Security Fail

Whenever security fails you ...

[Baptiste Robert @fs0c131y]

The identity of the Lockbit leader has been revealed. It's #OSINT time!

THREAD 1/n

[OWASP® Foundation @owasp]

Unsafe memory handling can lead to a whole host of bugs...and security vulnerabilities! While good CI/CD can mitigate some of that, it isn't fireproof. It may be time to think about adopting a memory safe programming language.

https://t.co/gTl75jhUoQ

#developers #memorysafety

[Ange @angealbertini]

A nice polyglot entry at Revision, with complete source: Shell DOS C64 GBA GBC SNES GC NDS ZIP PDF...
https://t.co/2MrhbTaNAJ

[x0rz @x0rz]

A suicide drone attacking a suicide drones factory 🔥

[Virginie Sigonney 🇫🇷 @GinieSigonney]

Do you recognize this aircraft? 😜
.
.
.

[Matthew Green @matthew_d_green]

Don’t worry everyone. There’s only one backdoor and we found it, so everything’s totally ok now.

[Open Source Security mailing list @oss_security]

Backdoor in upstream xz/liblzma leading to ssh server compromise https://t.co/29Vfiz0n1T

[SwiftOnSecurity @SwiftOnSecurity]

Get into the habit of denying meetings it’s a meeting request not a meeting mandate.

[Anthony Weems @amlweems]

I've been reverse engineering the xz backdoor this weekend and have documented the payload format and written a proof-of-concept exploit for the RCE. The payloads are signed with an ED448 key, so I patched my own key into the backdoor for testing. :-)

https://t.co/CvKo3xPRkP

[Juliano Rizzo @julianor]

Reverse engineering by @amlweems reveals 3 flaws that allows attackers to use the backdoor without the private key, using only a captured message signed for the target host:
1. Lack of replay protection
2. Symmetric encryption with a hardcoded key,
3. Partially signed commands

[stacksmashing @ghidraninja]

So, the @RIGOL_Tech DP832 had the issue that when you turn it on it had a significant voltage spike (with enough power to drive a motor).

Unfortunately it looks like this was not fixed on the DP932, the successor of the DP832 😐

[Jamon @jamonholmgren]

git push --force

https://t.co/1hsxVOv3g1