As @daringfireball writes, Google is lying through its corporate teeth about its claims to be encrypting messages.

https://daringfireball.net/linked/2024/12/04/shame-on-google-messages

What a slimy company Google has become, so far distant from its early days when it was so admirable.

‼️ New vulnerabilities have been disclosed in the Veeam Service Provider Console.

CVE-2024-42448 is critical, potentially allowing remote code execution. CVE-2024-42449 is rated high, potentially leaking the NTLM hash of a service account & allowing file deletion.

Learn more and see how to find potentially impacted systems:

https://www.runzero.com/blog/veeam-instances/

I updated the diagram representing the different Point and Print configurations and their exploitation on my blog.

Hopefully, this should provide a better understanding of the whole "PrintNightmare" situation to both defenders and red teamers. 🤞

New blog: Risk talk at JPL

Before Thanksgiving, I was in Southern California, and I was honored to be able to give a talk at the Jet Propulsion Lab. The talk is titled “Threat Modeling: Engineering and Science.” The first part of the talk puts threat modeling in context for engineering secure systems, while the second part considers why we do what we do and asks some questions about how we think about risk.

(1/4 https://shostack.org/blog/risk-talk-at-jpl/

Cisco security advisory 04 December 2024: Cisco NX-OS Software Image Verification Bypass Vulnerability
CVE-2024-20397 (5.2 medium severity but Cisco wrote high impact) A vulnerability in the bootloader of Cisco NX-OS Software could allow an unauthenticated attacker with physical access to an affected device, or an authenticated, local attacker with administrative credentials, to bypass NX-OS image signature verification. No mention of exploitation/public disclosure.

#cisco #vulnerability #cve #CVE_2024_20397 #cisconxos #infosec #cybersecurity

CISA: CISA Adds One Known Exploited Vulnerability to Catalog
Hot off the press! CVE-2024-51378 (perfect 10.0 critical 🥳 @cR0w) CyberPanel Incorrect Default Permissions Vulnerability

#cyberpanel #CVE #CVE_2024_51378 #cisa #kev #cisakev #knownexploitedvulnerabilitiescatalog #vulnerability #eitw #activeexploitation #infosec #cybersecurity

Unpatched and Exploited Zero-Days: Multiple vulnerabilities in I-O DATA routers UD-LT1 and UD-LT1/EX
Two different sets of researchers reported vulnerabilities in I-O DATA routers to JPCERT/CC.

• CVE-2024-45841 (6.5 medium) Incorrect Permission Assignment for Critical Resource
• CVE-2024-47133 (7.2 high) OS Command Injection
• CVE-2024-52564 (7.5 high) Inclusion of Undocumented Features

The developer states that attacks exploiting these vulnerabilities have been observed.

The developer states that the updates addressing these vulnerabilities (CVE-2024-45841, CVE-2024-47133) are planned to be released around December 18, 2024. Too early to speculate and no additional information provided.

cc: @cR0w @mttaggart @ntkramer @dreadpir8robots @neurovagrant @goatyell @metacurity (remember to remove the mentions to avoid ReplyAll madness)

#vulnerability #jpcertcc #cve #IODATA #eitw #activeexploitation #infosec #cybersecurity

Rust 1.83.0 has been released! 🦀✨

This release includes mutable references and pointers in const, references to statics in const, new `ErrorKind`s, and many new const methods on pointers, slices, floats, and more!

Check out the announcement: https://blog.rust-lang.org/2024/11/28/Rust-1.83.0.html

Don't threaten me with a good time, Microsoft.

https://www.theregister.com/2024/12/04/microsoft_update_recall_bug/

I haven't even had my first cup of coffee and we have another ../ CVE. This time it's Synology: https://nvd.nist.gov/vuln/detail/CVE-2024-11398

#directoryTraversalMemes

Exactly 11 (!) years ago we released an advisory for an rsync 0-day.

Two days earlier the Gentoo Linux mirror I was hosting and maintainig was compromised with it.

What a ride.

https://forums.gentoo.org/viewtopic.php?t=111779

https://lists.samba.org/archive/rsync-announce/2003/000011.html

Maybe fun to know - using #MS365 means that the US government has bulk access to your data, which matters if you are a government yourself. Supporters of Microsoft will tell you you can easily use "double key encryption" to protect your MS365 data against US government snooping. This is how easily you can do that. Hint, it involves GitHub and compiling code: https://learn.microsoft.com/en-us/purview/double-key-encryption-setup

My VirusBulletin presentation: A web of surveillance was uploaded to YouTube: https://www.youtube.com/watch?v=iERGg1dUVNE