@lizardmanisback@C2IRIS@0day_ninja@xoreaxeaxeax I think he meant the original makers publicly posting it, vs other's work.
But then again we would never get that for IME/PSP etc soooo 🤷♂️
‼️🚨 BREAKING: Another researcher skipped coordinated disclosure entirely and dropped a critical 1-click GitHub token theft in public because he doesn't want to deal with MSRC. In his own words: "I really don't want to deal with MSRC on VSCode bugs."
The bug: just clicking a link can hand an attacker a GitHub token that reads AND writes to all your repos, including private ones. It lives in github[.]dev, GitHub's browser-based VSCode editor, which passes the browser an OAuth token that isn't scoped to a single repo. That token can touch everything you can.
Researcher Ammar Askar found that VSCode's sandboxed "webviews" leak keyboard events to the main editor. A malicious repo opened via one link can simulate keystrokes, install a local extension that skips VSCode's publisher-trust check, and exfiltrate your token. He published a working proof-of-concept.
He says when he reports github[.]dev bugs, GitHub tells him they're out of scope and to go report to MSRC, and a prior VSCode bug he reported was silently fixed with no credit. One commenter summed up the mood: "MSRC has turned into Feedback Hub."
@0day_ninja I think it's a really insecure design as a whole, which is why we've had so many issues that we have.
On the other hand, it would make voltage glitching and other bits even more powerful on it.
@0day_ninja@C2IRIS https://t.co/Kqh6k6BqD4
@xoreaxeaxeax has done years of Research into this and posted about it. I think recently he did another talk too, I can look for the link if you want.
@lean0x2f@Hacker0x01 >People are still thinking BB platforms are for the people's benefit, not the company's
Idk how cybersec got baited into normie tier "Companies actually care about us :)" mentality.
@0day_ninja I assume they mean the malware doesn't do whatever custom obfuscation methods, etc, until there is a report already on the initial malware itself.
(so the methods to unpack it, spot it aren't in the report itself)
I could be completely wrong though.
@maskirovka3301@CIA@PalantirTech@mfa_russia@MFA_China Do you have any IoCs, logs, etc that you could have security researchers analyze?
The video showcases a USB not working but there isn't much to go on, besides that.
@Behi_Sec >download the most common ones SRC
>get an actually good AI model to organize what it does find, and doesn't
>code some shitty python 3 scripts to cover the gaps, not have the same IoCs as the main tools, etc
Hope it helps, friendo. Sorry it's a bit basic though
@medusa_0xf Yeah, most BB videos/courses are done by people that have under 10 public findings etc.
(not to say there is only public, but yeah scammers aplenty for BB)
@Behi_Sec@praetorianlabs Because alot of BB posting is done by people that make all their money through selling courses and other shit, not actual bug hunting.
That or they did a little successful hunting, then quit completely for years just to sell the above stuff.
@encrypted_past@therealshodan it's a m$ employee bro, they don't want to offend their overlord and Master.
Funny enough m$ will gladly fire people with 20+ years working for them though.
😕