Gallagher

Self-replicating Shai-hulud worm spreads token stealing malware on npm | ReversingLabs | ReversingLabs RL researchers have detected the first self-replicating worm compromising popular npm packages with cloud token-stealing malware.

👀
www.reversinglabs.com/blog/shai-hu...

Every Monday morning.

Turn on PSK Reporter spots and you can see in near real time how far your signal is being heard :) I use it to see how I need to adjust my power output up or down depending on band conditions.

Buying browser extensions for fun and profit An investigation into buying access to browsers through extensions

I acquired a Chrome extension for $5 and began redirecting the browsing traffic of existing users to whatever I wanted.

While doing so, I caught an ownership transfer of an extension with 400,000 installs that folks should be aware of.

www.secureannex.com/blog/buying-...

“The Enemy of Art is the Absence of Limitations” - Orson Welles

How to detect malicious browser extensions using Elastic Learn how the Elastic Infosec team created a full inventory of all browser extensions using osquery and Elastic Security with examples on building detections to alert the security team when a known…

If you use Elastic, @acjewitt.bsky.social wrote up how you can use their osquery based agent to get an inventory of browser extensions in your environment allowing you to know what is installed by your users no matter what browser. More with Elastic to come 👨‍🍳

Has anyone found the new DOGE server they installed at the Treasury Department on Shodan yet? 🤔

Announcing the Elastic Bounty Program for Behavior Rule Protections — Elastic Security Labs Elastic is launching an expansion of its security bounty program, inviting researchers to test its SIEM and EDR rules for evasion and bypass techniques, starting with Windows endpoints. This initiativ...

www.elastic.co/security-lab...

Congrats my friend! 🙂

🥲

nailedit

www.joanwestenberg.com/modern-work-...

I'm watching some folks reverse engineer the xz backdoor, sharing some *preliminary* analysis with permission.

The hooked RSA_public_decrypt verifies a signature on the server's host key by a fixed Ed448 key, and then passes a payload to system().

It's RCE, not auth bypass, and gated/unreplayable.

A darker image of space that contains a number of stars and reddish clouds of gas. The clouds become pretty dense across the lower right corner. A cluster of bright stars at the top appear to be embedded in and very near one of the gas clouds by the way their light reflects off of it.

One of my hobbies outside of Infosec is astrophotography and this is one of the most recent images I have captured. I am still learning, but I am pretty happy with the way this turned out and wanted to share. This is the center of the Heart Nebula and was about 3.5 hours of exposure time (52 x 240s)

On BlueSky we don't tweet, we post. Tweets go viral so what do posts on BlueSky do? Do my posts go "Stratocumulus" now vs "viral" ?

Will the cool kids be going around and saying, "My post went nimbus!"