nbd

@nbdsec@infosec.exchange
13 Followers
110 Following
39 Posts

I like security things.

Sharing is caring. Teaching is growing.

He/him

Imagine the shitshow we'd be in right now if ICANN hadn't been spun off from the US government

@RecklessPush38671 @jack_daniel

I've always said the same thing about the Indiana state motto: "Crossroads of America" because you're not supposed stop in the middle of the crossroads

🚨 Socket researchers uncovered malicious npm & PyPI packages posing as dev tools — stealing wallet seed phrases via Google Analytics and Telegram bots.

Inside the malware and how it works: https://socket.dev/blog/malicious-npm-and-pypi-packages-steal-wallet-credentials #Python #JavaScript

The Bad Seeds: Malicious npm and PyPI Packages Pose as Devel...

Socket researchers uncovered malicious npm and PyPI packages that steal crypto wallet credentials using Google Analytics and Telegram for exfiltration...

Socket

Wow. CVE database is in serious trouble, tomorrow.

The cyber industry as a whole is in trouble also really, it’s the elephant in the room - the collapse of the White House’s support for cybersecurity is obvious and pronounced due to widespread cutbacks.

MITRE-backed cyber vulnerability program to lose funding Wednesday

Organizations across industry, government, national security and critical infrastructure rely on the CVE Program, which serves as the de-facto global standard for vulnerability identification and management.

Nextgov.com

The Socket Research Team discovered a malicious #Python package that enables automated credit card fraud on #WooCommerce stores by abusing checkout and payment flows.

https://socket.dev/blog/malicious-pypi-package-targets-woocommerce-stores-with-automated-carding-attacks

Malicious PyPI Package Targets WooCommerce Stores with Autom...

The Socket Research Team investigates a malicious Python package that enables automated credit card fraud on WooCommerce stores by abusing real checko...

Socket

Not a single Republican is going to say anything about POTUS's shameful treatment of veterans? Especially those most in need? All cowards. This is hard to read without wincing, and it's an utter disgrace for the United States to treat its veterans this way.

"Late in February, as the Trump administration ramped up its quest to transform the federal government, a psychiatrist who treats veterans was directed to her new workstation — and was incredulous."

"She was required, under a new return-to-office policy, to conduct virtual psychotherapy with her patients from one of 13 cubicles in a large open office space, the kind of setup used for call centers. Other staff might overhear the sessions, or appear on the patient’s screen as they passed on their way to the bathroom and break room."

"The psychiatrist was stunned. Her patients suffered from disorders like schizophrenia and bipolar disorder. Treating them from her home office, it had taken many months to earn their trust. This new arrangement, she said, violated a core ethical tenet of mental health care: the guarantee of privacy."

"When the doctor asked how she was expected to safeguard patient privacy, a supervisor suggested she purchase privacy screens and a white noise machine. ā€œI’m ready to walk away if it comes to it,ā€ she wrote to her manager, in a text message shared with The New York Times. ā€œI get it,ā€ the manager replied. ā€œMany of us are ready to walk away.ā€

"Scenes like this have been unfolding in Veterans Affairs facilities across the country in recent weeks, as therapy and other mental health services have been thrown into turmoil amid the dramatic changes ordered by President Trump and pushed by Elon Musk’s Department of Government Efficiency."

"Among the most consequential orders is the requirement that thousands of mental health providers, including many who were hired for fully remote positions, now work full time from federal office space. This is a jarring policy reversal for the V.A., which pioneered the practice of virtual health care two decades ago as a way to reach isolated veterans, long before the pandemic made telehealth the preferred mode of treatment for many Americans."

"As the first wave of providers reports to offices where there is simply not enough room to accommodate them, many found no way to ensure patient privacy, health workers said. Some have filed complaints, warning that the arrangement violates ethics regulations and medical privacy laws. At the same time, layoffs of at least 1,900 probationary employees are thinning out already stressed services that assist veterans who are homeless or suicidal."

"In more than three dozen interviews, current and recently terminated mental health workers at the V.A. described a period of rapid, chaotic behind-the-scenes change. Many agreed to speak on the condition of anonymity because they want to continue to serve veterans, and feared retribution from the Trump administration."

"Clinicians warn that the changes will degrade mental health treatment at the V.A., which already has severe staffing shortages. Some expect to see a mass exodus of sought-after specialists, like psychiatrists and psychologists. They expect wait times to increase, and veterans to eventually seek treatment outside the agency."

https://www.nytimes.com/2025/03/22/us/politics/veterans-affairs-mental-health-doge.html

Trump and DOGE Propel V.A. Mental Health System Into Turmoil

A chaotic restructuring order threatens to degrade services for veterans of wars in Vietnam, Iraq and Afghanistan.

The New York Times
Supply-chain attack exposing credentials affects 23K users of tj-actions
tj-actions/changed-files, corrupted to run credential-stealing memory scraper.
https://arstechnica.com/information-technology/2025/03/supply-chain-attack-exposing-credentials-affects-23k-users-of-tj-actions/?utm_brand=arstechnica&utm_social-type=owned&utm_source=mastodon&utm_medium=social
Large enterprises scramble after supply-chain attack spills their secrets

tj-actions/changed-files corrupted to run credential-stealing memory scraper.

Ars Technica
If Watergate happened today, it would just be Saturday and forgotten the next week.
Ɨ

CVE extension to March 16th 2026

See y’all March 15th 2026 for the last minute renewal šŸ«”šŸ˜…

https://www.usaspending.gov/award/CONT_AWD_70RCSJ24FR0000018_7001_70RSAT20D00000001_7001

MITRE’s statement is interesting as they included trademark and copyright symbols on terms like CVE.. one to watch as people try to start their own systems.

https://mastodon.social/@bagder/114349504703321362

CVE Foundation - Frequently Asked Questions

What do you believe? We believe that CVEs are the cornerstone of cybersecurity defense. Without a common language to communicate about vulnerabilities, chaos follows. This is why the CVE Program was created 25 years ago and it is even more true today. We believe in a free, publicly available

@GossiTheDog Someone named ā€œMZMegaZoneā€?

@masek

> The commenter from F5, MZMegaZone, seemingly the principal security engineer at F5, ...

Source: https://arstechnica.com/information-technology/2024/02/nginx-key-developer-starts-a-freenginx-fork-after-dispute-with-parent-firm/

https://www.linkedin.com/in/megazone/

šŸ¤·ā€ā™‚ļø

Nginx core developer quits project in security dispute, starts ā€œfreenginxā€ fork

Disagreement over security disclosures and bug-fixing priorities led to split.

Ars Technica

@GossiTheDog @thecvefoundation the fact that people are afraid to reveal their names for this is very telling.

We are in a strange fucking place.

@acalarch @GossiTheDog Most of the people involved have 'day jobs' and not all employers are necessarily supportive. Some people asked to have time to first discuss what's happening with their employer before their name is public.

Especially as we're already seeing people presume that because someone involved with the Foundation works for Employer X it must mean Employer X is backing the Foundation - which is not safe to assume. So there is some concern about blowback on employers causing problems for the individual.

People are participating as individuals, not corporate representatives. As people are comfortable being named they'll be added to the FAQ entry.

(This is MegaZone. F5 is not officially involved, but supports employees working on initiatives outside of F5. They're aware of what I'm doing - our CEO commented on my LinkedIn post about being part of this.)

@thecvefoundation @acalarch @GossiTheDog Thats a good point. Thanks for clarifiying. Even efforts done outside of the workplace can reflect, so it’s best to not cross certain lines before knowing if it’s okay.
@GossiTheDog
CVE®™: Copyrighted Vulnerabilities and Exposures
@GossiTheDog @bagder Shouldn’t be a problem since the US tech elite doesn’t believe in intellectual property right? Right?
@GossiTheDog I guess at least a lot of us learned about https://euvd.enisa.europa.eu/search today
Vulnerability Database

Web site created using create-react-app

@GossiTheDog What kind of clown show is this government ​​

@GossiTheDog I have to say, as someone who lives in the D.C. area and is plugged into gossip networks of both civil servants and contractors…there is a lot of this kind of thing* going on lately.

*ā€This kind of thingā€ being ā€œthe contract is off, no, wait, now it’s back on.ā€

@GossiTheDog run a vulnerability database like you would handle certificate renewals 🤐
@number137 @GossiTheDog Exactly, like Let’s Encrypt. The reliance on MITRE (having a funding reliance on US gov) is itself a vulnerability. We need a CVE number for this whole event.
@GossiTheDog
Or before, depending on the random mood.