Dr. Christopher Kunz

Security (web, infra, app) nerd, has accepted that VR will never be a mass market, writer @heise Security 
All toots are IMHO & not my employer's opinion.
PGP fingerprint: C882 8ED1 7DD1 9011 C088 EA50 5CFA 2EEB 397A CAC1

where I work: heise Security
Linktr.ee: https://linktr.ee/christopher.kunz
private blog: https://www.christopher-kunz.de/
heise.de: https://www.heise.de/autor/Dr-Christopher-Kunz-4325470

Public Key

npub1sttn3l2n40lkk5eyt2czgeqnsct9ql6ltau6nmcqq4s8422ahcjqkjddpm

NIP-05 Address

christopherkunz_at_chaos.social@momostr.pink

Profile Code

nprofile1qqsg94ecl4f6hlmt2vj94vpyvsfcv9js0a0477dfauqq2cr649wmufqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsplt2a3

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1sttn3l2n40lkk5eyt2czgeqnsct9ql6ltau6nmcqq4s8422ahcjqkjddpm

Show more details

Last Notes

2026-07-01 12:50:53 UTC

Die Innenministerkonferenz will Indymedia komplett verbieten.
Weil wir als Gesellschaft derzeit keine drängenderen Extremismus-Probleme haben.
In 85 Seiten der Beschlusssammlung wird kein einziges Mal das Wort "rechtsextrem" erwähnt.
Die haben im wahrsten Sinne des Wortes die Schüsse nicht gehört. https://www.innenministerkonferenz.de/IMK/DE/termine/to-beschluesse/2026-06-19_DOK/Freie_Beschl%C3%BCsse.pdf?__blob=publicationFile&v=1

2026-06-04 14:33:11 UTC

- reply

Of all the writeups, I think I like this one best, especially with it having a human name in the byline: https://adscanpro.com/blog/patch-diffing-cve-2026-41089-netlogon
"read advisories carefully before deciding how to allocate research time." made me chuckle.

2026-06-04 12:47:09 UTC

- reply

From what I read in the writeup (and the sparse other sources), you need a long enough DNS name on the victim host to trigger the overflow. I think 54 chars or more? This github has a possible explanation why the PoC fails under most normal conditions: https://github.com/ADScanPro/CVE-2026-41089-LongLogon

2026-06-01 18:53:41 UTC

So CVE-2026-41089 (CVSS 9.8) in Windows Netlogon can be triggered by sending a username that is AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA or longer.
How original.

2026-05-15 08:34:54 UTC

Obligatory ping for @npub1z3m…zn2f ssh-keysign-pwn might belong in vulnerability.garden, I guess. Although it doesn't have a logo yet.
https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn/tree/main

2026-05-13 13:57:50 UTC

@npub1z3m…zn2f Time to add Fragnesia to vulnerability.garden? https://www.wiz.io/blog/fragnesia-linux-kernel-local-privilege-escalation-via-esp-in-tcp
Or are we just giving this vuln class a blanket name like "the copyfail zoo"?

2026-03-24 07:49:07 UTC

Aus gegebenem Anlass: Die Älteren unter Euch erinnern sich sicher noch an die Zulassungspflicht für Telekommunikationsgeräte in Deutschland. Nicht von der Post (genauer: dem BZT) zugelassene Modems waren ganz, ganz schlimm verboten.
In meinem Kopfkanon ist das Pesthörnchen des @npub15qj…3kl0 ein Resultat dieser Zulassungspflicht (weiß nicht, ob @npub1yny…pn2p das kanonisieren kann).
Turns out: Geschichte wiederholt sich. Demnächst fahren also FCC-Wagen durch die Städte und kontrollieren auf Fremdrouter.
https://assets.chaos.social/media_attachments/files/116/283/043/417/074/373/original/83992e74b7edff3a.png

2026-03-24 07:44:59 UTC

- reply

Ich freue mich schon auf die Fotos aus dem Best Buy in ein paar Wochen. Vielleicht machen die es ja wie Media Markt hierzulande und füllen leere Regale einfach mit Lego auf. Ach nee, das ist ja auch aus dem Ausland...

2026-03-24 07:06:42 UTC

- reply

Manche Menschen möchten einfach nur die Welt brennen sehen.

2026-03-24 07:03:43 UTC

- reply

Acht Uhr und ich habe schon keinen Bock mehr.

2026-03-24 07:03:10 UTC

> Nachts um drei in den USA
> ICE steht vor der Tür
> Ausländische Freundin und Kind im Hinterhaus versteckt
> Testament unterschrieben
> Burner Phone in Plastikbeutel geschluckt
> Guten Tag, uns wurde ein ausländischer Router gemeldet.

2026-03-23 15:25:07 UTC

OK, I said it first: CitrixBleed3 incoming. @npub1lcc…lcye

2026-03-20 13:53:15 UTC

CVE-2026-20963 Sharepoint Insecure Deserialization 8.8/10
Weekend soon. Where @npub13vn…f849 blog? Need lolz. I can has?

2026-03-09 06:30:54 UTC

- reply

„mit Datenverarbeitung in Europa“ ist wie „mit natürlichen Zutaten“ bei einer Knorr-Tütensuppe. tEcHnIcAlLy cOrReCt, bringt nur nix.

2026-03-03 10:38:50 UTC

Interesting to see how S&D (Socialists & Democrats) in the EU Parliament seems to have no qualms at all voting alongside the moderate and extreme Right as long as it is for upholding chat control.
Didn't work though.
https://assets.chaos.social/media_attachments/files/116/164/803/231/730/680/original/3b49abdc94b93f5c.png

2026-02-11 13:24:58 UTC

So #OpenAI wants to introduce an "adult mode" to ChatGPT so people who are fed up with the boring AI porn over at Grok have more choice.
And their product policy team pushed back, citing that this would likely be detrimental to users' well-being.
Being the balanced, well-hinged company they are, OpenAI then proceed to fire the head of said product team, citing sexual discrimination against a male colleague. And proceeds to tout "adult mode".
Whew.

2026-01-13 12:31:47 UTC

I'm looking for someone who has received one of the ominous unsolicited Instagram password reset e-mails around December 30, last year (or later). I'd like to cross-check their Instagram data with the recent "leak". Appreciate a boost!

2026-01-09 13:46:51 UTC

- reply

I would never in a thousand years recommend to use Telegram, I'm on there anyway. The easiest way to follow vx is likely to use xcancel: https://xcancel.com/vxunderground

2026-01-09 13:41:16 UTC

- reply

The very same. Their last toot is from 2022, while their last Telegram post is from *checks notes* 9:37 today.
I'm not sure why, but being on the Fediverse just doesn't seem to be in the cards for them.

2026-01-09 13:30:56 UTC

- reply

Ich wünschte, ich könnte da mal einen Blick 'reinwerfen. Ich habe vor Monaten 10 Exemplare (Friends&Family) beim @npub1rr4…mqdy bestellt und nie erhalten.

2026-01-09 07:52:27 UTC

Sorry, this could not wait until next #diday - I just deactivated my X account. The recent shitshow around Grok creating deepfake thirst traps is just too appalling.
Also, I found out that vxunderground, literally my last reason to keep my X account alive, is now on Telegram, so that's that. Let that sink in: I'd rather be on Telegram than on X at this point.
Anyhow, my account which has been around since sometime in the late 2000s is now gone.
https://assets.chaos.social/media_attachments/files/115/864/052/925/005/006/original/5aa89ec515c42fb9.png

2025-12-25 17:14:38 UTC

- reply

Youtube did the right thing and resolved my complaint within a few hours. And they decided that the clearly fraudulent ad is... not fraudulent.
Way to go, Youtube. Way to go.
It's a little bit ironic that this ad got shown to me while watching @npub1fdr…lvhs on the Daily Show, in anticipation of meeting him on #39C3.
https://assets.chaos.social/media_attachments/files/115/781/323/210/095/592/original/eff8991df8b6f678.png

2025-12-25 10:03:40 UTC

Merry christmas everyone. A word of warning: I just encountered this scam ad on YT - don't let scammers get the better of you during these holidays. There's obviously no way in hell that a 16TB usb drive is sold for this price.
https://assets.chaos.social/media_attachments/files/115/779/631/911/024/142/original/c9998b54d40e0908.png
https://assets.chaos.social/media_attachments/files/115/779/631/913/508/716/original/d4f2f48374161bca.png
https://assets.chaos.social/media_attachments/files/115/779/631/928/171/194/original/ff82cfc03b38abf0.png
https://assets.chaos.social/media_attachments/files/115/779/634/175/396/772/original/37c133f772c4b821.png

2025-12-19 14:54:55 UTC

RE: https://cyberplace.social/@GossiTheDog/115745701289876342
> - HPE added a REST command, executeCommand, which requires no authentication to execute commands. Obviously, this is dumb and now patched out
Wait. What?
#note1k85…suvp

2025-12-15 13:17:48 UTC

- reply

RE: https://mastodon.gamedev.place/@danielalbu/115723469299750446
The sound effects still live rent free in my head after 34 years.
#note1gx7…pfv4

2025-12-08 15:34:34 UTC

- reply

...and don't get me started about the existence of a security.txt.

2025-12-04 14:12:47 UTC

The headline "'End-To-End Encrypted' Smart Toilet Camera Is Not Actually End-To-End Encrypted" was not on my 2025 bingo card. Or any previous one.

2025-11-27 07:22:14 UTC

- reply

Dreamweaver was a pile of odorous excrement, change my mind.
Team HomeSite all the way.

2025-11-26 08:29:13 UTC

Sha1-Hulud has a dead man's switch
The second iteration of the Shai-Hulud worm had a dead man's switch that destroys data on infected machines.
If it can't reach Github or npm to self-propagate, the worm spawns a cmd.exe / bash shell and tries to delete all data that can be written by the current user. Yikes.
It seems sha1-hulud is now contained though: Only about 300 infected repos are left.
https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/
https://assets.chaos.social/media_attachments/files/115/615/047/785/265/668/original/f5e0154ae9ae3eac.png

2025-11-21 06:35:27 UTC

BINGO TIME! With CVE-2025-58034, Fortinet secures the crown in my Insecurity Appliance Bingo. This is technically a "high" severity vuln, but since it's being actively exploited and has landed a spot on CISA KEV, I'm admitting it.
https://cku.gt/appbingo25
Reaching a bingo took longer than expected, with FortiNet and Ivanti sitting at 5/6 vulns since about July. But now, there is a well-deserved winner.
I'm now taking new vuln class and vendor suggestions for next year's edition.
https://assets.chaos.social/media_attachments/files/115/586/296/566/691/683/original/c376c999596e738b.png

2025-11-20 15:35:21 UTC

Let me get this straight. If I want to report a currently active malware dropper domain to Cloudflare, they make forwarding my report (including my name and e-mail address) to the likely culprit _mandatory_?
This seems wrong. [@cloudflare](https://cloudflare.social/@cloudflare ) ?
https://assets.chaos.social/media_attachments/files/115/582/757/506/406/877/original/da0a001d0517a722.png

2025-11-13 08:16:13 UTC

- reply

It's amazing to me how many of these screen shots are of an open root shell where multiple skids unsuccessfully tried to install a rootkit.

2025-11-13 07:47:17 UTC

- reply

Deck at around the same time.
I had a hard time playing games in VR because they were extremely exhausting for me - due to immersion and the more immediate sensations. I'm no longer convinced that VR is capable of becoming a mass, mainstream market at all.
That being said, if anyone is able to make it work, it's probably Valve, if they are able to repeat the success formula of the Steam Deck.
Do you have a link to the discussion?
2/2

2025-11-13 07:45:24 UTC

- reply

I considered myself to be an early adopter of VR, used a Virtuality headset in ~1996, always dreamed of a Forte VFX1, had Oculus DK2, PSVR1, Quest1-3. I gave the whole VR thing so many tries, but it always felt lackluster.
On the Quest, the ecosystem felt neglected pretty much from the get go: Obviously fake app reviews, terrible lobbies in multiplayer, not-so-great update politics, etc. - after Zuckerberg pitched the whole Metaverse idea, I bailed. Incidentally, I sold my Steam 1/2

2025-11-10 08:23:49 UTC

Fediverse! Which password manager do you recommend to your parents, grandparents, kids, grandkids, those people from your sports club who come to you for computer help?
Please comment for additional options, I can only fit four options here.
I'd love a boost for this, it's for a talk I'll give in a week at the heise HQ in Hanover, Germany.

2025-11-07 10:52:08 UTC

- reply

always writes stellar articles. I absolutely adored his explainer about the "Chinese have quantum broken RSA" hype a few months ago: https://cku.gt/quantumhype

2025-11-06 09:39:04 UTC

Does anyone have an idea if the number "236787" is a significant number in any context, significant enough to be used as a device or login PIN? I'm a little stumped.
It's not a birthday, not a geometric number, doesn't seem to be a significant swipe pattern.
Any ideas, Fediverse?

2025-11-04 16:48:11 UTC

- reply

Lots of German ASes in that list. 1337 services runs "rdp.sh", a vps provider. the others seem to be mostly vps hosters, too.

2025-10-15 09:17:39 UTC

Do I know anyone from the @npub12us…h86y team who could answer a specific question for our newsroom?

2025-10-13 08:21:43 UTC

This looks like excellent value for the money. The Humble Bundle Cybersecurity Month features 24 O'Reilly books on various security topics: https://www.humblebundle.com/books/cybersecurity-month-oreilly-books

2025-10-07 10:24:16 UTC

Wem gehört denn chat-kontrolle.eu [@echo_pbreyer](https://digitalcourage.social/@echo_pbreyer ) @npub1t3g…qqds?
Bei Strato brennt gerade ein bisschen der Webserver, auf dem die Domain liegt, fürchte ich: Bekam gerade "502 Proxy Error" beim Aufruf.

2025-10-07 10:14:08 UTC

- reply

The timeline checks out: The exploit was posted on TG on October 3, early afternoon. It was also first uploaded to VT on October 3. After Oracle woke up to the news on October 4, they quickly assessed the damage and pivoted their narrative to "discovered during our investigation". aka "downloaded from telegram".
This fits a repetitive pattern of what I would diplomatically call "unethical disclosure practice". If you update your publications, AT LEAST mark the edits.
2/2

2025-10-07 10:08:29 UTC

- reply

I cannot stress enough how deceptive this tactic is.
First, Oracle gaslight their own customers into "if something happens, it's because you haven't patched". Then, after downloading a zero-day off Telegram finding out that they have been pwned by Scattered Lapsus$ Hunters, they quitely edit out the previous content.
And this is not some anonymous marketing writer, but the Chief Security Officer for one of the biggest corporations on the globe.
1/2

2025-10-07 07:57:45 UTC

TIL: The Cl0p ransomware group has been named "Graceful Spider" by CrowdStrike. What the actual f is that? There's nothing graceful about extortion. Nothing.
This is purely a marketing device for companies, and ultimately a transparent sales tactic.
If you want to see if companies take actual security seriously, look at small things like this. There is zero necessity for these individual TA names, on the contrary: They increase confusion by conflating clearly distinct profiles.

2025-10-06 13:48:30 UTC

The "ls -laR" of the Red Hat data breach by Scattered Lapsus$ Hunters is, put into a text file, 2.2 GB. That's a heck of a breach.

2025-10-06 12:12:26 UTC

- reply

They replaced the whole blog post and somehow purged copies from WBM. However, they forgot to change the SEO URL which still hints at their original narrative: "Apply July 2025 CPU".
Cl0p had it, SLSH has it, and if the indicators on the exp aren't faked, they have had it since May or so. And now, everyone has it, I expect it to make CISA KEV by tomorrow.

2025-10-02 06:51:51 UTC

This is Jamal Kashoggi. Seven years ago today, he entered the embassy of Saudi-Arabia in Istanbul and never came back. The people who ordered his assassination have never faced justice.
https://assets.chaos.social/media_attachments/files/115/303/188/214/700/718/original/ac6f00b721550694.png

2025-09-30 07:31:40 UTC

- reply

Yeah, good point. findmystreet.co.uk is still down too, hdsc.org.uk seems down, Harwich Town Council is the wrong site (org vs. co).

2025-09-30 07:27:00 UTC

- reply

The attacks ran a couple minutes ago, the check-host.net on Noname's TG are from around 7:00 am UTC. Most of the attacks are likely over already.

2025-09-26 13:37:17 UTC

- reply

And then there's this, too. Shareholders don't give a damn if your products take down whole airports.
https://assets.chaos.social/media_attachments/files/115/270/866/339/672/507/original/9be2db86cb9cc564.png

2025-09-24 07:43:15 UTC

- reply

Ta to Tata, I guess.

2025-09-23 08:37:49 UTC

- reply

This media isn't bored but there's just not enough for updated reports. Last I heard was that ENISA claimed ransomware, ShinyHunters got strangely quiet on the record when questioned by @npub17l5…4kr3 so maybe there's something interesting there. For me there's just not enough substance right now to report anything.

2025-09-16 14:12:48 UTC

- reply

Ha, I was faster! ;-) https://www.heise.de/news/Neuer-NPM-Grossangriff-Selbst-vermehrende-Malware-infiziert-Dutzende-Pakete-10651111.html
Very interested in seeing how this one will play out during the night.

2025-09-15 14:25:12 UTC

- reply

They can just keep leadership by derailing everyone else. CVE tariffs, maybe? ;-)
Jokes aside, that "CVE vision" PDF makes some quite sound points, and I like the overall tone of commitment - including a commitment to transparency, with CISA leading by example (their words, not mine). In this day and age, that sounds almost sane.
We'll see how much of that will survive the next CVE funding lapse.

2025-09-15 13:50:48 UTC

- reply

Reading their statement, this really reads like a boilerplate phrase that uses so many words for "we're not going to do anything to diversify the stakeholder landscape". The whole first page talks about how CVE is "CISA's thing" and that they claim ownership for the program, and then there's a lukewarm phrase à la "Yeah, we'll definitely circle back to this, but don't call us. We'll call you!"
I'm more concerned about the very clear "everyone: hands off CVE" undertone.

2025-09-15 12:39:37 UTC

- reply

They are looking at "potential mechanisms for diversified funding", that does not mean CVE will disappear from CISA's budget.
The document makes it very clear that CISA rejects privatization of the program and that they think that CVE is their mandate: "These conflicts of interest reinforce the need for CISA to
take a more active role in the long-term stewardship of the CVE Program. At CISA, we have the appropriate mandate [..]"

2025-09-09 08:49:11 UTC

- reply

Nope. Auch keine Mail bekommen.

2025-09-01 09:15:07 UTC

- reply

Do you have any indication that this outage also affects non-UK Colt customers?

2025-08-21 08:07:57 UTC

The Wero app seems to crash on ios26beta (10s yellow blank screen, then crash back to springboard). I tried to contact the development team via the e-mail address in the Appstore entry:
appstore@wero-wallet.eu
I was informed by two separate auto-reply e-mails in four different language that this e-mail address is not monitored and that it's a no-reply address.
Support questions should be asked exclusively via the in-app chat.
No punchline.

2025-08-13 08:11:34 UTC

Did anyone write a guide yet how to make self-hosted Ghost instances less dependent on external resources? This includes Stripe payment, the Mailgun requirement, but also external JS dependancies like JSdelivr etc.
Seems that even a fully self-hosted Ghost is still extremely entangled with cloud services that I certainly *don't* want to be entangled with.

2025-07-11 06:51:53 UTC

There's a lot of beauty in this VNC screenshot by @npub1q6h…zv6u
The longer I look, the more details I see, it's a little like a "Where's Waldo" picture.
https://assets.chaos.social/media_attachments/files/114/833/274/073/216/271/original/fee5c4bbbb069360.png

2025-06-26 14:14:46 UTC

- reply

I'm so sorry! Gave a little something and I hope your brother is able to meet his goal. This sucks on so many levels I cannot even begin to express it.

2025-06-20 14:35:37 UTC

16 Milliarden Datensätze in neuem Mega-Leak!!einseinself
Ja nee. Nicht so ganz. Weder ist das Leak wirklich neu (es handelt sich um Stealer-Logs, also von Malware auf clients abgegriffene Daten), noch ist der Umfang jetzt irgendwie großartig beeindruckend.
Ich habe das zusammen mit meinem Kollegen aufgeschrieben: https://heise.de/-10453723
Ein bißchen Zusatzrecherche und Datenauswertung habe ich auf Reddit gekippt: https://www.reddit.com/r/de_EDV/comments/1lg0j3f/infostealerpasswortlisten_von_innen_be%C3%A4ugt/

2025-06-16 12:57:24 UTC

- reply

well, then it's settled.

2025-06-10 08:53:10 UTC

Soooo... which Lemmy server should one join as a security interested person?

2025-05-13 06:56:08 UTC

CISA is changing the way they publizice alerts, including the KEV (known exploited vulnerabilities). These will no longer be shown on the "Alerts" overview, but must be subscribed to via GovAlert (or just scrape the JSON...).
The first vulnerability that is *not* being published as an alert is...drumroll... CVE-2025-47729. "The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL app users"
Isn't that a funny coincidence?

2025-04-15 12:25:06 UTC

- reply

phpMyAdmin still exists? Jeez, still looks like in 2002, too.

2025-04-07 13:24:41 UTC

- reply

Several second lag, 200p resolution, sounds a lot like my first experience playing Quake2 on a sorely underpowered PC at original release. "Practically unplayable" checks out, too.
So are we now officially in 1997 again?

2025-04-02 07:33:38 UTC

- reply

Total radio silence so far, no statement - not even acknowledgement of my request for comment.

2025-03-31 12:57:24 UTC

- reply

Something smells weird. Can I email you about that OCI thing?

2025-03-31 12:05:03 UTC

- reply

Ah right, then there's an extra space in that link on medium. The video id reads "375_G9wAff+o" there. Thanks!

2025-03-31 12:01:27 UTC

- reply

Interesting. There's however an extra space in the Youtube link in this sentence: "The meeting is viewable here and the transcript is "

2025-03-31 08:53:25 UTC

First day after a one week holiday and boy, seems to have been an interesting week. Amongst other things, there is now what seems to be a malware that installs a persistent backdoor in Ivanti Connect Secure, as per a CISA warning. The backdoor is injected
This means I get to update my insecurity appliance bingo and we're almost there. Just one critical "Auth Bypass" vulnerability away from the first bingo of the year. The bingo sheet lives at: https://cku.gt/appbingo25
https://assets.chaos.social/media_attachments/files/114/256/179/136/901/102/original/d43caed8c13d8b71.png

2025-03-18 16:26:08 UTC

- reply

I was wondering, actually. Where does it say that?
Side note: I have personally seen large ISO27001-certified orgs use this exact method to e-mail sensitive info. It's security theater and checkbox compliance, mimics the practices of credit card companies, mailing cards and PINs separately. However, real-life analogies rarely work, and vice versa. If an adversary has capabilities to exfil _one_ e-mail, they could exfil _all_ e-mails.

2025-03-05 12:05:05 UTC

I kinda love the edit history on the US DOD's statement about the purported stand-down order.
"There has been no stand-down order whatsoever from that priority, said the official who was granted anonymity to discuss internal decisions." @npub168d…tu7v
https://assets.chaos.social/media_attachments/files/114/109/729/615/373/758/original/d9069a6361ce57de.png

2025-03-04 17:07:03 UTC

- reply

A couple of hours or day after publication maybe, my screenshot is from november 27.

2025-03-04 15:55:53 UTC

- reply

This is a screenshot of the first snapshot for the CVE-2024-49035 advisory on MSRC. MS knew about exploitation from the get-go. Not sure why CISA is picking this up only now, being long patched and whatnot.
https://assets.chaos.social/media_attachments/files/114/104/970/757/335/660/original/b059bea81a928fe3.png

2025-02-13 14:58:53 UTC

@npub1fh7…ee83 wird von anonymen Störenfrieden angegriffen. Dazu habe ich eine Meldung geschrieben. https://heise.de/-10281324

2025-01-28 09:19:09 UTC

My personal advice for Data Privacy Day: Get all your data out of Big Tech platforms as quickly as possible. Do not feed them new data. They are not your friends or allies.
(Edit to add:) If you can't get your data out due to lock-in, at least get a full backup and keep it current. Always be prepared to be locked out, secure alternate means of communication etc.

2025-01-26 08:35:37 UTC

Sooooo... what is everyone thinking about Flohmarkt ? https://codeberg.org/flohmarkt/flohmarkt/
The notion of a federated, decentralized flea market / classifieds / Craigslist type network seems quite appealing to me, but maybe I'm being naive?
(PS: "Flohmarkt" is the German word for flea market, of course.)

2025-01-23 14:57:35 UTC

...and here we go: Next entry in our bingo card is CVE-2025-23006 in SonicWall SMA1000.
Thanks, everyone, and remember: Current version lives at https://cku.gt/appbingo25
https://assets.chaos.social/media_attachments/files/113/878/252/193/977/476/original/059ddd8851a43ab0.png

2025-01-23 08:01:09 UTC

- reply

As to be expected, that's from the Qu'ran. Sure al-Anbiya, verse 11-12

2025-01-21 10:09:51 UTC

- reply

How are we explaining the ADL's reaction in this thought construct?

2025-01-18 12:24:28 UTC

- reply

loads of privkeys in the Fortinet leak, from SSH to what appears to be web certs.

2025-01-18 10:42:11 UTC

- reply

I realized I could just have read the blog instead of asking a lazy question here 😅

2025-01-16 15:08:07 UTC

- reply

I read half a VPN password aloud to a victim on the phone, they completed the other half. They're *definitely* legit. They also seem to be mostly cleartext, even those not looking like cleartext?

2025-01-16 13:33:38 UTC

- reply

figures. I'll update my news item later if I get the chance. Why a cable customer in Medellin is running pre-release software is another question though... which I'm not going to ask, given the geographic circumstances. ;-)

2025-01-16 12:54:06 UTC

- reply

Yes. It's either a pre-release build or the machine was owned before 7.2.2 was installed. The backdoor user exists in the config, so both could be possible.

2025-01-16 07:13:57 UTC

@npub1vwk…7k3l @npub1lcc…lcye RE #FortiGate leak: I have found the version string "FWF61E-7.2.2-FW-build1327-220914" on one FortiWifi config from Colombia. I'm not sure which build date the first final version had but maybe a pre-release version?

2025-01-15 07:52:04 UTC

Anyway, here we go. Latest version of the 2025 (in)security appliance bingo adds CVE-2024-55591 / FG-IR-24-535 to the list. Thanks to watchTowr for reporting it, and thanks to @npub1x4l…tlqs @npub1vez…pzyc and @npub19a2…kmez for alerting me to it. https://cku.gt/appbingo25
https://assets.chaos.social/media_attachments/files/113/831/277/996/641/681/original/9ab3031b3a3454b4.png

2025-01-09 14:28:39 UTC

OK, I fleshed this out a little more. You can find the (In)Security Appliance Bingo 2025 in proper, two-dimensional form here:
https://cku.gt/appbingo25
Suggestions and submissions very welcome.
https://assets.chaos.social/media_attachments/files/113/798/864/093/049/152/original/1277f62ad9a51570.png

2024-11-06 20:29:40 UTC

- reply

It's only 9:30 pm, and the US wednesday is still mighty young. Let's not...

2024-11-06 20:22:18 UTC

Yeah, sure, why not dismantle the German Federal government, too. We haven't used up our daily contingent of push notifications yet.
As in: The German Chancellor has apparently asked the Federal President to fire the Minister of Finance, Mr. Lindner (Liberals). This means that the coalition of Greens, Liberals and Social Democrats is effectively over.