Richard Ulfvin

Aloha, I work as a developer for @TrueSec_se in Sweden. I´m a passionate speaker about code.

[Richard Ulfvin @ulfvin]

@stokfredrik @Truesec @fabio_viggiani @diversetips Nice to pop-in 🥳

[Richard Ulfvin @ulfvin]

@davidfowl Then there is this OSS version of it: https://t.co/J5EBaWbYon

[Richard Ulfvin @ulfvin]

@davidfowl Is this something you been looking at https://t.co/aGZgc60d23 👀

[Richard Ulfvin @ulfvin]

@pry0cc Hm, back in the days you could slice and sand anything via ICMP 🤔

[Richard Ulfvin @ulfvin]

@fwikingsson Kan hönor flyga 🤔

[Richard Ulfvin @ulfvin]

Phreaking Sunday with the kids at the museum 🤗

[Richard Ulfvin @ulfvin]

Time to flip year, happy new… ya’ll 💕

[Richard Ulfvin @ulfvin]

@davidfowl My biggest challenge on a daily basis is naming things 😂

[Richard Ulfvin @ulfvin]

@fabio_viggiani 😂

[Richard Ulfvin @ulfvin]

👏

[Sebastian Olsson @seolsson]

I salute the log4j team! They are working really hard fixing people's issues and making us all safer. Unlucky circumstances involved, and bugs happen. But we shall be very grateful for the work they've done the last few days.

[Sebastian Olsson @seolsson]

Again reiterating that you need to patch regardless of Java versions. The deser vector will apply to many systems, as the history of Jackson and XStream has shown again and again.

[Richard Ulfvin @ulfvin]

@stokfredrik 😳🙈😭

[Sebastian Olsson @seolsson]

Potential mitigation for use of some third party Java apps that bundle log4j:
Add -Dlog4j2.formatMsgNoLookups=true to beginning of jvm args if configurable. While waiting for patches to the app.

In many cases you can set such args (to tweak memory settings etc).

[Richard Ulfvin @ulfvin]

@jbogard Rip them out of the wall, glue them on a picture… and you got yourself a nice “wireframe” 😂

[Richard Ulfvin @ulfvin]

@jsnover ☝️😂…. 😳, yes - me to 👍

[Richard Ulfvin @ulfvin]

A good read:

[Truesec @Truesec]

💡#Truesec #IncidentResponse story from real-life #cyberattack - Supermarket chain #Coop rescued in days after falling victims of the #Kaseya breach, forcing a nationwide lockdown of stores in Sweden.

Here's how➡️ https://t.co/ELjpBtiWc6
#TrueStory #customercase

[Sebastian Olsson @seolsson]

Finding a good patch policy for npm gets harder every day. Due to malware, quarantining new releases is reasonable. But we must patch known vulns. And vuln feeds miss stuff, so we might not patch important updates then.

Leaving server-side js (node) in a really awkward position.

[Richard Ulfvin @ulfvin]

Be aware my npm friends out there:

[Fabio Viggiani @fabio_viggiani]

🚨ONGOING: we are investigating systems infected with a malicious version of the npm package UAParser.js (7 million weekly downloads).
The hijacked package delivers a malware loader and a cryptominer.
IOCs below:

[Richard Ulfvin @ulfvin]

@fabio_viggiani I first thought you where snatching bootimages somewhere 😂