Dan Goodin

Reporter covering security at Ars Technica. DM me on Signal: +1650-440-4479.

Public Key

npub1yyl6ktycvjymch9hyzq5yqphj89kalfqmtswcjpjmp7s67ms6g9sdp6r3v

NIP-05 Address

Profile Code

nprofile1qqszz0at9jvxfzdutjmjpq2zqqmerjmwl5sd4c8vfqedslgd0dcdyzcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dssc776n

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1yyl6ktycvjymch9hyzq5yqphj89kalfqmtswcjpjmp7s67ms6g9sdp6r3v

Show more details

Last Notes

2024-07-31 18:51:45

I'm looking for recent examples of Cloudflare not responding to verified complaints of abuse by customers using its service, particularly its pass-through service. Additionally, how does Cloudflare's abuse policy compare with those of competitors such as Fastly? Please text me on Signal at DanArs.82 or DM me here.

2024-07-25 20:18:48

- reply

@npub1pxy…htpa
Point taken. That said, I'm writing for a mainstream audience, not experts.

2024-07-25 18:43:29

For anyone who cares about Secure Boot: it's completely borked on hundreds of device models from some of the industry's biggest manufacturers. Some of the affected devices shipped as recently as this year. More details to come in a little more than an hour from now.

2024-07-17 06:12:54

There are times when you can be certain the story subject is Black just by reading the headline.
https://www.cnn.com/2024/07/15/us/terrell-davis-united-airlines-flight-incident/index.html

2024-07-17 00:00:02

I badly botched my earlier attempt at this, so I'm going to try again. I will no longer donate to @signalapp and I will encourage others to stop funding it as well, until its employees stop using Twitter in official communications. The blue vanity tick marks these employee accounts sport demonstrate the very real value these accounts have in keeping this toxic, anti-privacy platform alive. I'm getting close to stopping subscriptions to news outlets that are also doing their part to give oxygen to a site that actively undermines a free press.

2024-07-16 19:25:13

Someone just pointed out that Twitter will give blue vanity ticks for free in the event the account is followed by at least 2,500 other blue tick accounts. So, I may have misspoke in saying Signal and Meredith pay directly. That said, if they're getting the tick for free, that means they're undoubtedly providing financial support in the form of content that motivates others to pay.

2024-06-28 00:52:46

- reply

The NCC Group alert reports a "significant compromise of
the TeamViewer remote access and support platform by an APT group." This is at odds with the "evidence" TeamViewer is saying indicates access is limited to its corporate environment.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/691/034/550/470/686/original/93aae725c4ae9647.png

2024-06-24 18:15:00

- reply

Several replies to this thread bare a striking resemblance to Russian payops plays attempting to suppress the participation of potential Biden voters. Please keep that in mind when reading or engaging in these sorts of discussions.
Also, nation state psyops campaigns embracing the Fediverse. Yikes.

2024-06-22 03:45:34

To all the left of center people planning to sit out the election, or vote for someone other than Biden: can we at least agree that life under Trump will be infinitely worse than under Biden in so many important ways?

2024-06-11 18:31:23

Your reasons for staying on Twitter may be valid, but they don't change this ineluctable truth: you're breathing oxygen into a platform that's actively promoting antidemocratic, far-right disinformation.

2024-06-10 18:11:03

So now Apple is being pressured into adding a bunch of half-baked AI features that no user actually wants. I just hope all this AI crap is opt in.

2024-06-05 17:51:52

A reminder that if you're a member of a union or consider yourself pro labor you should avoid buying from Amazon whenever possible.
https://www.404media.co/amazons-ai-warehouses-isolate-workers-impact-union-organizing-new-report-finds/

2024-05-27 18:47:18

If you're mad at Biden for his policies toward Israel/Gaza, you will be absolutely apoplectic if Trump retakes the White House.
https://www.washingtonpost.com/politics/2024/05/27/trump-israel-gaza-policy-donors/

2024-05-23 19:39:13

I have now disconnected from all Slack channels except for the one used by my employer, which is a requirement for my job. I don't understand why more people aren't doing the same.

2024-05-07 07:06:35

People are still talking about how "Trump is worse" as if the 2024 election was just one more horse race that won't irrevocably change things for the worse for the next hundred years and beyond.

2024-04-22 19:43:54

Microsoft said today that Russian hackers have been exploiting the vulnerability tracked as CVE-2020-38028 since at least 2020. That would make it an 0day at the time Microsoft patched it in October 2022. And yet, Microsoft has never acknowledged that vulnerability as such. What's up with that?
https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2022-38028

2024-04-10 06:01:19

Am I the only person who connects my TV to the Internet? I ask because people commenting on an LG vulnerability story posted to a certain tech news site say it's cray cray and you should instead either go without or use a Roku or AppleTV to stream.

2024-04-02 18:57:36

I can't understand why anyone privacy conscious enough to use incognito would ever use Chrome going forward. Google has clearly shown its contempt for user privacy by collecting this data in the first place and agreeing to delete it only after facing legal pressure. Such a shame that a browser as well engineered as Chrome is such a privacy nightmare.
https://arstechnica.com/tech-policy/2024/04/google-agrees-to-delete-private-browsing-data-to-settle-incognito-mode-lawsuit/

2024-04-01 22:16:01

I'm doing my best to make my coverage of the xz backdoor accessible to laypeople while also providing the technical details engineers need. I'm also updating as new info becomes available. I hope it's helpful.,
https://arstechnica.com/security/2024/04/what-we-know-about-the-xz-utils-backdoor-that-almost-infected-the-world/

2024-03-23 21:12:35

@npub1x2u…ux0y's coverage of the GoFetch side channel is easier to understand than the article I did. It also digs into practical considerations of the vulnerability. Well worth the read.
https://www.zetter-zeroday.com/apple-chips/

2024-03-21 08:54:27

There's a newly discovered side channel that leaks encryption keys from a widely used CPU architecture. Details will drop in about 6 hours.

2024-03-12 17:26:19

- reply

Thanks all. The syntax is:
"from: "

2024-03-12 17:23:02

I can't believe I'm asking this again, but I can never seem to find it on duckduckgo: how do I search a particular Mastodon user's posts for a specific search term?

2024-03-12 02:03:06

- reply

Seriously, folks. When someone running for the highest office in the land says they admire dictators and intend to act like one on the first day of their term, you best believe them and vote accordingly.

2024-03-12 01:51:50

How much longer can left-of-center folks keep insisting there's no difference between Biden and TFG?

2024-03-12 01:45:33

Last week, Boeing whistleblower John Barnett appeared at a deposition where he testified over in support of a lawsuit he filed against the airline maker. He was due to undergo further questioning on Saturday, but never appeared. That same day, he was found dead in his truck from a self-inflicted wound.
https://www.bbc.com/news/business-68534703

2024-03-07 23:46:17

- reply

@npub17lg…9uux
Wait, who else besides Menlo Security is linking the Change Healthcare breach to the Chinese gov?

2024-02-09 20:38:39

Are any RF hacking experts available to help me untangle the differences in capabilities among various tools, including the Flipper Zero, hackrf and LimeSDR? Signal preferred (+1650-440-4479), but DMs here also open.

2024-02-07 04:27:00

Are any technical details available for this supposed DDoS botnet of toothbrushe devices?I remain skeptical.

2024-02-01 19:33:15

- reply

@npub1acq…ctl9
Sorry to hear HOPE emails still are reaching subscribers. Have Google's new DMARC policies gone into effect yet? Might those be contributing to the problem?

2024-02-01 19:09:21

- reply

@npub15zu…s7lx @npub1lsl…9c2x
Mike is one of the most courageous journalists and publishers I can think of.

2024-02-01 18:38:54

In another sign of how corrupt and out-of-control leaders of Big Tech are, Gary Tan, venture capitalist and CEO of Y Combinator, has prompted death threats on 5 San Francisco supervisors after tweeting to them: "Die slow motherfuckers." A few days later, the supes found flyers at their homes containing death threats.
Besides showing how privileged and out-of-touch Tan is, this transgression is ironic. Two years ago, he funneled $100,000 into the recall of progressive district attorney Chesa Boudin, arguing that he was responsible for a flurry of assaults on Asians living in the city. What can we do to put a check on Big Tech leaders who abuse their oversized power and privilege?
https://missionlocal.org/2024/01/y-combinator-ceo-garry-tans-online-rant-spurs-threat-to-supe-police-reports/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/857/421/612/164/307/original/ef742c2f64e99e9b.jpg

2024-02-01 01:00:32

The US Justice Department said Wednesday that the FBI surreptitiously sent commands to hundreds of infected small office and home office routers to remove malware China state-sponsored hackers were using to wage attacks on critical infrastructure.
The routers—mainly Cisco and Netgear devices that had reached their end of life—were infected with what’s known as KV Botnet malware, Justice Department officials said. Chinese hackers from a group tracked as Volt Typhoon used the malware to wrangle the routers into a network they could control. Traffic passing between the hackers and the compromised devices was encrypted using a VPN module KV Botnet installed. From there, the campaign operators connected to the networks of US critical infrastructure organizations to establish posts that could be used in future cyberattacks. The arrangement caused traffic to appear as originating from US IP addresses with trustworthy reputations rather than suspicious regions in China.
https://arstechnica.com/security/2024/01/chinese-malware-removed-from-soho-routers-after-fbi-issues-covert-commands/

2024-01-29 23:25:37

Quick survey because I need to replace my 14-year-old monitor: Do I need a 4k monitor if I'm using it mostly for email, web browsing (with video) and occasional streaming? Is it worth spending extra, or will a non-4k monitor suit my needs? Keep in mind, I'll likely use this monitor for 14 or more years, so please make your recommendation what that in mind.
Update: Thanks for all the comments so far. To answer a few questions: I have room for only 1 monitor, so I want it to be no smaller than 27" because I often have multiple windows open it it'd be nice if I could put them side-by-side sometimes. I'm willing to go bigger, if it fits into my budget. I'd like to spend no more than $600.

2024-01-26 20:53:47

- reply

@npub17lg…9uux
I found this image floating around on that wretched bird site. Am I interpreting it wrong or does it indicate there's a way to allow non-admins to read all inboxes? If not, can you show me an appropriate screenshot? (No need for the screenshot if too much of a hassle. Just an answer will suffice.)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/823/991/389/869/471/original/48a283f554d350b8.jpg

2024-01-26 20:42:35

- reply

@npub17lg…9uux
Doesn't the post say as much in the following:
Threat actors like Midnight Blizzard compromise user accounts to create, modify, and grant high permissions to OAuth applications that they can misuse to hide malicious activity. The misuse of OAuth also enables threat actors to maintain access to applications, even if they lose access to the initially compromised account. Midnight Blizzard leveraged their initial access to identify and compromise a LEGACY TEST OAUTH APPLICATION THAT HAD ELEVATED ACCESS TO THE MICROSOFT CORPORATE ENVIRONMENT. The actor created additional malicious OAuth applications. They created a new user account to grant consent in the Microsoft corporate environment to the actor controlled malicious OAuth applications. THE THREAT ACTOR THEN USED THE LEGACY TEST OAUTH APPLICATION TO GRANT THEM THE OFFICE 365 EXCHANGE ONLINE FULL_ACCESS_AS_APP ROLE, WHICH ALLOWS ACCESS TO MAILBOXES."
Or does being the tenant admin go beyond the above? If it does, can you or someone explain how?

2024-01-25 18:57:18

This story about Elmo spreading democracy-threatening election misinfo on Twitter is precisely why everyone needs to treat that platform like the pariah it is. No, you sticking around to counter the misinfo won't help. That's like raking leaves in a wind storm. And yes, I know there's community there, but mingling there does you and all of us more harm than good.
The most effective thing you can do is stop giving Twitter oxygen and allowing it to become just another fringe outlet, like 4chan or Daily Caller. With the very real prospect Trump will retake the White House, this stuff matters.
Free link:
https://www.nytimes.com/2024/01/25/us/politics/elon-musk-election-misinformation-x-twitter.html?unlocked_article_code=1.QU0.XdEo.wABJTW_W19AD&smid=url-share

2024-01-24 21:07:12

I'm curious to know what security professionals think of the new intelligence assessment from the UK about AI increasing the number and impact of cyber attacks in the next 2 years.
Do you buy this assessment, or is it wrong? Why or why not?
https://www.ncsc.gov.uk/report/impact-of-ai-on-cyber-threat
Key points:
-- AI will almost certainly increase the volume and heighten the impact of cyber attacks over the next two years. However, the impact on the cyber threat will be uneven (see table 1).
-- The threat to 2025 comes from evolution and enhancement of existing tactics, techniques and procedures (TTPs).
-- All types of cyber threat actor – state and non-state, skilled and less skilled – are already using AI, to varying degrees.
-- AI provides capability uplift in reconnaissance and social engineering, almost certainly making both more effective, efficient, and harder to detect.
-- More sophisticated uses of AI in cyber operations are highly likely to be restricted to threat actors with access to quality training data, significant expertise (in both AI and cyber), and resources. More advanced uses are unlikely to be realised before 2025.
-- AI will almost certainly make cyber attacks against the UK more impactful because threat actors will be able to analyse exfiltrated data faster and more effectively, and use it to train AI models.
-- AI lowers the barrier for novice cyber criminals, hackers-for-hire and hacktivists to carry out effective access and information gathering operations. This enhanced access will likely contribute to the global ransomware threat over the next two years.
-- Moving towards 2025 and beyond, commoditisation of AI-enabled capability in criminal and commercial markets will almost certainly make improved capability available to cyber crime and state actors.

2024-01-22 18:56:59

- reply

@npub143w…pykj
I'd like this too, please.

2024-01-22 18:30:31

"Russia-state hackers exploited a weak password to compromise Microsoft’s corporate network and accessed emails and documents that belonged to senior executives and employees working in security and legal teams, Microsoft said late Friday.
The attack, which Microsoft attributed to a Kremlin-backed hacking group it tracks as Midnight Blizzard, is at least the second time in as many years that failures to follow basic security hygiene have resulted in a breach that has the potential to harm customers. One paragraph in Friday’s disclosure, filed with the Securities and Exchange Commission, was gobsmacking:
'Beginning in late November 2023, the threat actor used a password spray attack to compromise a legacy non-production test tenant account and gain a foothold, and then used the account’s permissions to access a very small percentage of Microsoft corporate email accounts, including members of our senior leadership team and employees in our cybersecurity, legal, and other functions, and exfiltrated some emails and attached documents. The investigation indicates they were initially targeting email accounts for information related to Midnight Blizzard itself. We are in the process of notifying employees whose email was accessed.'
Microsoft didn’t detect the breach until January 12, exactly a week before Friday’s disclosure. Microsoft's description of the incident raises the prospect that the Russian hackers had uninterrupted access to the accounts for as long as two months.
A translation of the 93 words quoted above: A device inside Microsoft’s network was protected by a weak password with no form of two-factor authentication employed. The Russian adversary group was able to guess it by peppering it with previously compromised or commonly used passwords until they finally landed on the right one. The threat actor then accessed the account.
Furthermore, this “legacy non-production test tenant account” was somehow configured so that Midnight Blizzard could pivot and gain access to some of the company’s most senior and sensitive employee accounts."
https://arstechnica.com/security/2024/01/microsoft-network-breached-through-password-spraying-by-russian-state-hackers/

2024-01-20 20:33:47

This 2006 post from Daring Fireball, using hair-splitting and innuendo to excoriate an article I wrote on the growing hack threats facing Macs, hasn't aged well.
https://daringfireball.net/2006/05/good_journalism

2024-01-20 00:54:02

Microsoft today said that Russian state hackers compromised email accounts of its senior executives by conducting password-spraying attacks. The company said:
"Beginning in late November 2023, the threat actor used a password spray attack to compromise a legacy non-production test tenant account and gain a foothold, and then used the account’s permissions to access a very small percentage of Microsoft corporate email accounts, including members of our senior leadership team and employees in our cybersecurity, legal, and other functions, and exfiltrated some emails and attached documents. The investigation indicates they were initially targeting email accounts for information related to Midnight Blizzard itself. We are in the process of notifying employees whose email was accessed."
Does that mean that:
1) a legacy non-production test tenant account" had permissions allowing access to sensitive executive accounts and
2) this tenant account used a weak password?
This sounds like failures to follow really basic security hygiene. I'm tempted to think maybe I'm missing something and that maybe the mistakes aren't as bad as I think. Can someone give me a sanity check?
https://www.sec.gov/Archives/edgar/data/789019/000119312524011295/d708866dex991.htm

2024-01-19 20:35:05

- reply

HP CEO Enrique Lores said this about counterfeit ink cartridges this morningon CNBC:
They can "create security issues. We have seen that you can embed viruses in the cartridges, through the cartridges go to the printer, from the printer go to the network. So it can create [inaudible]"
I'm not aware of a single instance of this happening, either as a PoC attack by a researcher or a malicious one in the wild. Seems like the CEO is misspeaking. Any help here from people with experience in malware in embedded devices would be much appreciated.
Quote occurs at 3:28
https://youtu.be/QPRMyQSZGuY?si=EU905oCTcW860xJs&t=208

2024-01-19 19:44:30

Does anyone know of any attacks, either PoC or in the wild, that use malicious printer cartridges to infect printers? I saw this article from 2022
https://www.action-intell.com/2022/10/05/hp-bug-bounty-program-finds-reprogrammable-chips-open-printers-to-malware/
It says that HP's Bug Bounty program found such attacks are possible, but there are no details about who reported the bug that made such attacks possible. I remain skeptical about the accuracy.
Any help from experts in the form of pointers to attacks or analysis about whether printer cartridges are a viable infection vector would be much appreciated.

2024-01-17 20:39:02

Publisher Conde Nast is cutting costs at the expense of high-quality journalism and fairness to its dedicated employees. Just a small sample:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/772/968/526/348/093/original/8b09cf05de7631d0.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/772/968/603/393/081/original/9c9f41757b82649e.jpg

2024-01-17 17:30:06

UEFI firmware from five of the leading suppliers contains vulnerabilities that allow attackers with a toehold in a user's network to infect connected devices with malware that runs at the firmware level.
The vulnerabilities, which collectively have been dubbed PixieFail by the researchers who discovered them, pose a threat mostly to public and private data centers and possibly other enterprise settings. People with even minimal access to such a network—say a paying customer, a low-level employee, or an attacker who has already gained limited entry—can exploit the vulnerabilities to infect connected devices with a malicious UEFI.
Short for Unified Extensible Firmware Interface, UEFI is the low-level and complex chain of firmware responsible for booting up virtually every modern computer. By installing malicious firmware that runs prior to the loading of a main OS, UEFI infections can’t be detected or removed using standard endpoint protections. They also give unusually broad control of the infected device.
Five vendors, and many a customer, affected
The nine vulnerabilities that comprise PixieFail reside in TianoCore EDK II, an open source implementation of the UEFI specification. The implementation is incorporated into offerings from Arm Ltd., Insyde, AMI, Phoenix Technologies, and Microsoft.
By exploiting PixieFail, an attacker can cause servers to download a malicious firmware image rather than the intended one. The malicious image in this scenario will establish a permanent beachhead on the device that’s installed prior to the loading of the OS and any security software that would normally flag infections.
https://arstechnica.com/security/2024/01/new-uefi-vulnerabilities-send-firmware-devs-across-an-entire-ecosystem-scrambling/

2024-01-13 21:54:22

- reply

@npub1njx…6peh @npub1hyk…3p33
The enshitifiers can have my 2003 Frigidaire when they pry it from my cold, dead fingers. It leaves my heavily soiled dishes spotless even when I don't pre-rinse them at all and wash them on the shorter, water saving cycle.

2024-01-13 21:15:13

Chinese authorities are clamping down on free speech by exploiting an AirDrop weakness Apple has known about for 5 years (at least).
https://arstechnica.com/security/2024/01/hackers-can-id-unique-apple-airdrop-users-chinese-authorities-claim-to-do-just-that/

2024-01-11 04:30:19

Mandiant, the Google-owned company that sells cyber security services for large sums of money, got its Twitter account hacked last week.
Today, @npub1jx4…lywk issued a terse and vaguely-worded update that strongly suggests (1) the password protecting the account was weak and readily guessable and (2) the account had previously used SMS, the weakest form of 2FA available before eventually allowing 2FA to lapse entirely. I asked for clarification and a representative responded: "we ultimately aren’t going to be sharing further details at this time."
It's reasonable to ask billion-dollar security companies to account for mistakes that have the potential to harm customers or the public at large. So much for transparency.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/735/186/853/025/057/original/2387e290ed2f6055.jpg

2024-01-11 02:37:32

10-year-old walking in the door with a new chemistry set in one hand and phone in the other: "Dad, I have the perfect music to listen to while we mix up random chemicals." [Turns on theme to Breaking Bad by Dave Porter]
Me: [Ducks]
https://youtu.be/ilfYnhXD-bE?si=peWKVAOClD0kiBNO

2024-01-10 23:21:20

Attention Bob the Builder: Active exploitation of critical Ivanti VPN 0days is not a drill
https://arstechnica.com/security/2024/01/actively-exploited-0-days-in-ivanti-vpn-are-letting-hackers-backdoor-networks/

2024-01-10 18:59:27

The real headline here should be:
"Even after being purged with no explanation, prominent journalists cling to toxic platform hellbent on undermining a free press"
https://www.vice.com/en/article/5d948x/x-purges-prominent-journalists-leftists-with-no-explanation

2024-01-10 18:22:06

- reply

@npub1wf4…94wn
I miss the days when @npub1lsl…9c2x regularly posted to the fedi. Mike, please come back. We need you here.

2024-01-10 18:20:18

Bye bye, Substack. You had so much promise, but like almost all media platforms, you squandered it. You won't be missed.

2024-01-09 16:39:43

Researchers have unearthed nearly two dozen vulnerabilities that could allow hackers to sabotage or disable a popular line of network-connected wrenches that factories around the world use to assemble sensitive instruments and devices.
The vulnerabilities, reported Tuesday by researchers from security firm Nozomi, reside in the Bosch Rexroth Handheld Nutrunner NXA015S-36V-B. The cordless device, which wirelessly connects to the local network of organizations that use it, allows engineers to tighten bolts and other mechanical fastenings to precise torque levels that are critical for safety and reliability. When fastenings are too loose, they risk causing the device to overheat and start fires. When too tight, threads can fail and result in torques that are too loose. The Nutrunner provides a torque-level indicator display that’s backed by a certification from the Association of German Engineers and adopted by the automotive industry in 1999.
Nozomi researchers said the device is riddled with 23 vulnerabilities that, in certain cases, can be exploited to install malware. The malware could then be used to disable entire fleets of the devices or to cause them to tighten fastenings too loosely or tightly while the display continues to indicate the critical settings are still properly in place.
Bosch officials emailed a statement that included the usual lines about security being a top priority. It went on to say that Nozomi reached out a few weeks ago to reveal the vulnerabilities. "Bosch Rexroth immediately took up this advice and is working on a patch to solve the problem," the statement said. "This patch will be released at the end of January 2024."
https://arstechnica.com/security/2024/01/network-connected-wrenches-used-in-factories-can-be-hacked-for-sabotage-or-ransomware/

2024-01-07 22:35:20

People keep saying that I am condescending and unnecessarily riling up people with my posts about the very real potential for unprecedented world disaster resulting from the 2024 presidential election. I am sorry these posts are making you mad or offended or for any other negative emotion you experience. I assure you your anger and offense will be exponentially greater come November 6 if Trump is the president elect.

2024-01-06 22:19:26

Historian begs Americans not to downplay Trump's threats to use the military against them
If Donald Trump becomes the 47th president, Presidential historian Michael Beschloss said he believes there is going to be a severe danger of instituting the Insurrection Act and putting soldiers on missions to police American soil.
During a rally in Iowa, the 2024 Republican frontrunner described the metropolises of New York City and Chicago as “crime dens” and vowed to move fast to bring in the country's military might.
“The next time, I’m not waiting," he said. "One of the things I did was let them run it and we’re going to show how bad a job they do,” he said. “Well, we did that. We don’t have to wait any longer.”
Beschloss says we should be taking Trump at his word.
https://www.rawstory.com/trump-insurrection-act-2666371202/

2024-01-04 00:36:16

The NewsGuild of New York, the union representing me and thousands of other journalists, continues to undermine its own advocacy of worker equity and social justice by regularly and actively supporting Twitter, a platform that spreads dangerous hate speech and propaganda that's intended to weaken if not destroy a free press. Not only that, but Twitter's narcissistic robber baron owner is outwardly hostile to workers at SpaceX, Tesla, and Twitter.
I've voiced my opposition to the management of the NewsGuild of New York, and they said they continue keeping a "presence on many social media platforms because that is where many of our members are, despite some of the platforms having a troubling track record with blocking hate speech." The NewsGuild of New York has yet to even test the waters of Mastodon.
The NewsGuild of New York has a history of encouraging boycotts against antilabor organizations, but doesn't walk the walk when it comes to its own actions.
History won't judge the NewsGuild of New York, and the rest of the journalism establishment continuing to support Twitter, kindly.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/694/622/807/929/096/original/244ac6c41edf8f42.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/694/622/829/632/001/original/f280826fd27a4f75.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/694/622/964/245/540/original/f07a9ef025b7dd20.jpg

2023-12-19 19:10:16

- reply

As an added bonus, @npub14th…h3hw, the lead author of the Terrapin paper (who still isn't active on Mastodon 🙁 ) is holding court in the comments forum. Now would be a good time to mosey on over and ask questions.
https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/?comments=1&comments-page=1

2023-12-19 18:49:22

It's hard to overstate the importance of SSH in securing home networks, massive cloud centers and everything in between. Now, researchers have devised a novel cryptographic attack that breaks integrity of this widely used protocol. Dubbed Terrapin, it's the first-ever practical attack of its kind, and one of the very few attacks against SSH at all. Terrapin exploits weaknesses in the specification of SSH when paired with widespread algorithms (ChaCha20-Poly1305 and CBC-EtM) to remove an arbitrary number of protected messages at the beginning of the secure channel, thus breaking integrity. In practice, the attack can be used to impede the negotiation of certain security-relevant protocol extensions. Moreover, Terrapin enables more advanced exploitation techniques when combined with particular implementation flaws, leading to a total loss of confidentiality and integrity in the worst case.
https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/

2023-12-14 22:29:54

Folks, if you're going to tell me that a certain 0day is one of the worst ever, you better have data-driven reasons to back up the assessment. How many devices are vulnerable? How reliable and viable are exploits? How many devices have been compromised so far, and how does that compare with compromises resulting from previous 0days, such as Citrixbleed? So far as I can tell, there have been 0 confirmed successful exploits of this vulnerability, tracked as CVE-2023-50164. Last I heard from @npub17lg…9uux exploits seen so far used verbatim PoC code that didn't included non-existent file paths, so I'd also like to know what makes the exploitation qualify as "systematic." I can't see the value in "commentary" like this, and I can't imagine ever including it in coverage.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/580/884/561/813/686/original/010b45b8d41a25e2.jpg

2023-12-14 02:26:17

- reply

@npub1kc8…j65c
Why are you telling me this? I want my posts to be searchable.

2023-12-13 21:32:54

I know some people don't want their public Mastodon posts to be searchable. This reminder isn't for them. It's for everyone else: Please take a minute to update your Mastodon preferences to make your public posts searchable. This ensures more people can easily find your public posts on a given topic. This makes Mastodon a more useful place for all of us and gives Mastodon holdouts more incentive to join the fediverse.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/574/971/800/490/217/original/a15996e6b514f718.png

2023-12-13 18:30:14

Does anyone have a helpful primer on Mastodon searches? I want to do things like finding all posts from user X who mentioned the phrase y. I seem to remember reading a post that provided the syntax, but web searches are now failing me.

2023-12-07 17:03:06

For the entirety of today, please don't click on or publish links to any posts from the Washington Post. Please don't visit the WaPo site and don't provide any interviews to anyone from the paper. This is for today only. Reporters, editors, cartoonists, and ad salespeople at the publication are walking out today after having tried for 18 months to get a contract that keeps up with inflation. These folks work hard to inform us. Please show them solidarity.

2023-12-06 16:32:36

If you use a Windows or Linux device, it's vulnerable to a new post-exploit attack that can remotely install an undetectable backdoor at the UEFI level. Updates from just about every vendor available today. Impressive work from @npub1ruv…jnek and the rest of Binarly.
https://arstechnica.com/security/2023/12/just-about-every-windows-and-linux-device-vulnerable-to-new-logofail-firmware-attack/

2023-12-01 19:31:55

I still can't bring myself to care or even follow the OpenAI CEO firing and rehiring.

2023-11-30 03:16:30

In the stretch of a few days, two municipal water facilities that serve more than 2 million residents in parts of Pennsylvania and Texas have reported network security breaches that have hamstrung parts of their business or operational processes.
In response to one of the attacks, the Municipal Water Authority of Aliquippa in western Pennsylvania temporarily shut down a pump providing drinking water from the facility’s treatment plant to the townships of Raccoon and Potter, according to reporting by the Beaver Countian. A photo the Water Authority provided to news outlets showed the front panel of a programmable logic controller—a toaster-sized box often abbreviated as PLC that’s used to automate physical processes inside of industrial settings—that displayed an anti-Israeli message. The PLC bore the logo of the manufacturer Unitronics. A sign above it read “Primary PLC.”
A second hack hitting the North Texas Municipal Water District came to light on Monday after a ransomware group tracked as DAIXIN added the district, abbreviated as NTMWD, to its leak site. The post said the group has stolen sensitive data contained in 33,844 files. A text file that accompanied the post showed what appeared to be an extensive file directory tree of the network belonging to the NTMWD.
It’s tempting to think that the hacks of two different water facilities coming to light within a few days signals an escalation. It’s easier to bear in mind that water facilities are notoriously underfunded and employ IT staff who receive little training and resources and are underpaid. Either way, the attacks should serve as a wake up call to political leaders at every level of government that critical infrastructure is vulnerable to hacking and will remain that way until they make the necessary investments.
https://arstechnica.com/security/2023/11/2-municipal-water-facilities-report-falling-to-hackers-in-separate-breaches/

2023-11-29 02:22:35

Security researchers are tracking what they say is the “mass exploitation” of a security vulnerability that makes it possible to take full control of servers running ownCloud, a widely used open-source filesharing server app.
The vulnerability, which carries the maximum severity rating of 10, makes it possible to obtain passwords and cryptographic keys allowing administrative control of a vulnerable server by sending a simple Web request to a static URL, ownCloud officials warned last week. Within four days of the November 21 disclosure, researchers at security firm Greynoise said, they began observing “mass exploitation” in their honeypot servers, which masqueraded as vulnerable ownCloud servers to track attempts to exploit the vulnerability. The number of IP addresses sending the web requests has slowly risen since then. At the time this post went live on Ars, it had reached 13.
“We're seeing hits to the specific endpoint that exposes sensitive information, which would be considered exploitation,” Glenn Thorpe, senior director of security research & detection engineering at Greynoise, said in an interview on Mastodon. “At the moment, we've seen 13 IPs that are hitting our unadvertised sensors, which indicates that they are pretty much spraying it across the internet to see what hits.”
https://arstechnica.com/security/2023/11/owncloud-vulnerability-with-a-maximum-10-severity-rating-comes-under-mass-exploitation/

2023-11-28 19:04:06

A prolific espionage hacking group with ties to China spent over two years looting the corporate network of NXP, the Netherlands-based chipmaker whose silicon powers security-sensitive components found in smartphones, smartcards, and electric vehicles, a news outlet has reported.
The intrusion, by a group tracked under names including "Chimera" and "G0114," lasted from late 2017 to the beginning of 2020, according to Netherlands national news outlet NRC Handelsblad, which cited “several sources” familiar with the incident. During that time, the threat actors periodically accessed employee mailboxes and network drives in search of chip designs and other NXP intellectual property. The breach wasn’t uncovered until Chimera intruders were detected in a separate company network that connected to compromised NXP systems on several occasions.
Details of the breach remained a closely guarded secret until now. NXP didn't alert customers or shareholders to the intrusion, other than a brief reference in a 2019 annual report.
https://arstechnica.com/security/2023/11/hackers-spent-2-years-looting-secrets-of-chipmaker-nxp-before-being-detected/

2023-11-21 19:38:19

I'm feeling genuinely depressed today seeing so many journalists, researchers and civil liberties and privacy advocates continuing to support Shitter, a platform that has just sued the ADL for doing nothing more than publishing research on antisemitism. I just don't understand. When people who I thought had principles can't stand up against a platform that actively threatens their very existence, what reason is there for optimism that the worst case scenarios hanging over us like the Sword of Damocles won't fall?
I'm sorry to my friends, sources and journalism colleagues for sounding like a broken record. Maybe I should just let it go. My non-stop criticism comes from a place of deep desperation and fear of what's likely about to happen (Trump in the Whitehouse seems entirely possible). I feel despondent seeing so many influential people continue to use Shitter.

2023-11-17 21:34:27

- reply

@npub1lrv…tth9
I've left Chrome for Firefox, too, but I continue to suffer for that decision because Firefox STILL doesn't support passkeys. I mean, WTF, Mozilla. Passkeys have been supported for months on every other major browser. Mozilla's stalling is likely holding Chrome users from switching.

2023-11-17 21:28:35

To catch non-Californians up on a recent event. A major section of a freeway in Los Angeles was shut down 6 days ago when as arsonist set fire to it. After initially projecting the closure would last months, Gov. Newsom now says the freeway will be open 4 days from now. In large part, that's because repair crews have been working 24/7 and the state is sparing no cost.
Meanwhile, LA remains largely off limits to bicyclists, pedestrians and people who'd prefer public rapid transit because politicians insist there isn't enough money to fund these more climate-friendly alternatives.
So the vicious cycle will continue, despite a climate crisis that can no longer be denied or ignored.
https://www.nytimes.com/2023/11/17/us/10-freeway-los-angeles-reopen.html

2023-11-17 18:12:22

A reminder that Apple Support still has no qualms supporting and associating itself with a platform that promotes antisemitism and other far-right extremism.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/426/992/918/105/043/original/177e225e73a430ff.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/426/993/021/288/434/original/044f2e57cf984e95.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/426/993/052/344/971/original/3bc88b19e6846808.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/426/993/074/334/643/original/38aa0f9665628e5e.jpg

2023-11-17 04:35:36

- reply

@npub178r…qekt
Don't forget Apple. Apple has been running ads by the truckload all year.

2023-11-16 20:57:22

It should be clear now that it was and remains a catastrophic mistake for people to view privately owned social media platforms as any kind of public resource. People didn't know better a decade ago. They have no excuse now.

2023-11-14 22:35:00

Intel on Tuesday pushed microcode updates to fix a high-severity CPU bug that has the potential to be maliciously exploited against cloud-based hosts.
The flaw, affecting virtually all modern Intel CPUs, causes them to “enter a glitch state where the normal rules don’t apply,” Tavis Ormandy, one of several security researchers inside Google who discovered the bug, reported. Once triggered, the glitch state results in unexpected and potentially serious behavior, most notably system crashes that occur even when untrusted code is executed within a guest account of a virtual machine, which, under most cloud security models, is assumed to be safe from such faults. Escalation of privileges is also a possibility.
The bug, tracked under the common name Reptar and the designation CVE-2023-23583, is related to how affected CPUs manage prefixes, which change the behavior of instructions sent by running software. Intel x64 decoding generally allows redundant prefixes—meaning those that don’t make sense in a given context—to be ignored without consequence. During testing in August, Ormandy noticed that the REX prefix was generating “unexpected results” when running on Intel CPUs that support a newer feature known as fast short repeat move, which was introduced in the Ice Lake architecture to fix microcoding bottlenecks.
https://arstechnica.com/security/2023/11/intel-fixes-high-severity-cpu-bug-that-causes-very-strange-behavior/

2023-11-08 22:00:42

I so, so, so don't want to drive any new car that can do this:
A federal appeals court refused to bring back a class action lawsuit alleging four auto manufacturers had violated Washington state’s privacy laws by using vehicles’ on-board infotainment systems to record and intercept customers’ private text messages and mobile phone call logs.
The court ruled that the practice does not meet the threshold for an illegal privacy violation under state law, handing a big win to automakers Honda, Toyota, Volkswagen and General Motors, which are defendants in five related class action suits focused on the issue.
The plaintiffs had appealed a prior judge’s dismissal. But the appeals court ruled Tuesday that the interception and recording of mobile phone activity did not meet the Washington Privacy Act’s standard that a plaintiff must prove that “his or her business, his or her person, or his or her reputation” has been threatened.
A suit filed against Honda in 2021, argu[ed] that beginning in at least 2014 infotainment systems in the company’s vehicles began downloading and storing a copy of all text messages on smartphones when they were connected to the system.
An Annapolis, Maryland-based company, Berla Corporation, provides the technology to some car manufacturers but does not offer it to the general public, the lawsuit said. Once messages are downloaded, Berla’s software makes it impossible for vehicle owners to access their communications and call logs but does provide law enforcement with access, the lawsuit said.
Many car manufacturers are selling car owners’ data to advertisers as a revenue boosting tactic, according to earlier reporting by Recorded Future News. Automakers are exponentially increasing the number of sensors they place in their cars every year with little regulation of the practice.
https://therecord.media/class-action-lawsuit-cars-text-messages-privacy

2023-11-06 19:05:16

Mastadonians wanting more security- and privacy-related content here: there are a bunch of journalists, researchers and engineers who are woefully underfollowed relative to the impact and importance of the work they do. Please follow and engage with them so they have a strong incentive to use this platform more.
There are way too many to name all of them. In no particular order here are some (but sorry, not all; please look at the people I follow for more):
@npub1jpj…dkzf
@npub1ffs…cxj7
@npub1xl7…sxzx
@npub19s0…22vv
@npub1xmj…39tm
@npub1q4p…g778
@npub136x…mwy4
@npub1mdx…yy3y
@npub1kys…gtlf
@npub1gqs…3qas
@npub15xs…3y90
@npub1nlp…pzpa
@npub1ja9…egyf
@npub1y4v…5qgl
@npub15ep…kdu4
@npub1k6f…jp0a
Please boost for visibility

2023-11-03 20:23:18

Can someone help me parse a statement I just got from Okta? I asked if the service account compromised in a recent breach was protected by MFA. The response:
"The unauthorized access to Okta’s customer support system leveraged a service account stored in the system itself. Service accounts are used for machine-to-machine functions that would be disrupted by an interactive prompt. MFA is not supported on such accounts."
Can people with experience in these sorts of environments paraphrase in plain English? How is an account "stored in the system itself" different from other sorts of accounts? Is it really not feasible to use MFA for this account?

2023-11-02 19:56:06

Is there consensus on how damaging the latest breach to hit Okta may be to its overall security posture? I know it only involves the theft of names, Social Security Numbers, and health or medical insurance plan numbers for 5,000 employees, so it's tempting to think this sucks for those employees but there isn't going to be collateral damage elsewhere.
On the other hand, the people targeting Okta in past breaches are extremely resourceful. They know how to take a single thread and use it to hack all kinds of other targets.
How likely are we to see something like this play out again?

2023-11-02 17:38:58

https://arstechnica.com/security/2023/11/flipper-zero-gadget-that-doses-iphones-takes-once-esoteric-attacks-mainstream/

2023-11-01 01:28:48

People following me for cybersecurity content: Chris Bing, one of the most distinguished reporters on this beat, recently joined the Fediverse. Chris has broken way too many stories to count and also has valuable insight into all things related to hacking. Please follow him.
@npub1wwa…a50q
And please boost for reach.

2023-10-31 04:08:20

- reply

@npub178r…qekt
What if I PM you but encrypt it with a Cesar cipher? <ducks>

2023-10-30 19:02:56

- reply

@npub1yck…ujmw
Yes, I'm making people freak out.

2023-10-30 17:54:29

A reminder that ALL browsers running on iOS are vulnerable to iLeakage, the attack that allows hackers to steal passwords and other sensitive data when you visit their booby-trapped websites. It's not just Safari on iOS, although that's the only browser affected on macOS. Currently, there's no patch available.
https://arstechnica.com/security/2023/10/hackers-can-force-ios-and-macos-browsers-to-divulge-passwords-and-a-whole-lot-more/

2023-10-27 05:41:49

It's beyond exasperating to see @npub1yz0…mtvk calling out the very real threat Twitter poses to democracy even as is continues empowering and legitimizing the platform. This seems absolutely bonkers.
If you're not willing to stop using the site, shut the hell up about Twitter.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/304/884/682/347/856/original/27a309f91560b391.jpg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/304/900/908/964/874/original/b5df9f8459471a35.jpg

2023-10-25 19:31:25

Apple CPUs bitten by speculative execution bug in new password-stealing attack
https://arstechnica.com/security/2023/10/hackers-can-force-ios-and-macos-browsers-to-divulge-passwords-and-a-whole-lot-more/

2023-10-24 21:44:58

Dude in a 2-ton pickup truck has been idling outside my office window for more than 20 minutes. Today's weather is perfect: partly cloudy, 65 degrees, light breeze. I can see no sound reason why he'd do this. I asked him if he'd consider turning off his car while he's stationary and he gave me a nasty look.
This is probably the same climate-change-denying douche bag who complains about gas prices being too high.

2023-10-24 21:18:35

A victory for San Franciscans who oppose being guinea pigs in Big Tech's dangerous experiment. Now, we need to get Waymo off our roads too:
The California Department of Motor Vehicles has suspended Cruise from operating its driverless taxis in San Francisco, effective immediately.
The DMV, one of the state’s regulators for self-driving cars, said there is no set expiration for the suspension. At this time, the DMV says the suspension of Cruise’s driverless ops is based on the determination that “the manufacturer’s vehicles are not safe for the public’s operation.”
The DMV’s suspension means that Cruise cannot use its robotaxis without a human driver present, neither for free nor during paid rides. The company is still allowed to test its technology with a safety driver.
https://www.sfchronicle.com/bayarea/article/s-f-cruise-driverless-taxis-suspended-18445110.php

2023-10-23 23:04:00

1Password detects “suspicious activity” in its internal Okta account
1Password, a password manager used by millions of people and more than 100,000 businesses, said it detected suspicious activity on a company account provided by Okta, the identity and authentication service that disclosed a breach on Friday.
“On September 29, we detected suspicious activity on our Okta instance that we use to manage our employee-facing apps,” 1Password CTO Pedro Canahuati wrote in an email. “We immediately terminated the activity, investigated, and found no compromise of user data or other sensitive systems, either employee-facing or user-facing.”
Since then, Canahuati said, his company had been working with Okta to determine the means that the unknown attacker used to access the account. On Friday, investigators confirmed it resulted from a breach Okta reported hitting its customer support management system.
Okta said then that a threat actor gained unauthorized access to its customer support case management system and, from there, viewed files uploaded by some Okta customers. The files the threat actor obtained in the Okta compromise comprised HTTP archive, or HAR, files, which Okta support personnel use to replicate customer browser activity during troubleshooting sessions. Among the sensitive information they store are authentication cookies and session tokens, which malicious actors can use to impersonate valid users.
Security firm BeyondTrust said it discovered the intrusion after an attacker used valid authentication cookies in an attempt to access its Okta account. The attacker could perform “a few confined actions,” but ultimately, BeyondTrust access policy controls stopped the activity and blocked all access to the account. 1Password now becomes the second known Okta customer to be targeted in a follow-on attack.
Monday’s statement from 1Password provided no further details about the incident, and representatives didn’t respond to questions. A report dated October 18 and shared on an internal 1Password Notion workspace said the threat actor obtained a HAR file a company IT employee had created when recently engaging with Okta support. The file contained a record of all traffic between the 1Password employee’s browser and Okta servers, including session cookies.
https://arstechnica.com/security/2023/10/1password-detects-suspicious-activity-in-its-internal-okta-account/

2023-10-23 20:32:44

An off-duty pilot has been charged with 83 counts of attempted murder, after he allegedly tried to crash a passenger jet during a flight on Sunday night.
The suspect was sitting in the cockpit of an Alaska Airlines flight behind the captain and the first-officer, according to an airline statement.
The flight was on its way from Everett, Washington, to San Francisco, California, with 80 passengers aboard. It was diverted to Portland, Oregon, and the suspect was subdued without incident, officials said.
In a statement, Alaska Airlines said the off-duty pilot was traveling in the flight deck jump seat, when he "unsuccessfully attempted to disrupt the operation of the engines."
In a recording of air traffic control communication, one of the pilots was heard saying: "We've got the guy that tried to shut the engines down out of the cockpit, and he doesn't sound like he's causing any issue in the back right now."
"I think he's subdued," the pilot added. He requested police presence "as soon as we get on the ground and parked".
In a statement, the FBI confirmed it was investigating and said it "can assure the traveling public there is no continuing threat related to this incident".
On Monday, the Federal Aviation Administration sent guidance to US air carriers that the incident was "not connected in any way shape or form to current world events".
https://www.bbc.com/news/world-us-canada-67177294

2023-10-20 18:26:44

I didn’t join Mastodon until after we launched 404 Media. I joined, frankly, because lots of people told me that we should. Mastodon had been decried by many (me, previously), as a social media platform that is too complicated or weird to sign up for. I had also convinced myself that people on Mastodon would be mad at me if I made jokes, which has (mostly) not been the case.
I’ve now been using it for about two months and I am here to tell you that it is, in principle, what we should want the internet to be. If you have been remotely interested in Mastodon but had reservations about joining because you thought it would be difficult, confusing, or otherwise annoying, it is not.
https://www.404media.co/mastodon-is-the-good-one/

2023-10-19 18:20:18

- reply

And while we're at it, it'd be great if Signal's president would stop railing against Big Tech on the deadbird site.

2023-10-19 17:51:46

- reply

@npub178r…qekt @npub1sdt…96z3
My response has been to use my work number for a separate account dedicated for use when I don't want to expose my personal number. My work phone can't accept texts, but Signal will send a verification code by voice during account enrollment. Presto: I now have an account that only exposes a number that's already public.
This is better than nothing, but it's not ideal. I a now one of those people who carries two phones.

2023-10-19 17:34:20

I am so jealous of WhatsApp users now that they can have more than one account on a single phone. I so, so, so want Signal to do the same thing.
https://about.fb.com/news/2023/10/multiple-accounts-on-whatsapp/

2023-10-17 20:50:36

“Cisco buried the lede.” >10,000 network devices backdoored through unpatched 0-day
https://arstechnica.com/security/2023/10/actively-exploited-cisco-0-day-with-maximum-10-severity-gives-full-network-control/

2023-10-09 17:55:28

Last Tuesday, I reported that in-the-wild attacks exploiting two critical 10 and 9.9) vulnerabilities in the ancient WS_FTP Server software had begun.
https://arstechnica.com/security/2023/10/active-attacks-exploiting-ws_ftp-pose-a-grave-threat-to-the-internet/
Sentinel One today reports the attacks continue.
https://www.sentinelone.com/blog/threat-actors-actively-exploiting-progress-ws_ftp-via-multiple-attack-chains/

2023-10-06 01:50:07

To all my San Francisco friends looking for an easy way to get all your latest vaccinations:
Greetings from LTF and Unidos en Salud! Stay protected this fall. Get NEW free COVID vaccines for ages 12 and up, and free flu vaccines for all ages, Friday and Saturday, 9 am to 3:45 pm, at 24th and Capp St. No appt. needed, just drop in. Free testing too. Getting vaxxed helps keep our community healthy. See you soon!
¡Saludos desde LTF y Unidos en Salud! Manténgase protegido este otoño. Obtenga las NUEVAS vacunas de COVID gratuitas para mayores de 12 años y vacunas contra la gripe gratuitas para todas las edades, los viernes y sábados de 9am a 3:45 pm, en 24th y Capp St. No es necesario hacer cita. Pruebas gratuitas también. Vacunarse ayuda a mantener saludable a nuestra comunidad. ¡Nos vemos pronto!

2023-10-05 18:09:48

- reply

@npub1zj4…fyjh
It's good research, but ultimately, I don't think the vulnerabilities are as bad as Binarly suggests. That's because the exploits work only if an admin clicks on a malicious link sent in an email.