JSOF is a boutique cyber consultancy and project firm. We are cyber security experts
Joined January 2020
- Tweets250
- Following534
- Followers805
- Likes217
Pinned Tweet
We are releasing Dnspooq - 7 vulnerabilities in dnsmasq, and open source DNS forwarder used in major Linux distributions and by dozens of vendors
jsof-tech.com/disclosures/dn…
JSOF Cyber Security retweeted
I found some design and implementation flaws in Wi-Fi again. All Wi-Fi devices are affected. It was a long ~9 months embargo, over this time a lot of info has been collected and that info now available at fragattacks.com
JSOF Cyber Security retweeted
Forescout & @JSOF18 research disclose NAME:WRECK - 9 new DNS #vulnerabilities affecting popular TCP/IP stacks used in millions of #IoT #OT & IT devices. ow.ly/62ne50EnkpK
#NAMEWRECK
JSOF Cyber Security retweeted
As part of Project Memoria we're releasing a report together with @JSOF18 on several DNS vulnerabilities in popular TCP/IP stacks (FreeBSD, NetX, Nucleus NET, ...), including a breakdown of underlying anti-patterns (hint: check your message compression).
forescout.com/research-labs/…
Announcing the latest research by @JSOF18 and @Forescout
Great coverage by @campuscodi as always.
#NameWreck #IoT #Cyber
This quoted post is unavailable.
JSOF Cyber Security retweeted
Forescout and JSOF Disclose New DNS Vulnerabilities, Impacting Millions of Enterprise and Consumer Devices - Forescout forescout.com/company/blog/f…
JSOF Cyber Security retweeted
The Qualys Research Team has discovered a critical vulnerability in #Sudo, which allows an unprivileged user to gain root privileges in its default configuration. #linux #unix #vulnerability blog.qualys.com/vulnerabilit…
The #Dnspooq graphic design award goes to @BleepinComputer !
P.S. upgrade your dnsmasq to version 2.83 or above
DNSpooq bugs let attackers hijack DNS on millions of devices - @serghei
bleepingcomputer.com/news/se…
Supply chain issues affect Open Source Software too. Dnsmasq is extremely popular (and for a good reason!) and so the vulnerabilities affect dozens of vendors and many major Linux distributions.
Researchers have found set of flaws allowing for DNS cache-poisoning attacks (also known as DNS spoofing)
DNSpooq is a series of vulnerabilities found in the ubiquitous open-source software dnsmasq, demonstrating that DNS is still insecure
➡️threatpost.com/dnspooq-flaws…
#DNSpooq
Some recommended workarounds for #dnspooq if you can't upgrade your device. Configuring your devices to directly query a trusted DNS server would also be helpful.
Shout out to multiple vendors @cisco @google @The_Pi_Hole @RedHat to resolve @dnsmasq vulnerabilities. Thanks to @GitHubSecurity for GHSA platform and to @JSOF18 for responsible vulnerability disclosure!
Great article by @campuscodi covering our latest #Dnsooq findings. Another timely reminder that it's time for mitigations like DNSSEC to be more widely adopted.
This quoted post is unavailable.
JSOF Cyber Security retweeted
DNSpooq Flaws Expose Millions of Devices to DNS Cache Poisoning, Other Attacks securityweek.com/dnspooq-fla…
Great writeup by @RedHat, and there's a script here to check if your dnsmasq is vulnerable
See this Red Hat security advisory for great summary about the #DNSpooq vulnerabilties access.redhat.com/security/v…
Sounds like you will soon be able to know if your device is vulnerable to #Dnspooq. Good stuff @VDOOSecurity
DNSpooq, 7 #vulnerabilities in #dnsmasq just published by @JSOF-under certain conditions,attacker can achieve #DNScachepoisoning & #RCE. Given a device image, Vdoo's automated platform will soon be able to detect whether these vulnerabilities are actually #exploitable- stay tuned
JSOF Cyber Security retweeted
Today we release #DNSpooq - 7 vulnerabilities in dnsmasq, a popular open source DNS forwarder. 3 vulnerabilities enable cache poisoning and the other 4 are pre-DNSSEC-validation buffer overflows. Patch! jsof-tech.com/disclosures/dn…
JSOF Cyber Security retweeted
Vulnerability Response Information - Treck | Embedded TCP/IP | Internet Protocols treck.com/vulnerability-resp…