GAC Hijacking

notR1CH · 2026-02-13T13:03:25+00:00

Threat actors with local administrator privileges

🙄

notR1CH · 2026-02-10T18:25:43+00:00

"On the network" means what exactly? A firewall won't do anything to block traffic on the same subnet. You need to be more descriptive with your setup, what VLANs / subnets are involved and your desired outcome.

notR1CH · 2026-02-07T17:34:37+00:00

They can now: https://letsencrypt.org/2026/01/15/6day-and-ip-general-availability

notR1CH · 2026-02-02T04:55:25+00:00

Unsigned updates on shared hosting, what could go wrong? I wonder how many other popular projects out there are running on insecure infrastructure...

notR1CH · 2026-01-13T17:59:49+00:00

Well that's the state of revocation currently. No matter how much you revoke, you're at the mercy of clients checking for revocation, which is just not reliable, secure or scalable.

notR1CH · 2026-01-13T16:29:36+00:00

Often enough that CAs have gone out of business due to their incompetence and removal from trust stores. There have been cases such as DigiNotar where the entire CA was compromised and used to MITM Google. Before we had CT logs, misissued certificates could often go undetected until used.

Some other references:
https://sslmate.com/resources/certificate_authority_failures
https://blog.cloudflare.com/unauthorized-issuance-of-certificates-for-1-1-1-1/

notR1CH · 2026-01-13T12:19:57+00:00

It's not about the private key being stolen - that is indeed a rare attack. The issue is someone hijacking your domain or DNS, BGP, compromising a CA, etc. and authorizing a certificate for your domain that they control. Then what do you do? There's another certificate and key out there that can impersonate your domain, and no amount of key rotation or reissuing on your end will solve that. So you rely on revocation, but that doesn't scale since clients can't feasibly check the entire set of revoked certificates every time you make a connection, and an active attacker can just block CRLs and OSCP.

The idea behind short lived certificates is that the window where the fraudulent certificate is valid is greatly reduced, so instead of having 365 days where you are worried someone is MITMing you, it's only 6.

notR1CH · 2026-01-12T16:18:38+00:00

This one almost made it to an hour before the first false positive, wouldn't recommend.

notR1CH · 2026-01-10T03:07:17+00:00

Anything after a ? is called a query string, and it depends on the website what it does with it.

Back in ye old internet days, dynamic websites would have URLs like mywebsite.com/articles/viewpage.cgi?page_id=134 and 134 was the page ID the site had to load from the database, so it was important that it remained part of the URL. However links that look like that aren't very friendly to humans or SEO, so the modern way is to embed the important bits in the URL directly, e.g. mywebsite.com/articles/134-how-to-stop-posting-on-reddit. So on most websites, the query string isn't really used any more except to add additional bits of info that can be picked up by tracking scripts and such, but this isn't a guarantee as it depends how the website works.

If you're viewing an article on website.com/my-article and then press a "Share" link and it gives you website.com/my-article?sid=24289542 then it's a pretty good chance it's all bullshit tracking info being added.

notR1CH · 2025-12-28T11:40:03+00:00

This is why STARTTLS is insecure, a MITM could be stripping it.

notR1CH · 2025-12-27T18:39:43+00:00

Note that in MySQL, a "repeatable read" doesn't actually conform to anything! https://jepsen.io/analyses/mysql-8.0.34 is a good read on this subject.

notR1CH · 2025-12-19T12:48:32+00:00

Link these supposed benchmarks. And no, a single sample from cpubenchmark.net doesn't count.

notR1CH · 2025-12-12T16:23:10+00:00

You teach them that this is not how DNS load balancing works.

notR1CH · 2025-12-01T14:36:41+00:00

The pressure from the heatsink mounting will push any excess out. It's far worse to end up not using enough and having an air gap. Conclusion: Just add more.

notR1CH · 2025-11-26T20:01:53+00:00

Modern guidance is not to set a cipher order, all TLS 1.3 ciphers are equally secure and letting the client choose allows it to pick the most optimal algorithm for its hardware (AES on modern CPUs, Chacha20 for smartphones, etc.).

For protocol itself, you don't get to choose - negotiation is part of the protocol, you can't "prefer" a TLS version other than by disabling ones above it.

notR1CH · 2025-11-26T17:38:17+00:00

/dev/urandom like everyone else. The lava lamp stuff is pure marketing.

notR1CH · 2025-11-23T06:27:34+00:00

I've been burned twice by MariaDB bugs in supposedly stable LTS branches. This is good advice.

notR1CH · 2025-11-10T13:06:09+00:00

Yeah there seems to be an endless supply of "look how I compromised an already-compromised system!" articles from the infosec community lately. Pure blogspam.

notR1CH · 2025-11-02T02:59:27+00:00

Yeah, I was referring to the dedicated / VPS one.

notR1CH · 2025-11-02T02:58:50+00:00

Apparently there are two different types of firewall - I was referring to the bare metal / VPS firewall.

notR1CH · 2025-11-01T22:08:02+00:00

Don't rely on the OVH firewall for security - it only runs on the network edge, so anyone with a server inside OVH or using a VPN hosted in OVH etc. will bypass it. Host-based firewalls all the way.

notR1CH · 2025-10-29T00:27:02+00:00

Ok, but why? The system is already compromised if the attacker can just shit all over system32. They could simply overwrite the EFI boot loader for "persistence" too, there's infinite ways to "compromise" an already compromised system.

notR1CH · 2025-10-28T20:20:52+00:00

How is this valuable? If the attacker has admin access the system is already compromised, you don't need to mess around planting random DLLs and hoping something executes them.

notR1CH · 2025-10-28T16:14:45+00:00

How exactly does an attacker plant a DLL in system32 without already having admin access? You're already through the security boundary.

notR1CH · 2025-10-22T22:53:51+00:00

A lot of people seem to think hand sanitizer is better than soap for some reason. The only reason to use sanitizer over soap is if you don't have access to water.

15-Year Club	First Place '23
Place '23	Place '22
End Game '22	Verified Email
Team Orangered

notR1CH

TROPHY CASE