I'm looking for someone who has received one of the ominous unsolicited Instagram password reset e-mails around December 30, last year. I'd like to cross-check their Instagram data with the recent "leak". Appreciate a boost!

A recent leak of the BreachForums user table gave interesting insights into the most popular e-mail providers for Breached. By far the most accounts are on Googlemail (n=240736), followed by Proton (n=43319). 9th most popular is DNMX (n=2077), followed by the long tail (n=12418).

Sorry, this could not wait until next #diday - I just deactivated my X account. The recent shitshow around Grok creating deepfake thirst traps is just too appalling. Here's hoping that Bluesky won't suffer the same fate of enshittification.

Nominees for the insecurity appliance bingo 2026 Let's try and crowdsource this. A couple candidates are a given: - Fortinet, the 2025 winner - Ivanti, the runner-up One comment for each vendor who you'd like to include, and I'll try to count each "like" for that comment as one vote for the vendor.

BINGO TIME! With CVE-2025-58034, Fortinet secures the crown in my Insecurity Appliance Bingo. This is technically a "high" severity vuln, but since it's being actively exploited and has landed a spot on CISA KEV, I'm admitting it. cku.gt/appbingo25

The "ls -laR" of the Red Hat data breach by Scattered Lapsus$ Hunters -- err Crimson Collective -- is, put into a text file, 2 GB. That's a heck of a breach. % wc -l REDHAT_GIT_LS.txt 37665671 REDHAT_GIT_LS.txt

OK, interesting day so far. A lot of different ideas, initiatives and possible solutions to the MITRE CVE blackout are being floated and I kind of lost track. So I wrote it down here: heise.de/-10354564 Time will tell what happens, and I'll update the article as soon as official info is out.

Interessanter Tag mit vielen Ideen und neuen Konzepten (und sogar einer neuen Schwachstellendatenbank) zu CVE/MITRE. Ich habe das Ganze mal mit dem Stand von ca. 16h aufgeschrieben: heise.de/-10354324 Wenn sich was tut, versuche ich noch zu updaten.

I have upgraded the Insecurity Appliance Bingo to reflect the recent FortiNet advisory about a persistent backdoor. I also decided to include the Palo Alto Auth bypass CVE-2025-0108 in the bingo although it's not a "critical" (but barely). It is being actively exploited. cku.gt/appbingo25

Hallo @spiegel.de, es ist übrigens auch false Balancing, alles, wogegen rechte Spinner schimpfen, als "umstritten" zu framen. Le Pen wurde nach geltendem Recht verurteilt, nur weil in Faschisten-Kneipen dagegen gewettert wird, steht dieses Urteil nicht in Zweifel. www.spiegel.de/ausland/le-p...

Das Testmuster liegt noch vor mir auf dem Tisch, ganz überzeugt war ich allerdings nicht. Mein guter alter Flipper ist mir dann doch näher. Habt Ihr interessante Spielereien mit dem T-Embed CC1101 (und Bruce/Capibara) auf Lager?

At long last (two weeks without a critical vuln!), there's a new insecurity appliance entry. And it's... *drumroll* Ivanti again! With an almost classic Auth RCE due to a stack-based buffer overflow (CVE-2024-22467), they are creeping into Bingo territory. Only two more cells to go!

heise.de/-10257031 Firmware- und Bootloader-Bugs. Aber alle nicht "kritisch", daher füge ich sie erst einmal nicht ins Bingo-Sheet ein. Wenn jetzt natürlich jemand diese Bugs mit einem anderen verketten und eine Exploitchain mit persistenter Backdoor bauen würde...

We have a new entry in the #2025securitybingo - SonicWall has an interesting RCE opportunity in their SMA1000 series. 9.8/10, that merits inclusion on my bingo card. Three vendors down, three to go. We're halfway there!

A Series Of Unfortinet Events: There's a bunch of new CVEs, at least one of them critical. There's an attack campaign against unsecured web UIs. Aaaand there's a leak of fifteen thousand config files plus VPN passwords. I took a closer look here: www.heise.de/en/news/Unkn...

Latest version of the 2025 (in)security appliance bingo adds CVE-2024-55591 / FG-IR-24-535 to the list. Thanks to watchTowr for reporting it, and thanks to various Fediverse users for alerting me to it. cku.gt/appbingo25 FortiNet admins: Go and patch your stuff. This is being exploited ITW.

I have seen numerous news items about the purported "new PayPal account takeover attack". To any of the people who wrote said items: Have you tried the attack vector? I have, and I cannot reproduce the attack. There are various screen shots here: heise.de/-10234666 Is this a hoax? Fixed?

Last bingo post for today, I promise. I fleshed this out a little more. You can find the (In)Security Appliance Bingo 2025 in proper, two-dimensional form here: cku.gt/appbingo25 Suggestions and submissions very welcome.

(In)Security appliance critical vuln list, 2025 edition, first issue, v3: ✅ SonicWall ❌ Ivanti ✅ Cisco ✅ Sophos ✅ FortiGate ✅ Palo Alto (X means pwned, check mark means "not pwned yet".) Only new vulns, only critical vulns. Vendor CVSS score counts unless it's clearly wrong.

(In)Security appliance critical vuln list, 2025 edition, first issue, v2: ❌ SonicWall ❌ Ivanti ✅ Cisco ✅ Sophos ✅ FortiGate ✅ Palo Alto (X means pwned, check mark means "not pwned yet".) Only new vulns, only critical vulns. Vendor CVSS score counts unless it's clearly wrong.

(In)Security appliance critical vuln list, 2025 edition, first issue: ❌ SonicWall ❌ Ivanti ✅ Cisco ✅ Sophos ✅ FortiGate (X means pwned, check mark means "not pwned yet".)

In a blog article, FortiNet CISO Carl Windsor claims that phishers can hijack legitimate Paypal accounts by sending payment requests. I cannot reproduce this claim on my own accounts. Anyone been able to reproduce? www.fortinet.com/blog/threat-...

I don't know who needs to read this, but the lighter used by Indiana Jones in The Great Circle is an Imco Triplex. I was going to post a picture of me holding mine, but I didn't want my fingerprints duplicated.

Happy new year, everyone! I hope you all got over New year's eve in one piece, didn't get the "Congress Plague" after 38C3 and are adhering to the 6-2-1 rule. It's valid outside Congress, too! #38C3

They really handed out USB keys at a security conference. #38C3 #FlippyRAM

Hot of the press: #FragDenStaat newspapers #38C3

From 38C3 assembly area: „FSB agent, fuck off“

Tag 2 des #38C3 beginnt... neblig. Aber das ist wohl Teil des Lokalkolorits. Heute um 18h sende ich den "Passwort"-Podcast live aus dem Sendezentrum (Saal X) - mal sehen, wie das wird und wer vorbeikommt. :-)

Various sites in Germany were attacked by NoName dDoS conglomerate and are subsequently down. The list of victims looks kinda random though. heise.de/-10202915

Well, there goes the contents of my X account. The platform has made it artificially harder to archive your content, so I let Cyd do this for me, too. Now I have a HTML and SQLite version to peruse whenever I want to. (Spoiler: I don't.)

Although one might be tempted to headline this as "Russia cracks down on cybercrime", the draconian Hydra sentences likely stem from their commercial, OC-style drug trading business, not primarily their Darknet activities. Wazawaka faces up to four years in prison or a fine.

heise.de/-10187469 The purported ransomware duded named "wazawaka" was arrested and indicted, he is now out on bail waiting for his trial. The "Hydra" group were sentenced 8 to 23 years in penal colonies with strict regimes (high security prison with forced labor), with one life term handed out. 1/2

This was really interesting research: heise.de/-10186510 During my initial coverage, the story evolved and what looked like a slightly overhyped ESET blog now is a end-to-end UEFI bootkit. I talked to the author, too, and discovered an awesome rootkit researcher community. Go read the article!

@ryanaraine.bsky.social hey, remember me from the 2010-era DBIR report puzzles? I was wondering if you are available for a quick convo re BootKitty, will only take five mins.

This is a fascinating read: boehs.org/node/dark-we... Darknet vendors are using the cutting edge of web technology and carefully, CAREFULLY crafted, ingenious hacks to *avoid* using JavaScript. This includes stuff like image maps, a HTML feature I had completely forgotten about.

Interesting.Amazon has deployed a new shipping option, called "Versand ohne Eile" (Shipping without hurry?) in Germany. In a quick test case with a private order, I was offered about 0.70€ discount in exchange for +7 days shipping. This feels a little unbalanced.

Der Zeit-Artikel über den FDP-Koalitionsbruch ist mittlerweile aus der Paywall entfernt, und er ist sehr lesenswert. www.zeit.de/d-day

Four days after CISA warned of active exploitation and three days after Watchtowr's blog article with full PoC code, Unit42 is now moderately to highly sure that a public exploit for CVE-2024-0012 and CVE-2024-9474 exists. Meanwhile, Shadowserver saw 2K pwned devices on 11/20, -50% on 11/21.

Für alle Fand von Loriots Hoppe stedtschem Weihnachtsgeschenk „Wir bauen ein Atomkraftwerk“: Etsy hat da was für Euch. „Und dann macht es puff und die Bäume fallen um und die Kühe… das ist dann immer ein großes Hallo!“

Seit gut einer Woche erhält die Twitter/X-Alternative Bluesky einen riesigen Zulauf. Eine kurze Einführung nicht nur für Neulinge. #Bluesky

How can this even get into a production, let alone a security appliance? return $p->pexecute("/usr/local/bin/pan_elog -u audit -m $msg -o $username") This is actual code from PAN-OS WebGUI PHP, and $username is user-supplied. www.heise.de/news/Kritisc...

Kritische, derzeit ungepatchte Zero-Day-Lücke im Management-Webinterface einer Security Appliance. Oder wie wir bei heise Security sagen: Montag. https://heise.de/-10040500

Please don‘t calm ransomware gangs „hackers“. They aren‘t. Malware and ransomware are not creative outside-the-box usage of technology, they are industrialized blackmail following a well-defined business case.

Rund 2000 Trecker werden in Hamburg erwartet. Das sind fast genauso viele wie im Cookiebanner einer modernen Webseite.

Just noticed that the „404“ implant detection method for IOS-XE CVE-2023-20198 seems to have stopped working on November 2nd, with a sharp drop between noon and 6pm (300->1 detected implants in Germany). Anyone seeing similar?

Der hr hat mich gestern interviewt, um herauszufinden, ob Smartphones wirklich abhören, was wir bereden, um uns dann passende Werbung einzublenden. Auch ich hatte dieses Gefühl bereits, aber es bleibt ein Gefühl. Allerdings ein recht creepiges. Link zur ARD-Mediathek kommt als Reply.

One of the things I definitely don‘t miss after leaving the carrier/cloud field: Quarterly Cogent sales spam.

And here we go: Project curl Security Advisory, October 11 2023 - [Permalink](curl.se/docs/CVE-202...)

Sooo… is everyone adequately excited for the cURL vuln?

Top security misconfiguration according to CISA/NSA experience from 1000+ pentests: Default configurations. Sigh. www.cisa.gov/news-events/...