@kpwn@infosec.exchange avatar kpwn , to random

, your go-to place for discussions on the Fediverse and Bluesky, now supports email alerts.

https://cvecrowd.com

Here's how it works:

  • You define one or more alert keywords
  • Keywords are matched against vendor, product, and package names from official CVE data
  • If a post mentions a CVE that matches one of your keywords, you receive an email notification

Read more below ๐Ÿงต

@soatok@furry.engineer avatar soatok , (edited ) to random

Moving Beyond the NPM elliptic Package

If you're in a hurry, head on over to soatok/elliptic-to-noble and follow the instructions in the README in order to remove the elliptic package from your project and all dependencies in node_modules. Art: CMYKat Why replace the elliptic package? Yesterday, the Trail of Bits blog published a post about finding cryptographic bugs in the elliptic library (a Javascript package on NPM) by using the Wycheproof.

http://soatok.blog/2025/11/19/moving-beyond-the-npm-elliptic-package/

@indietechnews@ioc.exchange avatar indietechnews , to random

Turns out, Google is not likely to entirely destroy privacy phone projects developed from AOSP.
https://www.youtube.com/watch?v=znQToRxsrCo
*GOS workaround
*Independent OEMs still able to sign
*Few apps opt to G store sign. Why have financial apps on a phone anyway.

more on TEE / SGX
https://blog.golem.network/introducing-graphene-ng--running-arbitrary-payloads-in-sgx-enclaves/

These sorts of attacks require physical access, which is usually not a problem with phones because most people carry them always.
https://cybernews.com/security/hackers-can-bypass-linux-secure-boot/
Yes, if you are released from a gulag, you might want to get a new phone . . .

@GrapheneOS

@alice_again@tech.lgbt avatar alice_again , to random

Starting to question life without tech.
Starting to learn more about my divine connections, again.

Newly Mastodoned for the 3rd time. Maybe this one will stick?

Trans-femme - he/she/both

Not Christian, but a fan of the real Jesus.
Spiritualist: kinda like a "shaman" without appropriating from Indigenous, much.
Chatting with several deities of a few pantheons, some more, some less.

Kids.
Grandkids.
Spouse.
Pets.

Tech::

Ubuntu. Go. Bash. Python.
Still know some SQL.
Canada.
Humor. English.

Learning Go for purposes of humiliating myself. Cause how many languages have I learned in 30+ years of tech? Dunno.
And I am onward to beginner level again?

Huge fan of Tanya Janca.
Yes, that means I am learning AppSec.

@luriel@infosec.exchange avatar luriel , to random Portuguese

Hey folks,

I just published a new vulnerability research write-up: Who Scans the Scanner? Exploiting Trend Micro Mobile Security.

๐Ÿ”Ž Quick summary:

  • Info disclosure via device reports page (unauthenticated)

  • Stored XSS in the web console = session hijack via enroll key

  • Android agent routine manipulation (lab-only) = potential code execution vector

โœ… Vendor was contacted, patch released, researcher credited in the Hall of Fame.

๐Ÿ“„ Full writeup + PoC demo: https://hakaisecurity.io/who-scans-the-scanner-exploiting-trend-micro-mobile-security/research-blog/

ALT
@kpwn@infosec.exchange avatar kpwn , to random

New update for CVE Crowd!

You can now:

  • Search for vendors or products to see all related CVEs and discussions
  • Browse Bluesky posts alongside Fediverse ones
  • Enjoy cleaner feeds thanks to the "similar post counter"

And believe it or not... all of that without any โœจAI๐Ÿ’ฉ

Learn more below ๐Ÿงต or visit https://cvecrowd.com to see the changes live and in color :heart_cyber:

@Sempf@infosec.exchange avatar Sempf , to