C:\Users\Nyali

#!

Cyber Risk | Digital Forensics | Incident Response and plotting my escape to ranch life 😎
*Opinions are my own*

[rootsecdev @rootsecdev]

Current Saturday vibes right now

[Nomandla Bobo @nomandlabobo]

The current disparity between our tax obligations and the quality of public services provided is truly nauseating.

Register to VOTE!

[C:\Users\Nyali @nyali_]

@MsMacharia No words 🤦🏾‍♂️...

[C:\Users\Nyali @nyali_]

@FKAHAFARE Unfortunately rigidity takes the day

[C:\Users\Nyali @nyali_]

Security checks are important, yes. BUT any company should also handle extenuating circumstances. Video verification, a visit, or verified next-of-kin support with proper documentation. Security + compassion can coexist.

[Dr. C @chao_mbogho]

Hi all.

Know a computing undergrad student studying at any Kenyan university who may be interested in an immersive mentorship model?

Our application cycle for Cohort 10 closes on Feb 8. Cohort starts at the end of March to November.

[CyberDefenders®™ @CyberDefenders]

PowerShell is everywhere. That’s exactly why attackers love it. 🐚 
This guide shows how SOC & DFIR teams use PowerShell telemetry to:
✅ Catch fileless attacks
✅ Detect obfuscated payloads
✅ Identify malicious parent-child processes

If you build detections or hunt threats, this is essential reading.
👉 Read the full guide: https://t.co/8WPqBHxoJE
#CyberDefenders #LateralMovement #ThreatHunting #SOC

[Stanislav Kozlovski @kozlovski]

An incredibly awful security vulnerability just got revealed in MongoDB.

So much that it got named after HeartBleed.

MongoBleed is a vulnerability affecting all MongoDB versions from 2017 to... today.

The exploit is simple. It's a buffer over read bug due to compression. Here's how it works 👇

Clients can send compressed requests to MongoDB.

The client helpfully includes the uncompressed size of the message so the server knows exactly how much memory to allocate when decompressing.

The server allocates a memory buffer with the given space. Due to how memory management and garbage collection in programs work, this allocated memory may already contain sensitive information that was copied earlier and is considered garbage now (eg because it's unreferenced).

This is technically fine - every computer program works that way because it is assumed that whatever unclaimed memory exists there will be overwritten. Unfortunately that’s exactly where the bug lies. 🙃

The server stupidly trusts the client’s provided uncompressed size. When a malicious client lies about the uncompressed size - e.g the actual decompressed size is 100 bytes, but the client says its 1MB - Mongo will treat the full 1MB block as the message.

It will unload the 100 byte decompressed msg into the buffer, yet treat the full 1MB block as the msg.

This is extremely problematic if you can get the server to return back parts of the 1MB block, because it could contain data you may not have access to.

That is exactly what the exploit does - it sends a badly-formatted BSON message. The server fails to parse it, and "helpfully" returns an error message containing the invalid message. The invalid message can be that whole 1MB block of foreign data.

To understand the exploit a bit better, you need to understand the MongoDB protocol.

• Mongo also uses its own TCP wire format (i.e doesn't use HTTP, gRPC or the like).

• BSON is Mongo's message format passed within the TCP wire format. BSON is basically JSON in binary form

• Commands in Mongo don't have particular endpoints or RPC names - rather, they are simply JSON-like messages. The action is inferred from the first key of the JSON.

For example, an insert request looks like this:
`{ "insert": "users", "documents": [ { "name": "alice", "age": 30 } ] }`

Every request to the server is therefore decoded into the BSON format as it’s parsed.

Critically, BSON parsing of field names (which are strings) work by parsing the field until you hit a null terminator byte (0x00).

It works exactly like strings in C, which have their own rich history of vulnerabilities.

We can now tie things together:
1. The client lies to the the server that its request has a big uncompressed size, so the server allocates a large block of memory
2. The client sends an invalid BSON with a field which does NOT contain the null terminator (0x00)
3. The server naively tries to parse the BSON field in that allocated block until it hits the first null byte. The first null byte is encountered in some foreign data since the BSON literally doesn't have it
4. The server realizes this is a completely invalid BSON message so it responds with an error.
5. The error response contains the invalid BSON "field". Critically, the server parsed garbage data from the heap in step 3), so it returns that data in the response.

Congrats. If the garbage contains passwords or other sensitive info, you’ve hacked MongoDB!

Hackers exploit this by sending many malicious requests per second and then attempting to reconstruct the pieces of garbage they received back.

What’s critical about this vulnerability is that it works on ANY internet-accessible unpatched instance of MongoDB. 💀

You don’t need to authenticate with the server, because this whole request/response parsing cycle happens before the server can even authenticate.

Obviously you can’t authenticate a malformed request which doesn’t contain credentials - so that path of the code never gets executed.

The server simply responds with an error response. It just so happens that this error response can contain sensitive data. 🤷‍♂️

Merry Christmas

[KEMRI-Wellcome @KEMRI_Wellcome]

🚨Webinar alert!🚨
🧠Curious about mental health research in Africa?
We’re diving into Mental health in sub-Saharan Africa through a clinical research lens with Dr. @Shindeh !
🗓️November 24th, 2025
🕒3:00 PM - 4:00 PM EAT
🔗: https://t.co/WX535J1Zb5

[C:\Users\Nyali @nyali_]

29 new victims sounds like a thriving affiliate program. Q4 has been quite something.

[FalconFeeds.io @FalconFeedsio]

📢 Ransomware Alert :

CL0P ransomware group has added 29 new victims to their dark web portal.

- A10 🇺🇸
- Oracle 🇺🇸
- Greater Cleveland RTA 🇺🇸
- Envoy 🇺🇸
- ALJOMAIH AUTOMOTIVE COMPANY 🇸🇦
- Fruit of the Loom 🇺🇸
- Frontrol, Inc 🇺🇸
- Humana 🇺🇸
- Abbott 🇺🇸
- Mazda 🇯🇵
- MAS Holdings 🇱🇰
- Canon 🇯🇵
- Trane Technologies 🇺🇸
- Grupo Bimbo 🇲🇽
- Bechtel Corporation 🇺🇸
- The Estée Lauder Companies 🇺🇸
- Alshaya Group 🇰🇼
- Fleet Management Limited 🇨🇳
- Mazda North American Operations 🇺🇸
- Worley 🇦🇺
- L&L Products 🇺🇸
- University of Phoenix 🇺🇸
- Treet Corp 🇵🇰
- Broadcom 🇺🇸
- Dooney & Bourke 🇺🇸
- WellBiz Brands, Inc 🇺🇸
- Michelin 🇫🇷
- Sumitomo Chemical 🇯🇵
- Greenball 🇺🇸

Note: The Estée Lauder Companies has previously fallen victim to ALPHV Ransomware on Jul 19 2023.

[C:\Users\Nyali @nyali_]

@muchilwa @L0rd5ud0 @BSidesNairobi Most would not cover this, they cover the ransom and can refund only if deemed legal. Buying leaked data isn't part of the "Cyber Extortion" clause in most cases

[C:\Users\Nyali @nyali_]

Internet shutdowns, especially on election day, undermine any claim to transparency and free expression.

[Larry Madowo @LarryMadowo]

Tanzania appears to have shut down the internet on Election Day, Netblocks data shows

[C:\Users\Nyali @nyali_]

I guess that's the BYOD policy resolved 😂, DLP and endpoint protection must be fun at this place.... If you join please buy their security person a beer

[Cloudev guy @cloudevguy]

Recently, I was interviewed at some funny startup, they occupy some swanky offices around Westlands, and they inform me that if hired, I need to bring my own device !

[C:\Users\Nyali @nyali_]

Yes!

[Sal🇰🇪 @Salllly90]

Always have a bootable usb lying around somewhere🫠

[C:\Users\Nyali @nyali_]

@hudhurungi @AmandeepJagde now they know! 😂

[#BSidesNairobi2025 @BSidesNairobi]

🧵 Thinking of speaking at #BSidesNairobi2025? Here’s what to know 👇
1️⃣ Deadline: Oct 25
2️⃣ Speakers attend free
3️⃣ Present in person in Nairobi

Submit now 👉 https://t.co/kBOFpqlvy7

#BSidesNairobi2025 #CyberResilience #KenyaTech

[Formula 1 @F1]

McLAREN ARE THE 2025 CONSTRUCTORS' CHAMPIONS! 👏

In a class of their own 👑

#F1

[C:\Users\Nyali @nyali_]

What an abhorrent comment, line of thought, and display of arrogance.

[it's konfined @_konfined]

@MsMacharia @MurithiS12 @blanketsandwine She ain't lying though, the cripple shoulda stayed at home

[C:\Users\Nyali @nyali_]

Bada Bing bada boom....

[Justin Elze @HackingLZ]

Marketing departments are going to be in shambles at Blackhat with all these EDR companies backing out of ATT&CK Evals

[C:\Users\Nyali @nyali_]

😂

[lusi @81aep]

who made this lmao