October 19, 2022

the grugq

Oct 19, 2022

Russia is losing to comedians.

Melissa Chan @melissakchan

🚨 BREAKING (AFP): German cybersecurity chief sacked over alleged Russia ties: interior ministry.

(The Russian ties of the German cybersecurity chief were exposed by a comedian)

China Recruiting Former R.A.F. Pilots to Train Its Army Pilots, U.K. Says

Citing national security, Britain wants to stop its retired military pilots from accepting lucrative contracts to train members of the People’s Liberation Army

https://www.nytimes.com/2022/10/17/world/europe/china-recruit-uk-military-pilots.html

Seems pretty reasonable to me. If you won’t let the Chinese sell telco equipment to your country, maybe don’t let your retired military specialists train China’s Air Force. ¯\_(ツ)_/¯

Ministry of Defence Press Office @DefenceHQPress

When former UK military pilots provide training to the People’s Liberation Army of China it clearly erodes the UK’s defence advantage. We are taking immediate steps to deter and penalise this activity:

Propagandopolis @propagandopolis

American ad issued by the Freedoms Foundation (1961) showing a father apologising to his son for his complacency during the rise of communism.

weird medieval guys @WeirdMedieval

thread of medieval jokes that still kinda go hard:

weird medieval guys @WeirdMedieval

image text:

I knew an old Bishop who had lost some of his teeth, and complained of others being so loose that he was afraid they would soon fall out. “Never fear,” said one of his friends, “they won’t fall.” “And why not?” enquired the Bishop. His friend replied, “Because my testicles have been hanging loose for the last forty years, as if they were going to fall off, and yet, there they are still.”

Synacktiv @Synacktiv

Ever wanted to exploit a PHP file inclusion without having a file upload? Follow @_remsio_'s journey to discover PHP filter chains, ensuring they work properly, and transforming them into a tool. You can now convert almost any file inclusion to RCE!

synacktiv.comPHP filters chain: What is it and how to use itSearching for new gadget chains to exploit deserialization vulnerabilities can be tedious.

Massimo @Rainmaker1973

Scientists found that only some bees can figure out how to do this on their own. But 60% of inexperienced bees watching this, learned the new skill [read more: buff.ly/2XGvsFZ]

Clint Ehrlich @ClintEhrlich

German security forces claim to have disrupted a cell of Prussian monarchists. They accuse the cell of plotting to overthrow Democray and restore the Kaiser.

msn.com‘Terror granny’ accused of ‘plotting German civil war to bring back the Kaiser’‘Terror granny’ accused of ‘plotting German civil war to bring back the Kaiser’

Eduard Habsburg @EduardHabsburg

@ClintEhrlich ...must...resist...urge...to....answer.....

Abdulrhman Alqabandi @Qab

Check out the latest EdgeVR guest blogpost where @david_erceg shares a number of his findings + methodology

microsoftedge.github.ioGuest Blog Post - Memory corruption vulnerabilities in EdgeIntroduction

Marcus Hutchins @MalwareTechBlog

Can't wait for the "hackers stole my house" era of cyber security 🙃

unusual_whales @unusual_whales

This house sold as a real word NFT for $175,000 over the weekend. The way it works: - The LLC takes ownership of the property - They tokenize the property & mint an NFT that represents ownership of the house - Holding the NFT gives you ownership of the actual house https://t.co/fuUl3oGCHx

Vylegzhanin Daniil @jfmeee

Published a blogpost about using APC-based change memory protection primitive.

blog.offensive.afChanging memory protection using APCProcess injection is an important part of Windows offensive tradecraft. The strategy is defined by combining various primitives - memory allocation, write, execute, etc. One of the primitives is changing memory protection - for example from PAGE_READ...

0xor0ne @0xor0ne

"GLIBC heap exploitation techniques" Great writeup by @0xricksanchez buff.ly/3C3sCAz #glibc #libc #exploit #heap #informationsecurity #hacking #cybersecurity

Catalin Cimpanu @campuscodi

Security researcher Orange Tsai published today details on ProxyRelay, the fourth major vulnerability he found in Exchange servers. Previous include: -ProxyLogon -ProxyOracle -ProxyShell Blog: devco.re/blog/2022/10/1… Demo here:

youtube.comProxyRelay - A New Attack Surface on Microsoft Exchange Server!

Kevin Beaumont @GossiTheDog

Also I’ve seen people get very excited about this. The first patch for this was over 6 months ago. I wouldn’t worry about this one. More be concerned that there’s still two unpatched zero days in #ProxyNotShell, and the MS URL rewrites are easily bypassable.

Hex-rays has been acquired. Seems like they’re going to invest in something, which is sort of strange since in 2020 they had 18m euro profit on 20m euro revenue. Seems like they could easily afford to invest in whatever to grow the business. But my confusion is exactly why this is not a business newsletter!

https://smartfinvc.com/news/smartfin-acquires-leading-cybersecurity-software-provider-hex-rays-together-with-sfpim-and-sriw/