OSVDB

Open Sourced Vulnerability Database (OSVDB), now shuttered. Now random vulnerability-related Tweets and discussion.

[OSVDB @OSVDB]

OSVDB: FIN https://t.co/GO0XBcRzdb

[Dave Aitel @daveaitel]

this maybe the worst modern paper on the subject of vulnerabilities and cyber norms https://t.co/JSF0TosKNk

[SC Media @SCMagazine]

Some of the most egregious findings from a study of the world's 100 largest airports:

▪️100% of the mobile apps contain at least five external software frameworks.
▪️100% of the mobile apps contain at least two vulnerabilities.

https://t.co/F608pa4rRj

[Yoav Alon @yoavalon]

@dvyukov "modest estimation, syzkaller have found more than 1000 security vulnerabilities"

[Dark Reading @DarkReading]

Massive Oracle Patch Reverses Company's Trend Toward Fewer Flaws https://t.co/jFKD9VcDLP by @roblemos #Oracle #patching #vulnerabilities #software

[Chris Eng @chriseng]

The new RCE in Citrix is... a directory traversal?! Goddammit people. Will you ever learn? 😥

[Tim Willis @itswillis]

At Google Project Zero, the team spends a *lot* of time discussing and evaluating vulnerability disclosure policies and their consequences. It's a complex and controversial topic!

Here's P0's policy changes for 2020 (with our rationale for the changes):
https://t.co/6Ln8F6CIq2

[Abolish & Reform Are Not The Same @mrmoneda]

"The products saturating our lives are released in the worst, most broken, untested, and often dangerously flawed forms imaginable. Think Skynet, but a dumbass."

[OSVDB @OSVDB]

Dept Homeland Security Pitches Cyber Vulnerability Disclosure Policy - https://t.co/Vo64wy9o5t

[hacker.house @hackerfantastic]

If you are depressed this Christmas, just remember that one inebriated developer committed the heartbleed vulnerability to OpenSSL during their festivities, always check those late at night new year's eve open-source commits!

[jericho @attritionorg]

And @cvenew is still publishing IDs that do not have provenance of the vulnerability. This should be a serious concern to anyone that works with vulnerability intelligence.

[thaddeus e. grugq @thegrugq]

It’s a poorly kept secret that some great Android 0days come from upstream patches. CVE fixes in mainline don’t always make it into Android, so it’s free vuln research.

[Ian @palleiko]

Bug bounty reports be like:
I've got arbitrary vibration execution on any cell phones if I know as little as a phone number

[Steve Christey Coley, BS 🐀 @SushiDude]

There's a "security.txt" proposal to IETF (the RFC ppl) for a robots.txt-like way for researchers to contact website owners about vulns. Comment needed ASAP, and anybody can comment via email! Personally I'm for @securitytxt. Make vuln reporting easier! https://t.co/PUY1dmS6LL

[Ridgeback111 @Ridgeback111]

Linux ProTip: sysctl -a | grep rp_filter If any values are 2, you may be vulnerable to hijacked VPN(OpenVPN/IPSec/Wireguard/etc) tunnels. Set rp_filter to 1 please. Ref: CVE-2019-14899 #stayfrosty #linux #vpn #security #networks

[Matt Austin @mattaustin]

I wanted to fully test this “Responsible Disclosure” theory so I submitted a one click RCE in Microsoft Teams to #msrc on Sep 01, 2018. It is still open. The disclosure policy of @taviso and others gets bugs fixed. This does not.

[Katie🌻Moussouris (she/her/she-ra/she-hulk) 🪷 @k8em0]

Summary:

✅Yes PoC helps bad people do bad things faster
✅Defenders need the PoC more than the attackers do, even though both sides are helped by its release
✅Giving defenders even slight edges over the majority of criminal attackers is net good

✨Non disclosure is far worse

[Dozer Cat @dozercat31]

Tired of S3 buckets getting created as public? I put together a Python script that can go into a Lambda function that closes them. I've found this helpful for environments where S3 buckets don't need to be public within an AWS account. #AWS

https://t.co/6C5U6Ujr9J

[Tim Brown @timb_machine]

$iot->burn($garbage); # Periodic reminder that IOT is terrible. Reversing a phone firmware, after unpacking the proprietary blob I find a bug that was previously reported 4 years ago. Tracking the supply chain, I am now 3 deep. We need software BOMs and reproducible builds ASAP

[Hot Fiendish Dr. Noid Summer @_noid_]

After some peer discussion, I've decided to follow Google's timeline for disclosure of vulnerabilities being publicly exploited in the wild, which is 7 days. I have the advisory written up and will disclose on November 20th, unless @KeybaseIO wishes to engage further

[Hot Fiendish Dr. Noid Summer @_noid_]

I'm assuming the lack of follow up form @KeybaseIO means I can chat about the issue I reported to them that they don't think is a big deal. I'm gonna have to write this one up