technion

The entire premise of Bimi is just EV certs all over again, wrapped up in an email security blanket. Naturally it starts with a cartel of limited approved CAs.

Why not? Those pros have their opportunity to use this exploit dwindling by the hour as news of this and pressure to patch grows and grows. All the major managed hosting companies had this patched in the first 24 hours.

I never mentioned unreleased private exploits, I mentioned what every thought leader and popular creative wants us to believe right now.

There is a lot of cynicism in this thread but the fact this is still open and hour later ends the narrative in my view. There are not "thousands of swarms of agents autonomously compromising every site for its authors" or any the other x / LinkedIn dribble ive been reading.

It clearly isnt happening.

Claude is absurdly sensitive to anything that touches cyber, and threatens bans if it gets a whiff of a pentest going on. it wouldnt surprise me if openai had a similar approach.

Yesterday I joked that claude gave me a cyber stop for asking how to make the anime girl video for an exploit, but it was a thing that happened. Meanwhile im trying to convince people around me that having grok nudify people isnt "fine" just because grok says it is. Its wild where the lines a drawn.

I'm sure there is more to it than generally "ask Claude". I asked Claude this as a joke and it downgraded all the way to Sonnet before it would answer, and I was previously approved for their dual use cyber program.

The latest POC video for the php2shell exploit features a dancing anime girl. How would you create a video like this?

In nearly every org I've been in or contracted to, the public landing page of the company gets a special place outside of any ops of general technical team, and is instead the work of a marketing group or a "creative" outsourcer who will default to Wordpress on PHP.

It's an Easter Egg, in the form of the text you see when you finish Minecraft.

https://theoutpost.ai/news-story/america-gov-ai-chatbot-trig...

Wait, they rebounded scout as autopilot?

As someone who works with Microsoft intune autopilot regularly... ugh.

I never thought I'd see a browser support list that specifically includes "Dilo" or, in the last few years, "Internet Explorer", but apparently you're comprehensive.

I went to look for unauthenticated CBC mode like every time I see this sort of thing but it's actually GCM mode so, well consider me surprised.

It's in the sysadmin sub because we are routinely the people told buy and manage Grammarly deployments, and we're the people generally cancelling those services now given everyone is being pushed to use their flavor of AI instead. And those emails from users upset that we're doing what management told us to do (following this Grammarly advice)? They go from end users to sysadmins.

The purchase of Tumblr was basically Elon purchasing Twitter without the political gain. I'm amazed the purchase decision was ever made, and more amazed that it still exists after the hit to the user base.

This might depend what you mean by code. In the sysadmin space I ask a web interface for poweshell to generate specific information multiple times a day, and pasting it into a terminal is really the cleanest workflow on a corporate machine where you have to justify running an executable.

Vmware vsphere is not at all in the consumer space where virtualbox exists.

Ai cant make a static HTML page sitting on something like cloudflare pages have an rce bug.

Every static HTML pages built this way with ai is another WordPress site that wont get built by contractors just to be neglected, compromised, and used to launch phishing and ransomware attacks.

To give my example, if you search for locksmiths or plumbers or any sorts of trades you'll land on a page for "small family locksmith in your small suburb name". Except the site has thousands of urls with the same exact content and pictures, one for every suburb in Australia. Gary the small business owner does not live in my street.

As far as I can tell its a national company with an overseas call center, the scam is that it looks like a local company - at least they can sell a lead gen to someone that can open my lock.

It's not just elderly parents. I've sat in on many an incident where skilled people in accounts or HR similarly saw and ad and thought "I have to do this thing", leading to compromise.

In the last twelve months ive had electricians, plumbers, kitchen renovators all work in my home while I was wfh. In an age gone by I would burn annual leave to deal with this. I dont know how I could handle the logistics of full in office again.

On one hand yes, but on the other hand just configuring your server to refuse connections by IP address rather than server name seemed to drop roughly half the bots I ever see.

I'm confused at the way they promoted it. Is there any way someone outside the company reading a Twitter post would consider this a positive thing for the product to be told what incentives the sales team get?

Im supposed to be doing endpoint work with people working in this field amd basically have to convince compliance they'll need to be local administrators to do their job. They get onsite and dont know what app they'll need until they look at a plc model. They'll download something from a .tw ftp server and its an unsigned executable that absolutely must run as admin to program these things.

It is amazing how much of the sysadmin community just doesnt believe this is a thing you need to work with, everyone insisting its just security people being lazy and so on.

Dies it matter? Im sitting on the ops end of this myself right now where marketing purchased something like 15 new domains on Godaddy and both me and the Web developers that built the new site found it the new product will live on those domains and launches today.

This is an entirely normal experience across every org ive worked in and unless im also surprise promoted to cto today I do not have an ability to question it.

As someone managing dns for a lot of orgs, the part that kills me is the amount of crappy sass'es that demand you add a big include to your spf. If they already have a skim record thats plenty to get mail through, except their validator wizard thing wont let you use the tool until it finds their string in your record. That means no flattening either.

Companies make this hard, a bit like various email scams where legit company communication comes from seemingly random domains (hello paypal). Often the company is legit, but theres no public contact that knows anything about the recruiter thats working for them.

Compromising a crappy wordpress site means compromising mailbox credentials.

https://lolware.net/blog/2020-09-02-autodiscover-circus/

This isn't LinkedIn specific - the easily misclickable "one click to logon with Google" button showing up in browsers was a huge mistake and should never have existed. Reddit has started prompting too if you're not currently logged in, to just suddenly be logged in with Google.

Making them "fashionable" seems to be a selling point, as seen woth the last advertising positioning largely to the woman's fashion industry. They are definitely aiming to not look like nerdy tech.

There's an astounding amount of .DS_Store showing up - I hadn't realised how common it apparently is for people to accidentally upload this.

Our helpdesk deals with 2-300 users per day that logon every single day yet forgot their password.

This type of thinking doesn't work in large enough orgs dealing with end users.