Follow #infosec from Mastodon or any other Fediverse app and its public posts arrive in your timeline. No vutuv account needed.
@infosec@tags.vutuv.de
Mirko Wollenberg Senior Consultant @ DFN-CERT Services GmbH
27 posts
Cyberangriff auf Uni Leipzig: Studierende ohne Zugriff auf Noten, Bescheinigungen und Stundenpläne
Zwei Tage nach dem Angriff arbeitet die Universität weiter an der Wiederherstellung ihrer IT. Während die Ursachen noch untersucht werden, häufen sich die Einschränkungen im Studienalltag.
The more I think about it, the more this makes me angry.
I have had jobs with leadership who treat people like this. It damages your health (mental, physical, and emotional).
And in a market like ours, I suspect there are a lot of people at Proton who have pits in their stomachs. They’re expressing their pain to their partners, or kids, or friends. Feeling trapped.
This is what emotional abuse, toxic masculinity, and tech-bro capitalism look like. I’m tired of people thinking ethics and technology aren’t intersectional. They are.
Fuck Andy Yen, and fuck @protonprivacy@mastodon.social.
🧵 2/2
Universität Leipzig
Die Universität Leipzig ist weiterhin mit ihrer Webpräsenz komplett offline. Wenig Informationen, eine kleine FAQ. Ansonsten keine Hinweise darauf, ob Daten abgeflossen sind, ob es ggf. sogar eine Erpressung gibt.
Ich sehe auch keine große Berichterstattung darüber. 🙄
Imagine trusting your privacy with a company who favors speed over integrity.
A @protonprivacy@mastodon.social employee cautioned against releasing new code that wasn’t properly tested. Andy Yen responded to all Proton employees:
“That’s bullshit and loser thinking. Of course it’s possible to be fast and secure. Stop thinking always of how to be slower, and focus more on how to be faster. Only losers think like that. Stop lovingly handcrafting all our code and use AI more.”
Some of us keep warning folks to avoid Proton. Unfortunately, others, like trusted source @privacyguides@neat.computer, ignore the red flags and recommend it anyway. If you use Proton, you’re at risk.
404media.co/manifestos-fear-and-loser-t…
🧵 1/2
Mark Wyner Won’t Comply
@markwyner@mas.to
For anyone who still thinks Proton is all that:
🔥🔥🔥🔥🔥🔥🔥🔥🔥
» Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents | WIRED
wired.com/story/…
Nach Hackerangriff: Uni Leipzig ist offline
Die Universität Leipzig ist gehackt worden. Alle Server mit Internetverbindung sind offline. Wie ist die Uni zu erreichen?
😬
Google kann Daten aus Gmail und Fotos für personalisierte Werbung nutzen
Google kann Daten aus Gmail, Drive und Google Fotos künftig auch für personalisierte Werbung verwenden, wenn User sie für andere Google-Dienste freigeben. Das betrifft etwa Googles “Personal Intelligence”. In der Schweiz ist die entsprechende Verknüpfung derzeit nicht verfügbar.
Entweder wird die aktuelle Woche noch spannender. Oder es passiert ausnahmsweise mal gar nichts #infosec
Ganz schön viele…
Ich fand es ja witzig, als es in den Nachrichten hieß, die meisten Seiten seien nach dem Patch wieder online.
Tja, die meisten Seiten, die noch zu patchen sind, waren nie offline 🤷
🔐 The offline master keys were not offline. Zimmer, who ran the largest group of hijacked Tor relays, said so in his post-mortem. Copies sat in a backup on his management server, encrypted with a password the attacker already found. 😬
He was just as blunt about the cause: The root cause was ours: one password reused for SSH login, sudo, and the backup passphrase, stored in plaintext on both servers, plus SSH password authentication left enabled on the internet-facing management server. Credit to him for putting that in writing. 👏 I’d guess plenty of servers out there would earn the same sentence, maybe a few of yours.
In early October, attackers took over more than 300 Tor exit relays and rerouted SSH connections to 12 interception servers. At the peak on October 4, those relays carried 7.46% of Tor’s exit capacity, according to an analysis of public directory data. Zimmer’s own break-in came earlier. On August 28, the attacker logged into his management server with the account password on the first try and gained root within five minutes.
The victims got hit through passwords too. To get burned, you had to accept the interceptor’s host key and type a password. Some people saw an OpenSSH warning that the server had changed… others just got the usual prompt to accept a new key. If you used key-based login, the attacker couldn’t pass it through to the real server because the signature is tied to that session.
The backdoor is Ebury version 1.8.3, a single library file that leaves the packaged library alone, so the normal package checks come back clean. Zimmer’s servers showed none of the host-level signs on the Tor Projects checklist. The only thing that gave it away was the changed exit policy.
🚨 If you run anything with SSH open to the internet, turn off password login and use keys. If you accepted an unfamiliar or changed host key over Tor between October 1 and 5, assume that password is stolen, change it, and check the server. And if you’re poking around a box you suspect, log in with a key, since Ebury captures typed passwords.
Nobody knows yet how the other 58 operators got hit. On FranTech, the network behind BuyVM, 71 of 101 relays switched to the attackers’ policy, compared with 13 of 9,054 hosted elsewhere. The researcher who spotted this asked whether the attackers got in at the hosting provider level, and so far nobody has answered.
PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches
PHP warns CVE-2026-115560 may enable code execution in unusual session setups and advises disabling session upload progress pending a routine fix.
Oh, the story continues…
#git command https remote is affected by the #brotli buffer overflow vulnerability CVE-2026-111497 since it enables compression support:
github.com/git/git/…
github.com/git/git/…
Make sure to update brotli as soon as possible.
The French courts yesterday handed down an unfavorable ruling against Quad9 in a major case that undermines the transparency and stability of the internet. As a result, Quad9 will no longer be able to offer its free cyberprotection service to users located in France effective November 24.
Les tribunaux français ont rendu hier une décision défavorable à Quad9 dans une affaire majeure qui porte atteinte à la stabilité de l’Internet. À compter du 24 novembre, Quad9 ne sera plus en mesure d’offrir son service gratuit de cyberprotection aux utilisateurs situés en France.
a reminder that if you see a vendor having an unscheduled outage today to apply PHP patches - that is actually one of the most encouraging things you can see from an #infosec perspective, because it means
A) someone/some people at the vendor is paying attention
B) that person/people has enough sway to have them bring down prod in the middle of the day to apply patches
C) enough people at the vendor actually know what software they are running to know its an issue that needs to be dealt with
So, reach out to them and let them know you appreciate it - so they have something to show people who push back the next time a similar thing happens
The reason I posted this yesterday is that I suspended hundreds of accounts, just as @jerry@infosec.exchange did. And other moderators as well.
Important: this is NOT an issue with Mastodon. Or the fediverse. It’s a common thing that happens when passwords are compromised and folks use the same ones for many or all of their online accounts. Mastodon is simply one of the targets at the moment.
For server admins, Jerry has a script that will reset passwords on dormant accounts. I highly recommend running this on your instance.
Mark Wyner Won’t Comply
@markwyner@mas.to
Y’all! Please, please, please use appropriate passwords. We’re seeing a big spam campaign across the fediverse, using hacked accounts.
Y’all! Please, please, please use appropriate passwords. We’re seeing a big spam campaign across the fediverse, using hacked accounts.
First, change your fediverse password. Especially if it’s reused elsewhere, short/weak, or really old.
Then, here are some simple steps to protect you and your accounts:
Never reuse passwords. Use a password manager so you’ll only have to remember one password.
Make sure your passwords are secure. They should be 12+ characters with at least one capital letter and one special character. Good password managers have a generator built-in.
Set-up multi-factor authentication (MFA/2FA).
Use passkeys wherever possible.
If you need help, ask someone. Folks who know will help.
🚨 Rapid Response | Collabora Online Built-in CODE Server OS Command Injection (CVE-2026-110447) (CVSS 9.2) is a critical OS command injection vulnerability affecting the Collabora Online Built-in CODE Server app for Nextcloud. Exploitation in the wild has been reported, allowing unauthenticated attackers to execute operating system commands.
Censys currently detects 19,454 Internet-exposed hosts and 103,350 web properties with the app installed. These figures represent detected installations, not confirmed vulnerable instances.
Organizations should upgrade to version 26.4.303 or later, or remove the app. Disabling it is not sufficient.
Full Censys ARC advisory, including affected versions, exploitation indicators, and remediation guidance: censys.com/advisory/…
Heads up for fellow Linux admins: CVE-2026-99999 (dubbed “PwnEscape”) is out, and it is a nasty one (CVSS 9.3).
Despite being called a KVM escape, the actual bug lives in the host IPv4 networking stack. Untrusted CHECKSUM_PARTIAL offload metadata from a guest can overwrite already-validated packet headers during ip_do_fragment(), leaking host memory or allowing a guest-to-host escape.
Mainline patches landed Oct 14, and stable backports are out. Check your hypervisors and reboot!
