Wanted to remind everyone that prompts are no longer a level of effort or skill, since they are greatly being generated behind the scenes at frontier levels, as told from someone who works with them directly

🥴🥴🥴

Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing... The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer. - TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely. - LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap. - OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for. These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure. foxio.io/blog/choose-your-ba…

Wow! Big news today! Soon Discord messages will be indexable on Google. If you're in a public Discord which is discoverable, and has not changed its privacy settings, any messages posted moving forward can be found from search engines! Hooray!!!!!1 (I think this is very bad)

Hackers absolutely compromised New Mexico hospital system. Surgeries cancelled. Ambulances diverted. Hackers demands broadcast over the sound system.

Name your favorite backdoored model. I’ll go first.

i still call this place Twitter

Another criminally underrated tweet from the Kubernoodle Wizard, himself.

People are going to lose their mind when they realize its actually easier to hack things using FEATURES not CVEs.

Hello, Little People Living Inside Of My Computer, I have made my first YouTube video. I am bonking goop (malware) with a stick. I've tried to be both technical and non-technical to appeal to all nerds. This was a lot of work. I love you. piped.video/watch?v=MqdR7eMq…

Got my @phrack Zine at @unpromptedconf ✌️

This card reveals all other cards! 🥸 Backdoors & Breaches card - The Good Stalker - Based on Mishaal Khan's #OSINT Skills Never thought I'd be on a playing card! But it happened. One more item "added" to my bucket list 📋 and checked ✅ @Antisy_Training @BHinfoSecurity

ADVANCED HACKING TECHNIQUE: I can copy a file from your computer to my computer and login to every website as you. This advanced hacking technique BYPASSES MFA. This advanced HACKING technique is alao known on the darkweb as "BROWSER COOKIES". It's so over

By stepping out of your comfort zone, sharing your progress, and building genuine connections, you open doors that resumes alone cannot. Hear more on the latest episode: piped.video/SMV-Ui9i8z0 #careeradvice #networking #cybersecurity

Not only have I been posting some BANGER tweets recently, but @_rybaz and I are so close to teaching this in a workshop and releasing this publicly

hashcat v8.0.0 released! The largest update in the history of hashcat, with PCFG attacks, hash recipes that crack hashes without a hash-mode, and bcrypt on FPGA boards. Release notes: github.com/hashcat/hashcat/b… Download: hashcat.net/hashcat/

Cool writeup. Take note, you dont need the best, most expensive models to find cool stuff.

Tailscale replied on Reddit: Hi folks, Mike Shaver here, VP of Engineering at Tailscale. We've seen the concerns about Tailscale SSH and wanted to share what we know so far. If you want to jump to the most important part, based on our current assessment, we're not recommending that everyone disable Tailscale SSH. We've now received the researcher's report and are reviewing it. Our engineering and security teams had already been investigating independently, with help from external security specialists. That work has identified issues we're working to fix. We're still validating the full scope, including which configurations are affected. A bit of technical context: Tailscale SSH uses your tailnet's access policies to control who can connect to which machines. Most of the issues we've identified so far concern what happens after someone has been authorized to connect, particularly how Unix privileges and SSH forwarding are handled. In some cases, a session may be able to do more than the configured local user should be allowed to do. While it’s a serious concern, it isn't the same as an unauthenticated attacker being able to connect to arbitrary machines, but the potential impact depends on how SSH access is configured. We're still investigating, so we don't want to make blanket claims about what's affected or not. Again, based on our current assessment, we're not recommending that everyone disable Tailscale SSH. In the meantime, there are a few precautions you can take: •Review your SSH access policies. Make sure only the people and devices that need access have it. •Review SSH forwarding permissions and remove access you don't need. •Consider enabling SSH check mode for an additional authentication step. This won't fix privilege escalation issues, but it does add another barrier to gaining access. •Enable automatic updates where supported so you can pick up fixes when they're released. For particularly sensitive systems, consider temporarily tightening your Tailscale SSH access policies while we investigate, so that only the specific users and devices that need access can connect. We're working on fixes and testing them carefully. We'll publish a security advisory explaining the confirmed findings, affected configurations, recommended actions and available patches. We'll also follow up with a more detailed technical write-up. If we find anything that changes our assessment or requires immediate customer action, we'll communicate that. We know it's been a rough week for security teams, and we understand why people are concerned. We'd rather give you the technical context we have than speculate about things we haven't confirmed yet. We'll share more as we verify the details. If you have any questions about how this relates to your particular environment, please get in touch with our team tailscale.com/contact/suppor…

Hey. I just wanted to let you know that plex2shell also came out recently. zmain.info/blog/plex2shell Good night.

Thanks to @Shammahwoods for putting this on my radar and to @AikidoSecurity / Dania Durnas for writing this up Apparently we need to look at everything using Brotli and the wide variety of patches that are now coming out, not just node.js aikido.dev/blog/python-packa…