Track of the day: Metodi Hristov - Modern Dystopia

https://soundcloud.com/metodihristov/metodi-hristov-modern-dystopia-original-mix-set-about

Fuck
These
Algorithms

#techno #AI

back in my day we called this spyware

#AI #privacy #Microsoft

This SnapAttack writeup on CVE-2024-30051 is pretty neat: https://blog.snapattack.com/hunting-cve-2024-30051-8de021f0cf77

But don't let the mention of the UAC and even T1548.002 suggest that it's merely a UAC bypass. This allows going from non-admin to SYSTEM.

This is in no way a UAC bypass. The UAC's consent.exe is merely a mule to get the user-provided payload DLL to execute with SYSTEM privileges (by way of dwm.exe).

[RSS] Abusing url handling in iTerm2 and Hyper for code execution

https://vin01.github.io/piptagole/escape-sequences/iterm2/hyper/url-handlers/code-execution/2024/05/21/arbitrary-url-schemes-terminal-emulators.html

#OffensiveCon24 - Claudia d'Antoine - Opening Remarks in Memory of Our Friend Sophia

https://www.youtube.com/watch?v=a7zCs25M8Y8

TOCTOU||GTFO - The State of Sandboxing in Linux

https://git.sr.ht/~alip/syd/tree/main/item/doc/toctou-or-gtfo.md

Revolutionary idea:

An electronic toothbrush that doesn't tip over when you look at it.

A major part of why I find #wh40k Adeptus Mechanicus so fascinating is because they are technologists in a reality where critical parts of technological knowledge is lost, and this resonates really well to what we're observing in this day and age[1][2][3]:

https://youtu.be/xCGKPRiJp84?si=M8o4zBlHh_YueCr_&t=1553

[1] https://berthub.eu/articles/posts/cyber-security-pre-war-reality-check/
[2] https://bsd.network/@cynicalsecurity/112468795879743909
[3] https://infosec.place/notice/Ai3X2gievLP2m9YRns

New assessment for topic: CVE-2024-22729

Topic description: "NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page. ..."

"[metadata only] ..."

Link: https://attackerkb.com/assessments/1671c0a1-d996-4224-8034-3782acdb3bad

My Saturday in a nutshell:

https://www.youtube.com/watch?v=9n1dtmzqnCU

CVE-2024-23803 - Siemens Tecnomatix Plant Simulation Out-of-Bounds Write Vulnerability
https://zeifan.my/siemens_tecnomatix_oobw/?s=09

Migrated my vim config to Lua-based neovim+Lazy.nvim. I feel violated.

"[REDACTED] is a modern, Rust-based terminal with AI built in"

WHY?!?!?!

[RSS] QNAP QTS - QNAPping At The Wheel (CVE-2024-27130 and friends)

https://labs.watchtowr.com/qnap-qts-qnapping-at-the-wheel-cve-2024-27130-and-friends/

https://arstechnica.com/security/2024/05/ssh-backdoor-has-infected-400000-linux-servers-over-15-years-and-keeps-on-spreading/

Kernel.org folks never provided the postmortem they promised in 2011 after finding their infrastructure had been rooted. They also didn't bother to respond to my email earlier this week seeking comment on new information that, in fact, their servers had been rooted 2 years earlier by a 2nd, even more sophisticated piece of malware.

While no one responded to me, here's Linux Foundation member Konstantin Ryabitsev responding elsewhere to my post that the breach was the subject of an FBI investigation, and later of a lawsuit. This says lots about the obligation kernel.org, an organization entrusted with huge responsibility, feels toward transparency. If Microsoft did this, people would be apoplectic.

lmaooooo https://vxtwitter.com/yifever/status/1790941768617439339

Three years ago, #FDroid had a similar kind of attempt as the #xz #backdoor. A new contributor submitted a merge request to improve the search, which was oft requested but the maintainers hadn't found time to work on. There was also pressure from other random accounts to merge it. In the end, it became clear that it added a #SQLinjection #vuln. In this case, we managed to catch it before it was merged. Since similar tactics were used, I think its relevant now

https://gitlab.com/fdroid/fdroidclient/-/merge_requests/889

Is there a legislation in #Berlin requiring every bar to have a disco globe? They seem to obey this rule pretty strictly.