Wolfgang Ettlinger (inactive)

goodbye Twitter

[Certitude Lab @certitude_lab]

We identified >1000 organizations susceptible to subdomain hijacking https://t.co/A0jj64jFeR

[Certitude Lab @certitude_lab]

A privilege escalation vulnerability could have allowed unprivileged users of the IBM Spectrum Virtualize admin interface to execute code https://t.co/FoPt0kQ90H (by @ettisan)

[Certitude @Cert_it_ude]

Meet us at @WeAreDevs World Congress in Berlin this week and join our talk about the future role of AI in phishing attacks held by our experts Wolfgang Ettlinger (@ettisan) and Alexander Hurbean.

[Certitude Lab @certitude_lab]

Sicherheitsforscher von Certitude konnten zwei kritische Schwachstellen bei der SPÖ-Mitgliederbefragung identifizieren. Manipulation von Stimmen wäre mit einfachen Mitteln möglich gewesen. (1/7)

https://t.co/d7HQ5qNQX3

[Chick3nman 🐔 @Chick3nman512]

PBKDF2-SHA256 with 100100 rounds in @hashcat will run at 90kH/s on a single @NVIDIAGeForce RTX 4090. Not fast by any means, but also not super slower either. You can clear rockyou.txt(14M passwords) in about 2 minutes 45 seconds at that speed. RE: @LastPass

[Elon Musk @elonmusk]

How do you make a small fortune in social media?

Start out with a large one.

[Ben Phillips @benphillips76]

A clip from Don’t Look Up, and then a real TV interview that just happened

[Marc Nimmerrichter @nimmerrichterm]

It's possible to hide backdoors in JS by only adding invisible Unicode characters to legitimate-looking code. Research by @certitude_lab/@ettisan https://t.co/TApUwdk5Fu

[Certitude Lab @certitude_lab]

A neat approach for invisible backdoors in legitimate JavaScript source code. Can you spot it? Hint: unlike #TrojanSource, it does not use Unicode bidirectional-trickery! https://t.co/SVxcUfKdbj

[Certitude Lab @certitude_lab]

CSRF with JSF 2.x is impossible? We've taken a closer look at Apache MyFaces and found a way to predict CSRF/ViewState tokens: https://t.co/BwpmD16N0Q

[Wolfgang Ettlinger (inactive) @ettisan]

@Humbedooh sent you an encrypted mail on jan 27th. If you did not receive it please contact me via dm. No response required otherwise

[SEC Consult @sec_consult]

@ettisan @TrendMicro Attack vector 2: An attacker with access to the HTTP proxy port could abuse the authentication/authorization bypass vulnerabilities and the command execution vulnerability to take over the appliance as root without user/admin interaction. #infosec #websecurity #IWSVA

[Greg Linares (Laughing Mantis) @Laughing_Mantis]

Ever want to test systems & see if your password is ever stored/sent in plaintext?

Make it: X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

I am on the phone with a vendor right now because my test account is in an inoperable state.

🧐

[Programming Wisdom @CodeWisdom]

We've not posted an XKCD here till now, but this is just too true 🙂 https://t.co/Lu3g41XdAY

[Wolfgang Ettlinger (inactive) @ettisan]

@BafDyce @mozilla I am not that surprised. Moz. being reliant on its only (dominating) competitor is a questianble long-term model. Google can also force changes to Firefox threatening to cut funding (thought I think they would not do this [publicly]). Moz. should find a new revenue stream.

[Wolfgang Ettlinger (inactive) @ettisan]

@jsondb_io do you happen to have a way to privately contact you to discuss a security topic?

[Wolfgang Ettlinger (inactive) @ettisan]

@matdotsh @eric_conrad I can also recommend the book "The Cuckoo's Egg". Describes a security breach at a US university from 1986

[Wolfgang Ettlinger (inactive) @ettisan]

@mnimmerrichter Offenbar gab es mittlerweile ein screening zumindest unter Grippepatienten "Bei einem Coronavirus-Screening der Grippekranken habe sich herausgestellt, dass es in dieser Gruppe kaum Fälle gibt."
https://t.co/gr519ynWPR

[✨ saleem ✨ @saleemrash1d]

CVE-2020-0601