faebudo

Infosec Enthusiast.
Breaking things to find out how they break. #cybersec #blueteam

Languages: Deutsch, English
Family: Wife, 2 sons and a cat
Profession: Security Engineer
Hobbies: My homelab in a rack in the basement

Public Key

npub1rm3rkxye74zrnx4gnjsetuu7mp8qvjrkahkx8420a65uxp7tclpsl2jcx0

NIP-05 Address

faebudo_at_ioc.exchange@momostr.pink

Profile Code

nprofile1qqspac3mrzvl23pen25fegv47w0dsnsxfpmwmmrr6487a2wrql9u0scpzemhxue69uhhyetvv9ujuurjd9kkzmpwdejhgqgdwaehxw309ahx7uewd3hkcptptt0

Publishing to

relay.primal.net

nos.lol

relay.damus.io

Author Public Key

npub1rm3rkxye74zrnx4gnjsetuu7mp8qvjrkahkx8420a65uxp7tclpsl2jcx0

Show more details

Last Notes

2026-10-22 17:47:34 UTC

- reply

New Cloudflare blog post due tomorrow. We let an intern and 5000 agents rewrite PHP in rust and already put it in production.

2026-10-04 10:21:34 UTC

- reply

Also their CVSS 4.0 calculation only has VA:H, both VC and VI are None. So either they're lying or they didn't fix all the vulnerabilities used in this attack but only the triggering DoS condition but not the one leading to RCE.

2026-09-04 05:13:02 UTC

- reply

Use pktmon like this:
- pktmon filter remove (to remove the filters Defender for Endpoint uses by default)
- pktmon filter add -p 3389
- pktmon start -c --pkt-size 0 -m real-time
It will show the pakets on all layers of the network stack including WPF so you will be able to see the drop reason for the syn pakets.
- pktmon stop
You can also run it without -m real-time and then convert the etl using pktmon etl2txt to get the same output non-interactive.

2026-04-20 16:20:17 UTC

- reply

I don't know if this is what you want but you can already do this with EDL (External Dynamic Lists) if you have a webservice delivering the IPs for the ASNs:
https://iserv.nl/files/edl/feed.php
Trend Micro replied to a similar Feature Request that they don't have a good enough data source to allow this (I suggested MaxMind ASN).

2026-04-03 19:29:23 UTC

- reply

amazon.com doesn't have AAAA records, it's only reachable via IPv4 but it redirects to www.amazon.com which has IPv6 connectivity.

2026-02-15 13:36:06 UTC

- reply

Oh Scheisse, das IPv4 Netz auf das die Source genattet wird ist ein RFC5737 Documentation Address Block.
Das kann sich einfach niemand ausdenken..

2026-02-15 12:44:13 UTC

- reply

Ich würde einfach mal ganz frech raten das das Ihre Lösung ist für einen grossen Kunden der einen Grossteil der Infrastruktur bei AWS mit IPv6 hat (IPv4 kostet extra) und für "digitale Souveränität" trotzdem noch einen Dienst bei StackIT im Backend benutzt und diesen erreichen will.
Ganz geil ist ja auch das man nach dem NAT64 gar nicht mehr weiss woher der Traffic kommt und einfach alles an Traffic akzeptieren muss.
Somit hat man als StackIT Kunde keine Chance mehr irgendwelche Angriffe auf Netzwerkebene abzuwehren.

2025-11-22 10:47:16 UTC

- reply

While you cannot uninstall the Office Assistant from Office 97, you can eliminate it by moving all the Actorfiles (*.act) in the Actorsfolder to a backup directory. The default installation directory for the Actor files is:
\Program Files\Microsoft Office\Office\Actors

2025-11-18 18:49:12 UTC

- reply

From the questionnaire: "What IPv4-only applications does your organization use that require the use of Windows CLAT?"
- GitHub
- Microsoft Teams
Come to mind as first answers :ablobjoy:

2025-08-27 20:50:21 UTC

- reply

As a non-native english speaker I understand "several independent preconditions" as "any of the following conditions can be true to fulfill the prerequisites for it to be exploitable".

2025-04-20 06:02:16 UTC

- reply

I think the problem is that I am only seeing your side as I am following you on mastodon and don't follow them anywhere. So my timeline is full of you saying that you are harassed but I am not aware of the harassment you are experiencing.
I don't know if it would be a good idea to make public those false claims and attacks or if it would support the attackers, but as I said at the moment I only see you and never saw the attacks.
Just as in a domestic violence cases where outsiders only see the victim snapping but not the attacks it would maybe good to have a diary collecting evidence on the attacks.

2025-04-20 05:29:47 UTC

- reply

I think it is always ill-advised attacking competitors, no matter the reason.
It would be better from my viewpoint when GrapheneOS had a FAQ page listing the points that are listed against them and the answer to rebut the point including references to code/forum posts etc supporting it. So I don't have to search for social media for it but can refer to this FAQ page instead.

2025-04-14 09:36:27 UTC

- reply

So the update fixes CVE-2025-21204 by updating folder permissions for C:\inetpub even if it was created by a user beforehand. Also a normal user can't create files in C:\ only folders.
https://www.windowslatest.com/2025/04/11/windows-11-microsoft-warns-do-not-delete-inetpub-folder-after-causing-confusion/
Users that already deleted the folder should temporarily install IIS to create the folder again with correct permissions.

2025-04-10 16:15:02 UTC

- reply

Yes it opens a new one. But does the created folder by the update still allow a user to create files in C:\inetpub or are the permissions locked down to administrators?

2025-04-10 16:06:23 UTC

- reply

There are now sites that say that you can safely delete the folder after installation of the kb.
My assumption is that the folder has been created to fix a possible vulnerability where a user can place a folder/file there to exploit a bug in another component and elevate privileges. I would leave it there.

2025-01-15 17:19:29 UTC

- reply

This list was made by an intern running wireshark on Windows and clicking through dialogs. Not by engineers and developers.
It often contains wrong/misleading information as the one creating it did not check which process the traffic originates from and made some assumptions.
If you want to control where connections are mad from the information in the RTLFB guide is much more precise: https://learn.microsoft.com/en-us/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services
Add some DNS-Client Event Logs, Get-DNSClientCache and pktmon and you can get accurate information.

2025-01-15 16:59:57 UTC

- reply

I just checked some telemetry and only iexplore.exe is connecting to iecvlist.microsoft.com (8 connections in the last 30 days over a fleet of ~1000 clients and 200 server).
It's used with something called dual_engine_adapter_x64.dll from the Edge installation folder in Windows 11. So as I can see used for IE Mode.
And it's used directly by iexplore.exe on a Server 2012 R2 (why is this server still running? 😬)

2025-01-15 16:23:16 UTC

- reply

iecvlist is afaik used to load compability lists for IE (probably also IE mode). I don't think this will have a big (if any) impact.
There's a GH issue to report problems with ajax.aspnetcdn.com if you want: https://github.com/dotnet/AspNetCore.Docs/issues/34049
Also the documentation (https://learn.microsoft.com/en-us/aspnet/ajax/cdn/overview) states: "The Microsoft Ajax CDN has no SLA above and beyond using an Azure CDN."

2024-08-30 03:12:09 UTC

- reply

Delkin/Swissbit make microSD for heavy use with SLC flash: https://www.digikey.com/en/products/detail/SFSD2048N1AS1TO-I-QG-221-STD/1052-SFSD2048N1AS1TO-I-QG-221-STD-ND/16891107