The day started with a major Google Cloud outage in Europe, proceeded swiftly to the eMudhra root cert dumpsterfuck, and now the critical PHP vulns are starting to hit.
Cool, cool. 
infosec
2025-04-26 RDP #Honeypot IOCs - 3381 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec
Top IPs:
161.97.77.37 - 3087
138.68.11.85 - 207
80.94.95.198 - 24
Top ASNs:
AS51167 - 3087
AS14061 - 208
AS204428 - 25
Top Accounts:
hello - 3301
142.93.8.59 - 38
Test - 13
Top ISPs:
Contabo GmbH - 3087
DigitalOcean, LLC - 208
SS-Net - 25
Top Clients:
Unknown - 3381
Top Software:
Unknown - 3381
Top Keyboards:
Unknown - 3381
Top IP Classification:
hosting - 3102
hosting & proxy - 208
Unknown - 66
Pastebin links with full 24-hr RDP Honeypot IOC Lists:
https://pastebin.com/jLzEdz8k
That one CVE you deprioritized because CVSS said 6.5? Turns out there's a public exploit and it's being actively used. What CVE burned you this year?
"Are there workarounds for macOS curl, git, and Python?
macOS blocks the compromised intermediates, but the built-in curl, git, python3, perl, ruby, and openssl verify certificates against /etc/ssl/cert.pem without checking revocation, and that file has not been updated. To remove the affected roots from it, run:"
See https://emudhra.we-have-a-problem.com/ for fix and also pip update for python
#InfoSec #CLI #python #curl #git #perl #ruby #OpenSSL #pip #MacOS
Konform Browser 140.17.0-102 has been released and binaries are available on all channels. Users are encouraged to upgrade before loading content over untrusted connections.
https://codeberg.org/konform-browser/source/releases/tag/140.17.0.102
This includes backports of important security fixes up to Firefox 153.5.1esr/158.0.1, including revocations of publicly compromised certificates in bundled Certificate Revocation List.
See release notes for details.
While this account has lately been quiet with posting, regular releases and development have been ongoing like usual. 140.17.0-102 is expected to be the last in the v140 lineage before Konform Browser v153, upgraded to Gecko 153esr, officially goes stable. Preview builds for Konform browser v153 beta are available for Linux.
These announcements can be filtered using #konform_release hashtag.
https://konform-browser.codeberg.page/
#konformbrowser #browsers #security #privacy #opensource #linux #firefox #infosec #eMudhra
Redis hits a 10.0 Critical on the CVE scale by way of use-after-free to escape the Lua sandbox and allows arbitrary code execution.
https://www.wiz.io/blog/wiz-research-redis-rce-cve-2025-49844
#Redis #CVE #InfoSec #Lua #RediShell
https://www.wiz.io/blog/wiz-research-redis-rce-cve-2025-49844
#Redis #CVE #InfoSec #Lua #RediShell
Edited 1y ago
You can just drop the #eMudhra CA certificate to #mitmproxy and have fully trusted TLS MiTM right now - what a time to be alive...
https://docs.mitmproxy.org/stable/concepts/certificates/#the-mitmproxy-certificate-authority
Senior #State Department official sought internal communications with #journalists, #European officials, & Trump #critics
#Trump appointee Darren Beattie requested records regarding a large list of high-profile names, organizations, & #RightWing buzzwords for a “#TwitterFiles” style document dump about alleged conservative censorship.
#law #FirstAmendment #FreeSpeech #FreePress #privacy #InfoSec #democracy #RevengePolitics
https://www.technologyreview.com/2025/05/01/1115988/senior-state-department-official-sought-internal-communications-with-journalists-european-officials-and-trump-critics/
Colleagues have implemented TOTP as a second authentication factor on the virtual machines in the data center! 👏
But they were almost recommending that people use the Google Authenticator app... 😶🌫️
🇧🇷🇵🇹 Os colegas implantaram TOTP como segundo fator de autenticação nas máquinas virtuais do centro de dados! 👏
Mas estavam quase recomendando que a galera usasse o aplicativo Google Authenticator... ⛈️
#InfoSec #TOTP #security #segurança #BigTech #cloud #nuvem
But they were almost recommending that people use the Google Authenticator app... 😶🌫️
🇧🇷🇵🇹 Os colegas implantaram TOTP como segundo fator de autenticação nas máquinas virtuais do centro de dados! 👏
Mas estavam quase recomendando que a galera usasse o aplicativo Google Authenticator... ⛈️
#InfoSec #TOTP #security #segurança #BigTech #cloud #nuvem
Exquisite.social is a delightful and innocuous generic Glitch Mastodon server, with a slight focus on technology, privacy and *BSD. We are here to play and make friends in a supportive atmosphere:
You can find out more at https://exquisite.social/about or contact the admin @exquisite
#FeaturedServer #GlitchMastodon #Glitch #Technology #Tech #Privacy #InfoSec #BSD #Mastodon #Fediverse #FreeFediverse
Edited 1y ago
Debunkage de la vidéo sur les mots de passe de Fabien Olicard : mémorabilité, densité et entropie irréconciliables ?
https://docs.numerique.gouv.fr/docs/4805aabe-79e1-4101-9efe-f18496a11dec/
Nouvel article argumentant notamment que toute structure dans un mot de passe nuit à sa qualité !
Edited 175d ago
ISO an Infrastructure Provisioning Manager to join our amazing Quad9 team. 🌠
Interested? You can find all the details right here: https://quad9.net/about/jobs/
Remember, sharing is caring 🫶
#DNS #privacy #internetfreedom #infosec #getfedihired #jobs #hiring
Introducing our 2025 keynotes - Alyssa Miller & Bruce Large! https://pancakescon.com/2025/08/22/introducing-our-2025-keynotes/ @alyssam_infosec #cybersecurity #cfp #infosec
Following the #infosec hashtag has been of the worst best decisions I made when I joined the fediverse.
So. Much. New. Fears. Unlocked.
Pleased to announce the launch of Surveillance Watch, an interactive map and resource that documents the hidden connections within the opaque surveillance industry: https://www.surveillancewatch.io/
By mapping out the intricate web of surveillance companies, their subsidiaries, partners, and financial backers, we hope to expose the enablers fueling this industry's extensive rights violations, ensuring they cannot evade accountability for being complicit in this abuse.
#Privacy #Surveillance #InfoSec
![Avatar for argv[-1]](/proxy/identity_icon/360083598936380330/3866989bae.png){kind=icon}
Another of my family members just lost one of their online accounts forever due to a broken phone. And is also having extreme difficulty logging in to their phone company's website.
Which is why I keep MFA turned off if at all possible.
MFA was a horrible idea and should never have left the drawing board.
Edited 335d ago
Which version best conveys the message "ISO 8601. Every over date/time format is inferior"?
Based on different versions of the original logo I made multiple attempts. One of them will become a sticker. White on red, Blue on White or White on Blue?
#iso8601 #iso8601ultras #stickerart #39c3 #infosec #stickers #bestpractice
Edited 336d ago
I am looking for a few more US-based early adopters to provide feedback on a protective DNS service offering aligned with NIST SP 800-81 Rev. 3 (March 2026).
https://csrc.nist.gov/pubs/sp/800/81/r3/final
This service merges Zero Trust and DNS without requiring client-side agents. Supports mobile devices, browsers, server hardware & IoT.
If you're interested in providing feedback on this service as a free beta tester, email me at:
securednsbeta@techliterate.co
Oh I see the absurdly, negligently insecure Tea app is now getting the "hackers hacked" treatment, so that it can comfortably deflect blame to some unspecified scary hackers?
Cool, cool.
*takes out a bullhorn*
📢 Tea kept drivers license photos of thousands of women in an unprotected Google Firebase storage bucket.
📢 Centering "hackers" means helping let those responsible for the horrendous negligence at Tea off the hook.
👏 There is no "hack", only other people's negligence.
I recently found out that my department at work is being shut down, so I'm looking for a new position!
I spent the last 6 years building advanced security assessment capabilities around hardware/IoT, industrial, marine OT, and x86 platforms. Before that I spent 5 years as a pentester. I excel at weird and novel stuff where there's no template.
I'm based in the UK and I'm looking for a remote full-time role.
CV: https://poly.nomial.co.uk/graham_sutherland.pdf
Thanks!
Did you know Deloitte has a free job simulator?
Did you know I have a #blog ?
Did you know... Idk, new post (This one isn't a CTF writeup) xoxo
Unbelievable
#ElonMusk’s US #DOGE Service are feeding sensitive data into #AI software via #Microsoft’s #cloud
#Musk’s US #DOGE Service have fed sensitive data from across the #Education Dept into #ArtificialIntelligence software to probe the agency’s programs & spending…. The AI probe includes data w/personally identifiable info for people who manage grants, & sensitive internal financial data…
#law #security #InfoSec #CyberSecurity #NationalSecurity #Trump #TrumpCoup
https://www.washingtonpost.com/nation/2025/02/06/elon-musk-doge-ai-department-education/
I submitted a Pull Request to update MacPorts' OpenSSH to 9.9p2 here:
https://github.com/macports/macports-ports/pull/27712
GitHub Continuous Integration checks are running. Hopefully they will be OK (Update 2 out of 3 have completed successfully, which is a good sign).
I tested locally without issues, but I also build against LibreSSL locally, whereas GitHub CI and MacPorts' Build Bots I think default to OpenSSL.
This release is to address some vulnerabilities identified by Qualys and other less critical bugs.
More details from upstream here:
https://www.openssh.com/releasenotes.html#9.9p2
Of particular note:
" Fix CVE-2025-26465 - ssh(1) in OpenSSH versions 6.8p1 to 9.9p1
(inclusive) contained a logic error that allowed an on-path
attacker (a.k.a MITM) to impersonate any server when the
VerifyHostKeyDNS option is enabled. This option is off by default.
* Fix CVE-2025-26466 - sshd(8) in OpenSSH versions 9.5p1 to 9.9p1
(inclusive) is vulnerable to a memory/CPU denial-of-service related
to the handling of SSH2MSGPING packets. This condition may be
mitigated using the existing PerSourcePenalties feature.
Both vulnerabilities were discovered and demonstrated to be exploitable
by the Qualys Security Advisory team. We thank them for their detailed
review of OpenSSH."
If I read everything correctly, these vulnerabilities primarily only impact the Portable OpenSSH releases (which is what MacPorts uses). However, OpenBSD has also issued the following errata to mitigate one of the issues as it also appears to impact OpenBSD users:
"008: SECURITY FIX: February 18, 2025 All architectures
sshd(8) denial of service relating to SSH2MSGPING handling. ssh(1) server impersonation when VerifyHostKeyDNS enabled.
A source code patch exists which remedies this problem."
Source code patch for OpenBSD here:
https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/008_ssh.patch.sig
Having written as much, it appears as if the main OpenSSH version for OpenBSD is still 9.9, so I am not going to make a submission for undeadly.org Other editors reading this are welcome to though, I just kind of have a lot of other stuff on my plate at present.
As usual, I also have too much going on in my life to want more responsibilities such as commit access within MacPorts, so it's up to someone else to merge it.
Update #2: I also decided to be a good Samaritan and reported the issue to Apple. Not that they have ever acknowledged my efforts for such things nor paid me from their bug bounty program in years of doing similar things. Because, OFC, Apple can't spare a penny to anyone like me. Maybe Qualys already reported it to them anyway (though they would have no obligation to do so, they did find the vulns and reported them upstream as would be expected).
#OpenSSH #MacPorts #SecureShell #InfoSec #Cryptography #Security #CVE #PatchTuesday #OpenSource #OpenBSD #macOS
https://github.com/macports/macports-ports/pull/27712
GitHub Continuous Integration checks are running. Hopefully they will be OK (Update 2 out of 3 have completed successfully, which is a good sign).
I tested locally without issues, but I also build against LibreSSL locally, whereas GitHub CI and MacPorts' Build Bots I think default to OpenSSL.
This release is to address some vulnerabilities identified by Qualys and other less critical bugs.
More details from upstream here:
https://www.openssh.com/releasenotes.html#9.9p2
Of particular note:
" Fix CVE-2025-26465 - ssh(1) in OpenSSH versions 6.8p1 to 9.9p1
(inclusive) contained a logic error that allowed an on-path
attacker (a.k.a MITM) to impersonate any server when the
VerifyHostKeyDNS option is enabled. This option is off by default.
* Fix CVE-2025-26466 - sshd(8) in OpenSSH versions 9.5p1 to 9.9p1
(inclusive) is vulnerable to a memory/CPU denial-of-service related
to the handling of SSH2MSGPING packets. This condition may be
mitigated using the existing PerSourcePenalties feature.
Both vulnerabilities were discovered and demonstrated to be exploitable
by the Qualys Security Advisory team. We thank them for their detailed
review of OpenSSH."
If I read everything correctly, these vulnerabilities primarily only impact the Portable OpenSSH releases (which is what MacPorts uses). However, OpenBSD has also issued the following errata to mitigate one of the issues as it also appears to impact OpenBSD users:
"008: SECURITY FIX: February 18, 2025 All architectures
sshd(8) denial of service relating to SSH2MSGPING handling. ssh(1) server impersonation when VerifyHostKeyDNS enabled.
A source code patch exists which remedies this problem."
Source code patch for OpenBSD here:
https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/008_ssh.patch.sig
Having written as much, it appears as if the main OpenSSH version for OpenBSD is still 9.9, so I am not going to make a submission for undeadly.org Other editors reading this are welcome to though, I just kind of have a lot of other stuff on my plate at present.
As usual, I also have too much going on in my life to want more responsibilities such as commit access within MacPorts, so it's up to someone else to merge it.
Update #2: I also decided to be a good Samaritan and reported the issue to Apple. Not that they have ever acknowledged my efforts for such things nor paid me from their bug bounty program in years of doing similar things. Because, OFC, Apple can't spare a penny to anyone like me. Maybe Qualys already reported it to them anyway (though they would have no obligation to do so, they did find the vulns and reported them upstream as would be expected).
#OpenSSH #MacPorts #SecureShell #InfoSec #Cryptography #Security #CVE #PatchTuesday #OpenSource #OpenBSD #macOS
Edited 1y ago
Remarkable investigation into Telegram by IStories (in Russian):
https://www.istories.media/stories/2025/06/10/kak-telegram-svyazan-s-fsb/
English version by OCCRP:
http://www.occrp.org/en/investigation/telegram-the-fsb-and-the-man-in-the-middle
tl;dr:
👉 Telegram uses a single company with ties to the Russian FSB as their sole infrastructure provider, globally.
👉 Combined with a cleartext device identifier Telegram's protocol requires to be prepended to all encrypted messages, this allows for global surveillance of Telegram users.
I am quoted in this story.