n0name (@n0lab) profile picture
Joined June 2009
kernel hackers go serverless ring0 → cloud 9 ☁️ ?? brb pwning yr gpu nodes ✨
23
116
8
602
62,660
CVE-2025-32463: Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option. PoC: github.com/kh4sh3i/CVE-2025-… CVSS: 9.3 Affected Versions: ▪️Vulnerable: sudo 1.9.14 – 1.9.17 ▪️Non‑vulnerable: Legacy versions (<1.9.14, no chroot support)
4
180
4
873
63,298
GeoConfirmed Announcement. What led to the hospital courtyard explosion (Al-Ahli Baptist Hospital) has been a subject of discussion. To shed light on our initial view on this matter, we’d like to clarify that our team conducted a thorough geolocation analysis of more than 35,000 videos related to the Ukrainian-Russian conflict through GeoConfirmed. Through this process, we’ve gained valuable insights, notably the importance of verifying claims from both sides involved. We’ve previously debunked official statements based on geolocations. As the footage of the hospital explosion surfaced and our team was looking into the footage, it became evident that the world was incensed, largely due to communications from Palestinian Authorities and other sources. In a matter of hours, these sources asserted casualty figures ranging from over 500 to 1000 deaths and the complete destruction of the hospital. Our team has encountered thousands of explosion and bombardment videos. The damage/casualties claims based on the footage we were geolocating did not align with any of the videos we’ve viewed over the past years. Additionally, counting more than 500 deceased individuals would be a task requiring days, not mere hours. Our team conducted a preliminary analysis based on the information and footage available at that time. OSINT analysis can be inherently time-sensitive, as new and more informative footage may emerge, potentially contradicting our prior analysis. Our intent was to demonstrate that there was no foundation for the initial Palestinian communication and that alternative theories were plausible. We never anticipated that this would gain such widespread attention; otherwise, we would have selected our wording more carefully. Regarding the hospital bombing, following our initial assessment, numerous other investigations have been initiated. Most theories concur that the visible damage in the footage makes it improbable that an Israeli air-dropped bomb was responsible. The assertion of over 500 casualties is also widely viewed as a significant exaggeration. Over the past days, experts and intelligence sources quoted in various media outlets have estimated casualties to be in the range of a few dozen to perhaps around 100. It’s crucial to bear in mind that it’s a hospital functioning during a time of war, which inherently results in a significant number of wounded and deceased individuals. Our preliminary analysis based on the information and footage available at that time: xitter.cf/GeoConfirmed/sta… Next, let’s delve into the alternative hypotheses: The initial video from @yousuf_tw The rocket is intercepted in the air, and breaks apart into shrapnel. xitter.cf/yousuf_tw/status… @Nrg8000 Not consistent with an airstrike and is not consistent with claims that 500+ people were killed. xitter.cf/Nrg8000/status/1… @AJEnglish A rocket originating from Gaza was intercepted. No debris was found. Palestinian involvement is ruled out. xitter.cf/AJEnglish/status… @bellingcat The impacted area does not seem to match the usual characteristics of 500, 1000, or 2000-pound Joint Direct Attack Munitions (JDAMs). bellingcat.com/news/2023/10/… @ArchieIrving2 A missile coming from Iron Dome site (Interceptor) 3km east of Nahal Oz. xitter.cf/ArchieIrving2/st… @ForensicArchi Artillery shell coming from the North-East. xitter.cf/ForensicArchi/st… @AuroraIntel Video from Ashkelon and image from Sderot of recent impacts from two barrages of rockets earlier this evening from Gaza. xitter.cf/AuroraIntel/stat… @OAlexanderDK Artillery shell: The IDF SOP isn’t firing one solitary 155mm shell at Gaza and hoping that it hits something. xitter.cf/OAlexanderDK/sta… @Nrg8000 The Iron-Dome is a terminal-phase interceptor. It does not intercept in the launch phase. And it does not work above Gaza. xitter.cf/Nrg8000/status/1… @fdov A thread about 'view'angles in the different video’s. xitter.cf/fdov21/status/17… @gritsncollards and @georaccoon: Why the @ForensicArchi analysis can also be 180° wrong. xitter.cf/gritsncollards/s… xitter.cf/GeoRaccoon/statu… And many many more... Since the explosion a slew of disinformation claims emerged, with the majority being propagated by pro-Russian propaganda accounts like Lord Bebo or accounts known for disinformation like Hinkle. For example: These claims encompassed a video that purportedly showed the Israeli Airforce in operation, though it was subsequently proven to be from a different location and an hour later. (Tweet still online) Another video portrayed the Israeli Airforce conducting airstrikes near a hospital, but it was determined to be on the wrong day and at a different hospital. (Tweet still online) We are pleased to observe the open-source community and journalists actively engaged now in their work. After reviewing numerous articles, we’d like to pose some questions without providing definitive answers, as our role was primarily in the initial investigation. We now turn to experts and journalists for further analysis. These are questions that we believe warrant further investigation and answers. 1. Is the missile visible in the Al Jazeera stream above or near the hospital? 2. If an Iron Dome missile is involved, why was it fired above Gaza? 3. If an Iron Dome missile is involved, can we identify past incidents of Iron Dome missile interceptions occurring above Gaza? 4. If an interceptor was in action, what was its target? 5. What happened to the debris of the intercepted object ? 6. How did the Al Jazeera investigation determine there was no debris from a video ? 7. If it’s an Tamir interceptor and it intercepted something above the hospital, doesn’t this support the IDF’s claim regarding launch positions ? 8. Conducting a crater analysis is an exceptionally challenging investigative task. Even with access to the impact site, it can take weeks to determine the type of ammunition and the direction of impact. Depending on the underground conditions and the angle of impact, the resulting spray pattern can vary significantly, possibly even by 180 degrees. The accuracy of such an analysis comes into question when the specifics of the munition used and the angle of impact remain unknown. How sure are we that the investigation done by @ForensicArchi a) has enough data and ballistic/ammunition knowledge to support their conclusion. b) is not influenced by @alhaq_org participation while its clearly a very pro-Palestinian organisation? 9. If only one artillery shell impacted the site, why is there just one? Is this typical for artillery use? 10. Are there other recent examples of Israel using artillery in the area? 11. How can we be certain it’s artillery and not shrapnel from a rocket? ... There are many more questions that can be raised. We appreciate your valuable feedback on our initial analysis. It is important to consider opposing arguments to ensure the quality of any analysis. It is now time for experts and journalists to do their work. Both have a crucial role in providing accurate and unbiased information to the public. However, in some cases, an independent investigation team may be necessary to ensure objectivity and thoroughness. Such a team can conduct an impartial investigation on site and provide a comprehensive report. We will not make any further comments on this matter.
This quoted post is unavailable.
179
1,000
256
4,111
810,911
Today Lockbit ransomware group issued a poll to all of their affiliates. Lockbit is considering implementing new rules for Lockbit affiliates due to their frustration with ransomware negotiators. Currently, Lockbit ransomware group has no rules in place for how much (or how little) affiliates can ransom a company for. They are considering "regulating" ransom demands. They state newer affiliates are giving large discounts to victim companies out of desperation for money, whereas more experienced affiliates do not cave to negotiator's proposed payment from the victims. Lockbit administrative staff are proposing the following options. 1. No changes in payment policy, payment options will remain "unregulated" and remain up to the affiliates. 2. New rules in place which set the minimum payment allowed to be 3% of the victim companies annual revenue with the option of a 50% discount, bringing it down to 1.5% of annual revenue. 3. Establish a new rule where affiliates can only grant a 50% discount of the original ransom price. 4. Establish a new rule where they will not accept a payment below the victims maximum ransomware insurance policy. 5. Establish a new rule where they will accept a minimum payment of 50% of the victims ransomware insurance policy. In regards to this poll, National Hazard Agency, a subdivision of Lockbit ransomware group, has stated they will no longer accept payments below 3% of the companies annual revenue. They will immediately retaliate against any negotiator who approaches them with an offer of less than 3% of the companies revenue. The retaliation will be complete destruction of company data. Image 1. Original Lockbit poll (Russian) Image 2. Lockbit poll (English) Image 3. Message from National Hazard Agency
30
226
85
788
415,956
Our malware database is now live! - 18,000,000+ samples - 16,000,000+ samples in queue for upload - It's free, forever. Special thanks to @Malcoreio for assisting us in the development process (and additional funding). Check it out here: virus.exchange
21
191
3
711
89,059
France’s new SREN bill requires browsers like @Firefox to build powerful censorship tools & sets a dangerous precedent. Sign the petition, tell the French government: Remove Article 6 from the SREN bill! mzl.la/3PfzG4K
92
547
64
648
95,110
[🚨🚨[FRANCE]CyberAlert - 🇫🇷 PoleEmploi, les données de 10M de bénéficiaires en vente pour 835€] Il n'aura pas fallu attendre longtemps pour voir les données de #poleemploi en vente ! 900$ ! 900$ somme tellement ridicule au regard des données critiques en vente. On retrouve presque tout : prenom, nom, téléphone, mail, ... Il y a bien plus de données piratées qu'annoncées par #PoleEmploi ! Une vraie course contre la montre s'annonce désormais. Il va falloir être extrêmement vigilant dans les jours et semaines à venir surtout avec la rentrée des classes ! Des milliers de personnes vont se faire avoir hélas. Principal risque, le #phishing ou encore l'hameçonnage ! Ne renseignez pas vos coordonnées bancaires si vous recevez des sms ou des mails ! Cybèrement vôtre, SaxX
34
340
26
576
144,943
Go to Google Scholar and look up ‘As an AI language model” -“ChatGPT”’
477
7,461
2,378
66,885
9,738,681
Who remember or still use that old trick 😂 ?
9
29
1
234
36,934
"J'ai 15 ans et suis passionné par l'électronique et la programmation. J'ai conçu ce téléphone Paxo Phone de A à Z afin d'en faire un modèle open-source, peu onéreux et à faire soi-même, de manière à préserver la planète le plus possible." Gabriel R. paxo.fr/
129
988
144
5,416
2,170,286
Clop ransomware has now posted 3 of the accounting big 4. Deloitte has been breached by Clop. @DeloitteUS
34
264
30
798
241,926
#Spain 🇪🇸 - Allegedly, Data of Indra are on sale Threat actor claims to have sneaked into company meetings, spied on Indra Air Traffic Control Systems and captured data. #DarkWeb
37
5
88
33,029
#Cl0p have created a clear web website for PWC client files, registered two days ago hosted via pindc[.]ru
13
207
27
790
222,223
Angry CL0P #ransomware group 😑PWC's Ransomware Negotiations Take a Turn for the Worse, Troubling Trend Persists "FOR YOUR CONVENIENCE, WE HAVE MADE A WEB VERSION ***** OF THE COMPANY PWC.COM WHERE ALL THE FILES PUBLISHED" #DarkWeb #clop #pwc
18
2
42
24,285
Here is an interesting bit about the stolen MSA signing key from the China/Microsoft Incident this week: MS doesn't know how the hackers stole it.
14
117
9
653
193,180
The $5 Membership sale is now live! The sale lasts until July 17 23:59 UTC: account.shodan.io/billing/me…
128
846
202
1,586
618,096