OWASP Oopsies and Calling XZ What It Is - ThreatWire
Вставка
- Опубліковано 7 чер 2024
- ⬇️ OPEN FOR LINKS TO ARTICLES TO LEARN MORE ⬇️
Support ThreatWire → / threatwire
@endingwithali →
Twitch: / endingwithali
Twitter: / endingwithali
UA-cam: / @endingwithali
Everywhere else: links.ali.dev
@0xTib3rius
Twitter: / 0xtib3rius
Twitch: / 0xtib3rius
UA-cam: / tib3rius
Everywhere else: tib3rius.com/
@TracketPacer
Twitter: / tracketpacer
UA-cam: / tracketpacer
TikTok: / tracketpacer
Everywhere else: www.tracketpacer.com/
[❗] Join the book club on Patreon→ / threatwire
0:00 Intro
0:11 - Backdoor in XZ-Utils
4:46 - OWASP Oopsies
5:30 - UPDATE: NVD has broken its silence
8:14 - UPDATE: AT&T Finally Admits The L
8:57 - OUTRO
LINKS
🔗 Story 1: Backdoor in XZ-Utils
mastodon.social/@AndresFreund...
www.wiz.io/blog/cve-2024-3094...
bsky.app/profile/filippo.abys...
www.mail-archive.com/xz-devel...
www.openwall.com/lists/oss-se...
boehs.org/node/everything-i-k...
gist.github.com/thesamesam/22...
🔗 Story 2: OWASP Oopsies
/ 1774851614752313460
www.bleepingcomputer.com/news...
owasp.org/blog/2024/03/29/OWA...
🔗 Story 3: UPDATE: NVD has broken its silence
www.first.org/conference/vuln...
www.infosecurity-magazine.com...
sos-vo.org/news/nist-unveils-...
nvd.nist.gov/general/news/nvd...
🔗 Story 4: UPDATE: AT&T Finally Admits The L
www.securityweek.com/att-says...
____________________________________________
Founded in 2005, Hak5's mission is to advance the InfoSec industry. We do this through our award winning educational podcasts, leading pentest gear, and inclusive community - where all hackers belong. - Наука та технологія
Sorry this week’s episode was late !!! We are working through some production line optimizations for making threatwire - we will be back to being a well oiled machine very soon!
Thank you for understanding!!!
One of the biggest web consortiums is W3C (World Wide Web consortium) who support the development of web standards and accessibility.
Omg ya ofc !!! Totally forgot about this one !!!! Such an impt one
Notably the W3C didn't develop html5. In fact it was developed in spite of them, and they were ultimately told by everyone else that they needed to get on board with it or get out of the way. The WCAG 2.0 are also kinda BS, but they're sticking to that one because the industry doesn't care about web accessibility enough to push back (and nobody wants the PR of being "anti-disability" when ambivalence will suffice.
Your delivery really improving with every episode, keep it up Amy!
Who?
xP, LOL
@@VincentThePhotog He means Eva.
ALI Diamond 💎 jokster lol
Andres Freund deserves a Cuckoo's Egg award from Cliff Stoll.
It is one of the craziest exploits. Great coverage Ali cheers.
That backdoor did not make it to full distribution ... can you imagine if it did and how many have already gone through?😅
@@projectsspecial9224 would be terrible
Your doing such a good job and it’s been really awesome watching you grow more and more comfortable in front of a camera and your writing I do have one unsolicited suggestion but I feel will really help when reading off acronyms (like OWASP) it would really help if you read off what it stood for and just quickly said what they do just like once in the episode so I don’t have to google it 😂 some of us aren’t in netsec all day but love the tech news
Omg! Ya I’ll do this next time ! Great feedback
Genuine well-intentioned constructive feedback, nice. That's what makes us a community.
Loved the April Fool's video. Your deadpan delivery was perfect
"Is your name Ali Diamond?"
"No, mine's Clarence!"
Thank you for the coverage Ali! I appreciate how you show care for the dedicated few working on those repos
I literally avoided all other vids on XZ so I could get the breakdown here, GG!
Thank you. As usual, a very informational video. Keep it up. A great fan of Ali Diamond.
Love the work you do Ali🎉
Great job!! Alice👍🏻
Great video! Great info!
Kuddos on the Mastodon screenshot!
Who should I follow on mastodon!!! I’ve not spent too much time on there
Thank you for concise explanation
Thanks Amy... 😂😂😂 I appreciate the great content Ali. Have a wonderful day.
@endingwithali Loved this episode but now I need to know where you got those gorgeous earrings!
askandembla.net/products/sacred-heart-earrings !
Thank you, Ali (and Brewski), for keeping Threat Wire alive. I always enjoy your updates and insights
Nice video! Keep it up, Abby!
the puppies deserve more camera time.
Good job. I noticed a trend in the news in this video seems to come down to staffing resources hopefully over the coming years we can focus on pumping more people power to the areas that need it.
Love the show
I've seen several variations to Ali, like Allye, Aly, Alie. Someone typing Amy must have hearing problems. His or her brain is just filling in missing information.
On the plus side, you could always use Al Lee where that might be beneficial. He's the one armed man you're looking for officer. 😁
Shalom
Or....it was a typo...
great job
Rules of Engagement, good idea, especially for neurotic balls of anxiety like me.
Wot mate? Ru on something ? Oi is your mind in the right state? Plz d
Tell.
@@tibettenballs4962 What!? No, I'm not on anything and my mental faculties are something you'll never comprehend. You never know what someone has gone through, never assume anything about anyone. No need to be a git, mate.
FYI - I was talking about the book club R.O.E
@@Secret-Robot sry mate, didn’t mean to come off awry ! Blessed ma bruther
@@tibettenballs4962 all good, appreciate it.
@@tibettenballs4962 It's all good, much appreciated.
This format rocks .Ignore the haters
Ali with an i…Karate Kid flashback 😅
Good video Amanda.
Any one else think perhaps and maybe this might be bigger than just a few nefarious individuals and instead corporations
Imagine having to announce a data breach on April 1st. Insult to injury there.
You slayed this episode
Thank youuuuu
@@endingwithali@endingwithali keep up the great work and if I may offer some advice, keep being yourself but get comfortable with your audience, I hope you aren't being given a strict script and can be comfortable with the content, thanks for all you do and keeping Threatwire alive, keep up the great work. Please take feedback with stride we appreciate it. One more thing, not sure if HAK5 has you nervous, but you're great and comfortable on your channel. While this is for work, we hope you get just as comfortable with your audience professionally and a bit more casually. Again, you're helping keep the Treatwire segment alive so thank you.
framed Constellation Project NSA¨
1:39 it sounds like a confused mitm
4:24 I dont manage many repo containers but I am a chronic back pain sufferer and ergonomics correctness is the only thing that helps at a certain point.
That for the Lols.
7:46 You can't. Actually i always thought the business logic in terms of an IDOR is in reality, exactly this.
Does Bruceski have a ig?
Just wanted to drop a line to say I think you're doing a great job. You had some big boots to fill. I normally watch on my TV so don't get to comment.
😍😍
Great episode. Enjoyed the news covered, but also enjoy the dogs - how many do you own?
Is your name "עליה"?
I sometimes feel that Ali is sad 😅
DARPA nanotechnology soldier look me up Unix philosophy systems V
I keep telling people not to pay ransom because 1. they (or an associate) will come back later and try again (you paid once, so you'll pay again is the thinking). 2. they will, absolutely, no question, no ifs or buts, sell on your data regardless as to whether you pay up or not.
Amy is beautiful ❤️
It's official, I'm going to college for computer science!
Dont do collage, i promise you the people i know that went to collage for it vs the people who didnt and just learned the stuff through courses and online. Yeah the collage ones regret it and learned less
Lmao you wont make it just by that statment alone.
To elaborate, hacking and tech is an addiction to curiosity and knowledge. If you haven't picked up a book already and started, you don't have the messup head thats needed to succeed in the field.
PizzA
State-backed actors.
Pug!!!
audio changed slightly from the start to the end, great article none the less! love the pug
Why people connecting Andres to microsoft? 🤣 he is not related to MS as my understanding.
pulleralarm
I was going to say something... but pug. Pug stole it. Puggiest pug that pugged! 😄
Your dog is such a cutie!! Also, I hope the guy who planted the back down goes to jail or never gets a job in tech ever again.
מה זה השם הזה לא הבנתי את עליה או אלי
שלא נתבלבל היא שמה גם את השרשרת עם השם באנגלית מעל חח. אף פעם לא ממש הבנתי את העניין הזה עם השם על התליון, זה נועד להזכיר למישהו ששכח או מה?!
יש כאלה ששוכחים
@@tntomega ישכחו גם ללבוש תשרשרת ואז מה?!
@@MI-wc6nk בעיה אח בעיה....
Doggy!
This isn't a "supply chain attack." Open source maintainers aren't vendors.
Damn Dimples! Looking good girl.💓💓💓💞💞💞💘💘💘
I miss Shannon. the format just sucks now
please change the host , we want original host back!!