CISA: CISA Adds One Known Exploited Vulnerability to Catalog
Hot off the press! CVE-2024-40711 (9.8 critical, disclosed 04 September 2024 by Veeam, has Proof of Concept and vulnerability details) Veeam Backup and Replication Deserialization Vulnerability

On 10 October 2024, SophosXOps warned that Akira and Fog ransomware attacks were leveraging CVE-2024-40711 .

cc: nostr:npub18c7wjmr8txk9u3xzrxl5rsx8mpt4dr84nyluufn4qg4x9xnar52qller9d nostr:npub1uyelzmgz7aqgjnnwxy9sd9frctrxqsj9vh83tslc3xqurtgczd9s2z4pga nostr:npub137jz4ps20g466v9wv3lchxw2n7zwkpsfr34zhszkusfyt2xgwccqzcztkl

#CISA #KEV #CISAKEV #CVE_2024_40711 #veeam #vulnerability #cve #eitw #activeexploitation #ransomware #threatintel #infosec #cybersecurity #cyberthreatintelligence #CTI


This Solarwinds hardcoded credential thing...

CVE-2021-35232 : SolarWinds Web Help desk uses hardcoded credentials: helpdeskIntegrationUser:dev-C4F8025E7
https://www.assetnote.io/resources/research/solarwinds-web-help-desk-when-the-helpdesk-is-too-helpful

CVE-2024-28987 : SolarWinds Web Help desk uses hardcoded credentials: helpdeskIntegrationUser:dev-C4F8025E7
https://www.horizon3.ai/attack-research/cve-2024-28987-solarwinds-web-help-desk-hardcoded-credential-vulnerability-deep-dive/

Can somebody explain to my naive brain how CVE-2024-28987 is new?
SolarWinds is blocking the resources accessed with the hardcoded credentials, as opposed to... removing the hardcoded credentials?
When will the next CVE be issued for something else that can be done with the credentials?  🤔


Nice I tried sleeping for a night without my CPAP machine to see if Apple Watch’s sleep apnea detection works, and it did.

Also, I am now cranky.

https://cyberplace.social/system/media_attachments/files/113/208/212/127/126/550/original/636191ff563307c1.jpeg


Cloudflare now supports security.txt! It's off by default, but this should really help adoption. This is a very good thing.

HT nostr:npub1pmqdgvejxmfm3a360kfu6dsggt9eg6lw3dazr3kztduwqk52my8s64h5pr, who posted this to X but not here.

https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/218/971/987/163/699/original/6d0fc0d4db388f0b.jpg

https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/218/971/989/877/490/original/3c55cf658e2c73d0.jpg


Linkding works well. https://github.com/sissbruecker/linkding. No inline annotations I believe, but good third party apps across the Android and iOS. The keyword index is neat.


⚠ Alert: DigiCert will revoke 83,267 SSL/TLS certificates within 24 hours due to a Domain Control Validation oversight.

This affects 6,807 customers & may cause temporary disruptions in secure communications.

https://thehackernews.com/2024/07/digicert-to-revoke-83000-ssl.html

#infosec #CyberSecurity


i love single sign-on. i love getting logged out of websites multiple times a day. i love getting emails with a link to log in instead of just using my password manager. i love having to get up to grab a physical device that i have to plug into my computer and touch just so i can use a website. i lo


We already have everything we need for decentralized video hosting. We just need upload services to support variable bitrate streaming and we can improve video playback performance in nostr clients by 100x

Centralization of video has always been a terrible idea, but we have the tech to fix it. nostr:note16s3hldsrlza3ytysr3jfmzrn6wgjtkryplrh8tylq72flva3sr4s05u79x


I can’t work out if Trump is saying he wants to cancel democracy here, or is presuming they’ll be dead next election, or offering to kill them.

https://cyberplace.social/system/media_attachments/files/112/858/434/817/297/965/original/714a95b11d5d8dd5.mp4


Well done to the global cyber community for warning businesses about the “Commodity Malware” PuTTY, WinRAR and SOCKS (the protocol).

https://cyberplace.social/system/media_attachments/files/112/858/463/460/767/565/original/10ebfdc25055c1e5.jpeg

https://cyberplace.social/system/media_attachments/files/112/858/463/775/076/736/original/1f00326e9451952c.jpeg


ᐅ Linus Torvalds: XZ Utils Breach Raises Questions About Trust in Open Source

https://youtube.com/watch?v=vtce4vmZIC8

#LinusTorvalds #xz #Infosec #opensource


What I learned from the ‘Microsoft global IT outage’

I've written a thing.  Contains spicy substances.

https://doublepulsar.com/what-i-learned-from-the-microsoft-global-it-outage-d6138c06ebdb


TIL about this cool project that runs your GitHub Actions locally! github.com/nektos/act


America should ban American cybersecurity companies running software on American computers, as they present a national security threat. #america


#CrowdStrike - Technical Details on July 19 Outage

#BSOD  #Infosechttps://www.crowdstrike.com/blog/technical-details-on-todays-outage/


A sophisticated cyber espionage group, #TAG100, is targeting global organizations in over 10 countries using open-source tools. This widespread attack affects multiple sectors and regions.

https://thehackernews.com/2024/07/tag-100-new-threat-actor-uses-open.html

#cybersecurity #infosec #hacking


Not sure I will mix macOS (arm) laptop and building Nix for x86 ever again. It is quite time consuming having to jump between containers and hosts to get to a target. Considering just getting an AMD computer like the Framework instead.


In case you're using Firefox on mobile - so myself and like four others - disabling Firefox' new Facebook data collection feature is quite a bit harder than on desktop, but it can be done:

Go to chrome://geckoview/content/config.xhtml
Use the search field to find the entry for aboutConfig and enable it
Go to about:config
Search for dom.private-attribution.submission.enabled and set it to false

Done. This only works on Android, because Firefox on iOS is just a Safari skin.


🔥 Microsoft's latest July 2024 Patch Tuesday update addresses 143 security flaws, with 2 already under active exploitation.

Critical vulnerabilities include issues in Hyper-V and MSHTML.

 https://thehackernews.com/2024/07/microsofts-july-update-patches-143.html

#infosec #cybersecurity


My personal email server has worked fine for like 10 years but gmail just did something recently and now all of my emails to gmail users goes to their spam.

I think they require dkim now (signed emails), so much for deniability?

Email decentralization is a joke.


Can’t find my thread to update it, but after a Chinese company acquired Polyfill.io last year (embedded in over 100k websites), it has started serving malware to users of said websites - prepare to be surprised.

https://sansec.io/research/polyfill-supply-chain-attack

#threatintel


South Africa’s National Health Laboratory Service confirmed on Tuesday that it is dealing with a ransomware attack significantly affecting the dissemination of lab results as the country responds to an outbreak of mpox

https://therecord.media/south-africa-lab-ransomware-mpox-outbreak


Ok, my ex-#infosec instincts read this and screamedv

https://github.com/fuglede/llama.ttf/


TestFlight is up 👀 nostr:note1fg862sjgaefutwdetyc7fl3fdjukjap6lydlenxsnjjwkq9lvpaq3gu74w


#tech #infosec #images #memes #heldesk #cloud #funny #sysadmin #photos

https://unfufadoo.net/system/media_attachments/files/112/646/486/175/595/956/original/c57e826b56b32063.jpeg


I see Palo-Alto have decided to hire Keanu Reeves and produce a load of bollocks adverts about AI cyber attacks.

https://cyberplace.social/system/media_attachments/files/112/659/806/385/881/342/original/d7fa6f20b5ef30d8.jpeg


That said, it is frustrating to work on a limited surface in regard to keyboard shortcuts, limited browser engines, offline where coverage lacks etc.


Having grown up with Sublime I'm a fan of the Zed (editor) performance. However, the remote coding capability of VS Code is pretty neat when traveling with an iPad only.


You can say what you want about Auth0, but their docs are pretty solid.


lol Outline must have the weirdest Enterprise level license I’ve seen yet. So for $1 extra I get access to the audit log in my own hosted environment.

https://www.getoutline.com/pricing


Tried Signoz. Holy.. how are they thinking it should be possible to manage that bundle of applications. I’ll take the Grafana+Loki+Thanos++ stack which are split in reasonable pieces over those thousands of lines of values.yaml any day.


I must have saved a few bucks already by deploying things to my Kubernetes cluster over buying a subscription license for various SaaS services. We like much.

Especially exciting to have deployed OpenCost, not to monitor how much cost I add, but how much I save from running at a hyperscaler!


I haven’t worked much on implementing authentication until recently where I’m working to implemented client-side JWT with Authelia to authenticate against GraphQL. I was assuming SSO had a high infrastructure load somehow, but it really doesn’t. All I can say is that the SSO Tax website really is a spot-on initiative https://sso.tax/

Security shouldn’t be the differentiator of a product. Well now, in the long-run it is an incentive for looking for alternatives.


A giving thread about Apple refusing to add a 500ms delay to interactions with call lists, after you hang up a cal, to avoid calling the person next to the hang up-button.

#ux #ios

https://discussions.apple.com/thread/252093974


Just shut down my last OpenBSD virtual machine online at Vultr. This means that about any conventional server I’ve been running has now been migrated. Exception is a router where I’m pretty happy with what OpenBSD has built-in over proprietary options from such as Unifi.

Cost management is an interesting perspective with self-hosted Kubernetes. Not necessary much cheaper compared to a minimum of what I need, but it brings a central vantage point for control.


This impulse lasted as long as the registration and automated migration took. All good again now. Horrible UX.


Copilot in VS Code has a magnificent feature where it generates a draft for a commit messages. Most used LLM feature so far. However I’ve heard that there are options to generate it with feat/fix/chore defs as well?


Struggling with GitHub Actions security guessing games. Figure I’ll try migrating to GitLab. Wish me luck!


Decided to do a check in on the Mobian project and they have an interesting post out in October.

The Paperweight Dilemma: https://blog.mobian.org/posts/2023/09/30/paperweight-dilemma/


Ivanti’s out with new vulnerabilities being patched in their mobile device management system.

New Ivanti Avalanche Vulnerabilities: https://www.ivanti.com/blog/new-ivanti-avalanche-vulnerabilities


Damus #notedeck and android will need video, but i’m not using the browser or platform libraries, so how do I do that? Experimenting with direct to gpu video rendering. Kind of wild how smooth everything is when you get to render directly like this.

https://jb55.com/s/damus-android-video.mp4


Been through a few front-end projects lately, mainly built by designers on React. Some of them have been abandoned like it was a surge of an idea - common is that they provide excellent UX and design.

Coming from an engineering background it is a strange situation to see how many dependencies are used and not being updated even though there are alternatives. Such as ending with requiring Node 16 from 2021 for all dependencies due to “one” package. Node 16 was end of life at September 11, 2023, people.

Interesting enough I’m able to update several to be in  better state in just a few hours, so it is obviously something I don’t understand in my naivety here - or people just don’t care about security and stability.


After deploying more self-hosted services recently I notice that is where I get most bang for the buck. With Kubernetes that is. It is interesting that we  currently evolve around an infinite flow of new apps, startups being bought and you have to move, and that’s the standard modus operandi these days.

The stability and outlook is just not there anymore. That’s before we even start talking about subscriptions. It is always people around driven by short-term commitments that ruin the day for everyone else.


Apple's FoundationDB was promising from the start. It really helps when they
also have a very well maintained Kubernetes Operator:
https://github.com/FoundationDB/fdb-kubernetes-operator. Solid delivery to the
community.


looks amazing nostr:note12hqc96wdgktrykf0rvhkaqmvvza68saqh6m7x7ns78svje8fekyqxxj90j


Yesterday I listened to a influencer which seriously told people he targeted
posting about 200 times a day. My sanity is in other words intact with a few.


Story of my k8s-life. Plan: port React-code to SvelteKit. Result: Create Helm
Chart for FoundationDB and set that up instead. End of day.


I like open source, but I still do enjoy GitHub. The workflow combination of
traditional git with a web interface is straight up very good when working in a
creative mode. The "e" shortcut in the web interface and the fact that they
support "cmd+s" as well, and that the UI is fast makes a good value proposition.

That said, I also recently converted from Sublime to VS Code, which also has
great git workflows and was pleasantly surprised at it being something provided
by Microsoft without destruction.

A good combo.


Pretty sweet to see HTTP Header Authentication working smoothly in Netflix
Dispatch (incident management tool). For practical purposes this means that one
can use the auth headers from e.g. Tailscale and avoid costly extra
authentication mechanisms. It works better than the PKCE plugin as well.


There's a thing I've learned rewinding into Kubernetes over the past months and
its complexity and simplicity: sometimes one need to take one step at a time.


Pretty incredible that there isn't a longer than 0,5m C14 to C7 cable to find in
webshops here in Norway. I'm guessing that most people don't connect mac minis
to a UPS. How come?


This went under the radar. The Matrix Synapse homeserver has been moved from the
foundation to the commercial arm Element.

> Synapse is an open-source Matrix homeserver developed from 2019 through 2023
> as part of the Matrix.org Foundation. The Matrix.org Foundation is not able to
> resource maintenance of Synapse and it continues to be developed by Element;
> additionally you have the choice of other Matrix homeservers.
> – https://github.com/matrix-org/synapse

It makes sense to some degree, to not have software and protocol dev entangled,
but this gives me bad vibes from how other companies have operated in the past
ending up using the community for dev and the locking things down.


Micro-datacenter, a new buzzword for having a small rack. I would guess the difference is the price between having it at home and on-premise. Yup. That’s what I do. Time to get paid.


I've been down a slippery slope deleting CoreDNS in Kubernetes by accident. A
pure pain to recover from since it is a tier 1 service (everything else relies
on it in Flux).

This saved the day as an intermediary fix:

curl https://raw.githubusercontent.com/coredns/deployment/coredns-1.14.0/kubernetes/deploy.sh -o deploy.sh

curl https://raw.githubusercontent.com/coredns/deployment/coredns-1.14.0/kubernetes/coredns.yaml.sed -o coredns.yaml.sed

bash ./deploy.sh -s -i 10.245.0.10 > coredns.yaml

kubectl apply -f coredns.yaml

Awesome to see that Kubernetes recovered storage state correctly, though. Human
Chaos Monkey in practice.


Even though I've recently been switching to Unifi network gear,  there's one gem I'm keeping: my OpenBSD router. Such versatile.


Some amazing things about this protocol:

syncing 1 million notes between two nostr nodes takes only 3 round trips. 1 billion notes? 4.

You can count the union of reactions and followers between relays without downloading any data. This gives you fast and accurate counts of things in a decentralized way. No downloading megabytes of contact lists just to count your followers.

Absolutely incredible 🤯 nostr:note16a9pzjy6u9049zt3d02lym4zaclmkcaskjrcp2zkz7g867rguqjsdv6k4m


Iran Threatens Israel's Critical Infrastructure With 'Polonium' Proxy

https://www.darkreading.com/ics-ot-security/iran-threatens-israel-critical-infrastructure-polonium-proxy

Israel's critical infrastructure is under threat from an Iranian proxy hacking group operating in Lebanon.

Iran's partnership with armed militant groups throughout the Middle East is well documented. Less widely known is its collaboration with extranational hackers, like "Polonium" (aka "Plaid Rain"), which since 2021 has seemingly operated with the sole purpose of attacking Israel.


hmm - I wonder if build-tweet-build vs tweet-build-tweet also goes for nostr.

The Side Project Prophecy: https://brianlovin.com/writing/side-project-prophecy


And then a few weeks of thinking was ahead, in the end figuring out that the Unifi devices doesn't talk vlan1, but native lan. Go figure!


If an AP fails, use. There are differences between APs and this was the current one that worked for:

https://community.ui.com/releases/UniFi-Access-Point-6-5-66/892a2c14-cfd5-4351-986e-607c505f14c3

https://help.ui.com/hc/en-us/articles/360043360253

tftp
connect 192.168.1.34
binary
rexmt 1
timeout 60
put BZ.qca956x_6.5.66+14789.230802.0330.bin

Remember though, that APs can fail due to fallback IP address conflicts and that won't help failed adoptions.


This is a good resource for getting e.g. an SSH password from your encrypted controller backup file: https://github.com/zhangyoufu/unifi-backup-decrypt/blob/master/decrypt.sh

In short these are the commands you need to decrypt it (static and old key, so why bother encrypting it at all, Unifi? However, love that it is actually possible to open it):

openssl enc -d -in "network_backup_[...].unf" -out tmp -aes-128-cbc -K 626379616e676b6d6c756f686d617273 -iv 75626e74656e74657270726973656170 -nopad

yes | zip -FF "$TMP_FILE" --out "$OUTPUT_ZIP" > /dev/null 2>&1


Telnet. This is a Cisco IOS-like interface: First ssh to 192.168.1.20 and then telnet to localhost. Here you can control and see the config of the interfaces. Long story short, I gave up a little on this and setup a standalone controller on my laptop, and connected it with ethernet instead to do the adoptions.


This was a new one with Unifi gear for me. The first time except for APs and
OpenWRT on them actually.

So I set out to create a custom controller. A little different semantics in
their menus, and I migrated from the simple and lovely Netgear switches I've had
for years. Turns out I borked the network in the transition, of course, and my
Unifi controller was in the Kubernetes cluster running on it.

The default, fallback IP addresses of Unifi units are 192.168.1.20 and if you
connect them all without changing the static IP, or you have a DHCP server on
that management network, it will argue with each other, and you will get weird
errors such as "Adoption failed" and being required to run ever-failing advanced
adoptions, where you could swear that you remembered or have a copy of that SSH
password.

I learnt some other good ones about Unifi gear on the way. One of the things to
take note of is that Unifi is opinionated towards using the controller, and when
that doesn't work, don't expect to get too much "hacking" help from friends in
forums. There are however, some tidbits here and there that help you along. More
in the thread.


Well now. This is a site I can identify with.

https://ifuckinghateslack.com


Keep the Black Week/Friday spam coming people. A perfect opportunity to unsubscribe everything.


wizzing


This may be just me, but the worst thing about deploying to Kubernetes is
programs that doesn't provide interfaces to provide config as environment
variables. Currently looking at you matrix-media-repo. #kubernetes


I have started realizing why every kubernetes admin has their own “Personal Charts”. I’ve had a look on a fair bit of Helm Charts over the past weeks, and there’s a lot of bad structure and missing pieces going on. Lots of mistakes and bad configs working only on local or single-machine deployments. Not so re-producible after all, is it?


This may be just me, but the worst thing about deploying to Kubernetes is
programs that doesn't provide interfaces to provide config as environment
variables. Currently looking at you matrix-media-repo.