Taggart :donor:

Displaced Philly boy. Threat hunter. Streamer. Educator. Dad. Captain in the fight against #llm insanity. #infosec, #programming #rust, #python, #haskell, and #webapp. #opensource advocate. Cofounder of The Taggart Institute (npub1mgl…z233). Made [wtfbins.wtf](https://wtfbins.wtf ). Not your bro. All opinions my own. #fedi24 #searchable

Website: https://taggart-tech.com
The Taggart Institute: https://taggartinstitute.org
YouTube: https://youtube.com/@TheTaggartInstitute
GitHub: https://github.com/mttaggart
Pronouns: he/him

Public Key

npub14xx8pgqrkzr5wg8afzflp2724gjyvyxurhrfyk9739fu892p2evqhwcfzw

NIP-05 Address

mttaggart_at_infosec.town@momostr.pink

Profile Code

nprofile1qqs2nrrs5qpmpp68yr753yls40925fzxzrwpm35jtzlgj57rj4q4vkqc7lt68

Author Public Key

npub14xx8pgqrkzr5wg8afzflp2724gjyvyxurhrfyk9739fu892p2evqhwcfzw

Show more details

Published at

2024-09-17T21:44:58Z

Kind type

0 Metadata

Event JSON

{ "id": "c08d589a5e919b66b9be3494abddb6cc74fe3f89251253107b02eb20cf1292ca", "pubkey": "a98c70a003b0874720fd4893f0abcaaa244610dc1dc69258be8953c395415658", "created_at": 1726609498, "kind": 0, "tags": [ [ "emoji", "donor", "https://media.infosec.town/media/ebb68425-c529-4ea8-86b7-2e82e2b4c029.png" ], [ "t", "llm" ], [ "t", "infosec" ], [ "t", "programming" ], [ "t", "rust" ], [ "t", "python" ], [ "t", "haskell" ], [ "t", "webapp" ], [ "t", "opensource" ], [ "t", "fedi24" ], [ "t", "searchable" ], [ "proxy", "https://infosec.town/users/9ehji4uld9", "activitypub" ], [ "L", "pink.momostr" ], [ "l", "pink.momostr.activitypub:https://infosec.town/users/9ehji4uld9", "pink.momostr" ], [ "-" ] ], "content": "{\"name\":\"Taggart :donor:\",\"about\":\"Displaced Philly boy. Threat hunter. Streamer. Educator. Dad. Captain in the fight against #llm insanity. #infosec, #programming #rust, #python, #haskell, and #webapp. #opensource advocate. Cofounder of nostr:npub1mglxsy2zlzkshk8876h5jg5we6gutx8gwu56futa3wrz4pdm885s4ez233. Made [wtfbins.wtf](https://wtfbins.wtf ). Not your bro. All opinions my own. #fedi24 #searchable\\n\\nWebsite: https://taggart-tech.com\\nThe Taggart Institute: https://taggartinstitute.org\\nYouTube: https://youtube.com/@TheTaggartInstitute\\nGitHub: https://github.com/mttaggart\\nPronouns: he/him\\n\",\"website\":\"https://infosec.town/@mttaggart\",\"picture\":\"https://media.infosec.town/infosec-town/media/df420a28-b2ab-40e4-a218-e1c260ec1728.jpg\",\"banner\":\"https://media.infosec.town/media/2f138fb1-bd3d-435c-abe5-a6628aa77e0e.png\",\"nip05\":\"mttaggart_at_infosec.town@momostr.pink\"}", "sig": "554cb7721ba79887f816b4f620e0eea0872bf5f9f0396b3eaa388e9fb048e006b66cc2b33c265613e1b79d72fbfa377b7e9b0da9bc5ae71d94801dda3dc87b62" }

Last Notes

2024-09-05 16:57:52

Now is not the time for thoughts and prayers; now is absolutely the time for yelling, barking, hissing, throwing paint at anyone trying to silence cries for gun control. You are in the way of protecting kids and teachers, and it is intolerable.

2024-07-10 03:46:08

Nifty. A RADIUS flaw that leads to auth bypass. https://www.blastradius.fail

2024-07-09 04:21:05

We're all lonelier than we want to be, and we all think it's our fault.
It isn't.
Modernity has been optimized for labor, not for life. The result is the destruction of spaces and institutions in which you can make new connections as an adult.
And in a very real sense, this is what the owners want—if you are alone, you cannot organize resistance to inhumane conditions. Instead, you spend your time further optimizing yourself for labor, telling yourself (and others on LinkedIn) that you are living the dream. It's someone's dream, alright.
I don't have a master plan for how to reclaim a sense of local community, but I know that without it, we'll never be as united or as strong as we could be.

2024-07-03 16:19:11

- reply

Misskey and forks are vulnerable.
> The recent CVE-2024-29510 vulnerability (Remote Code Execution in Ghostscript) has been found to be exploitable against Sharkey and other Misskey-based software under specific environments. This is not a vulnerability in Sharkey itself, but in an optional dependency that may be installed as a system library. The official Sharkey docker images are not vulnerable, but bare-metal installations may be affected.
>
> An instance may be vulnerable if:
> - libgs and imagemagick are both installed.
> - libgs is older than 10.02.1, 10.01.2, 9.55.0, or 9.50.
>
> __To check the version of libgs:__
> - Execute dpkg -l | grep -P "ii\s+libgs\d".
> - If no results are found, then libgs is not installed and not vulnerable.
> - If the third column starts with 10.02.1, 10.01.2, 9.55.0, or 9.50, then libgs is patched and not vulnerable.
> - Otherwise, libgs is vulnerable.
>
> To patch the vulnerability:
> - Update libgs to the latest available version. The instructions will vary between environments.

2024-07-03 15:53:10

This would lend credence to @GossiTheDog@cyberplace.social 's theory that tomorros's Masto patch is about this.
It also means for sure that Iceshrimp here is vulnerable, and...will it be patched in a timely manner? ¯\_(ツ)_/¯

2024-07-03 13:05:45

- reply

Do PHP's image functions rely on Imagemagick under the hood? If so, well, this is the Imagemagick issue we've all dreaded.
Update: No, it's libgd.

2024-07-02 16:22:10

Stopping the march of the lie machines is now a global existential priority.
> Google’s greenhouse gas emissions have surged 48 per cent in the past five years due to the expansion of its data centres that underpin artificial intelligence systems, leaving its commitment to get to “net zero” by 2030 in doubt.
https://archive.is/7ZbkA

2024-07-02 06:07:42

- reply

Not sure if you were able to go through that whole thread, but SSH can produce logs that F2B can use in this case. Additionally if patching is not an option, there's a potential mitigation to set `LoginGraceTime` to 0. Only problem is, that could introduce a DoS condition.

2024-07-02 05:46:54

- reply

We are! https://mastodon.social/@Viss/112712217279846315

2024-06-28 22:37:12

- reply

The Vergecast mentioned this integration in their coverage of the RIAA suit.

2024-06-28 22:12:07

Okay, who wants some handcrafted, artisanal #ThreatIntel? The latest versions of LummaStealer use `BitLockerToGo.exe` as a process hollowing/injection target to do its second stage work.
Detecting execution or network activity from this binary is high-fidelity. Nobody uses it in real life.
https://media.infosec.town/media/35e486de-f482-4e66-bd62-88ca9243d55e.png

2024-06-27 16:07:40

For the love of all that is holy, please ban TeamViewer in your environments.
https://infosec.exchange/@jtig/112689362692682679

2024-06-27 06:14:02

Sigh.
Another night of instability here on infosec.town. It's seeming to happen once everyone gets home and pops on to engage.
But what's more, I'm finding that blocks on here are essentially useless. Maybe that's a broader ActivityPub issue, but it's quite irksome to see posts from blocked accounts in boosts and searches.

2024-06-26 15:06:10

- reply

Sorry to jump in here, but Vivaldi does phone home to its sync services. There are also some Google services, especially on install, that do phone home. More details here: https://vivaldi.com/blog/decoding-network-activity-in-vivaldi/
With regard to privacy, usually Viv gets dinged from a fingerprinting standpoint. This is adjustable, but it is true that it is _less_ anonymous than something like Mullvad by default.

2024-06-24 15:24:46

Ugh, my loyal dual Dell 1080p monitors are giving out. Do I replace them? Go ultrawide? Especially for making video, what's the common wisdom here?

2024-04-21 15:25:21

Do you run a #Discord? Here's how to get #SpyPet out of your house.
https://media.infosec.town/media/374e2c96-4a7a-4f7b-941b-c93f4db5ac58.png

2024-04-20 03:13:41

So, about [this claim](https://www.darkreading.com/threat-intelligence/gpt-4-can-exploit-most-vulns-just-by-reading-threat-advisories) that GPT-4 can exploit 1-day vulnerabilities.
I smell BS.
As always, I [read the source paper](https://arxiv.org/pdf/2404.08144.pdf).
Firstly, almost every vulnerability that was tested was on extremely well-discussed open source software, and each vuln was of a class with extensive prior work. I would be shocked if a modern LLM _couldn_'_t_ produce a XSS proof-of-concept in this way.
But what's worse: they don't actually show the resulting exploit. The authors cite some kind of responsible disclosure standard for not releasing the prompts to GPT-4, which, fine. But these are all known vulns, so let's see what the model came up with.
Without seeing the exploit itself, I am dubious.
Especially because so much is keyed off of the CVE description:
> We then modified our agent to not include the CVE description. This task is now substantially more difficult, requiring both finding the vulnerability and then actually exploiting it. Because every other method (GPT-3.5 and all other open-source models we tested) achieved a 0% success rate even with the vulnerability description, the subsequent experiments are conducted on GPT-4 only. After removing the CVE description, the success rate falls from 87% to 7%.
>
> This suggests that determining the vulnerability is extremely challenging.
Even the identification of the vuln—which GPT-4 did 33% of the time—is a ludicrous metric. The options from the set are:
1. RCE
2. XSS
3. SQLI
4. CSRF
5. SSTI
With the first three over-represented. It would be surprising if the model did worse than 33%, even doing random sampling.
In their conclusion, the authors call their findings an "emergent capability," of GPT-4, given that every other model they tested had a 0% success rate.
At no point do the authors blink at this finding and interrogate their priors to look for potential error sources. But they really should.
So no, I do not believe we are in any danger of GPT-4 becoming an exploit dev.

2024-04-04 12:47:10

- reply

Yeah I'm very from Philly and I still know what that phrase means in most of the US, but I'm glad we got that sorted out.
We certainly agree about consumer routers, although I don't think everyone will be as lucky as to have someone like you around to install higher grade equipment.

2024-04-04 12:40:37

- reply

Interesting! So in wide swaths of the USA, that phrase is used as a sort of "Oh, you have no idea how pathetic you are" kind of shorthand, hence my response.

2024-04-04 12:26:57

- reply

Congrats? What a weirdly condescending reply!

2024-04-04 05:10:39

I don't know why I never experimented with UPnP directly, but wow is it super easy to just completely open a port right up. For some reason I thought it would be more involved than a few SOAP requests.

2024-04-03 13:08:25

- reply

Savage. Basically Microsoft has no evidence to verify its theory of the attack.
> Microsoft learned that, in 2021, Storm-0558 had accessed a variety of documents stored in SharePoint and assessed that the threat actor was specifically looking for information on Azure service management and identity-related information. Despite Microsoft’s pursuit of the 46 key-theft hypotheses, the Board assesses that Microsoft does not know how Storm-0558 obtained the 2016 MSA key. Microsoft stated in a September 6, 2023 blog post that the most probable way Storm-0558 had obtained the key was from a crash dump to which it had access during the 2021 compromise of Microsoft’s systems. However, Microsoft had only theorized that such a scenario was technically feasible in the 2016 timeframe. While Microsoft updated this blog on March 12, 2024 to correct its assessment of these theories, it has not determined that this is how Storm-0558 obtained the key.

2024-04-03 12:51:07

Direct link to the Cyber Safety Review Board report on the Microsoft breach by Storm-0558: https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review_of_the_Summer_2023_MEO_Intrusion_Final_508c.pdf

2023-09-15 09:01:01

Still thinking about this thing and what could have been.
https://en.m.wikipedia.org/wiki/One_Laptop_per_Child
https://media.infosec.town/media/86359069-daf6-41ab-afc6-425a96987fa0.png