@da_667 @screaminggoat

Wut

@cR0w @krypt3ia

Enhancing Security with Systemd: Secure Web Tokens and TPM 2.0 has been released on media.ccc.de and YouTube #asg2024 #MainHall https://media.ccc.de/v/all-systems-go-2024-265-enhancing-security-with-systemd-secure-web-tokens-and-tpm-2-0 https://www.youtube.com/watch?v=NrO-Q_x36U8

[RSS] CVE-2024-28987: SolarWinds Web Help Desk Hardcoded Credential Vulnerability Deep-Dive

https://www.horizon3.ai/attack-research/cve-2024-28987-solarwinds-web-help-desk-hardcoded-credential-vulnerability-deep-dive/

Critical Vulnerabilities in WatchGuard SSO Agent https://www.redteam-pentesting.de/advisories/rt-sa-2024-006/

The conference website is live!
https://re-verse.io/

CFP is now open and training tickets are open as well. General ticket sales live in three weeks!

This week's show is up, featuring @metlstorm and special guest co-host @RGB_Lights. Available on YouTube or through your regular podcatcher...

https://www.youtube.com/watch?v=u9G4Ov5cXw4

. 🔥 🔥 🔥 🎟️ 🎟️ 🎟️ 🔥 🔥 🔥
#r2con2024 tickets are finally available!
🔥 🔥 🔥 🎟️ 🎟️ 🎟️ 🔥 🔥 🔥

https://radare.org/con/2024/

PD: All presentations will be recorded and published online for free. Tickets are only required to physically attend the event.

After his popular series on customizing the Sliver C2, our very own @ale98 is back with another series of three articles. This time, the topic is #Windows #kernel #driver #vulnerability #research and #exploitation, inspired by @saidelike’s @OpenSecurityTraining2 courses.

Part 1 is already out:
https://security.humanativaspa.it/exploiting-amd-atdcm64a-sys-arbitrary-pointer-dereference-part-1/

The others will follow shortly in the next weeks.

@dcoderlt There are probably less suspicious alternatives, but this is the one I know that certainly can do this.

@dcoderlt Hardcode the address on a local low-priv proxy (e.g. burp free)?

@cR0w This is very likely the reason, and IMHO it is good that general awareness is now raised. @Saren42 is technically right of course.

Holy fuck folks. Like Kapersky and their ties to the Russian government suck, yes. Them being banned from doing business in the US probably needed to be done. But folks, them installing UltraAV and uninstalling Kapersky was announced weeks ago. Paying customers got emailed about it weeks ago. Just because people don't pay attention doesn't mean it's time to engage in low effort journalism (like so many outlets are doing.)

My citation for reference. https://www.zdnet.com/article/one-million-us-kaspersky-customers-to-be-migrated-to-this-lesser-known-alternative/

#antivirus #kapersky #security #infosec #cybersecurity #malware

AWS Nitro Enclaves offer strong isolation for sensitive workloads but require careful security implementation. We cover key areas to help developers avoid common pitfalls and harden their enclave deployments. https://blog.trailofbits.com/2024/09/24/notes-on-aws-nitro-enclaves-attack-surface/

Today is your last chance to register to my Windows Kernel Exploitation training delivered at #hexacon in Paris/France https://www.hexacon.fr/trainer/halbronn/

@joxean I generally have a couple Gs free on my standard plans, so I'd count that as no cost. Hetzner has traffic limits, but that adds no additional cost until you try to serve many users (at which point torrents can help).

@joxean BitTorrent also comes to mind!

@joxean I can easily host 1.2G for you on one of my VPSs

@kaoudis I think what you describe is a slightly different case from the one in the post: you want to explicitly detect failure, while the author doesn't (note that there are no checks for empty).

Considering that even the Big Fat Policy Cat mentioned in the post couldn't prevent digression from the stated rule, it's a good question if trusting an API in a system with nullable types is a good idea in the first place...

Anyway, Mr.Chen usually answers comments, so it may worth to bring up these points at the source too!

[RSS] Going beyond the empty set: Embracing the power of other empty things

https://devblogs.microsoft.com/oldnewthing/20240923-00/?p=110297