| Pronouns | He/Him/His |
| Website | https://www.infosecworrier.dk |
| Github | https://github.com/martinboller |
| ISO 3166 Alpha 2 | DK |
In this blog post, I will walk you through various techniques for abusing WSUS on Windows Server 2022. We'll start with the basics, explaining how WSUS works and why it is a valuable target. From there, I will demonstrate attacks such as delivering a malicious PsExec.exe as an update, ARP spoofing clients to serve rogue updates, and achieving local privilege escalation. I will also explore special configurations and scenarios that allow an attacker to upload custom payloads to WSUS and have clients download them.
A brief addition to the 50000 words I wrote earlier on the cloud: what is the European situation? Software Initially, companies and governments would buy licenses to software. You’d typically have a piece of software in your office, on one of your computers, to calculate payroll with. Most other computers would have copies of WordPerfect installed. This software would function for years without updates or maintenance. If WordPerfect-the-company would disappear, you would not even notice.
A brief addition to the 50000 words I wrote earlier on the cloud: what is the European situation? Software Initially, companies and governments would buy licenses to software. You’d typically have a piece of software in your office, on one of your computers, to calculate payroll with. Most other computers would have copies of WordPerfect installed. This software would function for years without updates or maintenance. If WordPerfect-the-company would disappear, you would not even notice.
If you’ve detected exploitation of CitrixBleed 2 aka CVE-2025-5777 I’d be interested to hear - Signal GossiTheDog.1337, obviously I won’t publish details.
I’ve already had one contact, which is an incident with a ransomware group initial access - I’d be interested to help people compare notes on IP addresses and such so there’s a common understanding of level of activity and scale of threat.
This Saturday 12 July Linux install parties in #Danmark and #Nederland (all times local)!
* AlsSund Linux User Group (#AlsLUG) #Sønderborg, 13h-16h
* Repair Café #Amsterdam, 13h-16h
https://www.repaircafe.org/cafe/linux-repair-cafe-amsterdam-javaplein/
For details and more events worldwide: https://endof10.org/events/
#EndOf10 #FreeSoftware #OpenSource #FOSS #Linux #GNULinux #Windows #Windows10 #Windows11
Attention server admins! Yesterday I've read a post by @simon_brooke how nasty AI scraper bots are attacking his self-hosted @forgejo instance. Soon after I'm seeing unusual, periodic traffic spikes on mine and again - dominated by OpenAI, but some other freeloaders too:
Scott Wilson
K. Reid Wightman 
🌻 
Lesley Carhart 
Ivan Ožić Bebek
bert hubert 🇺🇦🇪🇺🇺🇦
Kevin Beaumont
End Of 10 Campaign
Tom
Gytis Repečka20.171.207.41 GPTBot/1.2
85.208.96.211 SemrushBot/7~bl
54.36.148.64 AhrefsBot/7.0
114.119.139.53 PetalBot
With GPTBot and SemrushBot attacking hardest 
They've been hammering my little server periodically today as well, slowing down my instance dramatically as if I was experiencing malicious DDoS attack 
Well, in a sense it is one 
Watch out - it seems corporate AI techbros learned to scrape 
content and starts doing it on a massive scale 
Remember when @Codeberg was (and repeatedly is) hit?
For now blocked IP ranges and User-Agent combinations, not sure for how long that will be enough 
Please boost for visibility and be prepared!
#forgejo #developerlife #coding #attack #techbros #aislop #openai #bots #ddos
Scraping hits my server every 3 hours and lasts for about 30 min.
When I blocked IP range of OpenAI crawler (GPTBot), it immediately switched to another one. While these techbros publish their IP ranges, list is not complete and server admins around the world report more
Fuck you, Sam Altman, fuck you OpenAI, fuck all who work there and damn those who use their products.
Fuck whole AI industry that broke the internet 
Installed and configured Anubis to protect my Forgejo instance 
Will be monitoring closely - so far so good 
@forgejo Thanks for the details 
Will try to deploy Anubis - wasn't too excited about enforcing mandatory enablement of JavaScript, but for time being it seems there's no better choice
@forgejo @gytisrepecka @simon_brooke @Codeberg @mahlzahn
Yea in my case I think ironically me hosting my own private instance off the public internet may be priming me against it, as much as I don't like being super private.
@TimWardCam Because they have enough resources to burn - I'd guess it's good to report how many GBs scrapers ate for investors. You know, KPIs, milestones and all that crap 
@TimWardCam There is hardly any sanity when companies are sourcing for investment - anything goes, bright minds may have no word in it at all 
@gytisrepecka @simon_brooke @forgejo @Codeberg That sort of reminds me of that period in the 1980s when word processors were sold on the number of words in the spelling dictionary - the more the better, according to the marketdroids.
But do you really want the word "formicate" in your spelling dictionary (I see it's in this one). Isn't it far more likely to be an error for "fornicate"?
More isn't always better.
@TimWardCam @gytisrepecka @simon_brooke @forgejo @Codeberg because they are stupid and uncoordinated (lots of different scapers for competing firms).
What they obviously think they need to add is new content and the current approach is extremely inefficient both for themselves and the site they attack.
If we must have LLMs that are aware of news then cab I suggest a more efficient approach would be:
1) Sites periodically produce a diff that just shows what's new. For many sites this will be empty.
2) You have one bot that scans the sites on the web once and consolidates this into an archive of new stuff.
3) Bots from each LLM company scan that new stuff archive. They only do it when they need to build a new training set.
4) The original scanning and the cost of maintaining the news archive is paid for by the Bots owners according to their use.
Maybe they could work out something with the Internet Archive.
Same here. I think we're also running into some design decisions in forge software that rely on dynamic content generation, in-memory access to large Git binaries, and heavy computing resources just to distribute a single file.
Not blaming open source software here, but maybe it's time to rethink HTTP access perhaps going back to basics with static content for crawlers and reserving dynamic content for actual users.
Forgejo
S.R. Weaver
Tim Ward ⭐🇪🇺🔶 #FBPE
Simon Brooke
sleepfreeparent
MarjorieR
Alexandre Dulaunoy
CyberFrog
TFed 🍉🌻🚀
