infosex.exchange <3

You are probably looking for the infosec.exchange Mastodon instance

This host is mostly for my random stuff, and in little part acts like a well-intentioned placeholder for the typosquatted domain.

Discoverability and Archiving

Currently I'm using this host for saving the items from my own feeds to the Wayback Machine and provide in-links for search engines. I hate that I have to do this, but the non-sense ideology of Mastodon pretty much ruined the search feature for Fediverse as a whole, and this wasn't changed by the fact that they owned their mistake and implemented search eventually.

Yes, I (or anyone else) could do similar things with other peoples published feeds, regardless of the tantrum. No, you can't defederate this, because the process doesn't rely on an instance.

Gluttony Section for Search Engines

Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!

https://blog.orange.tw/2024/08/confusion-attacks-en.html?m=1&s=09

Latest by Orange Tsai!
this post | permalink
A new post by #CrowdStrike refutes some claims I amplified earlier:

https://www.crowdstrike.com/blog/tech-analysis-addressing-claims-about-falcon-sensor-vulnerability/

Some notes:
- seems CS can't update through middleboxes. This is an unusual design but makes sense IMO (screw middleboxes!)
- "Before loading the channel file from disk, the Falcon sensor verifies that the file contents match the expected hash to detect any local modifications of the file." Sounds like a TOCTOU, but that's just a wild guess
this post | permalink
@risottobias ftr: https://www.crowdstrike.com/blog/tech-analysis-addressing-claims-about-falcon-sensor-vulnerability/
this post | permalink
This tabloid cover feels cyberpunk in a good way #adtech
this post | permalink
Fresh root cause analysis by #CrowdStrike

https://www.crowdstrike.com/wp-content/uploads/2024/08/Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf
this post | permalink
@risottobias I'm not saying revocation/key mgmt is useless, just that it's not relevant in this case as it seems there are no keys to manage
this post | permalink
@risottobias if I interpret the translation correctly there is no need for revocation as there are no sigs :) *roll smart*
this post | permalink
@risottobias Im not familiar with TUF. Here the key would be to verify the authenticity of (bytecode)updates since you have to expect middleboxes in the network path that you shouldn't trust.
this post | permalink
@Viss "now you can convert your web proxy to a multi-target remote kernel debugger"
this post | permalink
Alt:

Therefore, after in-depth analysis, we found that the conditions for LPE or RCE vulnerabilities are actually met here.


(1) The source of its input content is the `C-00000291-00000000-00000009.sys` file, and there is no signature mechanism;

(2) `CrowdStrike` lacks a self-protection mechanism and can read and write the `C-00000291-00000000-00000009.sys` file at will;

(3) `C-00000291-00000000-00000009.sys` itself is directly downloaded from the Internet by `CSAgent.sys`;

(4) `CSAgent.sys` supports reading the proxy from IE AutoProxy out of the network.
this post | permalink
Next Page