The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

    Mastodon

  • Twitter Updates

  • My Flickr Stream

    20140508-Delphi-2007--Project-Options--Cannot-Edit-Application-Title-HelpFile-Icon-Theming20140430-Fiddler-Filter-Actions-Button-Run-Filterset-now20140424-VMware-Fusion-6.0.3.-no-reclaimable
    More Photos

  • Pages

  • All categories

  • Email Subscription

    Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 717 other subscribers

Archive for the ‘Security’ Category

« Previous Entries

Fritz! Current security topics: Vulnerability in the handling of incoming IPv4 TCP connections in the Linux kernel (CVE-2026-98432): Updates in preparation

Posted by jpluimers on 2026/11/13

Not nice to see this in the Fritz [Wayback/Archive] Current security topics:

Tech media are currently reporting on a vulnerability in the way the Linux kernel handles incoming IPv4 TCP connections (CVE-2026-98432). Under certain circumstances, it can cause a system crash or allow code to be executed. We are not currently aware of any successful exploitation of the vulnerability, either in the context of our products or on other Linux-based systems. As a precaution, we are preparing updates for affected devices, which we will release as usual once they are ready.

This seems limited to MPTCP (Multipath TCP) according to [Wayback/Archive] Critical Linux kernel flaw allows remote root attacks on MPTCP servers

--jeroen

Posted in Fritz!, Fritz!Box, FritzOS/Fritz!OS, Hardware, Infosec (Information Security), Network-and-equipment, Power User, Security | Leave a Comment »

Old domains, especially defunct “secure” file sharing servies, are a risk (and a red team vector)

Posted by jpluimers on 2026/11/06

Interesting opinion to which I agree: [Wayback/Archive] Greg Linares (Laughing Mantis) on Twitter: “@SwiftOnSecurity Legit great tip One of the best vectors for this are old “secure” file sharing services that seem to have disappeared in the last 5 to 10 years which hosted files to be shared from corp to corp. Files are often white listed from these are several services such as EDR & web”

From this Twitter thread:

Read the rest of this entry »

Posted in Blue team, Power User, Red team, Security | Leave a Comment »

Git files hidden in plain sight 🫥 – Tyler Cipriani

Posted by jpluimers on 2026/11/05

Infinite magic awaits the intrepid developer willing to abuse git plumbing. After all, git is just a database with a terrible interface.

From [Wayback/Archive] Git files hidden in plain sight 🫥 – Tyler Cipriani

I wonder how various endpoint security solutions handle this (:

Via:

–jeroen

Posted in Blue team, Development, DVCS - Distributed Version Control, git, GitHub, Power User, Red team, Security, Software Development, Source Code Management | Leave a Comment »

Volledig Post-Quantum Cryptografie website

Posted by jpluimers on 2026/11/04

Voor mijn link archief als ik er aan toe kom om ook een PQC web-site in te richten: [Wayback/Archive] Volledig Post-Quantum Cryptografie website, een mooi artikel van [Wayback/Archive] Harld (@harld@masto.ai) – Mastodon die sommigen kennen van een of meer van deze sites:

Via

Read the rest of this entry »

Posted in *nix, *nix-tools, Apache2, Certificates, Development, Encryption, HTTPS/TLS security, PKI, Power User, PQC, Public Key Cryptography, Security, Software Development, Web Development | Leave a Comment »

eMudhra popularised the number four in old jokes and caused many other jokes as well

Posted by jpluimers on 2026/10/29

A week ago, it seems like an eternity in vulnerability land, eMudhra popularised quoting the number four:

It felt like the Diginotar debacle, but 15 years later and voluntarily. And like I wrote yesterday, another (partially – hello “O=eMudhra BV, C=NL” next to “O=eMudhra Inc, C=US”) Dutch company involved. Hopefully that’s not a prediction for the future.

Given their laughably weak keys and their laughably excuse, lots of jokes appeared.

Apart from “there is always an XKCD” (I wish [Wayback/Archive] Relevant XKCD Search still functioned, but luckily [Wayback/Archive] Relevant XKCD does, hello [Wayback/Archive] Relevant XKCD=random), Randall Munroe also created a  new one, plus one of the XCKD memes was re-used, so here are three, plus a whole lot of other jokes that quickly appeared:

Read the rest of this entry »

Posted in Certificates, Encryption, HTTPS/TLS security, Power User, Security | Leave a Comment »

“Add `–emudhra` option (#8500)” and “Add –emudhra-old option (#8503)” · mitmproxy/mitmproxy@1692344 and mitmproxy/mitmproxy@62243e7

Posted by jpluimers on 2026/10/28

These didn’t take long for [Wayback/Archive] Mitmproxy 12.3: eMudhra Edition to appear with these commits:

  1. [Wayback/Archive] Add `–emudhra` option by mhils · Pull Request #8500 · mitmproxy/mitmproxy
  2. [Wayback/Archive] Add `–emudhra-old` option by mhils · Pull Request #8503 · mitmproxy/mitmproxy · GitHub

It is by [Wayback/Archive] GitHub – mitmproxy/mitmproxy: An interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers. · GitHub which I mentioned a few times before on my blog¹, so now is the time introduce the mitmproxy category.

Oh BTW: like Diginotar, eMudhra lists about half of the affected certificates as coming from the Netherlands. See the O=eMudhra BV, C=NL bits at the [Wayback/Archive] eMudhra Intermediate CA Compromise.

I won’t go into much detail as why it is so easy to generate these eMudhra certificates, as a much better job already has been done at [Wayback/Archive] Why Were eMudhra’s CA Keys Easy to Guess? · Metaheuristic

Read the rest of this entry »

Posted in Certificates, Development, Encryption, HTTPS/TLS security, JavaScript/ECMAScript, mitmproxy, Power User, Python, Scripting, Security, Software Development, TypeScript | Leave a Comment »

With the rise of CVEs, we cannot conclude that people always have been programming in a sloppy way

Posted by jpluimers on 2026/10/27

During a private conversation, someone mentioned that there is a storm of CVEs and someone else asked if this was because people have been sloppy in programming for a very long time.

Luckily [Wayback/Archive] CVE: Common Vulnerabilities and Exposures has a table of Published CVE Records with totals which I have copied:

Read the rest of this entry »

Posted in Agile, Code Quality, Database Development, Development, JavaScript/ECMAScript, jq, JSON, PostgreSQL, Power User, Scripting, Security, Software Development | Leave a Comment »

Supermicro IPMI SSL

Posted by jpluimers on 2026/10/15

Some links on Supermicro IPMI SSL because of SSL_ERROR_UNSUPPORTED_VERSION which can either mean your SuperMicro motherboard is too old to include newer TLS versions (X9 series and older motherboards; first try to upgrade firmware and BIOS; check supported TLS with [Wayback/Archive] /bin/bash based SSL/TLS tester: testssl.sh), or you misconfigured custom TLS certificates.

Some links:

Read the rest of this entry »

Posted in Communications Development, Development, Hardware, Internet protocol suite, Mainboards, Power User, Software Development, SuperMicro, testssl.sh, TLS | Leave a Comment »

Stop Using Encrypted Email | Latacora

Posted by jpluimers on 2026/10/09

A very interesting 2020 read that will remain valid eternally: [Wayback/Archive] Stop Using Encrypted Email | Latacora

It lists reasons that an encrypted email will one day leak either enough of the content or enough of the meta-data to become problematic:

Read the rest of this entry »

Posted in Encryption, Power User | Leave a Comment »

Padlock coin holders for lockpicking challenges (CTF) by ThiceNL – Thingiverse

Posted by jpluimers on 2026/10/06

[Wayback/Archive] Padlock coin holders for lockpicking challenges (CTF) by ThiceNL – Thingiverse

Via: Read the rest of this entry »

Posted in Development, Hardware Development, Security | Leave a Comment »

« Previous Entries