OSVDB @OSVDB

Open Sourced Vulnerability Database (OSVDB), now shuttered. Now random vulnerability-related Tweets and discussion. osvdb.org Joined January 2009

Tweets

6K
Followers

7K
Following

17
Likes

4

Dave Aitel @daveaitel

6 years ago

this maybe the worst modern paper on the subject of vulnerabilities and cyber norms cfr.org/blog/three-mea…

1 3 9 0 0

Some of the most egregious findings from a study of the world's 100 largest airports: ▪️100% of the mobile apps contain at least five external software frameworks. ▪️100% of the mobile apps contain at least two vulnerabilities. scmagazine.com/home/security-…

1 20 10 0 0

Yoav Alon @yoavalon

6 years ago

@dvyukov "modest estimation, syzkaller have found more than 1000 security vulnerabilities"

1 2 8 0 0

Download Image

Dark Reading @DarkReading

6 years ago

Massive Oracle Patch Reverses Company's Trend Toward Fewer Flaws ow.ly/wGef50xYyFz by @roblemos #Oracle #patching #vulnerabilities #software

0 5 4 0 1

Chris Eng @chriseng

6 years ago

The new RCE in Citrix is... a directory traversal?! Goddammit people. Will you ever learn? 😥

TrustedSec @TrustedSec

6 years ago

The new RCE in Citrix is... a directory traversal?! Goddammit people. Will you ever learn? 😥

15 444 799 0 72

5 36 113 0 1

Tim Willis @itswillis

6 years ago

At Google Project Zero, the team spends a *lot* of time discussing and evaluating vulnerability disclosure policies and their consequences. It's a complex and controversial topic! Here's P0's policy changes for 2020 (with our rationale for the changes): googleprojectzero.blogspot.com/2020/01/policy…

4 166 514 0 32

Abolish & Reform Are Not The Same @mrmoneda

6 years ago

"The products saturating our lives are released in the worst, most broken, untested, and often dangerously flawed forms imaginable. Think Skynet, but a dumbass."

Violet Blue® @violetblue

6 years ago

"The products saturating our lives are released in the worst, most broken, untested, and often dangerously flawed forms imaginable. Think Skynet, but a dumbass."

0 4 17 0 1

0 7 7 0 0

OSVDB @OSVDB

6 years ago

Dept Homeland Security Pitches Cyber Vulnerability Disclosure Policy - bit.ly/2tZKbly

0 0 1 0 0

hackerfantastic.x @hackerfantastic

6 years ago

If you are depressed this Christmas, just remember that one inebriated developer committed the heartbleed vulnerability to OpenSSL during their festivities, always check those late at night new year's eve open-source commits!

3 65 268 0 3

jericho @attritionorg

6 years ago

And @CVEnew is still publishing IDs that do not have provenance of the vulnerability. This should be a serious concern to anyone that works with vulnerability intelligence.

1 2 0 0 0

thaddeus e. grugq @thegrugq

6 years ago

It’s a poorly kept secret that some great Android 0days come from upstream patches. CVE fixes in mainline don’t always make it into Android, so it’s free vuln research.

Ben Hawkes @benhawkes

6 years ago

It’s a poorly kept secret that some great Android 0days come from upstream patches. CVE fixes in mainline don’t always make it into Android, so it’s free vuln research.

0 18 55 0 5

2 20 65 0 2

Ian @palleiko

6 years ago

Bug bounty reports be like: I've got arbitrary vibration execution on any cell phones if I know as little as a phone number

5 46 334 0 1

Steve Christey Coley, BS 🐀 @SushiDude

6 years ago

There's a "security.txt" proposal to IETF (the RFC ppl) for a robots.txt-like way for researchers to contact website owners about vulns. Comment needed ASAP, and anybody can comment via email! Personally I'm for @securitytxt. Make vuln reporting easier! mailarchive.ietf.org/arch/msg/ietf-…

0 4 9 0 0

Ridgeback111 @Ridgeback111

6 years ago

Linux ProTip: sysctl -a | grep rp_filter If any values are 2, you may be vulnerable to hijacked VPN(OpenVPN/IPSec/Wireguard/etc) tunnels. Set rp_filter to 1 please. Ref: CVE-2019-14899 #stayfrosty #linux #vpn #security #networks

0 23 24 0 3

Matt Austin @mattaustin

6 years ago

I wanted to fully test this “Responsible Disclosure” theory so I submitted a one click RCE in Microsoft Teams to #msrc on Sep 01, 2018. It is still open. The disclosure policy of @taviso and others gets bugs fixed. This does not.

9 56 186 0 3

Katie🌻Moussouris (she/her/she-ra/she-hulk) 🪷 @k8em0

6 years ago

Summary: ✅Yes PoC helps bad people do bad things faster ✅Defenders need the PoC more than the attackers do, even though both sides are helped by its release ✅Giving defenders even slight edges over the majority of criminal attackers is net good ✨Non disclosure is far worse

10 62 177 0 10

Dozer Cat @dozercat31

6 years ago

Tired of S3 buckets getting created as public? I put together a Python script that can go into a Lambda function that closes them. I've found this helpful for environments where S3 buckets don't need to be public within an AWS account. #AWS github.com/hackersifu/s3l…

3 18 53 0 11

Tim Brown @timb_machine

6 years ago

$iot->burn($garbage); # Periodic reminder that IOT is terrible. Reversing a phone firmware, after unpacking the proprietary blob I find a bug that was previously reported 4 years ago. Tracking the supply chain, I am now 3 deep. We need software BOMs and reproducible builds ASAP

0 1 8 0 0

Hot Fiendish Dr. Noid Summer @_noid_

6 years ago

After some peer discussion, I've decided to follow Google's timeline for disclosure of vulnerabilities being publicly exploited in the wild, which is 7 days. I have the advisory written up and will disclose on November 20th, unless @KeybaseIO wishes to engage further

1 7 29 0 1

Hot Fiendish Dr. Noid Summer @_noid_

6 years ago

I'm assuming the lack of follow up form @KeybaseIO means I can chat about the issue I reported to them that they don't think is a big deal. I'm gonna have to write this one up