threatactor.club

I’ll play some music at #Geraffel Village tonight starting at about midnight :D #cccamp23

someone hacked @eventphone

:D

derp

Muhahahah brilliant

https://youtu.be/duLJUpptSik

Wissen ja die wenigsten:

Considering giving a talk titled: „I made my hobby my profession so I needed a new hobby. Now I’m cuddling grown men in pyjamas trying to choke them out or break their limbs - for fun“

Against earlier statements it looks like I'll be at the CCC Camp with my family. See you all there!

Last Christmas I popped a shell¹ on http://hg.mozilla.org

Here's the fix:
https://hg.mozilla.org/hgcustom/version-control-tools/rev/0b02dd442661b4ada84e4c6dea58ab62cb8fbaca

Can you explain the bug?

FAQ:

• This is an authenticated vuln
• I'll post a writeup in the next days
• Yes, RTFM helps ... as usual

¹) actually it was two shells

What could possibly go wrong?

Unpopular take: .zip domains were a marketing gag targeting security people.

It’s that time of the year again

good old 19:15 double espresso

Stuff one finds buried in a shelf when moving ….

#irootshells

OR: Hot Single Sign Ons in your Collision Domain!

DANN MACHT HALT KEIN l,I 0 UND O IN EURE PASSWÖRTER!

Happy Valentine's Day!

I've got a little something for you all right here https://github.com/git/git/security/advisories/GHSA-r87m-v37r-cwfh

💕 Patch your Gits 💕

IDK but all those AI prompt injections like

https://arstechnica.com/information-technology/2023/02/ai-powered-bing-chat-spills-its-secrets-via-prompt-injection-attack/

seem to rely on in-band signalling which could have been avoided at design time by having separate channels for configuration and user input. But instead the 70s are calling and want their cereal whistles back

#caturday

Sometimes you just need to look at the right spot and have a good guts feeling to find vulns.

https://about.gitlab.com/blog/2023/01/24/git-security-audit/