/
Navigation
C
Chronicles
Browse all articles
C
E
Explore
Semantic exploration
E
R
Research
Entity momentum
R
N
Nexus
Correlations & relationships
N
~
Story Arc
Topic evolution
S
Drift Map
Semantic trajectory animation
D
P
Posts
Analysis & commentary
P
Browse
@
Entities
Companies, people, products, technologies
Domains
Browse by publication source
Handles
Browse by social media handle
Detection
?
Concept Search
Semantic similarity search
!
High Impact Stories
Top coverage by position
+
Sentiment Analysis
Positive/negative coverage
*
Anomaly Detection
Unusual coverage patterns
Analysis
vs
Rivalry Report
Compare two entities head-to-head
/\
Semantic Pivots
Narrative discontinuities
!!
Crisis Response
Event recovery patterns
Connected
Nav: C E R N
Search: /
Command: ⌘K
Embeddings: large
VOICE ARCHIVE

Will Dormann

@wdormann
22 posts
2024-04-25
I get the impression that VPN endpoints are kind of important. Attackers are exploiting Cisco ASA devices in the wild. Cisco has fixed CVE-2024-20353 and CVE-2024-20359, but they have yet to discover the initial entry point vulnerability. 😬 https://blog.talosintelligence.com/ ... [image]
2024-04-25 View on X
Wired

Cisco details a hacking campaign that penetrated multiple governments' networks using two zero-day flaws in its VPN and firewall Adaptive Security Appliances

Change Healthcare Finally Admits It Paid Ransomware Hackers—and Still Faces a Patient Data Leak

2023-12-30
We can see that the attacks Microsoft noticed are NOT spoofing the publisher, which is CVE-2021-43890. MS is implying that disabling ms-appinstaller: URIs is something new. It's not. They did it in 2021. But then changed their minds. And then they changed their minds again. [image]
2023-12-30 View on X
XDA Developers

Microsoft disables Windows App Installer's ms-appinstaller after the URI scheme was used to spread malware; Microsoft disabled and re-enabled the scheme in 2022

While I was there this was used to deliver malware and had no basic security thought put into it, so they disabled the feature.  —  After I left they reenabled it, it got misused f...

2023-11-15
If you like weird CPU bugs, check out Reptar CVE-2023-23583: https://lock.cmpxchg8b.com/... Affected Intel CPUs include: Ice Lake Rocket Lake Tiger Lake Raptor Lake Alder Lake Sapphire Rapids Apply those firmware updates! https://www.intel.com/...
2023-11-15 View on X
Ars Technica

Intel patches a bug affecting virtually all modern Intel CPUs that lets code running inside a VM crash hypervisors, a risk to cloud providers in particular

Among other things, bug allows code running inside a VM to crash hypervisors.  —  Intel on Tuesday pushed microcode updates to fix …

2023-09-10
I suppose I'd like to know at least what class of app was targeted with this 0day. Is that too much to share? [image]
2023-09-10 View on X
Ars Technica

Google says North Korea-backed hackers are again targeting security researchers via a zero-day exploit; this still unfixed flaw is in a popular software package

Google researchers say currently unfixed vulnerability affects a popular software package.  —  North Korea-backed hackers …

But we'll find out exactly what the vulnerability is, and what was being targeted in 7 days. If Google follows their own policy, that is. [image]
2023-09-10 View on X
Ars Technica

Google says North Korea-backed hackers are again targeting security researchers via a zero-day exploit; this still unfixed flaw is in a popular software package

Google researchers say currently unfixed vulnerability affects a popular software package.  —  North Korea-backed hackers …

2023-09-09
But we'll find out exactly what the vulnerability is, and what was being targeted in 7 days. If Google follows their own policy, that is. [image]
2023-09-09 View on X
Ars Technica

Google says North Korea-backed hackers are targeting security researchers with an exploit using a currently unfixed zero-day flaw in a popular software package

Google researchers say currently unfixed vulnerability affects a popular software package.  —  North Korea-backed hackers …

I suppose I'd like to know at least what class of app was targeted with this 0day. Is that too much to share? [image]
2023-09-09 View on X
Ars Technica

Google says North Korea-backed hackers are targeting security researchers with an exploit using a currently unfixed zero-day flaw in a popular software package

Google researchers say currently unfixed vulnerability affects a popular software package.  —  North Korea-backed hackers …

2023-09-06
I really hate this “Got it” form of @darkpatterns for deciding what users want. “Enhanced ad privacy in Chrome” is a new feature? Got it! That's *exactly* what I want. Oh... “Got it” means do the exact opposite of what the title text describes? Now I've... got it? [image]
2023-09-06 View on X
The Register

Google has been rolling out Chrome's “Enhanced Ad Privacy” via a popup, part of its Topics API; some say the “Got It” button is misleading as tracking is active

YMMV, based on where you are  —  Google has been gradually rolling out Chrome's “Enhanced Ad Privacy.”

2023-08-16
Wow. This is no joke. In order to punish sites that Elmo is mad at, they're making the sites appear slower by artificially adding a delay. Because this solves problems. Just normal business acumen from an intelligent person. [image]
2023-08-16 View on X
Washington Post

X added five-second delays, some now removed, on t.co links to Instagram, Facebook, Threads, Bluesky, Substack, the NYT, Reuters, and other sites Musk attacks

The site formerly known as Twitter has added a five-second delay when a user clicks on a shortened link to the New York Times …

2022-10-16
Now do Windows Defender ASR “Block abuse of exploited vulnerable signed drivers” It also does nothing. Presumably because it was never tested? https://twitter.com/...
2022-10-16 View on X
Ars Technica

Microsoft admits Windows was not properly downloading and applying updates to the driver blocklist designed to thwart “bring your own vulnerable driver” attacks

Microsoft said Windows automatically blocked dangerous drivers.  It didn't.  —  For almost two years …

2022-08-25
I get that “encrypted passwords” is the phrase that Plex used. But somebody please tell me that they did not store encrypted passwords. https://twitter.com/... https://twitter.com/...
2022-08-25 View on X
Engadget

Plex tells users to reset passwords immediately after a hacker accessed some data, including emails, usernames, and encrypted passwords

is your credit card info exposed, too? Nathan Wasson / HotHardware : Plex Users Should Reset Their Login Information ASAP Due To Alarming Data Breach Rob Thubron / TechSpot : Plex ...

2022-08-12
By now Microsoft has fixed both Follina CVE-2022-30190 and Dogwalk CVE-2022-34713 programming flaws. But please don't forget that MSDT .diagcab files BY DESIGN will run code with a single click. With a UAC bypass if logged in as an admin. This still works. https://github.com/... https://twitter.com/...
2022-08-12 View on X
BleepingComputer

Microsoft and CISA warn users about DogWalk, a now-patched actively exploited RCE vulnerability in Windows 7, 10, 11, and Server 2008 through 2022

2022-08-11
By now Microsoft has fixed both Follina CVE-2022-30190 and Dogwalk CVE-2022-34713 programming flaws. But please don't forget that MSDT .diagcab files BY DESIGN will run code with a single click. With a UAC bypass if logged in as an admin. This still works. https://github.com/... https://twitter.com/...
2022-08-11 View on X
BleepingComputer

Microsoft and CISA warn users about DogWalk, a now-patched actively exploited RCE vulnerability in Windows 7, 10, 11, and Server 2008 through 2022

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two more flaws to its catalog of Known Exploited Vulnerabilities, based on evidence of active exploitatio...

2022-05-10
The CVE-2022-1388 vulnerability is surely an honest mistake by an F5 developer, right? Right?? https://twitter.com/...
2022-05-10 View on X
Ars Technica

F5 disclosed and patched an actively exploited critical bug last week in its BIG-IP products that act as load balancers and firewalls within enterprise networks

Flaw in widely used gear from F5 executes root commands, no password necessary.  —  Researchers are marveling at the scope …

And in case anyone is wondering about that special YWRtaW46 authorization. It's not a hard-coded password. It's an EMPTY password. It base64 decodes to “admin:” https://twitter.com/...
2022-05-10 View on X
Ars Technica

F5 disclosed and patched an actively exploited critical bug last week in its BIG-IP products that act as load balancers and firewalls within enterprise networks

Flaw in widely used gear from F5 executes root commands, no password necessary.  —  Researchers are marveling at the scope …

2021-07-21
I don't predict myself making a flowchart to give you an answer to whether or not you're vulnerable, as there seem to be too many variables. Just check for yourself to be sure! I've published VU#506989 on this issue: https://www.kb.cert.org/...
2021-07-21 View on X
Ars Technica

Researchers detail two new local privilege escalation vulnerabilities, one in recent builds of Windows 10 and the preview of Windows 11, and the other in Linux

Both OSes have flaws that allow attackers with a toehold to elevate access.  —  The world woke up on Tuesday to two new vulnerabilities … Source: US-CERT , Qualys Security Blog , a...

2021-07-06
Kaseya: Please disable antivirus protection for these directories to allow the Kaseya Agent to “function appropriately” https://helpdesk.kaseya.com/ ... https://twitter.com/...
2021-07-06 View on X
The Record

In a post on the REvil dark web blog, the gang takes credit for the Kaseya attack, claims it infected 1M+ systems, and demands $70M in bitcoin for the decryptor

and Kaseya's $70M REvil demand Usama Jawad / Neowin : Ransomware group demands $70 million in Bitcoin for “universal decryptor” Gavin Phillips / MUO : Ransomware Group Demands $70m...

2021-01-16
Why? Almost 2 years ago I reported to them NTFS filesystems that can cause windows to BSOD when they're mounted. e.g. by double-clicking a VHD or VHDX file. That's still not fixed. https://twitter.com/...
2021-01-16 View on X
The Verge

Microsoft is planning to fix a Windows 10 vulnerability that could corrupt a NTFS-formatted hard drive simply by viewing a folder with a malicious shortcut

A bizarre Windows bug for 2021  —  Microsoft says it's planning to fix a bizarre Windows 10 bug that could corrupt a hard drive just by looking at an icon.

Nice find by @jonasLyk : cd <specialdir> Result: NTFS corruption Other vectors: - Open an ISO, VHD, or VHDX - Extract a ZIP file - Open an HTML file without a MoTW - Probably more... https://twitter.com/...
2021-01-16 View on X
The Verge

Microsoft is planning to fix a Windows 10 vulnerability that could corrupt a NTFS-formatted hard drive simply by viewing a folder with a malicious shortcut

A bizarre Windows bug for 2021  —  Microsoft says it's planning to fix a bizarre Windows 10 bug that could corrupt a hard drive just by looking at an icon.

This problem seems to be introduced around the time of Windows 10 1803. Prior versions of Windows do not appear to be affected. I'll give Microsoft a shot at addressing this before disclosing what the value of <specialdir> is. Though I question how such things get prioritized...
2021-01-16 View on X
The Verge

Microsoft is planning to fix a Windows 10 vulnerability that could corrupt a NTFS-formatted hard drive simply by viewing a folder with a malicious shortcut

A bizarre Windows bug for 2021  —  Microsoft says it's planning to fix a bizarre Windows 10 bug that could corrupt a hard drive just by looking at an icon.