#infosec

Boosted by

@bobdahacker@infosec.exchange · 2d ago

✈️ New Blog Post: Your Boarding Pass Is a Skeleton Key. Frontier Airlines Doesn't Care. Frontier's mobile API returns full passport numbers, home addresses, children's DOB, credit card details, and KTNs for any booking. The only auth? A PNR and last name. Printed on every boarding pass. Reported March 3rd. 105 days later, still live. They fixed the least important vuln and ghosted me on the rest. They also updated the website code and somehow made the leaks worse. Full writeup: https://bobdahacker.com/blog/frontier-airlines-hack #InfoSec #BugBounty #ResponsibleDisclosure #FrontierAirlines #Security #CyberSecurity #Privacy #Aviation #PCIDSS #DataExposure

32

0

55

0

BobDaHacker 🏳️‍⚧️

@bobdahacker@infosec.exchange · 3d ago

⚽ New Blog Post: I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID. Registered on FIFA's public Agent Platform, got added to their Entra tenant, and accessed the Streaming Management panel for every live World Cup 2026 match. RTMP ingest URLs, stream keys, all five camera angles. Confirmed live in VLC. An attacker could have replaced live camera feeds on TV worldwide. Full writeup: https://bobdahacker.com/blog/fifa-hack #InfoSec #BugBounty #ResponsibleDisclosure #FIFA #WorldCup #Security #CyberSecurity #RTMP #BrokenAccessControl

32

0

59

0

Boosted by

scuti🌱 @scuti@stereophonic.space

Joanie with the Good Hair 😷

@clickhere@mastodon.ie · 3d ago

Someone mentioned in passing during a meeting in work today that "going passwordless is inevitable" and that using biometrics and facial scanning to sign in to accounts will be necessary. I work in the data protection office (the GDPR kind), so I'm begging please someone tell me this is not true.. 😩 #GDPR #DataProtection #biometrics #InfoSec

9

1

9

0

Fedora Project

@fedora@fosstodon.org · 6d ago

PSA regarding a change in how Secure Boot will work in Fedora soon. The change isn't urgent, but it is something you should take a look at. If you have any questions about this, please ask in our forum. 🙏 ➡️ https://fedoramagazine.org/expiration-of-microsoft-secure-boot-keys/ Forum: https://discussion.fedoraproject.org/c/ask/6 #Fedora #Linux #OpenSource #Cybersecurity #InfoSec #SecureBoot

14

0

13

0

Boosted by

oxy :

: :

: @oxy@social.bsdlab.au

Shawn Webb

@lattera@bsd.network · 6d ago

#HardenedBSD 16-CURRENT OS installer images and updates published to account for recent #FreeBSD security advisories. #infosec

1

0

1

0

Metin Seven 🎨

@metin@graphics.social · Jun 11, 2026

#tech #technology #BigTech #data #security #privacy #safety #InfoSec #IT #surveillance #computing #digital #online #internet #web #cloud #meme

292

5

328

4

GradleSurvivor

@GradleSurvivor@lemmy.ml in privacy · Jun 03, 2026

WebRTC messenger architecture — sealed-sender push, encrypted signalling, looking for threat-model critique. Open Source GPLv3

A WebRTC messenger where message content never touches a server and the push layer can’t see who’s messaging whom Android app, solo-built. Trying to find out where the architecture breaks before I scale it. The core idea. Messages travel through direct WebRTC data channels (DTLS/SRTP) between two phones. No server stores, reads, or relays content. Group chats use a gossip protocol, sender fans out to a few reachable members who relay onward; members who come online late fetch missing messages from any peer who has them. The supporting infrastructure, and what each piece can see. Signalling: needed to set up any WebRTC connection. I use a Cloudflare Worker (ephemeral, nothing persisted). The SDP/ICE payload is encrypted with the recipient’s public key before it leaves the sender, and the two participants are addressed by opaque per-session hashes. The relay forwards ciphertext between un-linkable identifiers. Push wake-up: FCM, because Android. Sealed-sender design: the wake-up payload is encrypted to the recipient’s public key, and the sender’s identity is inside that envelope. The push layer sees who’s receiving (it must, that’s how push works), not who’s sending. The FCM request is also forwarded via a Cloudflare Worker so Google doesn’t see the sender’s IP either. TURN relay: Cloudflare again, for restricted networks. Carries encrypted packets only, like any TURN. The code is open source (GPLv3). I wrote a detailed white paper explaining the full architecture on my landing page: www.mindtheclub.com Mainly interested in where the design assumptions break. The sealed-sender piece, I’d like to know if the threat model I’m assuming there is too generous. #infosec #privacy #WebRTC #cryptography #Android #FOSS #PeerToPeer

7

3

0

Larvitz

@Larvitz@burningboard.net · Jun 10, 2026

ansible_jailexec 2.0.0 is out. It's security release. Versions <2.0.0 have a jail-escape bug: put_file followed symlinks placed inside a jail during a root-owned, host-side move, allowing arbitrary root writes on the host. All file transfers now run inside the jail via jexec, confined to its chroot. Advisory: GHSA-cxgv-hp74-jj7r Release: https://github.com/chofstede/ansible_jailexec/releases/tag/v2.0.0 #FreeBSD #Ansible #infosec

0

Dumb Password Rules

@dumbpasswordrules@infosec.exchange · Jun 07, 2026

This dumb password rule is from NBC (National Bank of Canada).

Password length must be 8 to 25 characters
Password must contain at least one lower letter (any position)
Password must contain at least one digit (any position)
Password cannot contain spaces.
Copy/paste is not allowed when trying to set a new password

https://dumbpasswordrules.com/sites/nbc-national-bank-of-canada/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

0

1

0

aria.DNE

@grim_elsewhere@lgbtqia.space · Jun 03, 2026

Hey #Infosec crowd: I'm looking to snoop on all network traffic coming to and from a device on my local LAN. It's not open source, unfortunately, and I'm trying to troubleshoot a syncing issue. I have the IP and MAC address for the device. I know that the device only powers on the wifi as needed. But I'm a bit out of my depth on this. Thanks in advance!

0

Boosted by

disregard Joe Groff @joe@f.duriansoftware.com

Caria Giovanni - Harpocrates

@Harpocrates@infosec.exchange · Jun 02, 2026

New preprint: AI_Bleeding — inference cost amplification via OOD linguistic payload

TL;DR: send queries in Grecanico or Farsi to an LLM endpoint → TTFT +59.8%, compute cost +2.8%, statistically significant. No vuln, no volumetric signature, evades all standard detection.

Worst case: exposed unauthenticated Ollama instance with num_predict=4096 + keep_alive=300s → Amplification Factor 17.56 Wh/KB. 3KB of attacker bandwidth → enough energy to charge a phone 5%.

Especially nasty for:

PA/judicial chatbots on fixed budgets
Pay-per-use API deployments with client-side exposed keys
PNRR-funded public sector AI with zero inference monitoring

Four scenarios: EDoS, browser JS distribution, Ollama open-proxy relay, frontier providers as involuntary relays.

All tests on self-hosted Ollama, no commercial endpoints touched.

Paper (CC BY 4.0): https://doi.org/10.13140/RG.2.2.26767.96166

#llmsecurity #infosec #threatmodeling #ollama #ood #AI #AIResearch #aisecurity

8

0

6

0

mkj

@mkj@social.mkj.earth · Jun 01, 2026

WTAF?! Getting locked out of your cloud-based password manager would be really quite inconvenient. Being locked out of it by the provider because of actions taken by an adversarial actor against your account would be rather worse! If you haven't, then please consider your backup plan for if you ever get locked out of the one service that lets you into for all intents and purposes everything else. Do you even have a current backup? https://www.theregister.com/security/2026/06/01/password-manager-dashlane-suspends-customer-accounts-amid-brute-force-attacks/5248991 #infosec #Dashlane #PasswordManager

0

Boosted by

oxy :

: :

: @oxy@social.bsdlab.au

BeyondMachines

@beyondmachines1@infosec.exchange · May 31, 2026

Critical Samba Printing Vulnerability Enables Remote Code Execution

Samba patched a critical remote code execution vulnerability (CVE-2026-4480) in its printing subsystem caused by improper sanitization of the %J substitution parameter. The flaw allows unauthenticated attackers to run arbitrary shell commands by submitting crafted print job descriptions.

If you run Samba file/print servers, immediately upgrade to versions 4.22.10, 4.23.8, or 4.24.3 to patch CVE-2026-4480, or as a quick fix remove the %J parameter from the “print command” line in your smb.conf file. Also disable guest access to printing and make sure your Samba servers are only reachable from trusted internal networks, never directly from the internet. #cybersecurity #infosec #advisory #vulnerability https://beyondmachines.net/event_details/critical-samba-printing-vulnerability-enables-remote-code-execution-o-j-r-w-v/gD2P6Ple2L

2

0

7

0

Boosted by

hypebot @hypebot@goingdark.social

mc.fly

@mcfly@milliways.social · May 26, 2026

The dutchies have a centralized identity that you are using to basically interact with everything government. That contains pensions and health related issues. This is called DigID. It is run by a company called Solvinity an was was supposed to be taken over by a U.S. company called Kyndryl. The dutch cabinet (= government) has now blocked this takeover. I think the topic of souvernty is slowly landing in the right heads. I guess also ... thank you @bert_hubert@eupolicy.social and everyone else making noise there🙂 https://nltimes.nl/2026/05/26/netherlands-blocks-us-takeover-digid-operator-solvinity-security-concerns #infosec #cybersecurity #souveraeneInfrastruktur #sovereignty #digid

215

18

173

1

🐈‍⬛David Sommerseth

@dazo@infosec.exchange · May 25, 2026

I always remap my sshd daemon to listen to a non-standard port, to reduce a lot of noise. Which has worked fine for years. But every now and then there are attempts. All the #Linux kernel flaws found lately has made remote login attempts more interesting for attackers. And they scan much more broadly now than just port 22. And that's why my second line of defence is to disallow remote root login - and also make use of the AllowGroups feature in sshd_config. Users granted remote access must be member of a specific group. And root is also excluded from this group. That pays off these days. And this is a nice filter match for #fail2ban and similar tools https://termbin.com/0cf6 I have 293 login attempts on "random users" since May 21. And 259 attempts as root. #infosec #ssh #sshd #systemhardening #kernel

6

2

0

dallo

@dallo@pouet.chapril.org · May 18, 2026

A security researcher says Microsoft secretly built a backdoor into BitLocker, releases an exploit to prove it

https://www.techspot.com/news/112410-security-researcher-microsoft-secretly-built-backdoor-bitlocker-releases.html

YellowKey exploit bypasses BitLocker full volume encryption via USB stick and WinRE

#privacy #security #infosec #technology #microslop #Microsoft #windows #Linux

37

6

61

0

Mike Sheward

@SecureOwl@infosec.exchange · May 14, 2026

Mini Pen Test Diaries Story: The year was 2010, and I was onsite at a UK local authority doing an internal network assessment. One of the tasks was - if given a standard, non-privileged, domain user account, with minimal access afforded to it - what could I do? Could I access sensitive documents? Could I login to systems I shouldn't be able to? Could I elevate myself. Standard stuff. I got my account, and immediately started fishing around the main file share with the users home directories on it. To my immense surprise, I found out that I was able to access the content of every single users home directory. Including all the top level folks. They must've accidentally given me some account in an IT group or something, so I check it out. Nope - groups look normal. The permissions on the share look pretty normal too. I play around with the account more and more and encounter zero resistance to anything, access wise. Something must be very wrong - but what? Finally I go over and speak to the IT people who I'd been working with. "So," I said. "This account, it's supposed to have a very minimal permissions set right?" "Yes, the lowest of the low." They reply. "So how come I can get into all these files?" I ask, and show them my rummaging around the very senior peoples confidential files. "You shouldn't be able to do that!!" Now, the three of us are rapidly trying to figure out what the heck is going on. It's surprisingly difficult to figure out. Eventually, I make what to this day remains one of my all time favorite pen testing discoveries. This organisation, had somehow, managed to add the entire "Domain Users" group to the "Domain Admins" group! All 1,500 people who worked there, had domain admin access. And after investigation, we found out it had been like that for 10 months. Someone couldn't get something working, until they found this "fix". Amazing. For more, slightly less mini pen test diaries stories, check out https://infosecdiaries.com #infosec #pentest #pentesting

37

4

20

0

Saphire Lattice

@saphire@dragon.style · May 08, 2026

According to https://letsencrypt.status.io/ "Stopping Issuance for Potential Incident - We have been made aware of a potential incident and are shutting down all issuance." Does that uh, happen often or? #letsencrypt #webdev #infosec

29

8

22

0

Анна

@hannaB@social.vir.group · May 08, 2026

The loudest security headlines are often just theater. The real failures are buried in neglected protocols, misconfigured systems, and the boring gaps no one wants to fund. Don’t let the spectacle distract you from the substance. #security #infosec #protocols

2

0

Saphire Lattice

@saphire@dragon.style · May 07, 2026

Well, the new Google ReCaptcha is awful, sheesh It's a QR code you have to scan with a "proper" device - aka with Google Services installed Goodbye last 10 years of phishing awareness, time to scan random QRs without a thought while you are purchasing things, woo! Seriously what were they thinking? And because it's recommended to be put in "high risk" places, people will expect them to be seen there, and so a scam/phishing QR will be so much easier to slip in. https://cloud.google.com/blog/products/identity-security/introducing-google-cloud-fraud-defense-the-next-evolution-of-recaptcha/ #google #captcha #recaptcha #phishing #infosec #cybersecurity

239

52

286

0

About This Hashtag

#infosec

WebRTC messenger architecture — sealed-sender push, encrypted signalling, looking for threat-model critique. Open Source GPLv3

Related