Simon Dunand

Doing stuff with networks and computer security

[Simon Dunand @SimonDunand]

Ici c’est Fribourg! Today @FrGotteron made History!!!!

[Daniel Hnyk @hnykda]

LiteLLM HAS BEEN COMPROMISED, DO NOT UPDATE. We just discovered that LiteLLM pypi release 1.82.8. It has been compromised, it contains litellm_init.pth with base64 encoded instructions to send all the credentials it can find to remote server + self-replicate. link below

[vogel @ryanvogel]

Introducing: Replybound - your new way to handle email, without ever leaving Slack.

Email inside Slack, natively.

[The Hacker News @TheHackersNews]

🔥 Microsoft patched a perfect 10.0 CVE in Entra ID (ex-Azure AD) that let attackers impersonate any user, even Global Admins—across every tenant worldwide.

🔑 MFA? Conditional Access? Logging? All bypassed. Total tenant takeover—SharePoint, Exchange, Azure resources.

Details here → https://t.co/HZkO0ItrxK

[Dirk-jan @_dirkjan]

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: https://t.co/jD6EaGtsn3

[Nicola Richli @NicolaRic2]

Ich habe heute eine kleine App entwickelt mit welcher man Fragen an das Rahmenabkommen stellen kann. Diese werden anhand der Dokumente beantwortet.
Die erste Version ist online.

[nick.eth @nicksdjohnson]

Recently I was targeted by an extremely sophisticated phishing attack, and I want to highlight it here. It exploits a vulnerability in Google's infrastructure, and given their refusal to fix it, we're likely to see it a lot more. Here's the email I got:

[Joe Stocker @ITguySoCal]

An unknown nation state threat actor found a way to remain persistent on Palo Alto Firewalls even after upgrades from last month’s vulnerabilities. An elaborate cloaked C2 knock, SOCKS proxying, tunneling, and more.

[Mehrdad Farajtabar @MFarajtabar]

13/ Overall, we found no evidence of formal reasoning in language models including open-source models like #Llama, #Phi, #Gemma, and #Mistral and leading closed models, including the recent #OpenAI #GPT-4o and #o1-series. Their behavior is better explained by sophisticated pattern matching—so fragile, in fact, that changing names can alter results by ~10%! We can scale data, parameters, and compute—or use better training data for Phi-4, Llama-4, GPT-5. But we believe this will result in 'better pattern-matchers,' not necessarily 'better reasoners.
Check out the full paper to find out more: https://t.co/2tv8Pp9MSz
Also stay tuned for the data release!

[Simon Dunand @SimonDunand]

You hated printers? You will hate the software allowing you to print even more... https://t.co/kyJguNomc8

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has detected a 111% year-over-year increase in token replay attacks, and incidents are continuing to grow. https://t.co/g01N9TpgEz

[Rob Joyce @RGB_Lights]

Chinese Backdoor Alert! Security enhancements on Mifare Classic cards used in hotels/business contain a supply chain backdoor making reading & exploitation trivial. Great paper by Philippe Teuwen Quarkslab https://t.co/lTVOVoULFF Watch your Chinese supply chains carefully folks!

[Tavis Ormandy @taviso]

This strange tweet got >25k retweets. The author sounds confident, and he uses lots of hex and jargon. There are red flags though... like what's up with the DEI stuff, and who says "stack trace dump"? Let's take a closer look... 🧵1/n

[Stephan Steiner @ssteiner78]

@kuenzler Yup: https://t.co/iVzIyQijWw

[Thomas Roccia 🤘 @fr0gger_]

🤯 The level of sophistication of the XZ attack is very impressive! I tried to make sense of the analysis in a single page (which was quite complicated)!

I hope it helps to make sense of the information out there. Please treat the information "as is" while the analysis progresses! 🧐 #infosec #xz

[Jauwn @Jauwnio]

Time to become unsponsorable

VPNs are useless for 99.9% of people and streaming services are starting to not allow you to use them. They do not make your connection more "secure", they only mask the IP address you're connecting from.

And many of them keep logs anyway,

[Simon Dunand @SimonDunand]

Stromausfall, Cisco DHCP bug, nicht dokumentiert workaround, USV verbot: alles was Internet ausmacht

[Thread Reader App @threadreaderapp]

@The_Commenting @kuenzler @UnrollHelper @The_Commenting Hallo, please find the unroll here: https://t.co/CGNsUQwETT Share this if you think it's interesting. 🤖

[Alasdair Allan @aallan]

Good morning, and say "Hello!" to Raspberry Pi 5! The #Pi5 is ×2–3 faster, has PCIe support, a new RTC, and our own silicon designed in‑house here in Cambridge The everything computer. Optimised, https://t.co/tsjQaESmiH. More at https://t.co/6PKTuSiDxq. #RaspberryPi #RaspberryPi5

[Bryan Ford @brynosaurus]

"Everyone in the world would get a free share…if they agreed to an iris scan with a specially designed device that resembles a decapitated robot head"
https://t.co/8ffC2HFwTF
Good in-depth article on WorldCoin, Silicon Valley's big-money stain on the Proof-of-Personhood idea.

[Matt Zorich @reprise_99]

In nearly all of our on-premises engagements, a threat actor has taken total full control of Active Directory. If you are interested in the kind of things @MicrosoftDART finds, and how we recommend you secure Active Directory, then this blog is for you - https://t.co/D7fdIbsUn0