execveat

joined 1 year ago
MODERATOR OF
research
sorted by: new top controversial old
Fake zero-day PoC exploits on GitHub push Windows, Linux malware in c/securitynews@infosec.pub
[–] execveat@infosec.pub 4 points 1 year ago

They're not even that stealthy. The code is bullshit, gitignore folder is super suspicious and malware is just a binary within the zip file. Clearly meant for script kiddies.

10
Fake zero-day PoC exploits on GitHub push Windows, Linux malware (www.bleepingcomputer.com)
 

Someone created a bunch of github profiles impersonating real researchers alongside fake Twitter accounts. Pretty fascinating, really.

*Permanently Deleted* in c/infosecpub@infosec.pub
[–] execveat@infosec.pub 2 points 1 year ago (1 children)

Yep, noticed that too. @jerry should file a bug report. Is this issue present on other instances or just infosec.pub?

There is PR dealing with scheduled tasks which might be related: https://github.com/LemmyNet/lemmy/pull/3090 , but someone needs to check server logs to figure it out.

Mods of several hacking/security subs are going down indefinitely in c/infosecpub@infosec.pub
[–] execveat@infosec.pub 1 points 1 year ago

I do not speak for all r/netsec mods, but as a mod on r/netsec I have no idea where that info came from.

1
WWDC23: Passkeys (blog.millerti.me)
What's your side project of a month? in c/research@infosec.pub
[–] execveat@infosec.pub 3 points 1 year ago

Not at all. Figuring a work-life balance that suits you is a worthy goal.

BChecks (SDL for defining custom scans) available in Burp 2023.6 in c/research@infosec.pub
1
BChecks (SDL for defining custom scans) available in Burp 2023.6 (portswigger.net)
 

It's like nuclei templates I guess, but built into Burp. Only available in the Early Adopter release for now.

What's your side project of a month? in c/research@infosec.pub
[–] execveat@infosec.pub 2 points 1 year ago

I played around with WebSockets and wrote a new tool: https://github.com/doyensec/wsrepl

It's an interactive REPL interface like websocat, but it's meant specifically for pentesting, not debugging, and it's easily extensible in Python (while still retaining REPL interface). In future releases I'd like to expand the extensibility by adding declarative style configuration (the ultimate feature would be something like what Burp's Autorize plugin does, but for websockets).

6
Every Signature is Broken: On the Insecurity of Microsoft Office’s OOXML Signatures (www.usenix.org)
 

OOXML signatures are rendered pretty much useless due to 3 flaws in specification and 2 flaws in implementation.

"The vulnerabilities have been acknowledged by Microsoft. However, Microsoft has decided that the vulnerabilities do not require immediate attention."

Fortinet tries to silently patch critical RCE, researches burn it in c/securitynews@infosec.pub
[–] execveat@infosec.pub 2 points 1 year ago

With all of the embarrassing command injections they keep getting, Fortinet should assess their SOC and incident preparedness and find compromises that may lie hidden by calling their own Security Advisory Services.

12
Fortinet tries to silently patch critical RCE, researches burn it (www.bleepingcomputer.com)
 

Timely and ongoing communications with our customers is a key component in our efforts to best protect and secure their organization. There are instances where confidential advance customer communications can include early warning on Advisories to enable customers to further strengthen their security posture, prior to the Advisory being publicly released to a broader audience. This process follows best practices for responsible disclosure to ensure our customers have the timely information they need to help them make informed risk-based decisions. For more on Fortinet’s responsible disclosure process, visit the Fortinet Product Security Incident Response Team (PSIRT) page: https://www.fortiguard.com/psirt_policy.

What's your side project of a month? in c/research@infosec.pub
[–] execveat@infosec.pub 1 points 1 year ago (1 children)

Fascinating idea to use LLM for inspiration in researching new topics. Did it match your interests right away or did you need to wrangle with it?

7
CS:GO: From Zero to 0-day (neodyme.io)
 

They've chained 4 logic bugs to achieve RCE in CS:GO, pretty impressive. Valve sucks at communication and bug bounty payouts though.

Side projects for May/June 2023 (🔒podcast) in c/research@infosec.pub
[–] execveat@infosec.pub 0 points 1 year ago (1 children)

Hey there and congratulations on getting a few first episodes out! Launching is half the battle, and it looks like you're well on your way.

I'm actually running a small podcast as well and I feel your pain about figuring out the target audience and the personal style. Unless you're aiming for mainstream success, I'd suggest focusing on what you personally feel is missing in the podcasting sphere. Hopefully it will keep you driven, and ensure that you genuinely enjoy the process. Plus, it increases the odds that you won't abandon the project midway. Keep on the good work!

1
What's your side project of a month? (infosec.pub)
 

cross-posted from: https://infosec.pub/post/48321

If you're working on a research or side project, this is your platform to share your findings, roadblocks, breakthroughs, and more. Doesn't matter if it's still a work in progress or has been recently published - all stages of research are welcome.

Maybe you're not actively researching, but you're closely following an interesting development in the industry or a certain researcher's work - feel free to share that here too!

Or perhaps, you've got an idea for a project or research you wish to undertake, but need resources, collaborators, or simply some guidance - let the community know.

Here's a simple guideline to kickstart the conversation:

  • What's the research about? (Give a brief overview of the project or topic)
  • Current progress/Findings (If applicable)
  • Challenges and roadblocks (What issues are you facing or expect to face?)
  • Help needed (Are you looking for collaborators, resources, advice, etc.?)
2
What's your side project of a month? (infosec.pub)
 

If you're working on a research or side project, this is your platform to share your findings, roadblocks, breakthroughs, and more. Doesn't matter if it's still a work in progress or has been recently published - all stages of research are welcome.

Maybe you're not actively researching, but you're closely following an interesting development in the industry or a certain researcher's work - feel free to share that here too!

Or perhaps, you've got an idea for a project or research you wish to undertake, but need resources, collaborators, or simply some guidance - let the community know.

Here's a simple guideline to kickstart the conversation:

  • What's the research about? (Give a brief overview of the project or topic)
  • Current progress/Findings (If applicable)
  • Challenges and roadblocks (What issues are you facing or expect to face?)
  • Help needed (Are you looking for collaborators, resources, advice, etc.?)