Kev
@kevin_backhouse
Followers
4K
Following
671
Media
114
Statuses
765
Security researcher @GHSecurityLab @GitHub. Opinions are my own. he/him
Joined July 2016
RT @adnanthekhan: You know what else is interesting about Kong? @pwntester reported an Actions injection (which is probably still viable) t….
securitylab.github.com
Kong is vulnerable to Actions expression injection allowing an attacker to takeover the repository and steal secrets.
0
3
0
RT @GHSecurityLab: 🎉 You can now enable code scanning in your GitHub Actions workflow files!. ✅ By opting-in to this feature, you can enhan….
github.blog
You can now enable code scanning in your GitHub Actions workflow files. By opting-in to this feature, you can enhance the security of repositories using GitHub Actions. Actions analysis support…
0
7
0
RT @BlazingWindSec: 🚀 CodeQL zero to hero part 4: Gradio case study is out! This time we dive into how I wrote CodeQL to support the Gradio….
github.blog
Learn how I discovered 11 new vulnerabilities by writing CodeQL models for Gradio framework and how you can do it, too.
0
7
0
Solid advice usually. Not convinced it'll work on a smart meter though.
1
0
4
RT @pwntester: This is one of the real world vulnerabilities found by the new CodeQL packs. Can you exploit it to get the flag? Bring us yo….
0
7
0
RT @pwntester: Next week I'll be at @ekoparty talking about vulnerabilities in GitHub Actions and how I extended CodeQL to find them at sca….
0
6
0
The contrast between two CUPS vulns is amazing. This one, CVE-2024-35235, seems to have flown completely under the radar - in total contrast to CVE-2024-47176. It was an LPE with an exploit chain that sounds very reliable. I only heard about it for the first time today.
Want more CUPS vulns? Read about how our security labs team chained CUPS with some Ubuntu features for privilege escalation on Ubuntu 24.04:
2
17
58
RT @GHSecurityLab: Want to learn how to secure your browser extensions? Read our latest blog post where we talk about the security model of….
github.blog
Learn about browser extension security and secure your extensions with the help of CodeQL.
0
8
0
RT @UK_Daniel_Card: Morning world! Slept ‘ok’ (not great not terrible). So yesterday I was doing some mitm6 over public WiFi (in the lab) a….
0
33
0
RT @ekoparty: Charlas MainTrack #EKO2024 🔥. 📌 @artsploit, Security Researcher at GitHub Security Lab. 💡 “Breaking corporate Maven repositor….
0
4
0
RT @xnyhps: We had a short look at the buffer overflow found by fuzzing `process_browse_data` to determine its exploitability. Conclusion:….
0
28
0
RT @BillDemirkapi: > critical 9.9 cvss "unauthenticated" rce on linux!!!!.> look inside.> requires local network access, user interaction,….
0
309
0
The poc crashes for me though, so I didn't actually get to see /tmp/I_AM_VULNERABLE getting created.
1
0
2
Based on this poc, you have to click several times to get pwned.
The entire disclosure seems to have been leaked online. Here is the report and POC.
1
5
30
Considering the amount of hype, it's a bit weak to only have a poc that requires the user to try to print to a new device that just magically appeared on their network.
I love how everybody is like "oooh boring, the user has to print something!" and entirely ignoring the buffer overflows and whatnot in a process running as root :'D small, small people :D.
1
0
15
I think it's kind of an amusing bug, because an unprivileged user can put sshd (root) into an effectively infinite loop.
0
0
1
Looking through some old issues and found that this poc from 2020 still works today. It wasn't considered a security issue, which is why the bug report is public.
github.com
The algorithm for adding new entries to the environment in _parse_config_file is quadratic, which means that it is easy to cause a local denial of service. The algorithm is quadratic, because pam_p...
1
0
3
This series is fun. I was buying cable recently and literally couldn't find any information about the technical differences between CAT5e, CAT6a, etc. I ended up buying F/FTP CAT6a and the shielding is so heavy that it doesn't really bend. Looking forward to the CAT8 episode!.
have you ever wondered what’s inside a CAT7 twisted pair (ethernet) cable? no? too bad here it is
0
0
1
RT @watchtowrcyber: In August, watchTowr Labs hijacked parts of the global .mobi TLD - and went on to discover the mayhem that we could cau….
labs.watchtowr.com
Welcome back to another watchTowr Labs blog. Brace yourselves, this is one of our most astounding discoveries. Summary What started out as a bit of fun between colleagues while avoiding the Vegas...
0
129
0
RT @GHSecurityLab: GHSL-2024-005_GHSL-2024-008: SSRF, XSS, RCE and Sensitive information disclosure in OpenHAB Web UI - CVE-2024-42467, CVE….
securitylab.github.com
Several vulnerabilities were found in OpenHAB’s CometVisu addon, which is part of OpenHAB’s Web UI project.
0
7
0