Nostr notes by Dr. Christopher Kunz

Again? I know that ASN by heart now.

2026-07-09T16:47:48+02:00

In reply to nevent1q…3t3k
_________________________

Again? I know that ASN by heart now.

I have questions. Especially one: Which is the PAN-OS release ...

2026-07-09T16:30:37+02:00

In reply to nevent1q…5wch
_________________________

I have questions. Especially one: Which is the PAN-OS release preferred by the folks at watchTowr (npub13vn…f849) Labs?

Wait, we have preferred releases now? Like, as in "beta", ...

2026-07-09T16:24:01+02:00

In reply to nevent1q…szfd
_________________________

Wait, we have preferred releases now? Like, as in "beta", "latest", "lts", "preferred", "notso-hotso"?

"Product fails at core competency" should be the takeaway ...

2026-07-09T16:03:18+02:00

In reply to nevent1q…pz8n
_________________________

"Product fails at core competency" should be the takeaway from this. Unfortunaly, CVSS 1.7 will land this very low on anyone's priority list, be it SSVC or that CISA thing.

I should have made a 2026 issue for my insecurity appliance ...

2026-07-09T16:00:31+02:00

In reply to nevent1q…ah6h
_________________________

I should have made a 2026 issue for my insecurity appliance bingo. With another column: "CVSS sandbagging". However, I think they are actually right here, because the flaw only affects subsequent systems. I would have gone for SC:N/SI:H/SA:H though, upping the score to 2.7
This shows again how bad CVSS performs as a threat metric.

Die Innenministerkonferenz will Indymedia komplett verbieten. ...

2026-07-01T14:50:53+02:00

Die Innenministerkonferenz will Indymedia komplett verbieten.

Weil wir als Gesellschaft derzeit keine drängenderen Extremismus-Probleme haben.

In 85 Seiten der Beschlusssammlung wird kein einziges Mal das Wort "rechtsextrem" erwähnt.

Die haben im wahrsten Sinne des Wortes die Schüsse nicht gehört. https://www.innenministerkonferenz.de/IMK/DE/termine/to-beschluesse/2026-06-19_DOK/Freie_Beschl%C3%BCsse.pdf?__blob=publicationFile&v=1

I mean, why not use GLM 5.2 in the meantime? ...

2026-06-30T14:39:58+02:00

In reply to nevent1q…pppn
_________________________

I mean, why not use GLM 5.2 in the meantime? https://www.provos.org/p/qemu-escape-glm-5-2/

Nostr event nevent1qqsptxt37x43dvxqcaljtypuukv7k50c2frj7a6pc37vgqh0w9q4wsczyzpdww8a2w4l766ny3dtqfryzwrpv5rlta0hn200qqzkq74ftklzgqqxkwm

2026-06-10T22:24:53+02:00

In reply to nevent1q…sgvp
_________________________

Err...?

I can verify that the exploit still works with that mpengine.dll ...

2026-06-10T22:09:04+02:00

In reply to nevent1q…8tgt
_________________________

I can verify that the exploit still works with that mpengine.dll version and the 1.453.28.0 definition update that got released 6/10/2026 6:29:20 PM. It takes more than one attempt, sometimes up to 6-7 now, where it used to be almost always one shot, but it still works.
I'm waiting for my other VM to fully update and then I'll retry there, too.

N/A is a status, too. Just sayin'.

2026-06-10T17:25:27+02:00

In reply to nevent1q…sesp
_________________________

N/A is a status, too. Just sayin'.

The simplest of all possible modifications to the original ...

2026-06-10T09:50:51+02:00

The simplest of all possible modifications to the original RoguePlanet.cpp (literally interchanging two letters in the source code) defeats the detection and re-enables the exploit in current, fully patched Windows 11 with Definition Update 1.453.20.0 installed.

Sure, take it directly from the horse's mouth: ...

2026-06-10T09:22:01+02:00

In reply to nevent1q…734p
_________________________

Sure, take it directly from the horse's mouth: https://deadeclipse666.blogspot.com/2026/05/july-14th.html

CVE-2026-41091 is RedSun.

2026-06-10T09:19:23+02:00

In reply to nevent1q…3fux
_________________________

CVE-2026-41091 is RedSun.

Will we wake up to see Windows Defender quarantining wermgr.exe ...

2026-06-09T23:35:19+02:00

Will we wake up to see Windows Defender quarantining wermgr.exe pr the Task Scheduler in an attempt to contain RoguePlanet? Oh, the excitement….

Blatant typo: should be RougePlanet, not RoguePlanet. What with ...

2026-06-09T23:29:55+02:00

In reply to nevent1q…0m9p
_________________________

Blatant typo: should be RougePlanet, not RoguePlanet. What with it being a RedSun variant 'n all.

I see your header collection and raise you one "X-Disclaimer: ...

2026-06-09T17:55:19+02:00

In reply to nevent1q…ydu3
_________________________

I see your header collection and raise you one "X-Disclaimer: This email was set up by Hornetsecurity GmbH"

Yeahhh.... so that one looks fishy. It seems to be a fork of the ...

2026-06-04T16:50:13+02:00

In reply to nevent1q…fcuy
_________________________

Yeahhh.... so that one looks fishy. It seems to be a fork of the earlier one, but added a setup.py which seems to do slightly weird stuff.

From what I read in the writeup (and the sparse other sources), ...

2026-06-04T14:47:09+02:00

In reply to nevent1q…jnfr
_________________________

From what I read in the writeup (and the sparse other sources), you need a long enough DNS name on the victim host to trigger the overflow. I think 54 chars or more? This github has a possible explanation why the PoC fails under most normal conditions: https://github.com/ADScanPro/CVE-2026-41089-LongLogon

This writeup seems to make sense, were it not for the magic two ...

2026-06-04T14:42:17+02:00

In reply to nevent1q…72d4
_________________________

This writeup *seems* to make sense, were it not for the magic two letters in the TLD: https://aretiq.ai/research/vul260513-cve-2026-41089-microsoft-windows-netlogon-buildsamlogonresponse-stack-based-buffer-overflow-rce/

Nostr event nevent1qqsrs8swa7h03g5pmyy7pxlx3u42jcjxdkr4773w34anpffpl8tfcjqzyzpdww8a2w4l766ny3dtqfryzwrpv5rlta0hn200qqzkq74ftklzgtjgx59

2026-06-04T14:38:48+02:00

In reply to nevent1q…hg2w
_________________________

https://chaos.social/@christopherkunz/116676523296824499
nostr:note1ave4e08d6qr52xgxwc3mz0wnsgfznz68vsplel8gglmdm4wd4ddsryh92z

https://github.com/0xABCD01/CVE-2026-41089/blob/main/poc.py#L234

2026-06-04T06:18:11+02:00

In reply to nevent1q…73hu
_________________________

https://github.com/0xABCD01/CVE-2026-41089/blob/main/poc.py#L234

So CVE-2026-41089 (CVSS 9.8) in Windows Netlogon can be triggered ...

2026-06-01T20:53:41+02:00

So CVE-2026-41089 (CVSS 9.8) in Windows Netlogon can be triggered by sending a username that is AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA or longer.
How original.

So what's the suggestion? Instead of full disclosure + poc, ...

2026-05-27T17:39:55+02:00

In reply to nevent1q…a5rw
_________________________

So what's the suggestion? Instead of full disclosure + poc, let MS bury the vulns? I'm not really following.

Uh, not that it matters much if it's 1% or more, but the 14 ...

2026-05-27T15:05:17+02:00

In reply to nevent1q…v4l5
_________________________

Uh, not that it matters much if it's 1% or more, but the 14 CVE IDs on the dashboard are the _disclosed_ CVEs, there are more. Quote: "The records below are publicly available. The remainder are reserved, pending publication by the assigning authority."

Und wenn man dann noch Tolkien zitiert, kann man eigentlich ...

2026-05-26T09:05:03+02:00

In reply to nevent1q…lcdq
_________________________

Und wenn man dann noch Tolkien zitiert, kann man eigentlich nichts mehr falsch machen.

Nostr event nevent1qqsznllxtmpepxq8l8vgwqzy2640msug0u4p36r3txpthjkj3mdgrxszyzpdww8a2w4l766ny3dtqfryzwrpv5rlta0hn200qqzkq74ftklzghtcm3m

2026-05-20T19:49:10+02:00

In reply to nevent1q…q6ks
_________________________

WTF is Cisco Secure Workload? Apart from, obviously, an oymoron?

2026-05-20T19:25:52+02:00

In reply to nevent1q…lgkx
_________________________

WTF is Cisco Secure Workload? Apart from, obviously, an oymoron?

I also lowkey like how Crowdstrike goes from "data theft and ...

2026-05-18T15:30:54+02:00

In reply to nevent1q…jzxh
_________________________

I also lowkey like how Crowdstrike goes from "data theft and exto..." to "Contact sales".

I like "GRACEFUL SPIDER". I think this might be their ...

2026-05-18T15:28:25+02:00

In reply to nevent1q…547w
_________________________

I like "GRACEFUL SPIDER". I think this might be their logo.
Wait, that looks way too familiar.

Oh well. ssh-keysign-pwn seems to be _not_ copyfail class, but a ...

2026-05-15T08:31:31+02:00

Oh well. ssh-keysign-pwn seems to be _not_ copyfail class, but a six year old unfixed vuln in many distro kernels. This is a freshly installed VM with Ubuntu 24.04.4, latest patch level, 6.8.0-111-generic kernel.
I'm not even redacting the privkey because the VM is dead already as I write this.

And then, there's this gem. Google ads for ddos.su and ...

2026-05-14T18:08:54+02:00

In reply to nevent1q…ccqs
_________________________

And then, there's this gem. Google ads for ddos.su and Cloudflare, chilling on the result page for "best stresser tool". ddos.su has been advertising on Google for over a year. I have reported the ads but have not heard back yet.
Of course, ddos.su is behind CF. So I reported ddos.su to Cloudflare who just said "yeah that's no longer on our network". My bad, but www.ddos.su is.

A fresh VM with all updates and the latest definitions?

2026-05-14T17:58:38+02:00

In reply to nevent1q…scm3
_________________________

A fresh VM with all updates and the latest definitions?

@npub1z3m…zn2f Time to add Fragnesia to vulnerability.garden? ...

2026-05-13T15:57:50+02:00

shellsharks (npub1z3m…zn2f) Time to add Fragnesia to vulnerability.garden? https://www.wiz.io/blog/fragnesia-linux-kernel-local-privilege-escalation-via-esp-in-tcp
Or are we just giving this vuln class a blanket name like "the copyfail zoo"?

Huh, that's odd. Works fine for me. Same definitions version. ...

2026-05-12T17:15:49+02:00

In reply to nevent1q…ge8h
_________________________

Huh, that's odd. Works fine for me. Same definitions version.

May 11, 2026: The Red Sun still prevails. However, I noticed ...

2026-05-11T08:23:51+02:00

May 11, 2026: The Red Sun still prevails.

However, I noticed something odd. Either this is purely coincidence, or the exploit has less reliability now (?). On a freshly booted system, it works 100%, but after a couple minutes of runtime, it seems that it doesn't always win the race condition (or it takes longer than the usual ~10 seconds).

Ich weiß nicht, ob wir jetzt jede nischige Bastelsoftware von ...

2026-04-19T15:39:33+02:00

In reply to nevent1q…etfy
_________________________

Ich weiß nicht, ob wir jetzt jede nischige Bastelsoftware von irgendwelchen EU-Kommissionen besprechen sollten. ;-)

Ich habe in den Quellcode aber auch schon mit einem halben Auge hineingeschielt - weil ich wissen wollte, inwiefern die Android-Version Play Integrity verwendet. Habe aber nichts gefunden und bin für Pointer dankbar.

Acht Uhr und ich habe schon keinen Bock mehr.

2026-03-24T08:03:43+01:00

In reply to nevent1q…c6m7
_________________________

Acht Uhr und ich habe schon keinen Bock mehr.

> Nachts um drei in den USA > ICE steht vor der Tür > ...

2026-03-24T08:03:10+01:00

> Nachts um drei in den USA
> ICE steht vor der Tür
> Ausländische Freundin und Kind im Hinterhaus versteckt
> Testament unterschrieben
> Burner Phone in Plastikbeutel geschluckt
> Guten Tag, uns wurde ein ausländischer Router gemeldet.

The very same. Their last toot is from 2022, while their last ...

2026-01-09T14:41:16+01:00

In reply to nevent1q…n5ld
_________________________

The very same. Their last toot is from 2022, while their last Telegram post is from *checks notes* 9:37 today.

I'm not sure why, but being on the Fediverse just doesn't seem to be in the cards for them.

Sorry, this could not wait until next #diday - I just deactivated ...

2026-01-09T08:52:27+01:00

Sorry, this could not wait until next #diday - I just deactivated my X account. The recent shitshow around Grok creating deepfake thirst traps is just too appalling.

Also, I found out that vxunderground, literally my last reason to keep my X account alive, is now on Telegram, so that's that. Let that sink in: I'd rather be on Telegram than on X at this point.

Anyhow, my account which has been around since sometime in the late 2000s is now gone.

It's amazing to me how many of these screen shots are of an ...

2025-11-13T09:16:13+01:00

In reply to nevent1q…ut5l
_________________________

It's amazing to me how many of these screen shots are of an open root shell where multiple skids unsuccessfully tried to install a rootkit.

I considered myself to be an early adopter of VR, used a ...

2025-11-13T08:45:24+01:00

In reply to nevent1q…j2hx
_________________________

I considered myself to be an early adopter of VR, used a Virtuality headset in ~1996, always dreamed of a Forte VFX1, had Oculus DK2, PSVR1, Quest1-3. I gave the whole VR thing so many tries, but it always felt lackluster.
On the Quest, the ecosystem felt neglected pretty much from the get go: Obviously fake app reviews, terrible lobbies in multiplayer, not-so-great update politics, etc. - after Zuckerberg pitched the whole Metaverse idea, I bailed. Incidentally, I sold my Steam 1/2

This media isn't bored but there's just not enough for ...

2025-09-23T10:37:49+02:00

In reply to nevent1q…wgqc
_________________________

This media isn't bored but there's just not enough for updated reports. Last I heard was that ENISA claimed ransomware, ShinyHunters got strangely quiet on the record when questioned by Dissent Doe :cupofcoffee: (npub17l5…4kr3) so maybe there's something interesting there. For me there's just not enough substance right now to report anything.

Ha, I was faster! ;-) ...

2025-09-16T16:12:48+02:00

In reply to nevent1q…d69g
_________________________

Ha, I was faster! ;-) https://www.heise.de/news/Neuer-NPM-Grossangriff-Selbst-vermehrende-Malware-infiziert-Dutzende-Pakete-10651111.html

Very interested in seeing how this one will play out during the night.

Soooo... which Lemmy server should one join as a security ...

2025-06-10T10:53:10+02:00

Soooo... which Lemmy server should one join as a security interested person?

Total radio silence so far, no statement - not even ...

2025-04-02T09:33:38+02:00

In reply to nevent1q…ltf2
_________________________

Total radio silence so far, no statement - not even acknowledgement of my request for comment.

Ah right, then there's an extra space in that link on medium. ...

2025-03-31T14:05:03+02:00

In reply to nevent1q…g9dx
_________________________

Ah right, then there's an extra space in that link on medium. The video id reads "375_G9wAff+o" there. Thanks!

Interesting. There's however an extra space in the Youtube ...

2025-03-31T14:01:27+02:00

In reply to nevent1q…p04r
_________________________

Interesting. There's however an extra space in the Youtube link in this sentence: "The meeting is viewable here and the transcript is "

I kinda love the edit history on the US DOD's statement about ...

2025-03-05T13:05:05+01:00

I kinda love the edit history on the US DOD's statement about the purported stand-down order.
"There has been no stand-down order whatsoever from that priority, said the official who was granted anonymity to discuss internal decisions." The Guardian (npub168d…tu7v)

As to be expected, that's from the Qu'ran. Sure ...

2025-01-23T09:01:09+01:00

In reply to nevent1q…xne0
_________________________

As to be expected, that's from the Qu'ran. Sure al-Anbiya, verse 11-12

loads of privkeys in the Fortinet leak, from SSH to what appears ...

2025-01-18T13:24:28+01:00

In reply to nevent1q…456d
_________________________

loads of privkeys in the Fortinet leak, from SSH to what appears to be web certs.