Grambulf
9.2K posts
Grambulf retweetledi
#VisualStudio 1-click RCE, No Smartscreen warning, No trust need, No futher interaction need. Just download from internet, 1-click then pwn. But it will not be fixed, because Microsoft consider it's not a vulnerability😅
English
Ever wanted to attack AWS from GCP? I know I did.
Unveiling The DeRF @cloudvillage_dc Friday August 11th at 12:30 PDT.
#talks?collapsekattraxler" target="_blank" rel="nofollow noopener">cloud-village.org/#talks?collaps…
English
Grambulf retweetledi
Today, we're announcing the immediate availability of the Ferrocene release candidate! We're also inviting you to our birthday party on October 4th, where we will meet online with guests, have fun conversations and unveil the Ferrocene product fully.
ferrous-systems.com/blog/a-decade-…
English
🚨 New Advisory: RWS WorldServer 🚨
redteam-pentesting.de/advisories/rt-…
The vulnerability allows to feasibly enumerate session tokens. While it was fixed by the vendor prior reporting, no concrete information is publicly available that this critical issue was fixed in v11.8.0.
#infosec
English
@RedTeamPT "A significant number of security enhancements have been included in this release" 🤡
Awesome work (again)
English
Can I have your API Key?
oh wait.
"Data analysis using regular expressions to search for specific secrets revealed the exposure of 52,107 valid private keys and 3,158 distinct API secrets in 28,621 Docker images"
bleepingcomputer.com/news/security/…
English
Grambulf retweetledi
Introducing Forager! Check to see if anyone using your company's email domain posted LIVE SECRETS to GitHub and NPM: forager.trufflesecurity.com
English
Grambulf retweetledi
I wonder if we'll get more outages this summer due to record heat like this one from almost a year ago.
GCP Incidents@GCP_Incidents
There has been a cooling related failure in one of our buildings that hosts zone europe-west2-a for region europe-west2. This caused a partial failure of capacity in that zone, leading to VM terminations and a loss of machines for a small set of our customers 4/9
English
Grambulf retweetledi
The $5 Membership sale is now live! The sale lasts until July 17 23:59 UTC: account.shodan.io/billing/member
English
Grambulf retweetledi
Okay, so why are we releasing a free tool to see which companies are exposing secrets?
A little while ago we started doing disclosure emails for every key leaked out, but we were shocked to with what we saw
Short 🧵
Truffle Security@trufflesec
People don’t realize how often live keys leak out on GitHub in 2023, despite this being a known problem for almost a decade. Next week we’re releasing a tool to check if your company exposed any. Here’s a thread on it 1/6
English
Grambulf retweetledi
🎉 Go 1.20.6 and 1.19.11 are released!
🔐 Security: Includes security fixes for CVE-2023-29406 and Go issue go.dev/issue/60374
📢 Announcement: groups.google.com/g/golang-annou…
📦 Download: #go1.20.6" target="_blank" rel="nofollow noopener">go.dev/dl/#go1.20.6
#golang
English
Grambulf retweetledi
Grambulf retweetledi
Grambulf retweetledi
Grambulf retweetledi
📢📢📢 Accepted Talks and Speakers' Bios published 📢📢📢
Thanks to all who applied to our #CfP and to our reviewers, the list of accepted talks is now on our website. Detailed agenda will follow
bsideszh.ch/talks-bios/
REMEMBER: Tickets sale starts tomorrow 3pm Zurich time 🥳
GIF
English
Grambulf retweetledi
@N4hualH @CyberSleuth1 @solminingpunk @BruteBee There might already be active exploitation on this. Check for files newer than the installation date in /netscaler/ns_gui/ /var/vpn/ /var/netscaler/logon/ /var/python/
English
Grambulf retweetledi
"Sollte es jedoch Zero-Day-Exploits bei Messengerdiensten geben, müsse das BSI diese konsequenterweise verschweigen, wenn "andere Stellen" diese offenhalten wollten."
golem.de/news/neue-bsi-…
Deutsch
Grambulf retweetledi
After holding the talks at @x33fcon
and @WEareTROOPERS
done, I also finally managed to write down my latest research about userland hook evasion:
s3cur3th1ssh1t.github.io/Cat_Mouse_or_C…
English
Grambulf retweetledi
"Log Centralization: The End Is Nigh?" buff.ly/3CQQmZw <- a VERY incomplete thought blog that talks about centralized vs decentralized/federated/distributed approaches for dealing with logs, at scale.
English