user interfaces, typescript, photo, cdmx — needs money for RS6
Mexico City
Joined October 2009
- Tweets13.6K
- Following1.7K
- Followers653
- Likes73.5K
“Ponerle un cuatro”
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
69
Como me mira el Genius de la Apple Store mientras me muestra que mi teléfono actual (1TB) está casi lleno y que debería comprar el de 1TB como mínimo pero le digo que prefiero borrar todo y empezar desde 0 con uno de 512GB para no pagar más.
1
83
Node.js Security Advisory: a high-severity RCE flaw in Node's Brotli decoder affects Node.js 22, 24, and 26.
Vercel WAF rules are live for every project and block known exploit patterns.
vercel.com/kb/bulletin/node-…
1
101
Pedir cosas de Amazon Europa es como pedirle algo a un Lambda frío que no sabes si algún día llegará, ni cuándo.
1
266
Ya dirá el reporte la razón pero imagina el miedo de despegar con el freno de mano puesto.
Afortunadamente lograron despegar.
Tail strike on VN-A867 + possible ELECTRIC BRAKE ACTUATOR ISSUES On Both MAIN GEAR.
Vietnam Airlines 787-9 out of Munich today... very late rotation, almost full runway used, confirmed tail strike, then returned with multiple tires shredded.
Electric Brake Actuator (EBA) seizure or internal fault is high on my list for that kind of acceleration. Fits the PICTURE also arrived with shredded tires.
Just my theory. Waiting for the report.
255
