Skip Navigation

Treasure

@ treasure @feddit.org

Posts
2
Comments
14
Joined
1 yr. ago

  • Are these two rar files malware? (virustotal results)

    Jump

  • TLDR: I can't say for 100% sure, but there are multiple reasons to believe that this is malware.

    Long version: I'm seeing multiple suspicious things here.

    • The IPs being connected to are part of some hoster and have some abuse reports: https://www.abuseipdb.com/check-block/217.20.58.98/29
    • The domain being resolved is qcloud[.]com, which belongs to Tencent Cloud and definitely not Microsoft.
    • Other domains in memory like counter-strike[.]com[.]ua are very new and definitely sound fishy.
    • A standalone version of 7zip is being run and extracts the created rar file with the password "infected". Real alarm bells here.
    • A lot of the registry actions look like anti-debugging, which does not sound like something an Illustrator Plugin would do.

  • Discover Hidden Gems: Open-Source Software You Should Know About

    Jump

  • Sure thing, the reasons that are most important for me personally are better multi-attach, easier splitting and resize, better plugin ecosystem and it being more modern and actively maintained in general.

  • Discover Hidden Gems: Open-Source Software You Should Know About

    Jump

  • I much prefer tmux over screen.

  • Massive data backup question: What Linux software do you folks recommend for helping sort out and organize terabytes of files and remove duplicates?

    Jump

  • Take a look into borg backup.

  • The Privacy Iceberg

    Jump

  • Whats your story on accounts/data cleansing?

    Jump

  • Usually I just send an email template asking them to delete my data per the GDPR (I'm an EU citizen). I'm not sure if you can force them to delete anything if they don't have to by law, but I guess asking is free.

  • Whats your story on accounts/data cleansing?

    Jump

  • I went through some old accounts when I migrated from KeePass to Vaultwarden. From start to finish, it roughly took five weeks for all 25 inquiries to be completed. I check on my accounts every few moons.

    Giving a ballpark estimate, 30% of services offer a (semi-) automated delete function in the account setting, 60% comply to emails within a few days and 10% are absolute pains.

    RANT INTERMISSION

    One of those 10% is Twilio (This expressly doesn't apply if you only use Authy, their 2FA service). They don't have an automated delete possibility, which is already a huge ick for a company of their size. But it got infinitely worse.

    THEY DON'T LET YOU CREATE TICKETS WHEN YOU'RE A FREE CUSTOMER AND FORCE YOU TO USE THEIR AI BOT WHICH CAN'T DO SHIT AND WILL HALLUCINATE A WAY TO DELETE YOUR ACCOUNT BY YOURSELF. Their FAQs have conflicting information which some showing options that don't even exist (anymore). And you have to dig through a lot of policy pages to even find an email address to contact that THEY DON'T WANT YOU TO CONTACT BECAUSE THEY "cannot delete data on your behalf because we cannot authenticate your request by email" (quote of one of their FAQ pages).

    When I finally found an email address (that was for reporting data of minors being processed, but I didn't care at that point) and pointed out to them that this is likely illegal, it was processed like a normal ticket and my account got deleted within a few days. I wonder why their legal department followed up a few days after that, apologizing for my "experience" and telling me that they would "review their processes"?

    Anyway, that is that. If you want to use SendGrid or any other Twilio service except for Authy, save yourself the pain and just email [email protected] instead of trying to follow their processes which even they themselves don't seem to know.

    INTERMISSION END

    So far, every account I deleted, I couldn't log into after deletion. I can't really check if they deleted the rest without breaking into their data centers.

    And I'm not very strict with creating accounts nowadays but I'm much stricter with documenting them to my password manager now so I know that they exist. If I don't need them anymore, they'll get caught in the next rotation.

  • Unauthenticated RCE vs all GNU/Linux systems to be fully disclosed in 2 weeks with no working fix yet

    Jump

  • Yeah, what a disappointment. This guy brought shame to the security community because he was salty that his vulnerability didn't get the attention it "deserved".

  • Unauthenticated RCE vs all GNU/Linux systems to be fully disclosed in 2 weeks with no working fix yet

    Jump

  • Copying my reply from another thread:

    This link should be working.

    Quoting from the OP tweet:

    Unauthenticated RCE vs all GNU/Linux systems (plus others) disclosed 3 weeks ago. Full disclosure happening in less than 2 weeks (as agreed with devs). Still no CVE assigned (there should be at least 3, possibly 4, ideally 6). Still no working fix. Canonical, RedHat and others have confirmed the severity, a 9.9, check screenshot. Devs are still arguing about whether or not some of the issues have a security impact.

    I've spent the last 3 weeks of my sabbatical working full time on this research, reporting, coordination and so on with the sole purpose of helping and pretty much only got patronized because the devs just can't accept that their code is crap - responsible disclosure: no more.

  • Unauthenticated RCE vs all GNU/Linux systems to be fully disclosed in 2 weeks with no working fix yet

    Jump

  • This link should be working.

    Quoting from the OP tweet:

    Unauthenticated RCE vs all GNU/Linux systems (plus others) disclosed 3 weeks ago. Full disclosure happening in less than 2 weeks (as agreed with devs). Still no CVE assigned (there should be at least 3, possibly 4, ideally 6). Still no working fix. Canonical, RedHat and others have confirmed the severity, a 9.9, check screenshot. Devs are still arguing about whether or not some of the issues have a security impact.

    I've spent the last 3 weeks of my sabbatical working full time on this research, reporting, coordination and so on with the sole purpose of helping and pretty much only got patronized because the devs just can't accept that their code is crap - responsible disclosure: no more.

  • Privacy @lemmy.ml
    Treasure @feddit.org

    Unauthenticated RCE vs all GNU/Linux systems to be fully disclosed in 2 weeks with no working fix yet

    nitter.poast.org /evilsocket/status/1838169889330135132
  • Linux @lemmy.ml
    Treasure @feddit.org

    Unauthenticated RCE vs all GNU/Linux systems to be fully disclosed in 2 weeks with no working fix yet

    nitter.poast.org /evilsocket/status/1838169889330135132

  • I hate the rich

    Jump

  • Cannot complain.

    Spotted the German.

  • Rule

    Jump

  • The screenshot is getting crispy, time to get it out of the deep fryer

  • The Best Encrypted Messengers in 2024

    Jump

  • That's mentioned in the article I believe. I was just trying to save some people a minute or two. :)

  • The Best Encrypted Messengers in 2024

    Jump

  • TLDR: Avoid Telegram and WhatsApp. Recommended messengers are Session, Signal, SimpleX and Threema. Honorable mention: Briar.