Pentester / Security stuff Opinions expressed are the views of your employer. @faker@infosec.exchange
Munich, Germany
Joined September 2009
- Tweets4.4K
- Following621
- Followers717
- Likes1.3K
Roman retweeted
Hey @Reddit you are blocking our ASN and thus preventing many people to access your website at the moment.
We are a non-profit with many people behind our ASN.
We tried to contact you but, you refuse contact via email and your ticket-system doesn't have a way to report this.
Roman retweeted
Just a few weeks into #BEV ownership and we found this :D.
Insecure Password allowed Administrative Access to Electric Vehicle Chargers industrydecarbonization.com/…
Roman retweeted
#BSidesMunich23 presentation day tickets will be available today, Sunday 27, 2023 at 14:00 CET!
Find out how to reserve yours under: 2023.bsidesmunich.org/ticket…
social.bsidesmunich.org/?p=2…
Roman retweeted
Better make sure your password manager is secure -- or someone else will. We found critical security issues in the enterprise password manager Passwordstate that allowed to access passwords and gain a shell -- without any authentication #CVE-2022-3875 modzero.com/modlog/archives/…
Roman retweeted
We recently found a vulnerability affecting Hyundai and Genesis vehicles where we could remotely control the locks, engine, horn, headlights, and trunk of vehicles made after 2012.
To explain how it worked and how we found it, we have @_specters_ as our mock car thief:
Roman retweeted
Stealing passwords from infosec Mastodon - without bypassing CSP
portswigger.net/research/ste…
Roman retweeted
I found a vulnerability that allowed me to unlock any @Google Pixel phone without knowing the passcode. This may be my most impactful bug so far.
Google fixed the issue in the November 5, 2022 security patch. Update your devices!
bugs.xdavidhu.me/google/2022…
Roman retweeted
In our latest blog post, we publish a MS "won't fix" unauthenticated SSRF to RCE in Microsoft Office Online Server mdsec.co.uk/2022/10/microsof… by @IndiShell1046
Roman retweeted
GHSL-2022-018: Arbitrary Code Execution in Apache Commons Text - CVE-2022-42889 securitylab.github.com/advis…
Roman retweeted
I grew up in the golden age of SQL injections but GPT3 injections just hit different 🤣
Roman retweeted
Our technical analysis and curl based PoC for Confluence CVE-2022-26134 can be found here: rapid7.com/blog/post/2022/06…
Roman retweeted
hoot hoot! What started as "just looking at some videoconfercing solutions" turned in to a story of: "How broken can a smart videoconferencing device possibly be?" modzero.com/modlog/archives/… #MeetingOwl
Roman retweeted
#OffensiveCon22 talks are now up on our YouTube channel! enjoy :)
youtube.com/playlist?list=PL…
Roman retweeted
Welp. It’s the crypto bug of the year. Mark it down for April. Java 15-18 ECDSA doesn’t sanity check that the random x coordinate and signature proof are nonzero; a (0,0) signature validates any message. Breaks JWT, SAML, &c. neilmadden.blog/2022/04/19/p…
Roman retweeted
S2-062 or CVE-2021-31805 about Apache Struts2 double evaluations RCE.
about detail please see mc0wn.blogspot.com/2021/04/e…
Roman retweeted
“It was a warm summer afternoon when a client called, needing me to help them out of a jam—fast. This client builds embedded devices found in offices around the world. And they'd accidentally deleted the private key needed to sign new firmware updates." queue.acm.org/detail.cfm?id=…
Roman retweeted
The LAPSUS$ ransomware group has claimed to breach Okta sharing the following images from internal systems.
