Near as I can tell, the activity around the #Struts2 bug,
CVE-2024-53677, is just ham-handed runs of some generalized PoC, and nobody's actually exploiting this yet (since exploitation would be very application/path specific).

Most of the news last week was all "exploitation happening, patch and rewrite everything now!" but not seeing any reports of successful (or even possibly successful) this morning.

Tell me I'm wrong!

(The PoC identified by SANS at https://isc.sans.edu/diary/31520 isn't specific to some particular application -- it's on the user to define upload_endpoint and assumes no auth or session or anything.)

Using @voooooogel control vector library to backdoor a model so that it introduces command injection vulnerabilities rather than using safer subprocess methods

2024 Headline of the Year nominee (June)

Hi all. In order to make the Defensive Security Podcast content a bit more approachable and easier to navigate, I've created a playlist of individual stories/segments we cover here: https://www.youtube.com/playlist?list=PLzHXsgtVDQEq9JiCbwJojE4nd9dRVAT5l

Note: I've only gone back 4 episodes, but will be doing this for all episodes going forward.

Happy holidays!

Kagi's new video search controls let you replace clickbait thumbnails with real screenshots, customize title formatting, and focus on actual content.

You may find these controls in your search settings.

#Kagi #Search #AdFree #Videos

I started keeping a log of the serious attempts I've made to use generative AI for things (mostly coding-related). I've been bucketing them as successes or failures, along with the date and models used.

From the past several months, I'm up to 9 failures and 3 successes. I'll share this list some day.

When these systems have been successful, it's pretty neat. However, the successes I've seen have been for easy things, and the failures have mostly been time-sucks for me.

I feel like a heretic saying this (I'm a Principal Machine Learning Engineer), but I am not seeing a net benefit from using generative AI in my own work!

#directoryTraversalMemes

I’ll be honest, hearing SEO people complain about the state of Google now is like hearing an arsonist complain that they just can’t get the quality of kerosene they used to.

A few of my followers mentioned that they'd like to know about my background as a "musician", so I am very happy to share my story as an amateur who went from trying to form a high school band to publishing a track with Sony Music, performed by a famous singer and produced by an even more famous producer.

Buckle up! I hope it is going to be an inspirational story or something, because it is a story of giving up and starting again, and again, and again.

New post in my Hyundai Kona Electric reverse engineering series: introducing the Fakon project
https://www.projectgus.com/2024/12/fakon/

#badpuns #reverseengineering #KonaHacking #EVs

current debian no longer writes to syslog 😦

if you look in /var/log, someone left a README file.

the README says "you are looking for logs? but you cannot find them?" and continues in broken english, smugly telling you that systemd has made logs obsolete, and you should use "journal cattle" to ask politely for your own logs.

[did you just tell me to fuck off, jim?]

if you run journal cattle, it shows a page of syslog from april. if you hit G to go to the end, it hangs forever.

[slow clap]

Compiling C to Safe Rust, Formalized

Link: https://arxiv.org/abs/2412.15042
Discussion: https://news.ycombinator.com/item?id=42476192

#rust

@carbontwelve I used machine learning in my PhD. The use case there was data prefetching. This was an ideal task for ML, because the benefits of a correct answer were high and the cost of an incorrect answer were low. In the worst case, your prefetching evicts something from cache that you need later, but a 60% accuracy in predictions is a big overall improvement.

Programming is the opposite. The benefits of being able to generate correct code faster 80% of the time are small but the costs of generating incorrect code even 1% of the time are high. The entire shift-left movement is about finding and preventing bugs earlier.

LBs (https://peoplemaking.games/@david_chisnall@infosec.exchange/113690380907222545): not surprised at all copilot was a net negative in productivity. it can't be relied upon to write correct code which means you become the human code reviewer of machine generated code which is generated to *look* plausible

code review already (in my experience) has much higher cognitive load than just writing code yourself, and it would only be made worse by the fact that errors are likely to be particularly hard to detect because the LLM produces code that looks correct, something that wouldn't normally be an issue when reviewing code written by a human

Another #Ghidra goodie:
https://www.tripwire.com/state-of-security/ghidra-101-creating-structures-in-ghidra

structs are a bit annoying to reverse, especially when they are passed around like there's no tomorrow, and in part they track state, in part they refer to peripheral registers... x)

Man, corporations really want to put a stop to libraries:

https://www.cbc.ca/news/canada/ottawa/ottawa-library-e-books-queues-1.7414060?cmp=rss

"Depending on the title, public libraries may pay two or three times more for an e-book than they pay for its print edition. In some cases, the e-book may be up to six times the price, librarians told CBC."

"Those publishers ... will often license copies of e-books for just 12 or 24 months. Once that licence expires, libraries must repurchase access to the same book." #canada #cdnpoli #books