I will be presenting at THREATCON1 in October, explaining how I figured out how a non-admin user could get code execution as SYSTEM on Windows 11 by way of playing a MIDI file. 😂 threatcon1.org/agenda

Social media user double taps image in their web browser... Twitter, Mastodon: Zoom in. BlueSky: Close image, re-open it. 🤦‍♂️

Testing multi-posting app Croissant...

To those who still have posts remaining on the Nazi site for the sole purpose of being able to search through things that you've said in the past: 1) First download an archive of your data. (There might be a 1-day delay before you get it) x.com/settings/dow...

Did everybody enjoy that video streaming marvel that was the Mike Tyson fight last night?

Did you notice that Temu dropped the bucks for *several* superbowl ads? Turns out that their Android app was utilizing an 0day exploit to achieve an advantage over their competition. Totally normal stuff going on here. arstechnica.com/information-...

Every Patch Tuesday I'm reminded that in Microsoft's world, "No thanks" means "Ask me again later".

Dear documentation authors, You... You do know that people can't click buttons on paper, right?

watchTowr: Ivanti Connect Secure CVE-2024-22024 - Are We Now Part Of Ivanti? labs.watchtowr.com/are-we-now-p...

Ivanti Connect Secure is vulnerable to xmltooling CVE-2023-36661. How was this handled? HackerOne assigned CVE-2024-21893 to capture this. Nobody knows how CVE works, and nobody enforces any rules. 🤦‍♂️ twitter.com/stephenfewer...

We all know that the Ivanti ICT cannot be trusted on a maybe-compromised device. Even the external ICT. But what about this recommended factory reset? That restores it to the state when you got it from the factory, right? Get real. Please avoid magical thinking, folks 🪄 (insert desire for GIFs here)

Got a cheap toy drone, and it has... Fake antennas! I mean, why bother?

Hey everybody there are unfixed vulnerabilities in Ivanti Connect Secure! No, not those (which are STILL unfixed). The new ones: CVE-2024-21888 (privesc to admin) and CVE-2024-21893 (SSRF to access "restricted resources") mitigation.release.20240126.5.xml forums.ivanti.com/s/article/KB...

Apparently the Intel Wi-Fi driver for Linux isn't terribly reliable. Which makes me wonder... what's the go-to Wi-Fi 6E adapter that people use in the Linux world these days? Or has the Linux world not quite embraced Wi-Fi yet, and reliable requires wired? bugzilla.kernel.org/show_bug.cgi...

I wonder why Atlassian doesn't have any security documents anymore. No? Just me?

Just 3 adjacent passengers on a Delta flight, suggests said airline.

Connect Secure customers should: "stop pushing configurations to appliances with the [workaround] XML in place... it stops some key web services from functioning, and stops the mitigation from functioning" Surely no regrets with Ivanti purchases here. forums.ivanti.com/s/article/KB...

Only today did Google Nest send me a warning that my furnace started experiencing problems on January 9. Thanks for the tip, but guess what? I started noticing that there was trouble when... the house WAS COLD! Why was this information held back for a week and a half? 🤦‍♂️

Python: If you choose to explicitly enable shell=True, it's the application's responsibility to avoid shell injection vulnerabilities. Ivanti: (Hold my beer) YOLO!!!!!!!1

Ivanti Connect Secure CVE-2023-46805: You can access resources by prefixing with any number of no-auth resources and directory traversal to where you want to go. CVE-2024-21887: Command injection with certain targets. Paying customers can mitigate the former. attackerkb.com/topics/AdUh6...

CVE wonders: Apache created CVE-2023-49070 to capture: "Our OFBiz product has Apache XML-RPC, which is vulnerable to CVE-2019-17570". This seems... wrong? If every vendor created a new CVE to capture "Hey, we use library <foo> that already has a CVE", how can this possibly scale?

So apparently starting with Linux 5.18, ASLR is weakened for 64-bit executables, and absolutely BROKEN (i.e. not present) for 32-bit executables when the library is 2MB or larger. Oops? 🤦‍♂️ zolutal.github.io/aslrnt/ (Insert desire for BlueSky to support animated GIFs here)

Let's use Ivanti VPN CVE-2024-21887 CVE-2023-46805 as an example of magical thinking. If you think your web server was compromised, would you use a remote web browser to confirm whether this is true? This is what the "external" ICT workflow does. Thoughts and prayers to customers.

I'll admit it. I'm giddy.

Well, forcing Twitter users to now invent their own headlines is going exactly as absolutely everyone could have predicted. I really wish this exodus would happen quicker than the current pace. 😕

Meanwhile on the smoldering remains of the Twitter site: Elmo finds a way to make it better for the worst people on the planet. I also love how it says "subscribed", which I'm clearly not, and have had the account blocked for years.

It's so embarrassingly weird over at that other site. My hope is that BlueSky will get to the point where it's open to the public before Twitter explodes and/or the exodus actually happens. Otherwise, it'll just be a fun little experiment.

The in-app purchases part of the Twitter app in the iOS App Store is (unintentionally?) hilarious. Sign me up?

Meanwhile on the other site that used to be called Twitter, the new logo is apparently a standard Unicode character. The effort they're putting in over there is just... Chef's kiss.

"Users want federation!" Meanwhile, on that weird Twitter alternative site... One of these is actually me. I think.