the grugq's newsletter

Subscribe
Archives
November 21, 2022

November 21, 2022

-

Subscribe now

Twitter avatar for @0xor0ne
0xor0ne @0xor0ne
Kernel memory allocator hardening by @Apple kheap, data split, memory sequestering, kalloc_type, temporal safery... security.apple.com/blog/towards-t… #apple #malloc #kalloc #memory #infosec #cybersecurity #exploit
Image
Image
Image
8:30 AM ∙ Nov 20, 2022
141Likes39Retweets

-

Twitter avatar for @VietPetrus
Petrus Viet @VietPetrus
I have successfully reproduced CVE-2022-43781 causing RCE on Bitbucket server. Ref: jira.atlassian.com/browse/BSERV-1…
Image
6:47 AM ∙ Nov 19, 2022
467Likes90Retweets

-

The Google Cloud security team has released a set of open-source YARA Rules and a VirusTotal Collection to help security practitioners flag and identify Cobalt Strike components and specific Cobalt Strike versions on their networks.

https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse https://mastodon.social/@campuscodi/109376602832029191

-

Twitter avatar for @IlvesToomas
toomas ilves a.k.a. @toomas_ilves@mastodon.social @IlvesToomas
Time for all countries bordering Russia to beef up their borders even more.
newsweek.comLeaked FSB letters reveal civil war among Putin’s allies“The Service (FSB) is not ready for internal terror, and Prigozhin and Kadyrov think that their time has come,” an FSB agent wrote in an email shared with Newsweek.
8:41 PM ∙ Nov 20, 2022
1,293Likes335Retweets

Bear in mind that the source of the “leak” is “Winds of Change” a completely unverified source. They claim to be inside the FSB. But, here’s the thing, the FSB generally takes a poor view on people leaking secrets. As a rule they don’t let people just hang out at the office and tell the world what’s going on internally. Treason ain’t just a river in Egypt. 🤔

-

Twitter avatar for @samthielman
💭 @samthielman
Oh boy, $150,000!
Image
9:34 PM ∙ Nov 19, 2022
80,008Likes8,817Retweets

-

Twitter avatar for @BenjaminVanDyne
benjaminvandyne@zirk.us @BenjaminVanDyne
Ok but actually
Image
5:00 PM ∙ Nov 20, 2022
30,317Likes2,824Retweets

-

Twitter avatar for @_MG_
MG @_MG_
Did you know your Christmas tree uses more secure fuses than a lot of “secure” hardware? I learned about this because of a one in one million OMG Cable.
Time for a thread! 1/n
3:50 AM ∙ Aug 15, 2021
393Likes82Retweets
Twitter avatar for @_MG_
MG @_MG_
But let’s focus on *real* OTP fuses. Here is what a pair of real OTP fuses look like. The one on the right was “blown” by sending sufficient power through it & is now disconnected, making it read as a 0, while the intact fuse reads as a 1. Seems pretty permanent. Right? 4/n
Image
3:50 AM ∙ Aug 15, 2021
132Likes18Retweets
Twitter avatar for @_MG_
MG @_MG_
Well… there are some very rare conditions where a blown fuse can regrow. I saw exactly this happen with an OMG Cable when a MAC address suddenly changed after a few weeks of use. 10011111 (9F) became 11011111 (DF) 5/n
3:50 AM ∙ Aug 15, 2021
84Likes8Retweets

-

"AD is a system where any time you hack any computer on the network, you can become the domain controller, and own the whole company. That's just how it works.”

— @dave_aitel@mastodon.social

https://infosec.exchange/@raptor/109378388882420409

-

Twitter avatar for @willgater
Will Gater @willgater
Wow. Earth setting behind the limb of the Moon.
Screen captured the last ~3.5 minutes of imagery before loss of signal and turned it into a (sped up) GIF animation.👇 Credit: NASA TV/ESA
An animation of frames from NASA TV showing the small blue and white disc of the distant Earth setting behind the mottled grey globe of the Moon (which is positioned across much of the right side of the frame). The Orion spacecraft and service module appear across the left hand side of the frame.
12:44 PM ∙ Nov 21, 2022
27Likes15Retweets

-

Twitter avatar for @dcuthbert
Daniel Cuthbert @dcuthbert
Thanks to @Kerberosmansour for introducing me to Tony's brilliant talk about how one goes about securing the most physically attacked thing: the games console
youtube.comGuarding Against Physical Attacks: The Xbox One Story — Tony Chen, Microsofthttps://PlatformSecuritySummit.com/2019/speaker/chenEvery game console since the first Atari was more or less designed to prevent the piracy of games and yet...
12:26 PM ∙ Nov 21, 2022

-

Don't miss what's next. Subscribe to the grugq's newsletter:
X