Les rédactions francophones en #Belgique sont à la traîne en matière de #factchecking, comme le constate le magazine de l'Association des journalistes professionnels (#AJP) dans sa dernière édition. Pourtant, vérifier les affirmations qui circulent en ligne semble plus important que jamais dans un monde de plus en plus compliqué, où les décisions politiques, économiques et sociales sont davantage influencées par la #desinformation Alors que faire ?

1/4

Cat physics is mainstreamed with this paper in the new issue of The American Journal of Physics. Cats probably already know this and just haven't told us before now.

On Cat-Human Interaction from the Viewpoint of Physics: An Equation of Motion by Anxo Biasi. #ITeachPhysics #Physics #Cats #Caturday #CatPhysics #AJP

https://pubs.aip.org/aapt/ajp/article/92/11/827/3317285/On-cat-human-interaction-from-the-viewpoint-of

Would you like to make a meaningful impact on the lives of farmed #pigs? If so, we need you!

Public submissions are open for the #Victorian Parliamentary Inquiry into #pig welfare, which was initiated after #FarmTransparencyProject exposed the use of gas chambers in #Australian slaughterhouses. Chaired by #AnimalJusticeParty MP, #GeorgiePurcell, the inquiry will investigate the welfare of farmed pigs in #Victoria, and prepare a report suggesting improvements to the government.

Vegan Australia is preparing a submission that calls for an end to the breeding, using and killing of animals in #Australia. In order to ensure that the #vegan voice is fully represented, we want to encourage as many individuals as possible to write their own submission.

The deadline for submission is the 12th of January. For guidance in writing your submission, click through to this link:

https://mailchi.mp/veganaustralia/88digkpuuu

Let's work together to build a kinder world for pigs, and all animals.

#vegans #veganism #AnimalRights #AJP

Had a very interesting vuln disclosure experience today. I found a pre-auth RCE in F5-BIGIP admin panels (yes...the same one that's had RCE issues for years - there's more) with my coworker Thomas Hendrickson.

We went to report to F5 at the beginning of the month and had some back and forth with them over the disclosure timeline. We're not in a rush, we figured it would take a month or two to disclose, but they wanted to publish it in February 2024. That's a long time to wait for a pre-auth RCE bug, so we asked for it to be sooner, but with 48 hours notice so we could coordinate with our customers appropriately. They said they were fine with that.

Then last night at 8PM ET, we get an email that they're dropping the advisory + hotfix in 16 hours. We asked why and were told "we believe this vulnerability is now known outside of F5 and Praetorian thus forcing our hands at an immediate disclosure". The advisory was published a few hours ago - https://my.f5.com/manage/s/article/K000137353. No patch, but there's a hotfix you can run on some versions of F5s. A few versions have been marked as "will not fix", so this is a permanent way to pop them.

Simultaneously, a blog post that we referenced heavily for AJP Request Smuggling disappeared off the internet (the author locked every post they'd made since 2016). The posts were live 10 days or so ago.

It's likely all a huge coincidence - but regardless, if you want to read about a bug-chain to pop internet exposed F5 Management Panels or learn about AJP Request Smuggling, take a look over at https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/.

Once the patch has had a little bit of time to be applied, we'll drop the rest of the technical information about the bug.

If anyone here is aware of this being exploited in the wild, I'd love to hear about it. Tagging a few folks who are a bit more in the know (apologies if this is spammy, but I'm curious).

On the IoC side it's a bit tricky because the bug relies on abusing a bug in Apache, so I have no idea what it actually looks like in the logs. The raw request will have "Transfer-Encoding: <a valid value>, chunked" as one of the headers. For example "Transfer-Encoding: gzip, chunked" or "Transfer-Encoding: chunked, chunked".

I know it's no #citrixbleed, but this is a pretty bad bug if you're one of the thousands of orgs that still has an F5 config panel on the internet.

@GossiTheDog
@greynoise

#f5 #rce #vr #requestSmuggling #ajp #disclosure