Netgear Signed TLS Cert Private Key Disclosure
🗣homothebrave

Netgear left in its router firmware key ingredients needed to intercept and tamper with secure connections to its equipment's web-based admin interfaces.

Specifically, valid, signed TLS certificates with private keys were embedded in the software, which was available to download for free by anyone, and also shipped with Netgear devices. This data can be used to create HTTPS certs that browsers trust, and can be used in miscreant-in-the-middle attacks to eavesdrop on and alter encrypted connections to the routers' built-in web-based control panel.

In other words, the data can be used to potentially hijack people's routers. It's partly an embarrassing leak, and partly indicative of manufacturers trading off security, user friendliness, cost, and effort.
👤homothebrave


🎖@malwr

Hiding Your Tracks: Bash History
🗣bad3r_

Nice! I would add another one, kill the console to quit bash without saving history:


kill -9 $$
👤ReigningShells


🎖@malwr

What do you use for IP Reputation?
We are currently using IBM X-force, but o don't find it that reliable there is a lot if false positives in there.
Any suggestions? Especially for one were we can get a feed from (API or something)
🗣Mo7Robot

https://www.abuseipdb.com/register

https://talosintelligence.com/reputation\_center

https://www.apivoid.com/api/ip-reputation/
👤chrisknight1985

If you are looking for malicious domains the Fortinet threat feed is pretty good. It's part of their Fortinet Developer's Network Site License. It's an API feed that supports csv and stix formats.
👤Defiant_Success


🎖@malwr