INSINIA LABS

Security Research Team (SRT) at Insinia @insiniasec. Expect satire, sarcasm and tales from the cyber war.

[INSINIA LABS @InsiniaSRT]

Cyber Security Prediction 2019: things will remain hopelessly insecure. This insight was brought to you by 10 years of research and a £3B budget!

[INSINIA SECURITY @insiniasec]

DeepFakes - an emerging cyber threat to worry about in 2019.
Start-Up is developing technology to detect #deepfake videos.
https://t.co/f26iLdwPVl Question remains on how effective their efforts will be?

[Samuel Groß @5aelo]

I published the source code and (commented) example exploits for my #35C3CTF macOS browser exploitation challenges: https://t.co/jbX90g3t0i congrats to @qwertyoruiopz and @i41nbeer for solving all parts (and winning the CTF)! :) #35c3

[c3voc_releases @c3voc_releases]

The Layman's Guide to Zero-Day Engineering has been released on https://t.co/NWTIGxyqR7 and YouTube https://t.co/FYkIYL1BtP https://t.co/UqtjA7QMYT

[hacker.house @hackerfantastic]

I'm grateful @insiniasec used a security bug and highlighted it's effectiveness to force a fix to widely known hole. @Twitter should act to protect the platform and users. The only crime here is that you're all arguing over junk/stunt hacking. Shodan is as intrusive daily.

[INSINIA LABS @InsiniaSRT]

@Vegaskid1337 @insiniasec They have known since 2011. The true sign of insanity is doing the same thing again and again while expecting different results.

[Matt Nelson @enigma0x3]

I’ll never understand vendors that prohibit public disclosure after a vulnerability is fixed. If it’s fixed, let other vendors learn from the mistake. Why hide it?

[c3voc_releases @c3voc_releases]

Modern Windows Userspace Exploitation has been released on https://t.co/NWTIGxyqR7 and YouTube https://t.co/CwtDueMNKv https://t.co/L1wqvo0ydd

[INSINIA LABS @InsiniaSRT]

@0x4A757A @BufferBandit @insiniasec Ever.

[INSINIA LABS @InsiniaSRT]

@0x4A757A @BufferBandit @insiniasec Please never program software people use.

[INSINIA LABS @InsiniaSRT]

@0x4A757A @BufferBandit @insiniasec You could trust the source, the source gets MITM’d and then you have the same issue all over again. There are many issues in this case but fundamental one is trusting the input, more specifically the value of sender telco number.

[INSINIA LABS @InsiniaSRT]

@0x4A757A @BufferBandit @insiniasec Twitter trusting that input led to the impact you saw and the very reason you sent this tweet. Case in point. Validating identity is the FIX, trusting input is the ISSUE. If they tried to validate and fail, then you would be correct saying it’s a validation issue but they don’t.

[INSINIA LABS @InsiniaSRT]

@0x4A757A @BufferBandit @insiniasec I didn’t suggest or say that at all. Of course data has to be supplied, I am talking about trusting it blindly like they do.

[INSINIA LABS @InsiniaSRT]

@0x4A757A @BufferBandit @insiniasec @antisocial_eng Best fix would be remove it completely, especially when sms used for two-step auth by many people. We have enough ways to tweet as it is.

[INSINIA LABS @InsiniaSRT]

@0x4A757A @BufferBandit @insiniasec If you don’t check what is input to a program you can’t secure it. I agree its lack of auth/access control too but fundamentally the issue arises from trusting client data to invoke an action.

[INSINIA LABS @InsiniaSRT]

@David3141593 @GossiTheDog This is above your pay grade private. Get back to your unit.

[INSINIA LABS @InsiniaSRT]

We are at war. We are authorised to carry out these actions under cyber war directive 300012. All members are elite soldiers of the 671st grey-hat commando unit.

[Cytix Tom @0x4A757A]

UPDATE: It seems like #SMiShing isn't very well documented, so I wrote a quick SMiShing script and confirmed it as a #PoC.
#Twitter #Vulnerability #InfoSec #NetSec #Hacking #CyberSecurity #pentesting #owasp #brokenaccesscontrols #a2 #exploit

[Cytix Tom @0x4A757A]

@BufferBandit @insiniasec @InsiniaSRT The vuln works by texting twitter obh the user (src=user, dst=twitter). It definitely works https://t.co/VWQQJ7H0iR

[INSINIA LABS @InsiniaSRT]

🤦‍♂️