Positive Security (@positive_sec) 's Twitter Profile
Positive Security

@positive_sec

Holistic IT security research & consulting

ID: 1336696103685812224

linkhttps://positive.security calendar_today09-12-2020 15:36:22

31 Tweet

1,1K Followers

0 Following

Positive Security (@positive_sec) 's Twitter Profile Photo

New blog post: Windows 10 RCE via an argument injection in the ms-officecmd URI handler. While our RCE vector (MS Teams) has been fixed, the argument injection still persists. positive.security/blog/ms-office…

Positive Security (@positive_sec) 's Twitter Profile Photo

Microsoft Teams: 1 feature, 4 vulnerabilities We stumbled upon several vulnerabilities in Team's link preview feature, out of which MS only fixed one so far. positive.security/blog/ms-teams-…

Positive Security (@positive_sec) 's Twitter Profile Photo

We present a simple yet effective technique to get a high-resolution image from a pixelated video in order to recover redacted information (with no guessing involved) positive.security/blog/video-dep…

Positive Security (@positive_sec) 's Twitter Profile Photo

urlscan.io leaks API keys, shared documents, password reset links, team invites, and other sensitive data. We identified one culprit to be other security tools that accidentally make their scans public and put their users at risk. positive.security/blog/urlscan-d…

Positive Security (@positive_sec) 's Twitter Profile Photo

The latest Make: magazine features an article of ours on "DIY #AirTags". It contains: - Brief explanation of the Find My protocol - Introduction of @[email protected]'s OpenHaystack - Summary of our research (Send My & Find You) - Example use cases for such (enhanced) DIY trackers

The latest <a href="/make/">Make:</a> magazine features an article of ours on "DIY #AirTags".
It contains:
- Brief explanation of the Find My protocol
- Introduction of <a href="/seemoolab/">@seemoo@infosec.exchange</a>'s OpenHaystack
- Summary of our research (Send My &amp; Find You)
- Example use cases for such (enhanced) DIY trackers
Positive Security (@positive_sec) 's Twitter Profile Photo

The popular Ruby library "Ransack" can be abused to exfiltrate sensitive data via character by character brute-force. We compromised multiple applications this way and found hundreds more that could be vulnerable. positive.security/blog/ransack-d…

Positive Security (@positive_sec) 's Twitter Profile Photo

Fabian was interviewed (in German) by Deutschlandfunk about the new tracking protection standard by Google and Apple (featuring a "backdoor" near-owner bit) deutschlandfunk.de/zwielichtig-di…

Positive Security (@positive_sec) 's Twitter Profile Photo

We looked at the internals of JavaScript/TypeScript's most popular utility libraries and found interesting issues. The post contains hacking challenges/live demos. We recommend checking it out if you work with the affected libraries. positive.security/blog/lodash-ra…