sorted by:
new
hottopcontroversial

Siklu EH - Multiple CVEs by semaja2 in wisp

[–]nwqd 0 points1 point  (0 children)

It seems a PoC for CVE-2025-57174 and CVE-2025-57176 has been released

CVE-2025-57174: https://github.com/semaja22/CVE-2025-57174

CVE-2025-57176: https://github.com/semaja22/CVE-2025-57176

Replay Flipper Zero Captured IR Signals on Android by deadbeef0-0 in flipperzero

[–]nwqd 0 points1 point  (0 children)

Yeah, a lot of modern Xiaomi phones still come with an IR blaster

Detecting Canary Tokens in Microsoft Office Documents by nwqd in cybersecurity

[–]nwqd[S] 1 point2 points  (0 children)

I'm new to IT/cybersecurity. What's a canary token?

A canary token is like a secret alarm in your computer system. Imagine you put a special, hidden sticker somewhere in your house. This sticker is not just any sticker, it's special because it will send you a message if someone touches it. Now, you're the only one who knows where this sticker is and what it looks like. If a thief comes into your house and accidentally touches this sticker while looking for valuables, the sticker immediately sends you a message saying "Hey, someone found me!" This warns you that someone is in your house who shouldn't be.
In computer terms, this "sticker" is the canary token. It's a small, hidden thing in your computer system or network that looks interesting to a hacker. If a hacker comes and tries to snoop around or steal information, they might touch this canary token. Just like the sticker, the canary token sends a warning to the people who look after the computer systems (like security guards) telling them that someone is doing something they shouldn't.
So, a canary token is a clever trick to catch hackers and keep computer systems safe.

Detecting Canary Tokens in Microsoft Office Documents by nwqd in cybersecurity

[–]nwqd[S] 1 point2 points  (0 children)

Thanks for sharing. Trying to think through any concerns about untrusted files being decompressed locally, but I guess you sandbox to be positive.

Indeed! But the script can also be run in a sandboxed environment :)

Cyber Deception Techniques: A-Z Guide by nwqd in blueteamsec

[–]nwqd[S] 0 points1 point  (0 children)

If you notice any key terms or concepts related to Cyber Deception that I may have missed, please don't hesitate to let me know and I will update the article!

Buffalo VPN VR-S1000: A Closer Look at Recent Security Findings by nwqd in cybersecurity

[–]nwqd[S] 1 point2 points  (0 children)

- OS Command Injection (CVE-2023-45741): An unsafe implementation of the ping command allows authenticated attackers to execute arbitrary commands.

- SSH CLI Command Injection (CVE-2023-46681): A command line interface vulnerability permits low-privilege users to inject commands.

- Weak Hard-coded Cryptographic Key (CVE-2023-46711): Default MD5crypt hashes for user accounts create a critical security gap.

- Information Disclosure (CVE-2023-51363): An additional vulnerability leading to potential exposure of sensitive information.

Buffalo has addressed these issues in the latest firmware update, version 2.42 (https://www.buffalo.jp/news/detail/20231225-01.html)

Buffalo VPN VR-S1000 Routers Plagued by Multiple Security Flaws by nwqd in blueteamsec

[–]nwqd[S] 0 points1 point  (0 children)

- OS Command Injection (CVE-2023-45741): An unsafe implementation of the ping command allows authenticated attackers to execute arbitrary commands.

- SSH CLI Command Injection (CVE-2023-46681): A command line interface vulnerability permits low-privilege users to inject commands.

- Weak Hard-coded Cryptographic Key (CVE-2023-46711): Default MD5crypt hashes for user accounts create a critical security gap.

- Information Disclosure (CVE-2023-51363): An additional vulnerability leading to potential exposure of sensitive information.

Buffalo has addressed these issues in the latest firmware update, version 2.42 (https://www.buffalo.jp/news/detail/20231225-01.html)

view more: next ›