Oneironaut

@Oneironaut@infosec.exchange
13 Followers
105 Following
1.4K Posts
GRC advocate. Cyber adjacent. Celine Dion fan
Oneironaut1h ago
Electronic Frontier Foundation2h ago
Flock Safety has built a system where ICE can access local police data via informal backchannels and abortion seekers can be tracked under the guise of “missing persons.” And they’re continuing to expand it. https://www.eff.org/deeplinks/2025/06/flock-safetys-feature-updates-cannot-make-automated-license-plate-readers-safe
Flock Safety’s Feature Updates Cannot Make Automated License Plate Readers Safe

Two recent statements from the surveillance company—one addressing Illinois privacy violations and another defending the company's national surveillance network—reveal a troubling pattern: when confronted by evidence of widespread abuse, Flock Safety has blamed users, downplayed harms, and doubled...

Electronic Frontier Foundation
Oneironaut1h ago
NefariousPlotter5d ago

A question for folks out there who read fiction. I am an indie author with a new book. I do not use AI in my writing. Should I put a note or sticker on the cover which says something like "This story is entirely human generated" or "no AI was used in the making of this book." Would readers be interested / reassured by knowing it is all human-made? My covers are also designed using photos I took myself.

Edit: Please boost for reach.

#IndieAuthor #Bookstodon

Oneironaut1d ago
Jeremy KahnJun 18

Seeing usually smart folks getting rope-a-doped into arguing for LLM utility like there's a moral justice zero-sum trolley-problem slider between "useful" and "ethical" and we're just arguing about the best setting

But the real problem is even dumber

-is its mere use a climate disaster? Yes
-is its data provenance founded on theft? Also yes
-will it be used to ruin ordinary workers' lives? Yup
-will it ruin countless organizations who think they're buying their way to cheap labor? That too

Oneironaut1d ago
Dissent Doe  1d ago

In August 2020, @SchizoDuckie and I published what was to become the first of a series of articles or posts called "No Need to Hack When It's Leaking."

In today's installment, I bring you "No Need to Hack When It's Leaking: Brandt Kettwick Defense Edition." It chronicles efforts by @JayeLTee, @masek, and I to alert a Minnesota law firm to lock down their exposed files, some of which were quite sensitive.

Read the post and see how even the state's Bureau of Criminal Apprehension had trouble getting this law firm to respond appropriately.

https://databreaches.net/2025/07/04/no-need-to-hack-when-its-leaking-brandt-kettwick-defense-edition/

Great thanks to the Minnesota Bureau of Criminal Apprehension for their help on this one, and to @TonyYarusso and @bkoehn for their efforts.

#dataleak #misconfiguration #incidentresponse #incidentmanagement #responsibledisclosure #securityalert #infosec

Oneironaut1d ago
Kevin Beaumont1d ago
Ingram Micro have been experiencing some kind of ’technical issue’, including of their corporate and orders website.
Oneironaut2d ago
Tuta2d ago

⚠️ In four days Gemini wants to scan your phone ⚠️

Stop #Google now: 👉 https://tuta.com/blog/how-to-disable-gemini-on-android

#GeminiAI #Google #Android #PrivacyMatters

Oneironaut3d ago
cR0w 3d ago

Unit42 published a pretty decent write-up on malicious lnk files. It includes IOCs for the specific lnk files referenced in the post, but the concepts themselves are more important than the IOCs.

https://unit42.paloaltonetworks.com/lnk-malware/

Windows Shortcut (LNK) Malware Strategies

Our telemetry shows a surge in Windows shortcut (LNK) malware use. We explain how attackers exploit LNK files for malware delivery. Our telemetry shows a surge in Windows shortcut (LNK) malware use. We explain how attackers exploit LNK files for malware delivery.

Unit 42
Oneironaut4d ago
JWcph, Radicalized By Decency4d ago

"These are terrible numbers, but also, these are some genuinely impressive accounting gimmicks...." - you can say that again, @pluralistic; I think anyone with an iota of common sense would agree that this bullshit should be illegal.

We cannot allow "By the authority vested in me by being rich I declare that I am now even richer!" randos to control the common, even global #economy.

It's fucking bonkers.

https://mamot.fr/@pluralistic/114776534107792989

#AI #tech #business #resist

Oneironaut4d ago
BrianKrebs4d ago

We say "fucking" to keep Google's AI from fscking up search results with AI. And now we can say "gravy" to throw off the AI scrapers?

Fucking gravy.

Thank you @aj for cluing me in.

https://bsky.app/profile/did:plc:n2okvbdq33c32ekbv6hfzdg2/post/3lsvh7cupqk2z

AJ Sadauskas (@ajsadauskas.bsky.social)

For anyone wondering why #gravy has been trending: AI hucksters are trawling through your social media posts for training data and trends. And you know what can gum up the gears of an automated sentence generator? Posts that use the word gravy out of context. #auspol #ChatGPT #AI #LLM

Bluesky Social
Oneironaut5d ago
Show threadDr. Cat HicksJun 28

If I have to see this goddamn "spatial ability" argument one more time. Get more specific. What type of spatial ability you absolute clowns. Exactly what task, and explain how you address the spatial ability conflation with gender problems. Explain why and how these diffs vanish when you include all the spatial tasks THAT RESEARCHERS REMOVED BECAUSE GIRLS WERE GOOD AT THEM

https://link.springer.com/article/10.1007/s10648-023-09728-2

Gender Differences in Spatial Ability: a Critical Review - Educational Psychology Review

Spatial ability has long been regarded as important in STEM, and mental rotation, a subcategory of spatial ability, is widely accepted as the cognitive ability with the largest gender difference in favor of men. Multiple meta-analyses of various tests of spatial ability have found large gender differences in outcomes of the mental rotation test (MRT). In this paper, we argue that more recent literature suggests that the MRT is not a valid measure of mental rotation ability. More importantly, we argue that the construct of “spatial ability” itself has been co-constructed with gender, and thus has not been devised in a neutral way, but in a manner that is influenced by gender beliefs. We discuss that though spatial thinking is also required in feminized fields, past research has cast spatial ability as only necessary in masculinized STEM fields. Due to a prevailing belief that spatial ability was an inherently male ability, researchers “selectively bred” some spatial assessment instruments to maximize gender differences, rather than to precisely measure a spatial construct. We argue that such instruments, of which the MRT is one, cannot validly assess between-group differences, and ideas about biological or evolutionary causes of sex differences in spatial ability lack empirical evidence. Instead, the co-construction of gender and spatial ability better explains observed patterns. We also provide recommendations for spatial researchers moving forward.

SpringerLink
×
Show threadKevin BeaumontJun 26
ReliaQuest are reporting with medium confidence that CitrixBleed2, Electric Boogaloo, is being exploited in the wild HT @CyberLeech https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/
Show threadKevin BeaumontJun 26
My view on that is I don’t have the data to back it up (because Citrix haven’t provided any way to identify exploitation, including to customers), but if true and the threat actor is running those tools with that provider, it’s probably a ransomware group again.
Show threadKevin Beaumont4d ago
Citrix blog on CVE-2025-5777 and some other ones https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/
NetScaler Critical Security Updates for CVE-2025-6543 and CVE-2025-5777

Over the past two weeks, Cloud Software Group has released builds to address CVE-2025-6543 and CVE 2025-5777, which affect NetScaler ADC and NetScaler Gateway if they are configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR an Authentication Authorization and Auditing (“AAA”) virtual server. While both of the vulnerabilities involve the same modules, the exposures differ. CVE 2025-6543, if exploited, could lead to a memory overflow vulnerability, resulting in unintended control flow and Denial of Service. CVE 2025-5777 arises from insufficient input validation that leads to memory overread. 

NetScaler Blog
Show threadKevin Beaumont4d ago

If you see this GitHub PoC for CVE-2025-5777 doing the rounds:

https://github.com/mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC-

It’s not for CVE-2025-5777. It’s AI generated. The links in the README still have ChatGPT UTM sources.

The PoC itself is for a vuln addressed in 2023 - ChatGPT has hallucinated (made up) the cause of the vuln using an old BishopFox write up of the other vuln.

GitHub - mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC-: 详细讲解CitrixBleed 2 — CVE-2025-5777（越界泄漏）PoC 和检测套件

详细讲解CitrixBleed 2 — CVE-2025-5777（越界泄漏）PoC 和检测套件. Contribute to mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC- development by creating an account on GitHub.

GitHub
Show threadKevin Beaumont4d ago
Evidence if anybody cares
Show threadKevin Beaumont4d ago

I’ve heard that Citrix are complaining me billing this CitrixBleed 2 is causing them reputational damage, and isn’t related in any way to CitrixBleed.

For the record - it was a dumb joke name to attraction attention for patching. I know it isn’t exactly the same cause.

But, ya know, it is a memory disclosure vuln which reveals sensitive info, and it does require ICA sessions be reset.. which only happened before with CitrixBleed.

Show threadKevin Beaumont1d ago
I expect technical details of CVE-2025-5777 exploitation to become available next week.
Show threadKevin Beaumont1d ago
Further suggestions CVE-2025-5777 details will release next week. https://xcancel.com/Horizon3Attack/status/1940879804221522279 via https://horizon3.ai
Show threadKevin Beaumont1d ago

I've published my scan in progress of CVE-2025-5777 patching status, listing IPs, hostnames, Citrix Netscaler build numbers and if they're vulnerable to CitrixBleed2.

The scan isn't finished yet so these are only about a quarter of the results - unfortunately my coding skills are shite and it's really slow - should be finished over weekend or early next week.

Also, the SSL certificate hostnames are separated by comma which throws out CSV - sorry, I'll fix that later.

https://github.com/GossiTheDog/scanning/blob/main/CVE-2025-5777-CitrixBleed2-ElectricBoogaloo-patching.txt

scanning/CVE-2025-5777-CitrixBleed2-ElectricBoogaloo-patching.txt at main · GossiTheDog/scanning

Contribute to GossiTheDog/scanning development by creating an account on GitHub.

GitHub
Show threadKevin Beaumont1d ago

If anybody is wondering btw it's 4047 definitely vulnerable (so far) from 17021 scanned instances - so 24% unpatched after about 3 weeks.

But scan is still running obvs so the vuln number will keep growing.

Show threadKevin Beaumont1d ago

If anybody likes stats

- Of the 42 identified NHS Netscalers so far, 37 are patched🥳 The NHS are really good at this nowadays.

- Of the 65 identified .gov.uk Netscalers so far, only 48 are patched 😅 All of the unpatched are councils, which are obviously severely budget constrained in many cases - I'm also not sure they actually know they're supposed to be patching.

Show threadKevin Beaumont1d ago

First exploitation details for CVE-2025-5777 - the Netscaler vuln - are out. https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/

If you call the login page, it leaks memory in the response 🤣

I don’t want to specify too much extra technical info on this yet - but if you keep leaking the memory via requests, there’s a way to reestablish existing ICA sessions from the leaked memory.

Show threadKevin Beaumont8h ago

Updated scan results for CVE-2025-5777: https://github.com/GossiTheDog/scanning/blob/main/CVE-2025-5777-CitrixBleed2-ElectricBoogaloo-patching.txt

It's still partial due to bugs, but about 18k servers.

scanning/CVE-2025-5777-CitrixBleed2-ElectricBoogaloo-patching.txt at main · GossiTheDog/scanning

Contribute to GossiTheDog/scanning development by creating an account on GitHub.

GitHub
Show threadSanCla 🤘8h ago
@GossiTheDog Thank god everyone patched this before the weekend 🫨😭
Show threadcR0w 1d ago

@GossiTheDog

Revisiting this quote here:

Some commentators have drawn comparisons between CVE 2025-5777 and CVE 2023-4966. While the vulnerabilities share some characteristics, Cloud Software Group has found no evidence to indicate that they are related.

Show threadChristoffer S.1d ago
@GossiTheDog From watchtowr: "As we have discussed previously, we have a moral compass next to one of our favourite magnets, and we use it to guide our decision-making process."
Show threadCyberstern1d ago
@GossiTheDog wow that’s wild! how can that even happen? Wait… i do NOT want to know… alone thinking about the code that could do such a thing hurts
Show threadSpace Invader1d ago

@dunkelstern thankfully, being closed source, no LLMs can be trained on the sort of code that reads a random chunk of RAM and returns it in the response.

But sadly, being closed source, there’s no way to gawk at the eldritch horror this must be.

Show threadLatte macchiato  1d ago
@GossiTheDog why is all the citrix software such a complete nightmare
Show threadfuzzyfuzzyfungus1d ago

@privateger @GossiTheDog It's honestly darkly impressive. ICA vs. RDP was a pretty compelling beatdown at one time; but that was a no, of course I'm not that old, time ago; and basically everything they've touched since is a matter of indifference or distaste.

Normally I'd jump straight to blaming the private equity knackers; but in this case I can see why they were headed to the bone mill.

Show threadRobert Gützkow1d ago
@GossiTheDog that's an impressively bad implementation error to have on the login page.
Show threadIntensityCubed1d ago
@GossiTheDog Will the cybercommunity keep CVE alive in some form?
Show threadAlex1d ago
@GossiTheDog would this take 3 out of 6 months to find perl developers or am I thinking of a different vulnerability?
Show threadKetumbra1d ago
@GossiTheDog I wish they'd just put autoupdates on these things for orgs who can't manage it manually. 5 Min downtime at midnight local timezone wouldn't hurt much - 1 month downtime because of ransomware compromise really will...
Show threadEdge 🇨🇦🇲🇽🇺🇦🏳️‍🌈1d ago

@GossiTheDog

I absolutely love how little of this I understand, but that it makes me go back through the whole thread, and now I've learned a whole new thing to be concerned about.

Show threadJP1d ago
@GossiTheDog thanks for validating my patching teams good work.
Show threadJason Tubnor 🇦🇺1d ago
@Jplonie @GossiTheDog Excellent news!
Show threadOriel Jutty 1d ago

@GossiTheDog The hostnames field can be properly CSV'd by something like perl -pe 's/,/,"/; s/(,[^,]*,[^,]*$)/"$1/'

(Assuming a unix-ish shell. With cmd.exe you probably have to turn the inner " into ^" and the outer ' into ".)

Show threadmeriksson1d ago
@GossiTheDog No wibecoding?
Show threadsusika512  🏳️‍🌈1d ago
@GossiTheDog excellent work 🤠
Show threadJason Haar 1d ago
@GossiTheDog use tab delimited. Almost no data contains tabs, much better than csv
Show thread_asterisk1d ago

@GossiTheDog

160.101.128.198,*.labstage.citrix.com,labstage.citrix.com,14.1-17.38,VULNERABLE

oof

Show threadineedsleeps4d ago
@GossiTheDog but they're good with the "Electric Boogaloo" subtitle?
Show threadcR0w 4d ago

@GossiTheDog

Some commentators have drawn comparisons between CVE 2025-5777 and CVE 2023-4966. While the vulnerabilities share some characteristics, Cloud Software Group has found no evidence to indicate that they are related.

Emphasis theirs. 🤣

Show threadKevin Beaumont4d ago
@cR0w lols. Like the way they don’t mention CitrixBleed, or the relationship of memory disclosure and sessions needing to be reset 🤣
Show threadcR0w 4d ago

@GossiTheDog I also like Cloud Software Group does not provide forensic analysis; however, customers can contact Citrix Customer Support to get access to IoCs.

And

Does CVE 2025-6543 constitute a zero day vulnerability?

Cloud Software Group became aware of limited exploitation activity before the patch was released.

Show threadKevin Beaumont4d ago
@cR0w don’t say the zero day word! They wouldn’t provide us any IOCs for CVE-2025-5777.
Show threadFabrice Roux  1d ago
@GossiTheDog @cR0w the zero day qualifier should only be used when the CVSS is well north of 10. 😬
Show threadmicrowavetacos4d ago
@cR0w @GossiTheDog the only IOCs they will release is via a technical support request for CVE 2025-6543 and is literally a script that looks for a handful of vulnerable conditions and file types in locations they shouldnt be. No public IPs, domains, filenames, etc
Show threadKevin Beaumont4d ago
@microwavetacos @cR0w yeah, they’re trying to obfuscate that one is RCE via webshell implant
Show threadmicrowavetacos3d ago
@GossiTheDog @cR0w forgot about this but might help some people patching this week now that there is an official notice. Patching defaults some CSP setting to "on" which can cause blank login pages after updating. Citrix engineer we talked to last week stated they were getting inundated with calls about it. It extended our downtime by about an hour until a team member figured it. Never roll back, power through!
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694826
Loading...

Show threadDan 🔓​, powered by sarcasm4d ago
@GossiTheDog shit software causes reputational damage
Show threadjust_one_bear4d ago
@GossiTheDog As with so much in this world: "The little stupid differences are outweighed by the big stupid similarities."
Show threadhe1ix4d ago

@GossiTheDog im surprised to read they care about their reputation.

That's really difficult to imagine, given their track record of security problems.

Show threadVarious_Canaries4d ago
@GossiTheDog What about "Electric Bugaloo?" Lmao I bet they love that
Show threadAmar Kulo2d ago
@GossiTheDog I would say that increasing licensing prices 240% in a Broadcom style does them more reputational damage than this
Show threadMartin Boller 🇬🇱 🇺🇦     1d ago
@GossiTheDog They should quit whining and do something about their crappy code + thank you for trying to get people to do something about it! Heck they should be sending you $$$
Show threadDrew Mayo4d ago
@GossiTheDog I appreciate you. I want to punch folks using ai to make up this shit.
Show threadManuel Tejera4d ago
@GossiTheDog Vibe coder strikes again.
Show threadfuzzyfuzzyfungus4d ago
@GossiTheDog Is it normal for the IoCs section to just be "we are committed to transparency" followed by "If you encounter issues when updating your affected builds or need access to IoCs, please contact Citrix Customer Support"?
Show threadBruce Heerssen1d ago

@GossiTheDog @CyberLeech

Doh!