Nostr notes by Dr. Christopher Kunz

CrowdSec writes to me: „Monthly alert quota exhausted for ...

2026-09-01T04:52:19Z

CrowdSec writes to me:

„Monthly alert quota exhausted for christopher-kunz's account

Your Community plan has reached its monthly quota of 500 alerts.“

At 3:32 am on September 1. Well….

„Premium raises your alert quota to 10k/month/Security Engine“, they also upsell me. Yeah right. That would take me all the way to midday on the 3rd!

Guess I‘ll have to take a deep dive into the alerting behavior.

I have questions. Especially one: Which is the PAN-OS release ...

2026-07-09T14:30:37Z

In reply to nevent1q…5wch
_________________________

I have questions. Especially one: Which is the PAN-OS release preferred by the folks at watchTowr (npub13vn…f849) Labs?

Wait, we have preferred releases now? Like, as in "beta", ...

2026-07-09T14:24:01Z

In reply to nevent1q…szfd
_________________________

Wait, we have preferred releases now? Like, as in "beta", "latest", "lts", "preferred", "notso-hotso"?

"Product fails at core competency" should be the takeaway ...

2026-07-09T14:03:18Z

In reply to nevent1q…pz8n
_________________________

"Product fails at core competency" should be the takeaway from this. Unfortunaly, CVSS 1.7 will land this very low on anyone's priority list, be it SSVC or that CISA thing.

I should have made a 2026 issue for my insecurity appliance ...

2026-07-09T14:00:31Z

In reply to nevent1q…ah6h
_________________________

I should have made a 2026 issue for my insecurity appliance bingo. With another column: "CVSS sandbagging". However, I think they are actually right here, because the flaw only affects subsequent systems. I would have gone for SC:N/SI:H/SA:H though, upping the score to 2.7
This shows again how bad CVSS performs as a threat metric.

snapshots aren't currently working properly for win VMs on my ...

2026-06-10T16:55:42Z

In reply to nevent1q…pfyt
_________________________

snapshots aren't currently working properly for win VMs on my homelab hypervisor and I haven't had time to really look into it. My VM is now on 1.453.27.0.

With the latest definition update and after an sfc /scannow, the ...

2026-06-10T16:39:34Z

In reply to nevent1q…f5nz
_________________________

With the latest definition update and after an sfc /scannow, the modified PoGue still starts, but the EICAR file gets quarantined after the ISO is mounted, and I think the race becomes unwinnable. I can also not see a modification to \system32\wermgr.exe anymore. So I think this might be fixed now?
Maybe even a little more advanced than initial RedSun fix, seeing that they added Trojan:Win64/RoguePlanet.DA!MTB in 1.453.23.0 and Behavior:Win32/SuspDefAbuse in .21.0?

Will we wake up to see Windows Defender quarantining wermgr.exe ...

2026-06-09T21:35:19Z

Will we wake up to see Windows Defender quarantining wermgr.exe pr the Task Scheduler in an attempt to contain RoguePlanet? Oh, the excitement….

So CVE-2026-41089 (CVSS 9.8) in Windows Netlogon can be triggered ...

2026-06-01T18:53:41Z

So CVE-2026-41089 (CVSS 9.8) in Windows Netlogon can be triggered by sending a username that is AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA or longer.
How original.

I also lowkey like how Crowdstrike goes from "data theft and ...

2026-05-18T13:30:54Z

In reply to nevent1q…jzxh
_________________________

I also lowkey like how Crowdstrike goes from "data theft and exto..." to "Contact sales".

I like "GRACEFUL SPIDER". I think this might be their ...

2026-05-18T13:28:25Z

In reply to nevent1q…547w
_________________________

I like "GRACEFUL SPIDER". I think this might be their logo.
Wait, that looks way too familiar.

> Nachts um drei in den USA > ICE steht vor der Tür > ...

2026-03-24T07:03:10Z

> Nachts um drei in den USA
> ICE steht vor der Tür
> Ausländische Freundin und Kind im Hinterhaus versteckt
> Testament unterschrieben
> Burner Phone in Plastikbeutel geschluckt
> Guten Tag, uns wurde ein ausländischer Router gemeldet.

Youtube did the right thing and resolved my complaint within a ...

2025-12-25T17:14:38Z

In reply to nevent1q…hwev
_________________________

Youtube did the right thing and resolved my complaint within a few hours. And they decided that the clearly fraudulent ad is... not fraudulent.

Way to go, Youtube. Way to go.

It's a little bit ironic that this ad got shown to me while watching Cory Doctorow (npub1fdr…lvhs) on the Daily Show, in anticipation of meeting him on #39C3.

Merry christmas everyone. A word of warning: I just encountered ...

2025-12-25T10:03:40Z

Merry christmas everyone. A word of warning: I just encountered this scam ad on YT - don't let scammers get the better of you during these holidays. There's obviously no way in hell that a 16TB usb drive is sold for this price.

RE: https://cyberplace.social/@GossiTheDog/115745701289876342 ...

2025-12-19T14:54:55Z

RE: https://cyberplace.social/@GossiTheDog/115745701289876342

> - HPE added a REST command, executeCommand, which requires no authentication to execute commands. Obviously, this is dumb and now patched out

Wait. What?

quoting
note1k85…suvp

HPE OneView CVE-2025-37164 worth paying attention to

- Widely used enterprise management software

- HPE added a REST command, executeCommand, which requires no authentication to execute commands. Obviously, this is dumb and now patched out

- Being on OneView allows attacker to access VMware, 3PAR storage etc by design

- Expect exploitation in the wild as it's so simple

- The vulnerability (executeCommand) was introduced around 2020, feels like a vulndoor

Shodan dork: product:"HPE OneView"

RE: https://mastodon.gamedev.place/@danielalbu/115723469299750446 ...

2025-12-15T13:17:48Z

In reply to nevent1q…lwdh
_________________________

RE: https://mastodon.gamedev.place/@danielalbu/115723469299750446

The sound effects still live rent free in my head after 34 years.

quoting
note1gx7…pfv4

📅 34 years ago today, the second Commander Keen series, Goodbye Galaxy, was released!

💾 Commander Keen in Goodbye, Galaxy was released on December 15th, 1991! 💾

...and don't get me started about the existence of a ...

2025-12-08T15:34:34Z

In reply to nevent1q…f9tg
_________________________

...and don't get me started about the existence of a security.txt.

The headline "'End-To-End Encrypted' Smart Toilet ...

2025-12-04T14:12:47Z

The headline "'End-To-End Encrypted' Smart Toilet Camera Is Not Actually End-To-End Encrypted" was not on my 2025 bingo card. Or any previous one.

Dreamweaver was a pile of odorous excrement, change my mind. Team ...

2025-11-27T07:22:14Z

In reply to nevent1q…38qz
_________________________

Dreamweaver was a pile of odorous excrement, change my mind.

Team HomeSite all the way.

Sha1-Hulud has a dead man's switch The second iteration of ...

2025-11-26T08:29:13Z

Sha1-Hulud has a dead man's switch

The second iteration of the Shai-Hulud worm had a dead man's switch that destroys data on infected machines.
If it can't reach Github or npm to self-propagate, the worm spawns a cmd.exe / bash shell and tries to delete all data that can be written by the current user. Yikes.

It seems sha1-hulud is now contained though: Only about 300 infected repos are left.

https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/

BINGO TIME! With CVE-2025-58034, Fortinet secures the crown in my ...

2025-11-21T06:35:27Z

BINGO TIME! With CVE-2025-58034, Fortinet secures the crown in my Insecurity Appliance Bingo. This is technically a "high" severity vuln, but since it's being actively exploited and has landed a spot on CISA KEV, I'm admitting it.

https://cku.gt/appbingo25

Reaching a bingo took longer than expected, with FortiNet and Ivanti sitting at 5/6 vulns since about July. But now, there is a well-deserved winner.

I'm now taking new vuln class and vendor suggestions for next year's edition.

Let me get this straight. If I want to report a currently active ...

2025-11-20T15:35:21Z

Let me get this straight. If I want to report a currently active malware dropper domain to Cloudflare, they make forwarding my report (including my name and e-mail address) to the likely culprit _mandatory_?
This seems wrong. [@cloudflare](https://cloudflare.social/@cloudflare ) ?

It's amazing to me how many of these screen shots are of an ...

2025-11-13T08:16:13Z

In reply to nevent1q…ut5l
_________________________

It's amazing to me how many of these screen shots are of an open root shell where multiple skids unsuccessfully tried to install a rootkit.

Deck at around the same time. I had a hard time playing games in ...

2025-11-13T07:47:17Z

In reply to nevent1q…v8v6
_________________________

Deck at around the same time.
I had a hard time playing games in VR because they were extremely exhausting for me - due to immersion and the more immediate sensations. I'm no longer convinced that VR is capable of becoming a mass, mainstream market at all.
That being said, if anyone is able to make it work, it's probably Valve, if they are able to repeat the success formula of the Steam Deck.
Do you have a link to the discussion?
2/2

I considered myself to be an early adopter of VR, used a ...

2025-11-13T07:45:24Z

In reply to nevent1q…j2hx
_________________________

I considered myself to be an early adopter of VR, used a Virtuality headset in ~1996, always dreamed of a Forte VFX1, had Oculus DK2, PSVR1, Quest1-3. I gave the whole VR thing so many tries, but it always felt lackluster.
On the Quest, the ecosystem felt neglected pretty much from the get go: Obviously fake app reviews, terrible lobbies in multiplayer, not-so-great update politics, etc. - after Zuckerberg pitched the whole Metaverse idea, I bailed. Incidentally, I sold my Steam 1/2

Fediverse! Which password manager do you recommend to your ...

2025-11-10T08:23:49Z

Fediverse! Which password manager do you recommend to your parents, grandparents, kids, grandkids, those people from your sports club who come to you for computer help?
Please comment for additional options, I can only fit four options here.
I'd love a boost for this, it's for a talk I'll give in a week at the heise HQ in Hanover, Germany.

always writes stellar articles. I absolutely adored his explainer ...

2025-11-07T10:52:08Z

In reply to nevent1q…0r3t
_________________________

always writes stellar articles. I absolutely adored his explainer about the "Chinese have quantum broken RSA" hype a few months ago: https://cku.gt/quantumhype

Does anyone have an idea if the number "236787" is a ...

2025-11-06T09:39:04Z

Does anyone have an idea if the number "236787" is a significant number in any context, significant enough to be used as a device or login PIN? I'm a little stumped.
It's not a birthday, not a geometric number, doesn't seem to be a significant swipe pattern.
Any ideas, Fediverse?

Lots of German ASes in that list. 1337 services runs ...

2025-11-04T16:48:11Z

In reply to nevent1q…u6pw
_________________________

Lots of German ASes in that list. 1337 services runs "rdp.sh", a vps provider. the others seem to be mostly vps hosters, too.

Do I know anyone from the @npub12us…h86y team who could answer ...

2025-10-15T09:17:39Z

Do I know anyone from the Quad9DNS (npub12us…h86y) team who could answer a specific question for our newsroom?

This looks like excellent value for the money. The Humble Bundle ...

2025-10-13T08:21:43Z

This looks like excellent value for the money. The Humble Bundle Cybersecurity Month features 24 O'Reilly books on various security topics: https://www.humblebundle.com/books/cybersecurity-month-oreilly-books

Wem gehört denn chat-kontrolle.eu ...

2025-10-07T10:24:16Z

Wem gehört denn chat-kontrolle.eu [@echo_pbreyer](https://digitalcourage.social/@echo_pbreyer ) Digitalcourage (npub1t3g…qqds)?

Bei Strato brennt gerade ein bisschen der Webserver, auf dem die Domain liegt, fürchte ich: Bekam gerade "502 Proxy Error" beim Aufruf.

The timeline checks out: The exploit was posted on TG on October ...

2025-10-07T10:14:08Z

In reply to nevent1q…n4gt
_________________________

The timeline checks out: The exploit was posted on TG on October 3, early afternoon. It was also first uploaded to VT on October 3. After Oracle woke up to the news on October 4, they quickly assessed the damage and pivoted their narrative to "discovered during our investigation". aka "downloaded from telegram".

This fits a repetitive pattern of what I would diplomatically call "unethical disclosure practice". If you update your publications, AT LEAST mark the edits.

2/2

I cannot stress enough how deceptive this tactic is. First, ...

2025-10-07T10:08:29Z

In reply to nevent1q…n4gt
_________________________

I cannot stress enough how deceptive this tactic is.

First, Oracle gaslight their own customers into "if something happens, it's because you haven't patched". Then, after downloading a zero-day off Telegram finding out that they have been pwned by Scattered Lapsus$ Hunters, they quitely edit out the previous content.

And this is not some anonymous marketing writer, but the Chief Security Officer for one of the biggest corporations on the globe.

1/2

TIL: The Cl0p ransomware group has been named "Graceful ...

2025-10-07T07:57:45Z

TIL: The Cl0p ransomware group has been named "Graceful Spider" by CrowdStrike. What the actual f is that? There's nothing graceful about extortion. Nothing.

This is purely a marketing device for companies, and ultimately a transparent sales tactic.

If you want to see if companies take actual security seriously, look at small things like this. There is zero necessity for these individual TA names, on the contrary: They increase confusion by conflating clearly distinct profiles.

The "ls -laR" of the Red Hat data breach by Scattered ...

2025-10-06T13:48:30Z

The "ls -laR" of the Red Hat data breach by Scattered Lapsus$ Hunters is, put into a text file, 2.2 GB. That's a heck of a breach.

They replaced the whole blog post and somehow purged copies from ...

2025-10-06T12:12:26Z

In reply to nevent1q…r0cx
_________________________

They replaced the whole blog post and somehow purged copies from WBM. However, they forgot to change the SEO URL which still hints at their original narrative: "Apply July 2025 CPU".

Cl0p had it, SLSH has it, and if the indicators on the exp aren't faked, they have had it since May or so. And now, everyone has it, I expect it to make CISA KEV by tomorrow.

This is Jamal Kashoggi. Seven years ago today, he entered the ...

2025-10-02T06:51:51Z

This is Jamal Kashoggi. Seven years ago today, he entered the embassy of Saudi-Arabia in Istanbul and never came back. The people who ordered his assassination have never faced justice.

Yeah, good point. findmystreet.co.uk is still down too, ...

2025-09-30T07:31:40Z

In reply to nevent1q…2ppj
_________________________

Yeah, good point. findmystreet.co.uk is still down too, hdsc.org.uk seems down, Harwich Town Council is the wrong site (org vs. co).

The attacks ran a couple minutes ago, the check-host.net on ...

2025-09-30T07:27:00Z

In reply to nevent1q…t8hs
_________________________

The attacks ran a couple minutes ago, the check-host.net on Noname's TG are from around 7:00 am UTC. Most of the attacks are likely over already.

And then there's this, too. Shareholders don't give a ...

2025-09-26T13:37:17Z

In reply to nevent1q…yzwd
_________________________

And then there's this, too. Shareholders don't give a damn if your products take down whole airports.

Ta to Tata, I guess.

2025-09-24T07:43:15Z

In reply to nevent1q…d9ha
_________________________

Ta to Tata, I guess.

This media isn't bored but there's just not enough for ...

2025-09-23T08:37:49Z

In reply to nevent1q…wgqc
_________________________

This media isn't bored but there's just not enough for updated reports. Last I heard was that ENISA claimed ransomware, ShinyHunters got strangely quiet on the record when questioned by Dissent Doe :cupofcoffee: (npub17l5…4kr3) so maybe there's something interesting there. For me there's just not enough substance right now to report anything.

Ha, I was faster! ;-) ...

2025-09-16T14:12:48Z

In reply to nevent1q…d69g
_________________________

Ha, I was faster! ;-) https://www.heise.de/news/Neuer-NPM-Grossangriff-Selbst-vermehrende-Malware-infiziert-Dutzende-Pakete-10651111.html

Very interested in seeing how this one will play out during the night.

They can just keep leadership by derailing everyone else. CVE ...

2025-09-15T14:25:12Z

In reply to nevent1q…6z0x
_________________________

They can just keep leadership by derailing everyone else. CVE tariffs, maybe? ;-)

Jokes aside, that "CVE vision" PDF makes some quite sound points, and I like the overall tone of commitment - including a commitment to transparency, with CISA leading by example (their words, not mine). In this day and age, that sounds almost sane.

We'll see how much of that will survive the next CVE funding lapse.

Reading their statement, this really reads like a boilerplate ...

2025-09-15T13:50:48Z

In reply to nevent1q…x8f7
_________________________

Reading their statement, this really reads like a boilerplate phrase that uses so many words for "we're not going to do anything to diversify the stakeholder landscape". The whole first page talks about how CVE is "CISA's thing" and that they claim ownership for the program, and then there's a lukewarm phrase à la "Yeah, we'll definitely circle back to this, but don't call us. We'll call you!"

I'm more concerned about the very clear "everyone: hands off CVE" undertone.

They are looking at "potential mechanisms for diversified ...

2025-09-15T12:39:37Z

In reply to nevent1q…rw00
_________________________

They are looking at "potential mechanisms for diversified funding", that does not mean CVE will disappear from CISA's budget.

The document makes it very clear that CISA rejects privatization of the program and that they think that CVE is their mandate: "These conflicts of interest reinforce the need for CISA to
take a more active role in the long-term stewardship of the CVE Program. At CISA, we have the appropriate mandate [..]"

Nope. Auch keine Mail bekommen.

2025-09-09T08:49:11Z

In reply to nevent1q…xq8x
_________________________

Nope. Auch keine Mail bekommen.

Do you have any indication that this outage also affects non-UK ...

2025-09-01T09:15:07Z

In reply to nevent1q…9qxf
_________________________

Do you have any indication that this outage also affects non-UK Colt customers?

The Wero app seems to crash on ios26beta (10s yellow blank ...

2025-08-21T08:07:57Z

The Wero app seems to crash on ios26beta (10s yellow blank screen, then crash back to springboard). I tried to contact the development team via the e-mail address in the Appstore entry:
appstore@wero-wallet.eu
I was informed by two separate auto-reply e-mails in four different language that this e-mail address is not monitored and that it's a no-reply address.
Support questions should be asked exclusively via the in-app chat.
No punchline.

Did anyone write a guide yet how to make self-hosted Ghost ...

2025-08-13T08:11:34Z

Did anyone write a guide yet how to make self-hosted Ghost instances less dependent on external resources? This includes Stripe payment, the Mailgun requirement, but also external JS dependancies like JSdelivr etc.

Seems that even a fully self-hosted Ghost is still extremely entangled with cloud services that I certainly *don't* want to be entangled with.

There's a lot of beauty in this VNC screenshot by ...

2025-07-11T06:51:53Z

There's a lot of beauty in this VNC screenshot by VNC Resolver (npub1q6h…zv6u)
The longer I look, the more details I see, it's a little like a "Where's Waldo" picture.

I'm so sorry! Gave a little something and I hope your brother ...

2025-06-26T14:14:46Z

In reply to nevent1q…k2nr
_________________________

I'm so sorry! Gave a little something and I hope your brother is able to meet his goal. This sucks on so many levels I cannot even begin to express it.

16 Milliarden Datensätze in neuem Mega-Leak!!einseinself Ja nee. ...

2025-06-20T14:35:37Z

16 Milliarden Datensätze in neuem Mega-Leak!!einseinself

Ja nee. Nicht so ganz. Weder ist das Leak wirklich neu (es handelt sich um Stealer-Logs, also von Malware auf clients abgegriffene Daten), noch ist der Umfang jetzt irgendwie großartig beeindruckend.

Ich habe das zusammen mit meinem Kollegen aufgeschrieben: https://heise.de/-10453723

Ein bißchen Zusatzrecherche und Datenauswertung habe ich auf Reddit gekippt: https://www.reddit.com/r/de_EDV/comments/1lg0j3f/infostealerpasswortlisten_von_innen_be%C3%A4ugt/

well, then it's settled.

2025-06-16T12:57:24Z

In reply to nevent1q…08ch
_________________________

well, then it's settled.

Soooo... which Lemmy server should one join as a security ...

2025-06-10T08:53:10Z

Soooo... which Lemmy server should one join as a security interested person?

CISA is changing the way they publizice alerts, including the KEV ...

2025-05-13T06:56:08Z

CISA is changing the way they publizice alerts, including the KEV (known exploited vulnerabilities). These will no longer be shown on the "Alerts" overview, but must be subscribed to via GovAlert (or just scrape the JSON...).

The first vulnerability that is *not* being published as an alert is...drumroll... CVE-2025-47729. "The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL app users"

Isn't that a funny coincidence?

phpMyAdmin still exists? Jeez, still looks like in 2002, too.

2025-04-15T12:25:06Z

In reply to nevent1q…dp08
_________________________

phpMyAdmin still exists? Jeez, still looks like in 2002, too.

Several second lag, 200p resolution, sounds a lot like my first ...

2025-04-07T13:24:41Z

In reply to nevent1q…urd0
_________________________

Several second lag, 200p resolution, sounds a lot like my first experience playing Quake2 on a sorely underpowered PC at original release. "Practically unplayable" checks out, too.

So are we now officially in 1997 again?

Total radio silence so far, no statement - not even ...

2025-04-02T07:33:38Z

In reply to nevent1q…ltf2
_________________________

Total radio silence so far, no statement - not even acknowledgement of my request for comment.

Something smells weird. Can I email you about that OCI thing?

2025-03-31T12:57:24Z

In reply to nevent1q…xsnw
_________________________

Something smells weird. Can I email you about that OCI thing?

Ah right, then there's an extra space in that link on medium. ...

2025-03-31T12:05:03Z

In reply to nevent1q…g9dx
_________________________

Ah right, then there's an extra space in that link on medium. The video id reads "375_G9wAff+o" there. Thanks!

Interesting. There's however an extra space in the Youtube ...

2025-03-31T12:01:27Z

In reply to nevent1q…p04r
_________________________

Interesting. There's however an extra space in the Youtube link in this sentence: "The meeting is viewable here and the transcript is "

First day after a one week holiday and boy, seems to have been an ...

2025-03-31T08:53:25Z

First day after a one week holiday and boy, seems to have been an interesting week. Amongst other things, there is now what seems to be a malware that installs a persistent backdoor in Ivanti Connect Secure, as per a CISA warning. The backdoor is injected
This means I get to update my insecurity appliance bingo and we're almost there. Just one critical "Auth Bypass" vulnerability away from the first bingo of the year. The bingo sheet lives at: https://cku.gt/appbingo25

I was wondering, actually. Where does it say that? Side note: I ...

2025-03-18T16:26:08Z

In reply to nevent1q…rxku
_________________________

I was wondering, actually. Where does it say that?

Side note: I have personally seen large ISO27001-certified orgs use this exact method to e-mail sensitive info. It's security theater and checkbox compliance, mimics the practices of credit card companies, mailing cards and PINs separately. However, real-life analogies rarely work, and vice versa. If an adversary has capabilities to exfil _one_ e-mail, they could exfil _all_ e-mails.

I kinda love the edit history on the US DOD's statement about ...

2025-03-05T12:05:05Z

I kinda love the edit history on the US DOD's statement about the purported stand-down order.
"There has been no stand-down order whatsoever from that priority, said the official who was granted anonymity to discuss internal decisions." The Guardian (npub168d…tu7v)

A couple of hours or day after publication maybe, my screenshot ...

2025-03-04T17:07:03Z

In reply to nevent1q…0t2u
_________________________

A couple of hours or day after publication maybe, my screenshot is from november 27.

This is a screenshot of the first snapshot for the CVE-2024-49035 ...

2025-03-04T15:55:53Z

In reply to nevent1q…fvkp
_________________________

This is a screenshot of the first snapshot for the CVE-2024-49035 advisory on MSRC. MS knew about exploitation from the get-go. Not sure why CISA is picking this up only now, being long patched and whatnot.

@npub1fh7…ee83 wird von anonymen Störenfrieden angegriffen. ...

2025-02-13T14:58:53Z

Codeberg (npub1fh7…ee83) wird von anonymen Störenfrieden angegriffen. Dazu habe ich eine Meldung geschrieben. https://heise.de/-10281324

My personal advice for Data Privacy Day: Get all your data out of ...

2025-01-28T09:19:09Z

My personal advice for Data Privacy Day: Get all your data out of Big Tech platforms as quickly as possible. Do not feed them new data. They are not your friends or allies.
(Edit to add:) If you can't get your data out due to lock-in, at least get a full backup and keep it current. Always be prepared to be locked out, secure alternate means of communication etc.

Sooooo... what is everyone thinking about Flohmarkt ? ...

2025-01-26T08:35:37Z

Sooooo... what is everyone thinking about Flohmarkt ? https://codeberg.org/flohmarkt/flohmarkt/

The notion of a federated, decentralized flea market / classifieds / Craigslist type network seems quite appealing to me, but maybe I'm being naive?

(PS: "Flohmarkt" is the German word for flea market, of course.)

...and here we go: Next entry in our bingo card is CVE-2025-23006 ...

2025-01-23T14:57:35Z

...and here we go: Next entry in our bingo card is CVE-2025-23006 in SonicWall SMA1000.

Thanks, everyone, and remember: Current version lives at https://cku.gt/appbingo25

As to be expected, that's from the Qu'ran. Sure ...

2025-01-23T08:01:09Z

In reply to nevent1q…xne0
_________________________

As to be expected, that's from the Qu'ran. Sure al-Anbiya, verse 11-12

How are we explaining the ADL's reaction in this thought ...

2025-01-21T10:09:51Z

In reply to nevent1q…kla8
_________________________

How are we explaining the ADL's reaction in this thought construct?

loads of privkeys in the Fortinet leak, from SSH to what appears ...

2025-01-18T12:24:28Z

In reply to nevent1q…456d
_________________________

loads of privkeys in the Fortinet leak, from SSH to what appears to be web certs.

I realized I could just have read the blog instead of asking a ...

2025-01-18T10:42:11Z

In reply to nevent1q…khm7
_________________________

I realized I could just have read the blog instead of asking a lazy question here 😅

I read half a VPN password aloud to a victim on the phone, they ...

2025-01-16T15:08:07Z

In reply to nevent1q…mgtf
_________________________

I read half a VPN password aloud to a victim on the phone, they completed the other half. They're *definitely* legit. They also seem to be mostly cleartext, even those not looking like cleartext?

figures. I'll update my news item later if I get the chance. ...

2025-01-16T13:33:38Z

In reply to nevent1q…wqwv
_________________________

figures. I'll update my news item later if I get the chance. Why a cable customer in Medellin is running pre-release software is another question though... which I'm not going to ask, given the geographic circumstances. ;-)

Yes. It's either a pre-release build or the machine was owned ...

2025-01-16T12:54:06Z

In reply to nevent1q…8ch5
_________________________

Yes. It's either a pre-release build or the machine was owned before 7.2.2 was installed. The backdoor user exists in the config, so both could be possible.

@npub1vwk…7k3l @npub1lcc…lcye RE #FortiGate leak: I have ...

2025-01-16T07:13:57Z

Lawrence Abrams (npub1vwk…7k3l) Kevin Beaumont (npub1lcc…lcye) RE #FortiGate leak: I have found the version string "FWF61E-7.2.2-FW-build1327-220914" on one FortiWifi config from Colombia. I'm not sure which build date the first final version had but maybe a pre-release version?

Anyway, here we go. Latest version of the 2025 (in)security ...

2025-01-15T07:52:04Z

Anyway, here we go. Latest version of the 2025 (in)security appliance bingo adds CVE-2024-55591 / FG-IR-24-535 to the list. Thanks to watchTowr for reporting it, and thanks to Jeroen Wiert Pluimers (npub1x4l…tlqs) nadaka (npub1vez…pzyc) and CISA (npub19a2…kmez) for alerting me to it. https://cku.gt/appbingo25

OK, I fleshed this out a little more. You can find the ...

2025-01-09T14:28:39Z

OK, I fleshed this out a little more. You can find the (In)Security Appliance Bingo 2025 in proper, two-dimensional form here:

https://cku.gt/appbingo25

Suggestions and submissions very welcome.

It's only 9:30 pm, and the US wednesday is still mighty ...

2024-11-06T20:29:40Z

In reply to nevent1q…nhds
_________________________

It's only 9:30 pm, and the US wednesday is still mighty young. Let's not...

Yeah, sure, why not dismantle the German Federal government, too. ...

2024-11-06T20:22:18Z

Yeah, sure, why not dismantle the German Federal government, too. We haven't used up our daily contingent of push notifications yet.

As in: The German Chancellor has apparently asked the Federal President to fire the Minister of Finance, Mr. Lindner (Liberals). This means that the coalition of Greens, Liberals and Social Democrats is effectively over.

Wie stehts's mit HumHub?

2024-07-08T10:53:49Z

In reply to nevent1q…9j4f
_________________________

Wie stehts's mit HumHub?