Will Dormann

@wdormann

Vulnerability Analyst at the CERT/CC. My thoughts are my own, not my employer's.

Joined August 2012

Tweets

You blocked @wdormann

Are you sure you want to view these Tweets? Viewing Tweets won't unblock @wdormann

  1. Retweeted
    Feb 2

    And here’s a wonderful post by OpenSMTPD’s main developer : Very interesting insight on how a bug enters the code and becomes exploitable over time.

    Undo
  2. Retweeted
    Jan 28

    Qualys Security Advisory: LPE and RCE (CVE-2020-7247) in OpenSMTPD, OpenBSD's mail server. Erroneous logic in smtp_mailaddr() which validates user and domain. More details and PoC at: PS: "Did you ever play tic-tac-toe?"

    Undo
  3. Jan 29

    I think I'd like to have a word with the folks involved with the creation/distribution of this sign.

    Undo
  4. Retweeted

    macOS 10.15.3 is out, fixing a bunch of nasty (remote) bugs! 🍎🐛 ...go patch! 🛡️

    Undo
  5. Retweeted
    Jan 27

    BREAKING: We’ve confirmed that the Ring doorbell app on Android covertly shares personally identifiable information on its users with third-party companies, including Facebook.

    Show this thread
    Undo
  6. Retweeted
    Jan 27

    New: leaked documents, data, contracts show how hugely popular antivirus Avast now harvests internet browsing data and sells it for millions of dollars. Clients included Home Depot, Google, Microsoft. Documents show a product called "All Clicks Feed"

    Show this thread
    Undo
  7. Jan 26

    I'll move to Hyper-V for virtualization on my home computer... Smaller attack surface, and enables the ability to use extra exploit mitigations. 1) Broadcom network driver causes BSODs when Hyper-V bridges a VM to that network. 2) Hyper-V NAT doesn't even provide DHCP. Sigh...

    Undo
  8. Jan 26

    Hey , Find somebody at your organization that appreciates the difference between HTTP and HTTPS, and listen to them. Thanks.

    Undo
  9. Retweeted
    Jan 24

    Mini-scoop: Hackers exploited a zero-day in the Trend Micro OfficeScan antivirus to plant malicious files on Mitsubishi Electric servers

    Show this thread
    Undo
  10. Retweeted
    Jan 16

    CVE-2020-2551 WebLogic RCE via IIOP protocol.

    Undo
  11. Jan 24

    Based on suggestions from and I've updated No longer requires dumpbin.exe or listdlls.exe (if Python pefile and psutil are available). Also exports the findings as a CSV. Any reported app is a good candidate for EMET or WDEG force ASLR!

    Show this thread
    Undo
  12. Jan 22

    I would love to see a "wall of shame" to call out vendors/applications that aren't ASLR compliant. Anybody who runs this script on a real-world system would be able to help contribute!

    Show this thread
    Undo
  13. Jan 22

    Since this doesn't seem to be a thing, I've created a rudimentary python script that does it. Seems useful. Note: For now it requires both Sysinternals ListDLLs and Microsoft dumpbin.exe

    Show this thread
    Undo
  14. Jan 22

    Are there any tools to auto-enumerate any running processes in Windows that don't leverage ASLR themselves, or have libraries loaded that don't leverage ASLR? Sort of like what's outlined at but without requiring any user interaction.

    Show this thread
    Undo
  15. Retweeted
    Jan 22

    There is a high probability that Citrix ADC servers with no mitigation applied on or after January 9, 2020, have been taken over and their TLS certificates and associated keys have been stolen. [2/2] Please patch AND revoke your certificates.

    Show this thread
    Undo
  16. Jan 21

    I think that forgot the "viable" part when making the minimum viable product that is the Apple TV+ app for the It sort of works, but is by far the most buggy app on the device.

    Undo
  17. Retweeted
    Jan 21

    I suspected this was true ever since Apple released iCloud Keychain and did nothing interesting with it. Government pressure works.

    Show this thread
    Undo
  18. Retweeted
    Jan 17

    Last month I canceled a random charge for $4.99 per month from HP called "InstantInk". Wasn't sure what it was for. I've had it for over a year but had no idea what it did. I just found out what it did

    Show this thread
    Undo
  19. Jan 20
    Undo
  20. Jan 20

    Note that Citrix is rolling out changes to address CVE-2019-19781 for some versions at Unauthenticated users no longer appear to be able to request the pages in question.

    Show this thread
    Undo

Loading seems to be taking a while.

Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.

    You may also like

    ·