Taner

IT professional.

[Harman @itsharmanjot]

firewalls can't stop this.

A developer just open sourced a tunnel that smuggles your entire internet through port 53 the port every router on earth is forced to leave open.

It's called MasterDnsVPN. It hides your traffic inside DNS queries, the one type of packet no network can block without breaking itself.

Every firewall on earth has to allow DNS. Schools, airports, hotels, hotel WiFi, entire countries running ISP-level censorship all of them keep port 53 open or nothing on the network resolves. This repo turns that loophole into a full encrypted tunnel.

Here's what makes it different from every other DNS tunnel that came before:

→ Custom ARQ layer gives you TCP-level reliability over UDP DNS, so nothing drops even on garbage networks
→ Sends every packet through up to 12 different resolver paths at the same time, if 11 fail the packet still arrives
→ Auto probes the maximum DNS payload your path can handle, then locks in the fastest MTU possible
→ AES-256-GCM, ChaCha20, AES-128, AES-192 all built in, pick your encryption
→ SOCKS5 proxy on 127.0.0.1:1080 point any browser or app at it and you're through

Killed: $12/mo Mullvad, $10/mo NordVPN, $15/mo Astrill, every commercial DNS tunnel charging monthly fees for the exact same idea.

Pre-built binaries for Windows, Linux AMD64, Linux ARM64, macOS ARM64. No Python install needed. Configure two DNS records, drop in the encryption key, run the executable.

Works in environments where every other VPN protocol is dead on arrival.

MIT License. 100% Opensource.

[Andy Piazza @klrgrz]

Bad news: #regreSSHion impacts a lot of systems

Good news: OpenSSH has an update available and Qualys provides some hunting guidance to check logs for activity.

Best news: @qualys didn't publish this on Friday!

https://t.co/xQN01QfesQ

https://t.co/FE2kyZWIcO

[USCYBERCOM Cybersecurity Alert @CNMF_CyberAlert]

Russian-state linked cyber actor APT29 is adapting their tradecraft as more organizations move to the cloud. CNMF joined FVEY 🇬🇧🇦🇺🇨🇦🇳🇿🇺🇸 partners to expose the group’s TTPs & provide mitigation strategies.

Read the CSA here: https://t.co/02efFRs760

[mRr3b00t @UK_Daniel_Card]

hahahaha #fucklockbit !

great work @NCA_UK and partners!

[Kim Dotcom @KimDotcom]

I’m getting into that age group now where friends get cancer and die. @kevinmitnick called me when he got his diagnosis and he died within a year. The same cancer that took my best friend Finn. Imagine if all the money that is wasted on stupid wars would be used to cure cancer.

[@[email protected] - @2600.com on Bluesky 🇸🇴 @2600]

We are heartbroken. https://t.co/ynbSs7okBw

[spencer @techspence]

Dump Kerberos tickets with PowerShell https://t.co/k4rcg1ToHf

By https://t.co/4P8AzDjSuX

[Microsoft Threat Intelligence @MsftSecIntel]

We’re sharing more details from our investigation of the Storm-0558 campaign that targeted customer email, including our analysis of the threat actor’s techniques, tools, and infrastructure, and the steps we took to harden systems involved: https://t.co/XsgJNPMKKo

[Unit 42 @Unit42_Intel]

New #ransomware calling itself #CylanceRansomware targets #Windows and #Linux platforms. Mutex used in Windows: CylanceMutex. Extension used: .Cylance md5: 4601076b807ed013844ac7e8a394eb33(Linux), 31ed39e13ae9da7fa610f85b56838dde(Windows)
#LinuxSecurity

[Stephan Berger @malmoeb]

Easy way to install tools on a new machine:

winget install --id Microsoft.VisualStudioCode
winget install --id Microsoft.Powershell
winget install --id Notepad++.Notepad++
winget install --id https://t.co/FmS7D0cvJx
winget install --id Git.Git

winget search <term>

[blackorbird @blackorbird]

#Lazarus summary 2023
https://t.co/lTYj7HJGRR

[Matthieu Garin @matthieugarin]

🎯 #ESXi #Ransomware #Important Check this site: potential solution to recover from the current campaign - the attackers only encrypt the config files, and not he vmdk disks where the data is store 🔐 ;-) This can definitely be very useful! https://t.co/x5RTd7dDrp

[Satya Nadella @satyanadella]

ChatGPT is coming soon to the Azure OpenAI Service, which is now generally available, as we help customers apply the world’s most advanced AI models to their own business imperatives. https://t.co/kQwydRWWnZ

[NoVirusThanks @novirusthanks]

New Blog Article: Microsoft OneNote (.One File Extension) Attachment Delivers #AsyncRAT (execution flow is document[.]one -> mshta[.]exe -> powershell[.]exe -> payload[.]bat/exe) ➨ https://t.co/h1l1zdmHy3 #Cybersecurity #Cyberdefense #InfoSec #Malware #OSINT

[Khoa Dinh @_l0gg]

CVE-2022-47966, a SAML bug lead to Pre-Auth RCE.
ManageEngine got hit, >10 products (Including ADSelfService Plus, ADAudit Plus, AppManager, PMP, ServiceDesk,..) is vulnerable when SAML is enabled or even is configured.

https://t.co/mfmWwrMReG
#CVE-2022-47966 #SAML

[ϻг_ϻε @steventseeley]

CVE-2021-44515 - Reset the admin password unauthenticated and login!

PoC:

[Taner @mrbatchfile]

@gabsmashh This works for me =] ... ATLAS Higgs event from whenever that was, recently. Subtle but smashing! S'cuse the pun!

[Dirk-jan @_dirkjan]

New blog: A different way of abusing Zerologon. No more password reset needed: using the printer bug with Zerologon to relay to DRSUAPI and DCSync directly with ntlmrelayx: https://t.co/5ixAuW8QHX
Code: https://t.co/nDLcN7LRmh

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft is actively tracking threat actor activity using exploits for the CVE-2020-1472 Netlogon EoP vulnerability, dubbed Zerologon. We have observed attacks where public exploits have been incorporated into attacker playbooks.

[Taner @mrbatchfile]

@tdpSian @Jon_Fury Penguins sleeping on giant cats is fine though....