Binji's teaching in Europe! By popular demand and for the first time ever, Novice to Ninja is online in GMT! Uncover the truth behind today's most pressing cybersecurity issues, and what might be done to mitigate them. No reversing experience required! https://binary.ninja/training/n2n-syllabus.html

The SAILR paper is being presented at @USENIXSecurity
.

It's a nice piece of work. If you're interested in what we think, take a look at the in-depth review we did on Feb!

https://pad.rev.ng/s/T3RdsvKNx#

It's here! #Phrack officially released online, and with it my article! http://phrack.org/issues/71/9.html#article It's about writing a good virus, using oldschool techniques to show you how effective old stuff can still be! #infosec #malware

ugh. I picked up a shitty NUC from ewaste and it had a label on it for an AI company.
ahh, another startup that burnt out trying to build some silly AI project on crap hardware. I wonder what they did? I check their URL:
ahh. healthcare. great, great.

That’s no moon – it’s the Moon 🌗

The first colour images from ESA JUICE’s close lunar encounter last night are out.

Taken by the monitoring cameras, both show sunlit craters & shadows on the surface with parts of the spacecraft in the foreground.

At the top of the second image, you can just make out Earth as a small dark circle, surrounded by the ring of its backlit atmosphere.

We arrive (t)here tonight 🛰️🌏

Kudos to @stim3on for the magical processing 🙇‍♂️

#JUICELEGA

UPDATE: Palo Alto Cortex XSOAR CommonScripts Critical Vulnerability (CERT-EU Security Advisory 2024-083)

On August 14, 2024, Palo Alto Networks released a security advisory for a critical command injection vulnerability, CVE-2024-5914, in Cortex XSOAR. This flaw allows unauthenticated attackers to execute arbitrary commands within the context of an integration container, potentially compromising the system. The vulnerability affects the product's CommonScripts Pack and is rated as high severity with a CVSS score of 9.0.

https://www.cert.europa.eu/publications/security-advisories/2024-083/

There's an article written by me in Phrack Magazine: http://www.phrack.org/issues/71/11.html#article.
Very proud to be in that historic hacking magazine! For me, this is a major achievement :)

Bonus: the source code and binaries are here https://github.com/cryptax/talks/tree/master/Phrack-71

Enjoy! And if you really like it, I'd appreciate you nominate it here https://www.virusbulletin.com/conference/peter-szor-award/

Anybody with a paper edition to send me? This offer still stands: https://mastodon.social/@cryptax/112775284733028530

#phrack #dart #reverse #flutter

OpenBSD crond / crontab set_range() heap underflow - CVE-2024-43688

https://www.supernetworks.org/CVE-2024-43688/openbsd-cron-heap-underflow.txt

https://vulnerability.circl.lu/cve/CVE-2024-43688

#vulnerability #cron #crontab #infosec #crond #openbsd #unix

http://phrack.org/issues/71/1.html new Phrack is out!

it you would like to read ~10k words about going from "a 12kb binary that fell off a truck" to "a disassembler that knows the whole instruction set except like five opcodes", all without running a single instruction, phrack 71 is up and has a treat from me to you: http://phrack.org/issues/71/3.html#article

go to the cloud they said
it'll be fine they said

@johnefrancis
I was able to open up a Titan missile guidance computer and examine it hands-on. Unfortunately, nobody would give me a Minuteman guidance system to teardown. But I found that the National Air and Space Museum has extremely detailed photos that I could use for analysis.
https://www.righto.com/2020/03/inside-titan-missile-guidance-computer.html

I wrote a blog post that goes into much more detail on the Minuteman guidance system and computer, so check it out: https://www.righto.com/2024/08/minuteman-guidance-computer.html
22/23

Although the Minuteman guidance system is interesting technologically, one has to keep in mind its purpose was to unleash nuclear devastation On the other hand, Minuteman has been successful as a peacekeeping deterrent (so far). In any case, it is morally ambiguous compared to, say, the Apollo Guidance Computer. There are currently 400 Minuteman missiles active, down from a peak of 1000. 21/N

A launch normally requires launch orders from two separate Launch Control Centers. But a single surviving Launch Control Center could launch the missiles, unless vetoed before a timeout. A complicated state machine managed the launch process. 20/N

The Minuteman III missile (1970) is America's land-based nuclear deterrent, with 400 missiles ready to launch. The missile used a complex guidance system with over 17,000 electronic and mechanical parts that cost $4.5 million in current dollars. Let's take a look at the guidance system and computer. 1/N

thanks to @gsuberland's excellent work, we now have an in-depth dive into the technical details of the #GlasgowInterfaceExplorer hardware published on the website!

you can read them at https://glasgow-embedded.org/latest/revisions/revC3.html

Recently, a Dutch hacker found a vulnerability allowing him to shut down 4 million solar power installations. A handful of mostly non-European places manage perhaps 100 GW of solar power in the EU. Any mishap there, or heaven forbid, a compromise, could easily shut down so much power that the European electricity grid would collapse. Shockingly, we regulate these massive control panels as if they are online birthday calendars. And that must change. https://berthub.eu/articles/posts/the-gigantic-unregulated-power-plants-in-the-cloud/

@neurovagrant
Their products are vulnerability free, so clearly there's nothing to see here.

r2 script to symbolicate #ios kernels using the json files generated by the IPSW tool from @blacktop https://github.com/radareorg/radare2/blob/master/scripts/ipsw-kernel-symbolicate.r2.js