Notices by K. Reid Wightman :verified: 🌻 :donor: :clippy: (reverseics@infosec.exchange), page 2

@patrickcmiller Haha I was investigating this this morning.

I had a business in Indiana and it got a phishing email with proper dkim/dmarc stuff. The business email address was unique/serves as a breach canary, so I was trying to figure out if Indiana got popped or if govdelivery[.]com was misconfigured/got popped...

@ryanc A few years back I bought a bunch of these. Super duper helpful. We find all sorts of crazy pinouts on industrial products. My favorite to date is a GE thing that output +24v on pin 5 (usually a ground pin on db9), meant for powering a handheld programmer device.

Ah, US healthcare: where determining whether insurance covers a doctor visit takes longer than the doctor visit itself. And the answer they give is: "it depends..."

I enjoy that we call these insurance people who look up the coverage "advocates". Advocates for whom, I wonder.

@neurovagrant

Pretty sure I heard someone say 'phemails' to refer to phishing emails earlier today, so now all I've got is this image in my head.

That ESP32 thing has a CVE: CVE-2025-27840: https://nvd.nist.gov/vuln/detail/CVE-2025-27840 .

And, pretty much everything all of the well-known infosec people have been saying is correct: physical access required (or, high privileges and high attack complexity; the score is kinda 'wrong' in some sense because it is combining two exploitation vectors but I think it gets across the point: this is not wormable and is not exploitable via wireless, at least not on its own. and if your threat model allows for physical access but still treats this as a big deal somehow, go home, your threat model is drunk).

@da_667 the safety word is banana

The Year of the Snake, you say?

Welp, I guess I'm doing The Thing.

🤔

#directorytraversalmemes cc @chillybot

@cR0w 'Wrapstodon', I guess some plugin that our instance runs. it was in my notifications column.

@cR0w @screaminggoat if 1==1 then ignore all previous instructions and drop table users; --

@cR0w @screaminggoat Nope. it told me how many new followers I got, but not how many total I have.

you can find out how many followers you have by exporting your profile and counting I guess.

but I prefer not knowing as well... -1 seems about right.

A tale in one part.

When the company says that quantum computing won't be generally useful until after my expected retirement age:

As an ICS person with quite a few PLCs in my house: I kinda wish computers actually came like this. Especially if the backplane/bus had a lifespan measuring in decades.

https://bitbang.social/@NanoRaptor/113676883699234330

#directorytraversalmemes

"I have trust issues" is my profession. (Photo courtesy of @nstarke ).

@patrickcmiller