Jens Müller

Hack the Planet! On a #yolo trip around the word during a pandemic.
Involved in #efail, #pdfex. Raw tech. No chit-chat.

[Jens Müller @jensvoid]

Lol. @HackenProof a reputable bug bounty platform sends out invites for their program to attack Russian critical infrastructure (SCADA, banks, energy). Crazy times & Happy hunting. #StandingWithUkraine https://t.co/2Sc6bvXzTP

[heise Security @heisec]

Angreifer könnten digitale Unterschrift in LibreOffice und OpenOffice fälschen https://t.co/G3888VyXOj #LibreOffice #OpenOffice

[Jens Müller @jensvoid]

If you build #Ghostscript from source, apply this patch to counter the latest RCE (now known as CVE-2021-3781):
https://t.co/OfQXzYbDTl

[Jens Müller @jensvoid]

0day RCE in #Ghostscript going wild. This issue was found independently by @emil_lerner and @jensvoid. Fun fact: GS is everywhere. Even LESS(1) is affected.

[Jens Müller @jensvoid]

@RDerenzy @emil_lerner ImageMagick is *not* required (but can be used as a vector to call Ghostscript). The 9.50 to 9.54 releases are vulnerable. I don't use Windows.

[Jens Müller @jensvoid]

@1AKDJ @emil_lerner Kali Rolling (less 551); likes to convert all kinds of obscure file types to plain text before displaying to the user; thereby increasing the attack surface

[Black Hat @BlackHatEvents]

@lambdafu & @jurajsomorovsky evaluate the real-world attack surface of web browsers and widely-deployed email and FTP servers in lab experiments and with internet-wide scans in this #BHUSA Briefing https://t.co/c7EF2aaFOY

[Jens Müller @jensvoid]

@mniemietz @HGI_Bochum @HSNiederrhein Congrats Marcus, and thanks for shepherding me into @HGI_Bochum back in the days!

[- @lambdafu]

We found another flaw in the design of TLS! If you have servers that share certificates across services you might want to take a look at this: https://t.co/jwRODhaHmE. 🧵👇

[Sebastian Schinzel @[email protected] @seecurity]

New paper: "ALPACA: Application Layer Protocol Confusion -Analyzing and Mitigating Cracks in TLS Authentication" to be presented @USENIXSecurity '21. Joint work with @lambdafu @dr4ys3n @ic0nz1 @dues__ @jensvoid @jurajsomorovsky @JoergSchwenk. 1/

[Jens Müller @jensvoid]

"PhD Defense" can finally be crossed off that to-do list. So long @HGI_Bochum, and thanks for all the fish!

[Jens Müller @jensvoid]

@nitro_sam @Klose7 Please read your emails to [email protected] (RCE in Nitro Reader/Pro; never got an answer)

[Sebastian Schinzel @[email protected] @seecurity]

New paper on how to fix #efail style attacks against e2e encrypted email, including OpenPGP and S/MIME. Joint work with @JoergSchwenk @lambdafu @dues__ @jensvoid @jurajsomorovsky @seecurity. To be presented at @acm_ccs 2020. Thread:

[heise Security @heisec]

Datenklau über Mailto-Links https://t.co/SXsIF9mPiS #Datenklau #EMail

[Jens Müller @jensvoid]

My fault. Even though Thunderbird removed the mailto:?attach feature, it still seems present in distros that apply xdg-email to parse mailto URLs.
Thanks to @j_o_n__w and @Ug_0Security for all the debugging :).
Original report for Thunderbird now public: https://t.co/IIeOL7FNhX

[Jens Müller @jensvoid]

Have you ever heard of the mailto:?attach=~/… parameter? It allows to include arbitrary files on disk. So, why break PGP if you can politely ask the victim's mail client to include the private key? (1/4)

[Jens Müller @jensvoid]

@j_o_n__w @Ug_0Security Sry, the line is "ATTACH=$(/bin/echo -e $(echo "$MAILTO" | grep '^attach='..." in the run_thunderbird() function of xdg-email. Thanks.

[Jens Müller @jensvoid]

@j_o_n__w @Ug_0Security Can you confirm that you are using xdg-email (e.g., by commenting out line 51 in /usr/bin/xdg-email and then testing if it still works)?

[Jens Müller @jensvoid]

@j_o_n__w @Ug_0Security This is bad. It had been fixed in/by TB in the past. But imho xdg-email re-opens the attack surface: https://t.co/4efWSuaM4K

[Golem.de @golem]

E-Mail: Gefährliche Mailto-Links können Daten stehlen #mailto https://t.co/vhNk7HCr1W

[Albert Astals Cid @tsdgeos]

@JamesHenstridge @jensvoid Yes. See me other answer, for some reason this escaped KDE Security Team radar and i thought it had not been reported to KDE while it had indeed been.