infosex.exchange <3

You are probably looking for the infosec.exchange Mastodon instance

This host is mostly for my random stuff, and in little part acts like a well-intentioned placeholder for the typosquatted domain.

Discoverability and Archiving

Currently I'm using this host for saving the items from my own feeds to the Wayback Machine and provide in-links for search engines. I hate that I have to do this, but the non-sense ideology of Mastodon pretty much ruined the search feature for Fediverse as a whole, and this wasn't changed by the fact that they owned their mistake and implemented search eventually.

Yes, I (or anyone else) could do similar things with other peoples published feeds, regardless of the tantrum. No, you can't defederate this, because the process doesn't rely on an instance.

Gluttony Section for Search Engines

Today I realized our national postal service uses a *lot* of printers at customer desks. Maintaining those and the software that use them must be The IT Hell.
this post | permalink
[RSS] CVE-2024-21111 – Local Privilege Escalation in Oracle VirtualBox

https://www.mdsec.co.uk/2024/04/cve-2024-21111-local-privilege-escalation-in-oracle-virtualbox/
this post | permalink
[RSS] Micropatches Released for Windows Workstation and Server Service Elevation of Privilege Vulnerability (CVE-2022-38034, CVE-2022-38045, No CVE)

https://blog.0patch.com/2024/04/micropatches-released-for-windows.html
this post | permalink
[RSS] An Analysis of the DHEat DoS Against SSH in Cloud Environments

https://www.positronsecurity.com/blog/2024-04-23-an-analysis-of-dheat-dos-against-ssh-in-cloud-environments/
this post | permalink
Memory disclosure bugs rock :)
this post | permalink
@verovaleros @eldraco Interesting! I found that on desktop HTTP is often employed so TLS errors won't block updates (and traffic is often MitM'd anyway by perimeter security) and you can check file signatures (which eScan apprently didn't). I don't know much about MDM but this looks like a less reasonable choice on mobile.
this post | permalink
Cisco @TalosSecurity analysis about the apparent ASA 0-days:

https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

Note that while the vendor identified two vulnerabilities (CVE-2024-20353, CVE-2024-20359) these are related to post-exploitation, the initial access vector is still unknown.
this post | permalink
@singe Thanks, maybe my DNS messed with me!
this post | permalink
Umm, could someone ping Horizon3 to fix this link?

https://go.horizon3.ai/l/971073/2024-04-24/36qj4/971073/1713970076IfZta1Or/Whitepaper_SupplyChain.pdf
this post | permalink
@verovaleros @civilsphere @stratosphere Do you have a link to share about this research? @arstechnica
this post | permalink
Next Page