frycos

Private account! Red teamer @codewhitesec. @[email protected] @frycos.bsky.social

[frycos @frycos]

Thank you ⁦@msftsecresponse⁩ for the unexpected Most Valuable Researcher 2024 gift. The pink hoodie will probably end up in my wife's closet. 😉

[thaidn @XorNinja]

We’ve now seen at least four nginx RCEs that require non-default configs: nginx rift, nginx poolslip, and two of our own (including the one in the last tweet).

The configs involved are unusual, which raises the obvious question: do these attacks actually work in real-world deployments?

We asked Claude to download and analyze more than 4,000 nginx config files from GitHub.

The result was embarrassing: none of them were vulnerable to nginx rift or our own attacks. We can’t say anything about nginx poolslip yet, since it hasn’t been published.

So don't worry about your nginx yet.

Moral of the story: AI can generate FUD, but also help fight FUD. Embrace it!

[frycos @frycos]

@lcamtuf @AlizTheHax0r Already ordered 🫡

[Enclave @EnclaveAI]

NGINX Rift is the new 18-year-old nginx RCE. Every version since 2008 in scope.

We scanned 1,465 configs from 528 popular GitHub repos to see how bad it really is.

What we found, and where the real attack surface actually lives 👇

[frycos @frycos]

@steventseeley @offensive_con Absolutely! 👍

[frycos @frycos]

See ya @offensive_con 👋

[frycos @frycos]

@XorNinja They also "made" the deserialization part work for their Tomcat RCE 🤦‍♂️

[Toan Pham @__suto]

Would love to see ZDI showing stats of submissions, so we can know what is truly on fires (everyone sitting on 0day exploit) instead of all the hypes around these noisy LPE and unexploitable CVE, or in OS that nobody use...

[frycos @frycos]

@Chackal__ @VinchinSoftware @Chocapikk_ I saw your blog post, some from intelX and a few ZDI submission. Inspired, I searched for completely different attack surfaces…which I found 🫣

[frycos @frycos]

Anybody has a security contact @VinchinSoftware ? 👀

[frycos @frycos]

@MyOwnerBites @VinchinSoftware Exactly used both so far but didn’t succeed…

[frycos @frycos]

@AmmarAshshiddi1 1. VR using AI makes perfect sense.
2. You might wanna check my PhD bio. 😬
3. I‘m glad you got my point anyway.

[frycos @frycos]

Infosec community right now…

[Peter Girnus 🦅 @gothburz]

I am a Vulnerability Analyst at the National Institute of Standards and Technology (NIST). There were 28,961 new CVEs published last year. I processed eleven per week.

I need to explain what enrichment is because, without it, the rest of this does not matter. A CVE is a numeric identifier that catalogs a new software vulnerability.

A CVE without enrichment is a number. CVE-2026-XXXXX. The number tells you a vulnerability exists. It does not tell you the severity. It does not tell you which products are affected. It does not tell you the attack vector. It doesn't indicate whether to patch on Tuesday or now. Every CISO in the country builds their patch-priority list using our enrichment data. We are the triage. Without us, the number is a fire alarm with no address.

28,961 alarms. I got to 572.

Every morning I open the queue. The queue is a spreadsheet. It was a spreadsheet when I started, and it is a spreadsheet now. Monday's queue has between 70 and 130 new entries, depending on whether someone found a batch of WordPress plugins over the weekend. I scroll to the top. I pick two. Sometimes three, if one is straightforward. I assign them to myself. I open the enrichment template. I begin.

The other 70 stay in the queue. Tuesday, they will be joined by 70 more. I will pick two.

The page looks the same.

I want to say that clearly. The NVD website, the one bookmarked on every security team's browser in every hospital and bank and water treatment plant and power utility in the country, loads the same way it loaded in 2023. Same interface. Same search. Same logo. There is no banner that says "this data is no longer current." There is no warning. There is no asterisk. The security team at a hospital in Ohio who checks NVD at 7 AM to decide which of their 340 unpatched systems to prioritize today is making life-and-death triage decisions using a database that stopped being maintained. They do not know it stopped being maintained.

The page looks the same.

We have not been defunded. I want to be precise about that. We have been "deprioritized." Our headcount has been "reallocated to other initiatives." Four analysts were moved to the AI Safety Measurement Initiative in January. AI safety measurement is the initiative that has funding. CVE enrichment is the initiative that protects the hospitals. The hospitals do not have an initiative.

My manager told me in February that we are "transitioning to a community-driven enrichment model." Community-driven means that vendors whose products have vulnerabilities will self-report the severity of those vulnerabilities. I sat in that meeting. I wrote it down. Oracle will now assess the criticality of its vulnerabilities. Microsoft will now assess how urgent it is to patch Microsoft. The fox will now audit the henhouse and submit the findings in JSON.

I still have my badge. I still have my login. I still open the spreadsheet. I still pick two. The queue has 9,247 unenriched CVEs as of this morning. Some of them are critical. I do not know which ones because they have not been enriched. That is what unenriched means. It means we do not know how dangerous they are because we stopped analyzing how dangerous they are.

The page looks the same.

The system that catalogs broken systems is itself broken. I catalog the brokenness. I have been cataloging it at a rate of two per day. At this rate, I will finish the current backlog in twelve years and seven months, not accounting for the 80 new entries that will arrive tomorrow, and the 80 after that, and the 80 after that.

I am a Vulnerability Analyst at the National Institute of Standards and Technology.

The page looks the same.

The data doesn't. Nobody told the hospitals.

That is my job. I am also not doing that.

[frycos @frycos]

@ReneFreingruber I’m interested in your opinion when you’re done. Got it on my watch list for some time.

[ς๏гєɭคภς0๔3г ([email protected]) @corelanc0d3r]

New Post: https://t.co/R86kfIdetp #corelan

[frycos @frycos]

Next level…
Me: “Your PoC doesn’t make sense technically.”
Them: “Yeah, but you know…I got a CVE anyways because my AI also wrote a comprehensive report. 🤷”

Well: performance boost for experienced VRs with access to AI. For beginners and script kiddies, not so much.

[frycos @frycos]

Wow, I wrote with an author of a cool VR blog post yesterday. Just asked for some more explanations and maybe references. Tl;dr: he couldn’t explain or elaborate because exactly this part of the blog was written by GPT…

[Patrik Grobshäuser @ITSecurityguard]

I finally let Claude do my pentest this week. Full 5-day engagement, zero human input. Here's what the client got: 😏

https://t.co/1PPuxhs4V9

#bugbounty #pentesting #AI #cybersecurity #infosec #claudeai

[frycos @frycos]

Fortunately, humans still learn to walk first, even though the car has been invented.

[frycos @frycos]

@starlabs_sg @CurseRed @bestswngs Cool article 👌 But you’re referencing lines of code without showing line numbers. 🤔

[CODE WHITE GmbH @codewhitesec]

Highly recommend the writeup from our @flomb_ and congrats on this well-deserved achievement!