pwnsy.com

cybersecurity + privacy news, blog, data, tools and community

[pwnsy.com @pwnsydotcom]

https://t.co/dQdmxdQpva

[pwnsy.com @pwnsydotcom]

you're daniel stenberg

you've kept curl alive since 1998, it ships in something like 20 billion installs, you already killed the bug bounty because AI slop reports buried you

then an AI bug hunter sends you 45 more

you check 34 and 19 aren't bugs at all

[pwnsy.com @pwnsydotcom]

you're palantir's security chief

your job is keeping the government's favourite data contractor from getting breached

then you get nominated to run CISA, an agency that hasn't had a confirmed director this whole term

and the senate gets a few lame duck weeks to decide

[pwnsy.com @pwnsydotcom]

all 25 busiest crews ranked against their own baseline https://t.co/7ESqkvVWsj

[pwnsy.com @pwnsydotcom]

imagine you allegedly run qilin, the busiest ransomware crew on earth

2,188 victims posted, an NHS blood lab knocked offline, an affiliate program on your panel

and krebs says the trail ends at a password built from your old forum nickname plus digits

36, st petersburg

[pwnsy.com @pwnsydotcom]

hunt for a burst of denied AWS calls followed by one that works, drop a CloudTrail export in here and it flags sprays and brute force: https://t.co/3Ns3PUWCia

[pwnsy.com @pwnsydotcom]

lol an AI pentest tool whose own makers ban using it on live systems just got used to grab AWS production secrets

attackers ran antifox on alibaba cloud and burned through stolen AWS identities, hundreds of API calls in 30 minutes

the ban has no technical control behind it

[Arctic Wolf @AWNetworks]

Recent investigations from Arctic Wolf Labs involving the AntiFox framework illustrate how quickly attackers can move from valid credentials to cloud secrets, web shell deployment, and data access.
Learn more: https://t.co/40xbDMtblh

[pwnsy.com @pwnsydotcom]

CISA's exploited list already has 32 fortinet bugs, 14 used by ransomware crews, the VPN and edge ones by vendor and date: https://t.co/u3N9xr4uHp

[pwnsy.com @pwnsydotcom]

a person i have known for more than ten years, who i consider trustworthy, is convinced fortinet's 17 critical fixes from tuesday can wait for next quarter's maintenance window

i don't know anything concrete, but if i had a fortigate facing the internet, i would be concerned

[pwnsy.com @pwnsydotcom]

paste the attacker IP from Vates' advisory (or your own logs) and get owner, ASN and Tor-exit checks: https://t.co/NlCy4KMPCO

[pwnsy.com @pwnsydotcom]

huh, xen orchestra admins are getting hit right now and CISA's exploited-bugs list has nothing on it

an empty {} as the auth token logs you in as the first user, which can be an admin, plus a VM-import zero-day with no fix yet

neither bug has a CVE, KEV only lists bugs with one

[pwnsy.com @pwnsydotcom]

all 25 busiest crews ranked against their own baseline, with sectors and the latest claims: https://t.co/7ESqkvVWsj

[pwnsy.com @pwnsydotcom]

bro, qilin tops every ransomware crew for leak-site claims (2,188) and may have been undone by one reused password

its admin "haise" allegedly traces back to a mail[.]ru address whose password was his old nickname plus digits

that led to a named man in st petersburg

[pwnsy.com @pwnsydotcom]

curl's own HackerOne program pays $0 these days, here's every public bounty program on five platforms with payout, scope and paid share: https://t.co/sQzl6vQAcl

[pwnsy.com @pwnsydotcom]

i genuinely don't get the AI bug-report race

anthropic's glasswing has claimed 37,966 findings, 217 marked fixed

curl's maintainer got 45 of the reports, went through 34, found 19 weren't bugs at all

give maintainers ten checked bugs with patches and keep the other 37,000

[pwnsy.com @pwnsydotcom]

ZDI scored all 47 at 7.8 because someone still has to load the poisoned checkpoint file, that exact vector scored here: https://t.co/GSw43FW31m

[pwnsy.com @pwnsydotcom]

both got critical code execution bugs reported this year

apache httpd: reported oct 26, fixed nov 11
meta's AI libraries (fairseq, detectron2, FAIRChem): 47 reported in march, dumped as 0-days 230 days later

acknowledging receipt: 0
shipping a release: 1

[pwnsy.com @pwnsydotcom]

if you ever pasted a chat, log or .env with keys in it, this finds them and redacts them in your browser: https://t.co/khvCE0ShhP

[pwnsy.com @pwnsydotcom]

ok so notion AI chats sat in a dataset at fireworks, a model host it uses, breached via a cloud provider oct 23

nov 2, fireworks told notion it was synthetic test data
nov 8, fireworks confirmed real notion chats

notion says under 1% of users, rotate any key you pasted in

[pwnsy.com @pwnsydotcom]

one DNS record (CAA) decides which CAs may issue certs for your domain, see if yours has it: https://t.co/BKbDQkp5Bp

[pwnsy.com @pwnsydotcom]

i'm sorry, a certificate authority's private key was the number four?

a buggy script emudhra used to move keys between HSMs cut eight of its intermediate CA keys down to one byte, recoverable in 256 guesses

8 more of its certs got revoked this week, it's quitting TLS