced .
how we owned almost all of america's fast food chains
how we owned almost all of america's fast food chains - eva's site
how we owned almost all of america's fast food chains
(me to a plumber in 1974): so in the future… hackers in belarus can hijack your washing machine to solve complex equations, producing magical internet money pic.twitter.com/MU05qcqJx3
— sean mcguire (@seanw_m) January 10, 2024
bro getting rinsed
— NaN demeulemeester (eigenfunc on 🟦🌥️) (@snikolov) January 10, 2024
There is an increase of account takeovers due to insiders at telco firms simply giving control to people paying them. Do a check on systems where this would permit a compromise. https://t.co/WTfLhAZYcQ
— SwiftOnSecurity (@SwiftOnSecurity) January 10, 2024
We can confirm that the account @SECGov was compromised and we have completed a preliminary investigation. Based on our investigation, the compromise was not due to any breach of X’s systems, but rather due to an unidentified individual obtaining control over a phone number…
— Safety (@Safety) January 10, 2024
The private upstream security@kernel.org list has been sitting on CVE-2023-6270 for 103 days, and there's enough public info to see exactly what the problem is:
— Brad Spengler (@spendergrsec) January 10, 2024
__skb_queue_tail gets called on a skb that has its dev set to something for which a reference was just grabbed, but the packet processing can continue after dev_put() is called, which if it's the last reference, will cause it to be freed and the packet processing path to UAF
— Brad Spengler (@spendergrsec) January 10, 2024
.@Volexity detected an incident where it discovered a threat actor chained 2 #0days in Ivanti Connect Secure, CVE-2023-46805/CVE-2024-21887, to achieve RCE, modifying components of the software to backdoor the device.https://t.co/RibC5G0aOp#dfir #threatintel #memoryforensics
— Volexity (@Volexity) January 10, 2024
https://brian.carnell.com/wiki/the_hunt_for_red_october_the_untold_story
Awesome Team! Awesome #fuzzing Projects & a must-watch talk titled "Fuzz Everything, Everywhere, All at Once" at CCC: https://t.co/19kBAp9HCd. A big shout out to Addison, Andrea, Dominik, Donjia, Marc and other contributors to @aflplusplus and LibAFL.
— Thuan Pham (@thuanpv_) January 11, 2024
Malware Analysis - VBS Decoding With Cyberchef (Nanocore Loader)
— Matthew (@embee_research) January 10, 2024
More malware Deobfuscation using Cyberchef, regex and Notepad++ 🔥 https://t.co/y65d3ITlgt#malware #cyberchef
Poland's GDP is growing so fast because a single drone can do the work of 300 Poles https://t.co/t2B0gyngRM
— Nikolaj🍦🇺🇦 (@nikicaga) January 10, 2024
Poland has entered the Information Age pic.twitter.com/Dh1ALrrsbF
— John Stuart MILF (@slobodanchudjak) January 10, 2024
Just like with the drone strike videos from Ukraine, they’ll only post the successful operations
— Brice (@FaranciaAbacura) January 11, 2024
You should write an article for Phrack #71 !! I hear it's coming out by summer time. 👀
— Battle Programmer Yuu (@netspooky) January 11, 2024
Let's open the windows and get some phresh air back into the scene.
If you've got a story to tell, you should send it in by April 1st and keep the vibe going. :)https://t.co/Zc77uUWgvR pic.twitter.com/Q44xnCkug0
How would ransomware work if there was no cryptocurrency?
— nyxgeek (@nyxgeek) January 10, 2024
The business cost and risk would be higher, but terrorism survived in the much more harsher environment and ransomware would too. It's a matter of cooperation – once you recruit the opposite side to cooperate, options would arise.
— dunadan (@udunadan) January 11, 2024
100% correct.
This is the most chilling part of this - these billionaires are unashamed in their attempts to control the media using their money and power https://t.co/cLxry6MB10 pic.twitter.com/S8oHVuWUbv
— Ed Zitron (@edzitron) January 11, 2024
SSH-Snake: Automatic traversal of networks using SSH private keys
https://joshua.hu/ssh-snake-ssh-network-traversal-discover-ssh-private-keys-network-graphHarder Drive: Hard drives we didn't want or need
‘Iranian cyber army’ blamed as Wikipedia deletes atrocities
Start the conversation: