-
The Linux CNA – Red Flags Since 2022
[2/28/2024 Update: A bit more info added at end regarding “almost any bug might exploitable“.] MITRE announced that The Linux Kernel Organization (Kernel.org, hereafter referred to as ‘Linux’) was officially a CVE Numbering Authority (CNA) on February 13, 2024 and via the CVE web site, that their advisories would be posted here. That means they…
-
No one will burn a zero day on you…?
For at least two decades, a common mantra in the Information Security industry is that “no one will burn a zero day on you!” This is typically said to a person, often someone that comes across as overly paranoid, or perhaps a small hobby website. This term refers to zero day vulnerabilities, ones that are…
-
2024 and Some Still Don’t Understand the CVE Ecosystem
[Update: Even before I publish this, I want to keep everything I wrote for now. But I believe this rebuttal is in response to trash written by SpiceWorks and a GPT.] The world of vulnerability disclosures is growing fast, for a variety of reasons I won’t get into. Suffice it to say my time is…
-
Techstrong TV Appearance on Vulnerabilities
On December 21, 2023, I was a guest on the Techstrong.tv podcast hosted by Alan Shimel. The topic was finding and identifying hidden vulnerabilities. The show summary: Flashpoint has found/identified more than 100,000 hidden vulnerabilities beyond what CVE reports. Brian Martin and Alan discuss the company’s breakthrough.
-
Puzzling the Community a Bit!
Earlier this year I drove by a fire station in the foothills and noticed it had a Little Free Library. Before driving by completely I realized there was a big tub on a bench next to it with something written inside. Wow… a community puzzle swap! If you happened to read my last blog, you’ll…
-
The Fine Art of Wooden Puzzles
Growing up as a kid, I did puzzles with my mom and grandmom, especially around Christmas. It was standard to have a puzzle going on a card table near the kitchen and whenever someone walked by, they did a couple pieces. After the big feast, we all sat around and worked to complete it. Between…
-
Concert Review: Tash Sultana
On Saturday night, I went to my first concert in … a long time, maybe a decade? In fact, someone asked me when the last concert I went to was and it sent me down a rabbit hole because apparently I didn’t start using Google Calendar until much later than I remembered. After digging through…
-
Speaking Ill of the Dead?
Folks in the Information Security (InfoSec) circles are getting old. It is evident from the last few years and seeing those we know, in some capacity, passing on. For many of us still here, we find ourselves battling a world of conditions ranging from the relatively simple high blood pressure, to the more complicated like…
-
That Vulnerability is “Trending” … a Redux
A couple weeks ago I published a blog titled “That Vulnerability is ‘Trending’ … So What?“. I didn’t think I would be publishing another on this topic, especially this fast. But I ran into another absurd case of a vulnerability “trending” and figured out why, which is even more ridiculous. I caused this… A CVE…
-
That Vulnerability is “Trending” … So What?
Yesterday, more than one organization reached out to my company asking why a particular vulnerability wasn’t in VulnDB yet. First, it had been less than 24 hours since publication in CVE/NVD, NVD hasn’t analyzed it as of the time of this blog, and it is in software no significant business would use. It’s part of…