Konrad Ravenstone

[Konrad Ravenstone @_cr0n_]

https://t.co/IHeafTBdEw

[Konrad Ravenstone @_cr0n_]

https://t.co/BhMF3uIJJd

[ThreatLocker @ThreatLocker]

Nightmare Eclipse has released a new privilege escalation exploit, #RoguePlanet.

ThreatLocker Threat Intelligence validated the proof of concept shortly after publication. The video below shows the exploit successfully executing during our initial testing.

The team has also confirmed that ThreatLocker Application Allowlisting blocks the exploit by default.

Our team is actively assessing impact, affected systems, and additional mitigations. Additional findings will be shared as they become available.

https://t.co/vyiWNXph3r

#NightmareEclipse #ZeroDay #ThreatIntel #BlueTeam #SOC #CyberSecurity

[Konrad Ravenstone @_cr0n_]

https://t.co/JoKRahJVJ6

#windows10 #hacks #persistence

[Konrad Ravenstone @_cr0n_]

https://t.co/4NvMA5o4KU

[Konrad Ravenstone @_cr0n_]

more than 400+ repo ifected in AUR.

https://t.co/C75VMA7WYo

[Konrad Ravenstone @_cr0n_]

https://t.co/naIGbSetGj

[Konrad Ravenstone @_cr0n_]

@AntwanGRT @Scot0xo Мене так заблокував "заради безпеки" Райффайзен Банк. Разом з моїми коштами. Непогана схема!

[Konrad Ravenstone @_cr0n_]

@Scot0xo На даний момент вже цього немає. дані знову приховуються)

[Konrad Ravenstone @_cr0n_]

@3uj1_ У мене показує приховану інформацію:

[impulsive @weezerOSINT]

This exploit has been around for a while. Instagram has been on fire ever since they started integrating everything into their GraphQL / Bloks API. They're trying to merge all the separate Meta app APIs under one surface and its a mess. The account recovery endpoint alone gives you full PII from a username alone. The new API is littered with no auth, no rate limits, race conditions and logic bugs everywhere.

[Konrad Ravenstone @_cr0n_]

https://t.co/3YGFglPwEr

[Konrad Ravenstone @_cr0n_]

https://t.co/ELVWuVbUIT

[Microsoft Security Response Center @msftsecresponse]

Over the past several days, we have been listening to the conversation around coordinated disclosure and the relationship between security researchers and vendors. We recognize that this relationship is both critical and, at times, fragile. We deeply value the security community, and will continue to take your feedback seriously.

To be clear about our approach to legal matters, we have no intention to pursue action against individuals conducting or publishing their security research. When an individual breaks the law and engages in malicious activity causing real harm to our customers, we will work with law enforcement as appropriate.

We recognize the work that goes into researching and submitting a vulnerability. We are committed to approaching every interaction with transparency, clear communication, and professionalism. We continue to believe strongly in Coordinated Vulnerability Disclosure as the foundation for protecting customers and improving our products. Each year we process a high volume of vulnerability reports. That volume continues to grow and will continue with the rise of AI-enabled research. We acknowledge that some interactions have fallen short and are working to learn from them.

Many of us have experience on both sides of this work, as researchers reporting vulnerabilities and as responders triaging and assessing them. That perspective informs how we approach this feedback and the importance we place on getting it right, particularly as the volume and complexity of research continues to grow.

The security community plays a vital role in helping us protect customers. We are committed to maintaining a constructive and respectful relationship and growing together. We know that, given the nature of this work, there will at times be misunderstandings. We remain committed to engaging in good faith and to providing a respectful and professional experience for all researchers, regardless of past interactions.

[Konrad Ravenstone @_cr0n_]

@Anastasis_King already patched?

[Konrad Ravenstone @_cr0n_]

Як Palantir впроваджує технофашизм
https://t.co/YSVF4cKcMV

[Konrad Ravenstone @_cr0n_]

151 вразливість запатчив Chrome, і майже ще стільки там залишається)
https://t.co/EvxzqTgVYe

[Konrad Ravenstone @_cr0n_]

Хакери - не співробітники Microsoft. Їх завдання - знайти і тицьнути носом. Ваше - оперативно усунути. Натомість, Мілкософт хоче, щоб і далі все замовчували, а їх співробітники таємно користувалися цими бекдорами, паралельно торгуючи 0-Zero Day в даркнеті

https://t.co/GIgrxTbkn0

[Konrad Ravenstone @_cr0n_]

Windows просто кишить вразливостями. Логіка роботи Defender фактично порушена. Експлойтів дуже багато.

https://t.co/iCoAgAjLpk

[Konrad Ravenstone @_cr0n_]

Nightmare-Eclipse: six zero-days, six weeks and one big grudge | Barracuda Networks Blog

https://t.co/tLxY7xW925

#windows10 #CVE #bluehammer #nighmareeclipse #exploits #redsun #miniplasma