Nathanaël Havez

Just a (not so) weird guy doing and enjoying weird things that may be called Art. Hats included. 🎩 Artist agent, DIT, AV/IT Engineer, Cybersecurity/OpSec 🦉

[Nathanaël Havez @NathaIsNatha]

@FelipeDaragon Geez. What the hell is happening today

[Nathanaël Havez @NathaIsNatha]

Patch your #php server y’all. Dunno what I’m talking about? Check this tweet NOW: https://t.co/J72W2LixeN #php2shell

[Andras Bacsai @heyandras]

@ThePHPF

[Andras Bacsai @heyandras]

@ThePHPF

[Nathanaël Havez @NathaIsNatha]

@maxkarpis Mine is still down. Also, I really don't get what kind of redundancy plan they did implement up until this point. (And yes, I'm aware that the outage was due to a power outage in a Google Cloud Data Center)

[Objective-See Foundation @objective_see]

We've also added a HeartBreaker sample and its metamorphic framework to our public macOS malware repository:

https://t.co/QcaSI536nC (pw: infect3d)

#SharingIsCaring

[Nathanaël Havez @NathaIsNatha]

@Beluga1000 If you were not subscribed, it could be worth subscribing for a month so that you can have access to a real support (with real humans, ya know) by in-chat and by email. I'm not advocating for giving money to Meta, X and co. But when you need to protect your ID...

[Nathanaël Havez @NathaIsNatha]

@Beluga1000 I know this won't fix the deletion in itself. But besides being verified (on your Facebook page), are you also subscribed to Meta Verified? (Having been verified doesn't give you access to some of the tools behind these subscriptions) https://t.co/jZrOWETbvq

[Nathanaël Havez @NathaIsNatha]

@DailyDarkWeb Maaaaaybe could this be related to the recent zero-day ads malware made in Israel?

[Nathanaël Havez @NathaIsNatha]

@heyandras @avasdream_ Juuuuust enough to kill the biggest neo-bank worldwide for more than 4h. And many other British banks it seems.

[Nathanaël Havez @NathaIsNatha]

@GergelyOrosz Yep, I don't get that most of their infrastructure was on these servers, with no real redundancy elsewhere in Europe. "Don't put all your eggs in the same basket..." should be common sense these days, no?

[Nathanaël Havez @NathaIsNatha]

Vous utilisez le CLI d'OVHCloud et l'avez mis récemment à jour ? Remettez le de nouveau à jour ASAP.

[Octave Klaba @olesovhcom]

Si vous avez téléchargé aujourd'hui la dernière version de CLI d'OVHcloud, merci de la mettre à jour à nouveau très rapidement. Sinon effacer. Il s'agit de repo:
https://t.co/mSILpJyTEq

La version CLI de 14h47 a été compromise par un hacker. Nous l'avons détecté et bloqué à 16h21. Merci au client qui nous a remonté le souci. La version compromise est v0.11.0 v0.12.0 v0.13.0 v0.14.0 v0.15.0.

La version v0.10.0 et la future 0.16.0 est clean.

On vient de finit les premières vérifications et aucun autre repo n'est affecté. Nous avons aussi retracé l'incident. Le hacker a utilisé le compte github d'un des développeurs et a ajouté un binaire dont le job est récupérer les secrets sur le disque. La qualité du binaire est médiocre mais il peut aller jusqu'au bout. Si vous êtes concernés, merci de changer tous les secrets sur votre disque.

On continue les recherches sur le binaire et on va publier les détails additionnels sous peu.

[Nathanaël Havez @NathaIsNatha]

FYI: 'seem like there was a power outage at one of the EU West Google Cloud Datacenter. This explains that. #Revolut

[Nathanaël Havez @NathaIsNatha]

And yet we thought that a company, hell a bank, like Revolut, would have some redundancy in place. 🫠

[Revolut @Revolut]

We are currently experiencing a service disruption affecting multiple services. We can confirm that all our customers’ money and data are safe. We’ve been working to fix the issue since it was identified this morning and apologise to anyone affected and for any inconvenience caused.

[Revolut @Revolut]

We are currently experiencing a service disruption affecting multiple services. We can confirm that all our customers’ money and data are safe. We’ve been working to fix the issue since it was identified this morning and apologise to anyone affected and for any inconvenience caused.

[Nathanaël Havez @NathaIsNatha]

@IntCyberDigest I’ll report the 💩 of this to my local DPA. Or just forward it to one of my colleagues/representative at the EU Parliament & Commission. Bring the popcorn 🍿

[Nathanaël Havez @NathaIsNatha]

@vxunderground This bounty is so, so insulting.

[Nathanaël Havez @NathaIsNatha]

@IntCyberDigest Great OpSec.

[Nathanaël Havez @NathaIsNatha]

@patomation @IntCyberDigest ‘Seems to be Plex only.

[Nathanaël Havez @NathaIsNatha]

@IntCyberDigest @jellyfin, @KodiTV (both fully open source) and @embyapp (semi open source, but can’t be worse than Plex).

My take: @jellyfin for the win 🪼

[Nathanaël Havez @NathaIsNatha]

@IntCyberDigest By the way, besides mining Monero, is there a point in crypto mining these days? Like, we all know that Plex has a long history of bad security. It just seems “boring” for any hacker to go for a crypto miner these days. Either way, here are much better alternatives to Plex: