syncop @colt@nanao.cybtex.fr

Our #rapid7 blog about an 0-day being actively exploited in Forta GoAnywhere:

https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/

Just did a bug fix release of ssldump (version 1.6) which fixes an annoying bug with ports not being recorded in the pcap output. Thanks to all the contributors.

#opensource #tls #ssl #ssldump

:link: https://github.com/adulau/ssldump/

#Ransomware attacks on schools can have some unexpected consequences. For example, here's a snippet of an email I received after an incident involving a small, rural district.

The #malvertising campaigns via Google Ads are not just about software downloads and scams. They also include phishing for popular password managers such as 1Password.

The differences are so subtle, most people will fall for it.

Real URL:
https://my[.]1password.com/signin
Phishing URL:
https://my1pasword[.]com/signin

#Botconf2023 The tickets are now officially on sale ! https://www.billetweb.fr/botconf-2023

This is a summary of the most important highlights in r2-5.8.2, compared to 5.8.0:

* Add support for micromips (m4k)
* Add sourceline support from DWARF5 and Plan9
* Run any command to replace N bytes inside the disasm with the Cr command
* All the bugs reported by linux and bsd distros are now fixed, rpm packages are now tested and built in the CI, debian packages are now built with fakeroot
* Better error messages when missing basic tools, specially on Termux
* Added support for scripting in Pascal, assembly
* Fixed regressions in the GDB register mapping
* Huge optimization that mainly affects r2dec (80s -> 20s)
* Improved ESIL for arm64, v850
* Support multiple core plugins in pure quickjs, updated r2papi with integrated esil decompilation
* Updated support for Typescript
* Implemented TIRE algorithm in the search api, with much faster scans
* Added support for GNU/Poke
* Support two column and colors in r2slides
* Bug fixes and performance improvements in many places.

There are two CVEs for 5.8.0 related to ansi escape injection and a null deref, nothing really critical. but @pancake found and fixed a couple of UAFs so we encourage and recommend everyone to update!

IVRE v0.9.19 has just been released! See below for the main changes

@harris Yes! Reflections off of a lot of things, including coffee pots, mugs, spoons, plastic coke bottles, and things like that.

Check out:

• "Computer Monitors around a Corner" (Backes, Duermuth, and Unruh, S&P 2008)
• "Tempest in a Teapot: Compromising ReflectionsRevisited" (S&P 2009)

A few fun examples from those papers:

Hey #OSINT, Carrot2 (http://search.carrot2.org) organizes your search results into topics. With an instant overview of what's available, you will quickly find what you're looking for. No more rummaging search results to find what you need

#infosec #tools

this is a relaxing post

A #ransomware gang sent an email directly to students stating, “Additionally all of your SSN and Medical records will be put for sale, for every hacker to gain access and use your data in whatever illegal activity they want."

https://www.nbcnews.com/tech/security/ransomware-hackers-take-demands-directly-college-students-s-sad-day-rcna61253

It’s pretty insane what someone can do with Chinese PCB assembly, a steady hand and some resin. A full working computer in a sloped 2x2 LEGO brick.

https://youtu.be/6wBrOV2FJM8

Tails 5.8 is out, and it is the most important release of #Tails in years.

It includes both major redesign of existing features, important usability improvements, and hardened security.
https://tails.boum.org/news/version_5.8

the secret meetings you always suspected were going on behind the scenes at #defcon

#hiddencamera #jk #SeriousBusinessMeeting