NEW: Amnesty International has documented two cases where Serbian authorities used Cellebrite to unlock the phones of a journalist and an activist.

And then they installed spyware on the devices.

In a way, this is a return to the old days of government spyware, where remote attacks were rare and impractical, and cops needed to get their hands on target's computers.

https://techcrunch.com/2024/12/15/serbian-police-used-cellebrite-to-unlock-then-plant-spyware-on-a-journalists-phone/

Platform.sh team finds auth bypass in Go SSH package https://platform.sh/blog/uncovered-and-patched-golang-vunerability/

as a sysadmin this so much. It’s one thing to say “oopsie something went wrong” and provide a button for the professionals to see where it went wrong and it’s another to just not provide any diagnostic information so I get to debug a black box.

#shitpost

Just returned from #BHEU. I presented my research on how server-side HTML sanitization is a security nightmare due to the mess that is HTML parsing.

If you are interested in learning more on that topic, please check out the following resources:
Github: https://github.com/ias-tubs/HTML_parsing_differentials
Our S&P '24 Paper: https://www.ias.cs.tu-bs.de/publications/parsing_differentials.pdf
Slides will be available shortly.

Or get in touch :)

Huge thanks to @BlackHatEvents, @InfosecVandana, and all the other great folks who made this such an amazing experience.

@nf3xn Because it's how statistics work: sometimes you end up on the other path. And as they say, when you are large enough, 1 in a million is next Tuesday.

🍿🍿🍿
https://youtu.be/6hVe_spuJQI

Good and interesting presentation by Joe Bialek:

Pointer Problems – Why We’re Refactoring the Windows Kernel:

https://t.co/Qwz0zk3CLH

#microsoft #windows #kernelsecurity #programming

@nsg650 Technically yes, but the system would immediately crash if you enabled it since user mode access happens constantly from ring 0. They are working to enable it for real some time in the future.

Important news: Microsoft is working to bring SMAP into Windows

https://bird.makeup/@ale_sp_brazil/1868496728275452261

@floyd I don't do mobile personally so can't tell, but I've heard about similar cases (no clue how they were resolved).

@floyd Precious jailbreakable phones on different versions. Corellium is nice but doesn't support some important I/O like NFC.

#ai #infosec #InfosecMemes

It's one thing that educated people think that using parrots on acid to generate headlines is a good idea. What's terrifying is that people try to spare the work of writing 3 short sentences.

https://www.bbc.com/news/articles/cd0elzk24dno

Why every app icon has to be blue?

Can you find an ITW 0-day from crash logs? Project Zero finds out

https://googleprojectzero.blogspot.com/2024/12/qualcomm-dsp-driver-unexpectedly-excavating-exploit.html

Yearlong supply-chain attack targeting security pros steals 390K credentials https://arstechnica.com/security/2024/12/yearlong-supply-chain-attack-targeting-security-pros-steals-390k-credentials/

Looking at legacy NeXT source:

https://github.com/johnsonjh/NeXTSrc/blob/ff846608a76ab2fbbb86e8a14c52ac85332f9786/libc-34.1/libc/gen/execvp.c#L34

Quoting from the OS X man page for execvp():

"Historically, the default path for the execlp() and execvp() functions was ``:/bin:/usr/bin''. This was changed to place the current directory last to enhance system security."

#noshitsherlock, #codereview, #appsec, #sdlc, #bug

- There are lots of things worse than movies: politicians, wars, forest fires, famine, plague, sickness, pain, warts, politicians...
- You already mentioned them.
- I know I did. They are twice as bad as anything else.

https://m.imdb.com/title/tt0107362/?ref_=ttqu_ov

JOURNALISM 101 RULE: If someone says it’s raining, and another person says it’s dry, it’s not your job to quote them both. Your job is to look out of the fucking window and find out which is true. — Now more than ever.

Look ma, no copilot in the Notepad!