Will Dormann

So the Trump Mobile T1 phone is just an off the shelf phone painted gold, and with a malformed American flag on the back.
Who could have predicted? 😂
https://www.ifixit.com/News/117789/teardown-confirms-the-trump-phone-is-a-gold-painted-htc-u24-pro
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/734/092/771/816/876/original/682e80a52414eef6.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/734/092/775/987/329/original/1709697a5acd572f.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/734/092/784/553/996/original/da974908aef316cb.jpeg

2026-05-15 03:26:41 GMT

Are you sick of Linux vulnerabilities lately?
Good.
Here's ssh-keysign-pwn
You can read any root-owned files from an unprivileged account. CVE unknown. Was patched in the Linux kernel 11 hours ago
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/576/458/080/710/754/original/29d18f3b6724bbf8.png

2026-05-12 15:34:20 GMT

- reply

@nprofile…mej2 @nprofile…g4vn @nprofile…m4cn
The dialog is the detection of the EICAR TieringEngineService.exe and is definitely a part of the successful exploit flow.
It's just that at least for me, it never succeeds with updated defs. 🤷‍♂️
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/562/332/553/045/247/original/b9bd67ec41b20439.png

2026-05-12 15:27:43 GMT

- reply

@nprofile…mej2 @nprofile…g4vn @nprofile…m4cn
The executable bits for Defender are updated along with sigs.

2026-05-12 15:26:04 GMT

- reply

@nprofile…g4vn @nprofile…mej2 @nprofile…m4cn
Cloud-delivered protection ?
If so, then yeah, it's on.
It's the same stock Win11 VM that worked in April. Just with Defender updates installed.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/562/299/801/120/426/original/a8479e05a70d8d97.png

2026-05-12 15:12:13 GMT

- reply

@nprofile…m4cn @nprofile…mej2
I suspect that Microsoft pushed out Defender updates that mitigate the exploit.
With current definitions, I've not seen RedSun succeed. No matter how long I wait.
With old definitions, success is pretty quick.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/562/230/582/681/814/original/262483d424fd1700.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/562/231/063/519/567/original/0f68eaf9c05845c3.png

2026-05-11 16:50:34 GMT

Pwn2Own Berlin 2026 is rejecting working RCEs because organizers ran out of contest slots.
Visit a website in Firefox and get code execution? Rejected.
Strange days indeed.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/556/965/769/742/276/original/b9a64843c5927877.png

2026-05-11 15:48:35 GMT

- reply

And in case Dirty Frag wasn't unpatched enough for you, IKotas labs has found a new variant of Dirty Frag still captured as CVE-2026-43500
So far, patches have only landed in today's Linux 7.0.6 and 6.18.29.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/556/725/576/453/677/original/05425d2dfa560a23.png

2026-05-10 13:47:38 GMT

Remember the early days of Uber and Lyft, when rides were dirt cheap because the companies were operating at a loss in order to capture the minds/wallets of the masses?
The rug pull in the AI/LLM world when the companies adjust pricing to actually make a profit is going to be spectacular. Especially when you consider the numbers of people / orgs that are addicted to or dependent on such technology.

2026-05-09 02:46:37 GMT

- reply

@nprofile…44dh
The Red Hat mitigation works fine for protecting both Red Hat and Fedora.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/542/325/474/837/036/original/2ae865b9884a6a65.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/542/325/478/626/900/original/364aacfe14994515.png

2026-05-08 12:51:40 GMT

- reply

And just to clarify about "Dirty Frag" vs. "Copy Fail 2":
Dirty Frag is TWO vulnerabilities:
The xfrm-ESP Page-Cache Write vulnerability has been assigned CVE-2026-43284 and patched in mainline at f4c50a4034e6.
The RxRPC Page-Cache Write vulnerability has been reserved as CVE-2026-43500 for tracking; no patch exists in any tree yet.
Copy Fail 2 is a "clean room" rediscovery/exploitation of f4c50a4034e6 (CVE-2026-43284)
Since Copy Fail 2 was published to GitHub 1 hour earlier than Dirty Frag was published. The Dirty Frag writeup specifies that the embargo was broken, and as a result TWO vulnerabilities were disclosed.
Personally, I think that if you publish a patch for a vulnerability, and then you begin an embargo a week after it was published, that doesn't really count as an "embargo"? 🤷‍♂️
Fun stuff...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/539/036/774/988/462/original/9f13cc148d11f95d.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/539/036/777/452/524/original/350618b878990220.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/539/036/771/168/968/original/2469ed45c5fdc2a6.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/539/036/788/084/569/original/f16e1360d12cd8b2.png

2026-05-08 03:31:00 GMT

The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure.
Copy Fail: Publicity stunt where they claim to have done the right thing, yet didn't bother to tell a single distro vendor, and lied about updates being available.
Dirty Frag: Attempted to do proper coordination, including notifying the linux-distros mailing list. But the embargo was broken, so it was disclosed unexpectedly ahead of time.
Copy Fail 2: Discovered as an n-day by looking at kernel commit logs and Spender noticing that it was copyfail-class
Each path had basically exactly the same outcome (No fixes at publication time). 😂
#nevent1q…3fcv

2026-05-08 01:03:57 GMT

- reply

@nprofile…44dh
Indeed the DirtyFrag mitigation blocks Copy Fail 2.

2026-05-08 00:05:19 GMT

While it's raining Linux LPEs, I suppose it's worth mentioning Copy Fail 2:Electric Boogaloo
Unlike CopyFail, this one works against Ubuntu 26.04, as it was only patched a few days ago
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/536/013/872/295/710/original/c73948ac6f00b407.png

2026-05-07 20:47:15 GMT

- reply

CopyFail didn't affect Debian 12, and it has been said that this was not intentional, but rather due to an imcomplete backport
Interestingly, Debian 12 is also seemingly unaffected by Dirty Frag as well. (But Debian 11 and 13 are affected)
I'm curious if the Debian 12 behavior is by accident. 🤔
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/535/249/839/439/163/original/6c4651474c8f7d4a.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/535/250/899/718/771/original/28e7d7a2711c7e35.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/535/251/840/563/129/original/d246c5adfeee2dc7.png

2026-05-07 20:15:59 GMT

Did you like CopyFail, but were annoyed that it didn't work on distros with somewhat up-to-date kernels, like Ubuntu 26.04?
Don't worry. Dirty Frag has got your back!
From the advisory:
Because the responsible disclosure schedule and embargo have been broken,
no patches exist for any distribution. Use the following command to remove the
modules in which the vulnerabilities occur:
sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' >
/etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true"
From the Code:
* DirtyFrag chain — uid=1000 → root.
*
* 1. ESP path (authencesn AF_ALG --corrupt-only): overwrites the first
* 160 bytes of /usr/bin/su's page-cache with a static x86_64 root-
* shell ELF. Works on every distro tested regardless of PAM nullok
* or /etc/passwd contents — once invoked, the patched setuid-root
* /usr/bin/su just execs /bin/sh as uid 0.
*
* 2. rxrpc path (Ubuntu fallback): if AF_ALG is sandboxed and the ESP
* path can't reach the page cache, fall back to the rxrpc/rxkad
* nullok primitive that patches /etc/passwd's root entry empty.
* PAM nullok then accepts the empty password during `su -`.
*
* 3. Once either target is corrupted, spawn `/usr/bin/su -` inside a
* fresh PTY and bridge the user's tty to it. The bridge handles
* both the patched-su (no PAM at all) and the patched-passwd (PAM
* nullok) cases uniformly, and works even when the caller is in a
* background process group of an ssh-allocated PTY.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/535/100/196/553/539/original/aebe69ecb1afd946.png

2026-05-07 17:33:37 GMT

- reply

@nprofile…44dh
Not good enough. As mentioned in my earlier reply in this thread, even if you change association at the machine level, there's still default per-user associations that will override what happens in HKCR.
And as such, you're still in the boat of needing to do both per-user and machine-wide changes.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/534/487/986/260/308/original/149af4dc9dcae273.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/534/488/647/148/543/original/5b711f3aeca9a71f.png

2026-05-07 17:10:40 GMT

- reply

@nprofile…44dh
Not even SYSTEM has the ability to write that key.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/534/398/242/170/803/original/e4a41a5a1a3bbc14.png

2026-05-07 17:03:45 GMT

- reply

@nprofile…44dh
How does a mere mortal even modify that value (or what its target really is)?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/534/372/118/005/813/original/492703069e79fcf7.png

2026-05-07 16:54:35 GMT

- reply

@nprofile…44dh
And I'll admit that "disassociate .URL files from opening in Windows" is a touch more hand-wavy than it should be, I suppose.
When double-clicking a file in Windows, there's a little dance of system-wide file associations and user-specific file associations to determine how Windows should handle the file.
With a little bit of testing, I've determined that this seems to neuter .URL files:
Per-user:
To disassociate .URL files for the current user:
reg add HKCU\Software\Classes\.url /ve /d DisabledURLFile /f
reg add HKCU\Software\Classes\DisabledURLFile /ve /d "Disabled Internet Shortcut" /f
reg add HKCU\Software\Classes\DisabledURLFile\shell\open\command /ve /d "notepad.exe \"%1\"" /f
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url /f
To undo disassociation for the current user (i.e. you really need to be able to open .URL files):
reg delete HKCU\Software\Classes\.url /f
reg delete HKCU\Software\Classes\DisabledURLFile /f
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url /f
System-wide:
This is a bit weird, as even if you disassociate .URL files in the system-wide registry locations, you'll encounter user-specific bits that still know how to handle the files.
To disassociate .URL files system-wide:
In an elevated prompt:
reg delete HKLM\Software\Classes\.url.original /f
reg copy HKLM\Software\Classes\.url HKLM\Software\Classes\.url.original /s /f
reg delete HKLM\Software\Classes\.url /f
reg add HKLM\Software\Classes\.url /ve /d DisabledURLFile /f
reg add HKLM\Software\Classes\DisabledURLFile /ve /d "Disabled Internet Shortcut" /f
reg add HKLM\Software\Classes\DisabledURLFile\shell\open\command /ve /d "notepad.exe \"%1\"" /f
In a non-elevated prompt (i.e. for the current user):
reg delete HKCU\Software\Classes\.url /f
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url /f
To undo disassociation system-wide (i.e. you really need to be able to open .URL files):
reg delete HKLM\Software\Classes\.url /f
reg copy HKLM\Software\Classes\.url.original HKLM\Software\Classes\.url /s /f
reg delete HKLM\Software\Classes\DisabledURLFile /f
Personally, I think this is a bit overly complex. Perhaps somebody can chime in with some better advice?
I have seen a write-up on how to disable file associations for dangerous files, but in my simple world that's differently complicated. (I'm no Windows sysadmin)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/534/335/521/311/140/original/1c3552c5aa4bed7f.png

2026-05-07 15:08:43 GMT

- reply

@nprofile…44dh
Yep, that'd be an excellent protection.
There are indeed workflows that do use .URL files. In fact, a clean Windows 26H1 system comes with a .URL file.
But weighing the protection gained by neutering .URL files vs. the potential for an annoyed user, I think I know which wins.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/533/919/914/483/656/original/a0149f8e5f346ef0.png

2026-05-07 14:53:44 GMT

Let's talk about Windows .URL (InternetShortcut) files.
Last year there was discussion about a vulnerability in how Windows handles .URL files. Specifically, when a .URL file specifies a WorkingDirectory directive, an otherwise harmless app being launched would load DLLs from the remote (e.g. WebDAV) server specified. You know, being the current working directory of the app being launched and all. This vulnerability was being exploited in the wild, and it worked well because it bypassed annoying (to attackers) things like SmartScreen. Sure, it required the victim to click Open on a dialog saying Type: Unknown File Type (😂), but we all know that users are click-happy, so this is fine. Besides, the file clearly has a .pdf extension, so it should be safe (😂).
Microsoft recognized the vulnerability and published an update in the form of CVE-2025-33053.
If we were to believe the Microsoft documentation at the time,
When the user clicks the icon, the browser is launched and displays the site associated with the shortcut.
But wait...
How did this .URL file cause a program to be launched? The URL= parameter specifies a website address to be loaded in the browser.
Oh, naive child. Obviously a .URL file can directly point to code on a remote (e.g. WebDAV) server. This technique is also being exploited ITW as well.
I reported this to Microsoft, as this has the EXACT SAME IMPACT as CVE-2025-33053. So if that's a vulnerability, then this too is a vulnerability, right?
Bless your innocent soul. Per MSRC:
When the Shell invokes an app from a remote share, it's expected that you will see the legacy Windows Security prompt, not the SmartScreen one. SmartScreen Application Reputation (AppRep) evaluation applies to locally downloaded files that bear an Internet Zone mark of the web. It is not meant to apply to execution of files from Network Shares.
Okie dokie. I'm sure Windows users surely appreciate this. But what about the incorrect documentation? After my prodding, they updated the wording:
When the user clicks the icon, the URL path is opened by the handler application, typically the user's default web browser.
Leaving in the quite misleading first sentence:
The Internet shortcut object is used to create desktop shortcuts to Internet sites.
(An "Internet site" is a web page, right?)
How can CVE-2025-33053 warrant a CVE, while the behavior I described has the exact same trigger and impact is not CVE worthy? That's pretty easy. Microsoft assigns CVEs to updates, not vulnerabilities. They are the decider as to what is a vulnerability and what is not.
What can we do about it?
At the very least, turn off the Windows feature that hides file extensions, even if you have the option turned on to see file extensions. The disdain that Microsoft has for Windows users is tangible here. On what planet would I not want to see the actual extension of a file? Go to HKCU\InternetShortcut and delete the NeverShowExt value. After this, your pwned.pdf file will reveal its true self as being pwned.pdf.url.
More powerful protection would be to block the ability to receive .URL files via email, web browsers, etc. There is no workflow that I can imagine that requires a user to double-click on a .URL file that came from the internet.
This screen recording is a Windows 11 system that has no internet connectivity. The fact that no warning was displayed that SmartScreen cannot be reached is evidence that SmartScreen is not in play at all. And that dialog...
Do you want to open this file?
and
Type: Unknown File Type
Do you think that users are presented with enough information to make an informed security decision? Of course not. But obviously we all know that we can't rely on users making informed security decisions in general. Don't put users in that position.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/533/712/734/034/973/original/7873081a273e8a42.mp4

2026-05-04 20:34:40 GMT

Everything is a lie.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/518/208/672/071/533/original/90af9da8f584e654.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/518/209/431/136/643/original/686a19f61de9db62.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/518/210/823/676/970/original/2a1848312846ce5e.png

2026-05-03 16:00:40 GMT

- reply

@nprofile…0hde
This is the sort of convergence that concerns me.
Like, if I had Apple Intelligence enabled it's probably not reading and learning from my Signal messages? But how do I really know?
And what's to say that the way the world works today won't change tomorrow when companies get greedier in the slurping up of your for the purpose of making AI better.

2026-04-30 12:47:45 GMT

- reply

@nprofile…g4vn
TBH, when I first read your writeup, I didn't believe that it was from Microsoft, the company.

2026-04-29 18:37:29 GMT

So CopyFail CVE-2026-31431 is a thing.
If you're on the Ubuntu platform, 26.04 is not affected. If you're on another platform, check with your vendor.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/489/442/181/221/777/original/e03a85c201d4361a.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/489/455/070/545/988/original/98a9ca3459e8b30c.png

2026-04-22 01:49:03 GMT

- reply

@nprofile…44dh
Even Recall, which nobody wanted, did its processing locally.
This sure is something.

2026-04-19 13:51:12 GMT

- reply

@nprofile…adl2
My shortcut for launching Chrome has --disable-features=ExtensionManifestV2Unsupported,ExtensionManifestV2Disabled on the cmdline, so all the good blockers still work.
At least for now. 😂

2026-04-16 21:03:47 GMT

I thought that ClickFix was silly, but we've clearly entered the "please fire this footgun" stage of infosec.
https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/416/402/259/048/505/original/0e4d20443122cf0c.webp

2026-04-16 12:45:42 GMT

- reply

@nprofile…mej2
TBH, for code that doesn't include a .SLN file, I usually have minimal luck compiling it straight-up with cl.exe
In this case, I simply made a new Visual Studio 2022 project for a console app, and then replaced the .CPP file contents with what's in the GitHub repo. There are a slew of warnings, but it compiles.
<snip>
1>C:\Users\test\source\repos\test\test\test.cpp(431,11): warning C4267: 'initializing': conversion from 'size_t' to 'int', possible loss of data
1>C:\Users\test\source\repos\test\test\test.cpp(694,49): warning C4267: '=': conversion from 'size_t' to 'ULONG', possible loss of data
1>C:\Users\test\source\repos\test\test\test.cpp(696,92): warning C4267: 'argument': conversion from 'size_t' to 'ULONG', possible loss of data
1>C:\Users\test\source\repos\test\test\test.cpp(714,20): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
1>C:\Users\test\source\repos\test\test\test.cpp(736,57): warning C4838: conversion from 'LONG' to 'DWORD' requires a narrowing conversion
1>Generating code
1>Previous IPDB not found, fall back to full compilation.
1>All 27 functions were compiled because no usable IPDB/IOBJ from previous compilation was found.
1>Finished generating code
1>test.vcxproj -> C:\Users\test\source\repos\test\x64\Release\test.exe
1>Done building project "test.vcxproj".
========== Build: 1 succeeded, 0 failed, 0 up-to-date, 0 skipped ==========
========== Build completed at 8:43 AM and took 01.818 seconds ==========

2026-04-16 02:27:28 GMT

From the same author as BlueHammer we now have RedSun.
This works 100% reliably to go from unprivileged user to SYSTEM against Windows 11 and Windows Server with April 2026 updates, as well as Windows 10, as long as you have Windows Defender enabled.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/412/016/760/812/126/original/af2cf09911b90b83.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/412/016/764/961/933/original/c70c00109489ea5a.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/412/016/775/721/000/original/3fe5485c2580eca2.png

2026-04-14 21:19:48 GMT

- reply

@nprofile…gu7x
Yup. It seems to make the race condition unwinnable.

2026-04-09 14:56:37 GMT

Let me get this straight...
The default setting for Signal on an iPhone allows law enforcement to see the content of all incoming messages, even after the app has been deleted? 🤔
https://www.404media.co/fbi-extracts-suspects-deleted-signal-messages-saved-in-iphone-notification-database-2/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/375/318/988/912/395/original/cd2e38defe89c4af.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/375/319/484/821/201/original/fe0e2e85e6dc2ef5.jpeg

2026-04-02 00:29:50 GMT

- reply

@nprofile…h3hp
"gave" is a weird way to spell "sold"

2026-03-09 23:00:37 GMT

My local hardware store just installed a vending machine out front of it, in case you need things when they're closed.
I love it.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/201/699/300/335/899/original/9c33a05602a61b0b.jpeg

2026-02-17 21:24:24 GMT

In the year 2026, it still appears that virt-manager cannot create snapshots of systems that use UEFI.
I haven't paid attention to this stuff for a while, but I have to assume that there's a sane and free modern replacement for virt-manager these days?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/088/072/387/382/464/original/9c10448802aa7b47.png

2026-01-11 23:19:34 GMT

- reply

@nprofile…vdk8
... About a year ago?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/879/020/723/545/852/original/f6834054dd5f1b3b.jpeg

2025-12-26 14:31:39 GMT

- reply

@nprofile…wy8e
The very first extension in this list cannot be used in modern Chrome/Chromium without trickery.

2025-12-03 21:41:55 GMT

- reply

I mean, I get why this is a problem.
Microsoft took two completely different things and called them both "UAC"
The UAC Credential UI, which is a security boundary.
The UAC Consent UI, which is NOT a security boundary.
Because the UAC Consent UI makes sense to default to [No], it's blue and is the default you get when you press [Enter]. However, the UAC Credential UI not only stole the "UAC" name, but it also stole the UAC Consent user interface, and just added fields for username and password.
The developer knew that keeping the [No] button blue didn't make sense when the default button in the UAC Credential UI is [Yes]. But they apparently didn't bother to fix it.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/657/806/012/459/066/original/740b64c42b07859b.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/657/806/382/216/261/original/d793a60b0946447b.png

2025-12-03 20:45:32 GMT

UI/UX wonder:
When a Windows dialog has multiple buttons, but one of them is blue, that blue one is the default action you get if you hit [Enter], right?
With the UAC Credential Dialog, [No] is the blue button, implying that it's the default action.
When you enter your credentials and press [Enter], the non-default [Yes] button is activated.
Am I confused, or did the UAC Credential Dialog authors simply choose to do the opposite of what UI guidelines state? Or are there no such guidelines?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/657/583/550/195/581/original/b961664dbe972567.png

2025-11-21 00:26:59 GMT

Apparently Gmail has a default-on setting that grants the permission to train their AI using your emails and attachments.
I'll file this as "expected".
The unexpected part?
When you toggle Smart features to turn it off, the pop-up says:
Smart features turned **on**
🤦‍♂️
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/584/844/222/557/744/original/82ef0bc0fe5dddc3.mp4

2025-10-30 15:12:46 GMT

Microsoft:
As much as 30% of the company's code is written by AI.
Also Microsoft:
Somehow we managed to make it so that clicking the x in Task Manager doesn't close the app. Whoopsie daisy!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/463/758/861/236/645/original/2fff515a1fda37bf.png

2025-10-29 15:00:39 GMT

Back when I first left the CERT/CC, I was unpersoned by the SEI pretty much right away. "Will Dormann" ? Never existed. All we have is user-9a25e.
Just recently, looking for a thing I had done in the past, I realized that the entire vuls.cert.org website has been taken offline. Which I suppose is not terribly surprising given the lack of understanding the SEI seems to have of how the World Wide Web works.
Only by way of the lovely archive.org can we find things like:
Creating aarch64 (ARM64) Windows Shellcode: Part 1 - no ASLR
Creating aarch64 (ARM64) Windows Shellcode: Part 2 - ASLR support
I made these public for a reason.
Remember, folks:
Your current employer probably doesn't really care about your actual work. What the work gets them is all that matters. All else is irrelevant and therefore ephemeral.
Just because something is online doesn't mean that it will stay that way. If you care about ever seeing something online ever again, be sure to submit it to archive.org and archive.ph.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/457/995/105/060/090/original/058c4fed82335e2f.png

2025-10-28 18:48:14 GMT

I've noticed that Gmail is letting a pattern of spam messages through lately (maybe the past month or two?).
With the subject line of Delivery Status Notification (Failure) and then just a junk email body.
Just me? Is using a subject line of Delivery Status Notification (Failure) really all it takes to get past Gmail's spam filtering?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/453/279/983/177/054/original/b0a6dc6f7a7cb502.png

2025-10-25 22:08:09 GMT

TIL that I can take the part of my post-sauce tomatoes that I'd otherwise throw away (the skins), throw them in a spice grinder, and you get delicious tomato powder!
mindblown.gif
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/437/080/249/765/993/original/0172c1fa588119e8.jpeg

2025-10-17 13:34:08 GMT

Do you or somebody you know have a Windows 10 that isn't fit for a Windows 11 upgrade? (e.g. no TPM)
Get a Windows 11 25H2 ISO
Run setup /product server
Enjoy your Windows 11 with no coerced Microsoft Account, TPM features, etc.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/389/760/139/297/698/original/a40929b810a7a5bd.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/389/760/525/928/238/original/359b7ab0e60c9842.png

2025-10-08 17:19:29 GMT

- reply

@nprofile…5lc3
Three clicks is a lot to expect, I suppose.

2025-10-08 14:52:07 GMT

For some reason, people seem to be spun up about recent changes that allegedly force people to create Microsoft accounts during Windows 11 setup.
Except, nothing is being forced.
Windows 11 Pro or better:
Just do the usual:
Set up for work or school
Sign-in options
Domain join instead
Create local account.
Windows 11 Home:
Ok, fine. Microsoft has indeed removed the OOBE.CMD batch file. But you know what? You can run the command that a batch file runs without the batch file itself?
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE /v BypassNRO /t REG_DWORD /d 1 /f
Once you reboot, you'll have the I don't have internet link, where you can create a local account.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/339/098/324/820/507/original/0c702edb7cf88c97.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/339/098/336/907/693/original/73f8d637c48da2ec.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/339/098/349/572/219/original/643e0ae19d349b4f.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/339/099/231/060/018/original/d0c84dbe5a016502.png

2025-08-25 22:23:20 GMT

I approve.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/091/740/267/819/777/original/f82a022d7dde9742.jpeg

2025-08-19 21:10:36 GMT

Me: Ooh, my VeraCrypt install is out of date. I should probably update it.
Oh, that's why people don't update their software. Got it...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/057/479/409/716/544/original/446c63597c3af63b.png

2025-07-23 03:50:24 GMT

NGL... Super Sauce tomatoes are kind of ridiculous.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/900/505/431/833/053/original/83cbd76bb20277a8.jpeg

2025-05-26 13:35:46 GMT

I made a pizza from a recipe book.
Caramelized shallots in olive oil, asparagus, prosciutto, and fontina / parmesan cheese.
It was... DELICIOUS!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/574/395/381/043/125/original/c9e0ef1faf523336.jpeg

2025-05-13 17:35:27 GMT

Ooh, another of my NTFS vulnerabilities that I reported years ago was patched today. 🎉
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32707
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/501/728/289/047/593/original/127d5aa8905234a9.png

2025-05-13 15:21:40 GMT

I'm at a meeting hosted by somebody else where they're using Microsoft Teams, and in the chat I attempted to share an image that is on my laptop. By clicking the + button and Attach file.
The result of doing this is that Teams puts the image in MY COMPANY'S SHAREPOINT SERVER, and nobody else in Teams can see the image because they DON'T HAVE AN ACCOUNT on my company's SharePoint server. 🤦‍♂️
Wonders:
1) Has anybody at Microsoft actually tried using Teams?
2) Why do people choose to use Teams?
Aside: If you copy an image and press Cmd - V to put the image in the chat, Teams actually... puts the image in the chat.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/501/201/358/592/222/original/03cbbcbea6ab57d9.png

2025-05-08 20:08:29 GMT

Neat way to disable Windows Defender (or possibly other AV products)...
Register a no-op AV product in the Windows Security Center (WSC). This action is protected by an NDA that AV vendors sign, and, well...
Anyway, yeah, admin users can do admin things. Don't forget that.
https://github.com/es3n1n/defendnot
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/474/016/191/416/836/original/c1cc0ab02f3454bc.png

2025-05-06 18:53:54 GMT

@nprofile…r0kn
Search on infosec.exchange returns No results and a 500 in the lower left corner.
Known issue?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/462/400/046/094/207/original/6f5013653af6c046.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/462/400/453/444/818/original/9bd1ace7b1b27705.png

2025-05-01 12:39:57 GMT

- reply

@nprofile…5lc3 @nprofile…fle4
Not sure what you mean...
My hotmail account is passwordless? (Locally it uses a PIN)
Unless you're talking about something else?

2025-05-01 12:30:31 GMT

- reply

@nprofile…fle4 @nprofile…hy3c @nprofile…gqp6 @nprofile…5lc3
Got it. I was on auto-pilot so I took the path that I assume everyone takes. 😂

2025-05-01 12:26:12 GMT

- reply

@nprofile…fle4 @nprofile…hy3c @nprofile…gqp6 @nprofile…5lc3
Log in locally to the hotmail account how? The option it gives me is to log in to that account with a PIN. Not a password.

2025-05-01 12:14:02 GMT

- reply

@nprofile…fle4 @nprofile…hy3c @nprofile…gqp6 @nprofile…5lc3
I never realized that "Other users" was required. Thanks for the confirmation. TBH, that's the only way I've added other users to Windows.
Also, I cannot confirm your "... until someone logs into that computer with a password" part, though.
When I add a hotmail.com account, it sets up a PIN for it. And as you mention, logging in with that locally doesn't invalidate the ability to connect with RDP using the old password. But, even after I log in to Windows locally using an other password-based account, that still doesn't invalidate my ability to log in as the hotmail account using the old creds.

2025-05-01 00:26:22 GMT

- reply

@nprofile…fle4
@nprofile…2a7l BTW

2025-04-30 23:23:43 GMT

- reply

@nprofile…hy3c @nprofile…fle4 @nprofile…gqp6 @nprofile…5lc3
It's in the "Advanced" tab.
Mine is definitely off, and it connects fine.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/429/487/495/327/815/original/54fb732b8f1b48a9.png

2025-04-30 23:19:29 GMT

- reply

@nprofile…fle4 @nprofile…gqp6 @nprofile…5lc3
I never clicked any "use a web account" setting.
TBH, I didn't know such a setting existed until now.

2025-04-30 23:07:53 GMT

- reply

@nprofile…fle4 @nprofile…5lc3
In my case:
Windows 11 Enterprise with a local account initially (via BYPASSNRO)
I added a Microsoft (hotmail.com) account.
I then turned on RDP.
That's all. Absolutely nothing else.
If I log in via that hotmail account to RDP, it will accept the original cached password even if I change my hotmail account password.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/429/420/945/735/068/original/f090a15060e8ba01.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/429/422/475/304/248/original/6caffd399e4feb41.png

2025-04-30 23:01:40 GMT

- reply

@nprofile…fle4 @nprofile…5lc3
Hm, that all sounds different than what I tested.

2025-04-30 22:11:06 GMT

- reply

@nprofile…fle4 @nprofile…5lc3
Really? I found it quite easy:
1) log in to windows with a Microsoft account
2) Turn on RDP
🤷‍♂️

2025-04-30 19:58:12 GMT

- reply

@nprofile…5lc3 @nprofile…fle4
Yeah, I didn't have a local AD ready to test.
But I could definitely see a difference with authenticating RDP using a local account vs. an online account.
With local accounts, the instant the password changes, the RDP client needs the new password.
For online accounts, the old password still works, indefinitely.

2025-04-30 19:36:04 GMT

- reply

@nprofile…fle4
I've seen no evidence that the RDP cred cache gets updated ever.
Granted, I only started looking at this very recently, but the reporter seems to indicate that this is the case.

2025-04-29 12:49:13 GMT

Google published a blog post about 0days and the like. This jumped out at me:
Vendor investments in exploit mitigations are having a clear impact on where threat actors are able to find success.
Stack canaries gained popularity in the Linux world in 2002. When did the Linux-based Ivanti ICS product get stack canaries, after years of ITW exploitation? 2025. That's right. They decided to wait TWENTY THREE YEARS before deciding to turn on a compile-time flag that would have prevented successful exploitation of April's CVE-2025-22457.
We all know that comparing the security disposition of companies/products based on CVE counts is both foolish and futile, but sometimes they make it easy for us. 😂

2025-04-24 16:02:55 GMT

If you create an ARM VM in Azure, beware that your "Recently used size" will be ARM, and as such you will not be able to create any preconfigured x64 VMs.
Because of course if your "Recently used size" is ARM, Microsoft will disable the ability to pick an x64 size. 🤦‍♂️
Yes, I had to create a sacrificial x84 VM in Azure to work around this. Once my recently used size was x64, I was able to pick any size that I wanted.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/393/660/047/299/710/original/b8c83e056a7bd900.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/393/660/464/816/983/original/b2b5148efbc9de3f.png

2025-04-22 17:28:19 GMT

- reply

@nprofile…fle4
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/382/791/715/018/360/original/2d0a4ac06d0948c0.png

2025-04-22 17:16:35 GMT

- reply

@nprofile…fle4
https://infosec.exchange/@wdormann/114382471590770757

2025-04-16 14:25:29 GMT

- reply

@nprofile…xutp
At some point we got on a plane to tell them such sorts of things IN PERSON.
The general gist of the reaction was: Features sell, security doesn't.

2025-04-16 14:08:09 GMT

- reply

In 2016, I told MSRC that Microsoft Word running ActiveX controls in RTF documents without prompting was bad.
(The same content in a .DOC or .DOCX file would prompt the user)
They said that I was wrong.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/348/042/357/312/889/original/589e5826708f6696.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/348/024/138/320/988/original/0c65ae7b214313f8.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/348/025/275/737/138/original/0d82624de699410e.png

2025-04-16 02:39:59 GMT

Microsoft blocks ActiveX by default in Microsoft 365, Office 2024
https://www.bleepingcomputer.com/news/microsoft/microsoft-blocks-activex-by-default-in-microsoft-365-office-2024/
About damn time!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/345/323/808/365/253/original/5298a4f71037e0f1.jpeg

2025-04-14 13:06:23 GMT

- reply

Yeah so as an experiment I chose not to charge my phone with the battery pack overnight. Rather, this morning I plugged my needing-charge iPhone into a USB-C PD battery pack that was at 100% capacity.
The result? My iPhone complained that the device was using too much power. 😂
Unplugged it and plugged it back in again... And now the phone is charging.
USB-C PD is weird when both sides being connected are battery powered.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/336/458/414/731/419/original/596a29016a83891a.jpeg

2025-04-13 15:21:16 GMT

Last night I didn't have a phone charger handy, so I plugged my iPhone into a USB-C PD battery pack.
I'm pretty sure that what happened here was:
Quick charge for a bit
Paused charging while I was sleeping
Finished charging
The battery pack used the phone's power to top off itself. (The phone wasn't even on at this time)
😂
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/331/325/809/678/352/original/115f353b060ee839.jpeg

2025-04-11 12:20:56 GMT

- reply

@nprofile…5lc3 @nprofile…h32e
Hilarious.
The two things that MSRC seems to aim to to achieve are:
Avoid saying anything about what their security updates do unless their hand is forced.
Take the path of "least resistance" as opposed to fixing the root cause of problems. (In this case, non-admins can create subdirectories directly off of C:\)
https://infosec.exchange/@wdormann/114319281111054638

2025-04-10 20:26:26 GMT

- reply

@nprofile…5lc3
Ah, you'd think that you couldn't.
But indeed you can!
That is, a non-admin user can create a "directory" junction to a file target, which will have the result of April's security updates failing to install. 😂
It seems that this weird concept of a junction to a file achieves an unexpected double-standard:
It counts as a directory when it comes to NTFS ACLs (a non-admin user can create a junction in C:\)
Depending on how the junction is accessed, it might count as a file as opposed to being treated as a directory.
This seems like a problem. Obviously in the case of April's updates here. But perhaps even more generically in that a junction to a file target seems to almost guarantee unexpected behavior.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/315/468/118/374/963/original/117737951bd66c59.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/315/468/098/079/634/original/231bb5eedc25ad85.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/315/494/751/134/719/original/1f3da3b5b4a3c3d9.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/315/468/576/264/239/original/637c727e33bcbaa2.png

2025-04-10 19:58:07 GMT

- reply

@nprofile…5lc3
Just to be clear, while mklink /h can itself be used by a non-admin user, that same non-admin user would not be able to create a hard link in C:\ as that would be the same as creating a file there. Which non-admin users can't do.

2025-04-10 19:35:25 GMT

- reply

@nprofile…5lc3
You can?
Non-admin users don't have SeCreateSymbolicLinkPrivilege, so I don't believe you. 😀
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/315/339/916/620/405/original/0ac365f918db7466.png

2025-04-10 19:28:04 GMT

- reply

@nprofile…5lc3
Ah, that'd do it!
But at the same time, creating files in the root directory requires admin privileges.
And if you're a trigger-happy admin, there are plenty of footguns that you can use. 🤷‍♂️
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/315/306/010/556/017/original/4edcd62c718580ca.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/315/312/018/694/860/original/c76890f4e4d646cb.png

2025-04-10 18:32:52 GMT

- reply

@nprofile…5lc3
Specifically, I've seen all April updates install even when C:\inetpub exists ahead of time.
I should have known better than to attribute the correlation of C:\inetpub in a VM before updates to the causation of a failed update.
What happens with C:\inetpub is tough to see, as it either happens before the Procmon boot driver loads, or Procmon is otherwise foiled by the updates occurring. But either way, there's a bit of a blind spot between pre-reboot C:\inetpub not being there and it being there post-reboot. A Procmon boot log sees nothing. 😕
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/315/085/369/818/791/original/2e70f29df7d7ed13.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/315/096/002/788/236/original/c73ec6e4493404ac.png

2025-04-10 14:17:31 GMT

- reply

@nprofile…5lc3 @nprofile…87gl
Yeah, so this is interesting. I was skeptical, but I can confirm that KB5057589 (which installs KB5055674) for Windows 10 will fail to install if there is a C:\inetpub directory present ahead of time, which a non-admin user can fulfill.
I wouldn't expect the update to be so fragile that the mere presence of a C:\inetpub directory prevents its installation. While KB5057589 is indeed listed as a "Security Update", I can find no information of what CVE(s) it fixes. 🤔
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/314/084/290/005/673/original/1046fbf3d5631702.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/314/084/912/020/799/original/ada09b9ca13f641b.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/314/085/867/522/689/original/e8d5cf1eaac1fb90.png

2025-04-09 16:05:41 GMT

After installing April's updates, Windows 10 and 11 systems now have an empty C:\inetpub directory.
This seems... unexpected?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/308/855/978/617/969/original/add7da11cee02475.png

2025-04-06 14:44:49 GMT

- reply

@nprofile…kxpq
Honest question:
What would lead somebody to install the disgrasya Python package?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/291/550/968/696/447/original/bd574169bb9f2d08.png

2025-04-03 21:52:30 GMT

- reply

@nprofile…kxpq
Ivanti naver claimed to have patched the vulnerability. They said that it is remediated in 22.7R2.6
As in, the exploit mitigations that they finally started using stop the exploit from being successful.
https://infosec.exchange/@wdormann/114275557601801461

2025-03-31 17:54:15 GMT

- reply

Apparently YMMV when checking for macOS updates. 🤷‍♂️
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/258/321/572/273/858/original/f01e13c5a203e7ff.png

2025-03-31 17:47:07 GMT

Time to update your fruit.
https://support.apple.com/en-us/100100
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/258/294/037/861/046/original/803a242ba200e932.png

2025-03-31 14:09:04 GMT

In today's episode of drama in the CVE ecosystem:
The Canonical CNA created CVE-2025-0927 and an associated advisory for a heap overflow in HFS+ in the Linux kernel.
The Linux kernel CNA stripped out the information (like the reporter of Attila Szász, useful references, etc) from the CVE entry and added the passive-aggressive:
The Linux kernel CVE team has been assigned CVE-2025-0927 as it was incorrectly created by a different CNA that really should have known better to not have done this.to this issue. [sic]
Also TIL: If you look only at the assignerShortName in a cvelistV5 CVE entry, you might not get the whole picture of whose CVE it technically is. While the Linux kernel rewrote history to claim that they assigned the CVE, that was only done via the cna container's ProviderMetadata shortName value. The top-level [assignerShortName](https://github.com/CVEProject/cvelistV5/blob/main/cves/2025/0xxx/CVE-2025-0927.json#L7) for the entry still shows canonical.
Good times...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/257/381/114/219/227/original/3812831817c8bd89.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/257/431/435/673/328/original/f86fe742deac6337.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/257/433/764/597/291/original/8cafd467d7c4c038.png

2025-03-29 12:57:47 GMT

Broadcom has determined a way to get more money out of VMware licensing:
If a customer has a single-processor server with 8 cores, VMware by Broadcom will license 72 cores.
😂
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/245/831/989/747/827/original/5ed1a738613c50e3.jpeg

2025-03-28 22:51:57 GMT

- reply

I mean, bypassnro.cmd just does:
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE /v BypassNRO /t REG_DWORD /d 1 /f
So what Microsoft is saying is that they want to make it more work to install Windows without a Microsoft Account? 🤔

2025-03-28 22:43:50 GMT

Upcoming Windows 11 builds won't have the ability to to install without internet connectivity and a Microsoft Account.
https://blogs.windows.com/windows-insider/2025/03/28/announcing-windows-11-insider-preview-build-26200-5516-dev-channel/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/242/473/836/170/826/original/22c23d2f9c70561d.jpeg

2025-03-28 20:01:12 GMT

From the Bad Site, and I have to share:
I have a tip for everyone with imposter syndrome: Just browse linkedin for a few minutes, and it will go away 🤣🤣

2025-03-26 15:14:17 GMT

In today's episode of reading through infosec drivel produced by self-serving organizations:
Trend Micro's writeup of CVE-2025-26633 ("MSC EvilTwin").
For starters, rather than giving an IOC of an example exploit, they give the SHA256 of mmc.exe. Thanks?
They also slightly hand-wave over the fact that this ITW exploit starts with executing a PowerShell script. That is, the attack chain begins with the ability of the attacker to execute code on the target system as a prerequisite. Sorry, I'm sort of bored already.
But they've got my attention, so let's dig in a little deeper as to why this is a prerequisite...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/229/367/796/260/760/original/ce542128456a3f2e.png

2025-03-19 17:06:07 GMT

From the world of "CVE has poorly designed rules that are poorly enforced":
https://www.bleepingcomputer.com/news/security/whatsapp-patched-zero-day-flaw-used-in-paragon-spyware-attacks/
WhatsApp had a zero-click 0day exploited ITW, but they didn't bother with CVE assignment because they didn't have to.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/190/190/109/262/148/original/edef377c75f75544.jpeg

2025-03-19 12:07:57 GMT

- reply

@nprofile…8nj8 @nprofile…5lc3
I've got a better one:
Windows hides file extensions by default. Unlike the LNK thing, this one actually gets people to do things like double-clicking on things like foo.pdf.exe, thinking it's a PDF.
Surely this deserves media hype and an ID, as it's much more impactful than ZDI-CAN-25373. 🤔

2025-03-19 11:37:12 GMT

- reply

@nprofile…8nj8 @nprofile…5lc3
The fact that it doesn't warrant a CVE should be a red flag enough to indicate that it's made up. BUT the story going around has got all of the buzzwords that the media foams at the mouth about, so...
But seriously, though. How many times have you looked at a LNK target using the Windows GUI to use as a factor in the decision making process of deciding whether or not to double-click on it? 😂