Notices by cR0w :cascadia: (cr0w@infosec.exchange), page 3

When you fix one thing and the next thing you know you're the SME.

@screaminggoat Oh yeah, I already have that one. I saw another post about this issue and then happened across this gif for a different chat so I threw it up here because it felt relatable. Thanks though.

Trying to get vuln details from a vendor despite it being labeled as exploited in the wild

@screaminggoat Is this a random guess or...

Living off the Land

How is it that this industry is so full of "the only thing that will stop a bad guy with AI is a good guy with AI" takes? Meanwhile, "advanced" persistent teens are running circles around modern enterprise security systems with ../ and command injection. Fuck. If it weren't for the physical systems that real people rely on to survive being connected to vulnerable networks, I would be so gone.

@ra6bit

TCP fragmentation

@mattly "Last updated on..."

What was updated?

... the last updated date?

@catsalad I would like to be angel investor for this particular meowing artificial intelligence project.

@Mike_Enos @hacks4pancakes Ashley Madison was my final "Well, I guess literally no one gives a fuck" moment. It's when I shifted from caring about the immediately impacted individuals to the downstream impacts only.

Heads-up if you're working on CVE-2024-3393:

PAN changed the advisory so that the required configuration for exposure is now:

Both of the following must be true for PAN-OS software to be affected:

• Either a DNS Security License or an Advanced DNS Security License must be applied.
• DNS Security logging must be enabled.

Instead of this:

DNS Security logging must be enabled for this issue to affect PAN-OS software.

POV: Watching an 0day PoC video while the vendor claims there is no known vulnerability in their product.

#directoryTraversalMemes

Soon...

@GossiTheDog Isn't that what CSI:Cyber tried to do?

There are multiple CVEs in this advisory for SHARP routers, but CVE-2024-46873 ( CVSS3 9.8 ) sure sounds like a bugdoor to me. I wonder if the US will ban SHARP routers too. 🤔

https://k-tai.sharp.co.jp/support/info/info083.html

https://nvd.nist.gov/vuln/detail/CVE-2024-46873

2025 CVEs gonna read like

Are we doing 2025 predictions yet?

#directoryTraversalMemes

"Okay class, today we are going to talk about Tor."