fabiochiu/medium-articles huggingface dataset:
Part 2 of Does 95% Efficacy Seem too Good to be True?
Tags: Vaccines, Pfizer, Superpowers, Vulnerability, Coronavirus

It seems Pfizer and the government know they have a boondoggle on its hands that make the Edsel and New Coke amazing successes by comparison and are scrambling to do damage control. The assertion of 95% efficacy is being repurposed to 95% efficacious at preventing disease if it does not prevent infection. In The Atlantic, Ed Yong now reports:

The print version of this article stated that the Moderna and Pfizer/BioNTech vaccines were reported to be 95 percent effective at preventing COVID-19 infections. In fact, the vaccines prevent disease, not infection.

That may turn out to be true if and when a properly designed study is implemented. As I have shown, this study cannot be relied upon for proof of symptom prevention.

Pfizer, come clean, admit your mistake, apologize and start a new study ASAP. Spinning this will never get the public on board. A much younger woman with whom I am dear friends, who has no scientific training, and had not yet read any of my drafts, intuited yesterday in from-the-mouth-of-babes fashion:

It’s retarded and Ill never trust it until they actually do proper research

As I noted in Part 1, James Hamblin’s article states: “trust must consistently be earned through transparency.”

Transparency. Transparency. Transparency.

As long as I am correct that motives were pure, the public will forgive a sincere apology. Do not pull another Ellen Disengenuous. See Kelli María Korducki’s A Real Apology Isn’t 7 Minutes Long.

My theory of why and how

Pfizer and its scientists believe deeply in the mRNA technology design. In their hearts and minds they are sure it will work and will work safely. Two problems: they didn’t try hard enough to come up with a study-design that eliminates or otherwise solves for the vigilance issue; and the fame of solving a pandemic combined with the pressure of not solving it overwhelmed them. The results that I shed light on cannot have been missed by them. So, confident that they are doing no harm they construct the 95% efficacy story which is so great that people want to believe it and its such a simple statement that when repeated enough, it is believed. (The psychological basis for such successful propaganda campaigns is described very well by Tessa Schlesinger last week in Why Freedom of Speech No Longer Works). Now they close the logic gap with the story that at least it treats the symptoms, presumably by reducing the viral load, which is testable, but no one asks for that proof because they so want it to be true, and as the study deems it safe, they see no harm. Of course as I pointed out in Part 1, it will be years before we know if that is true.
Equanimity
By: Est Maria
Tags: Calmness, Mindfulness, Vulnerability, Mindset, Grace

Oh this is for sure is my word for 2021 and beyond…what does this word mean you ask? According to the oxford dictionary, this word “means mental calmness, composure, and evenness of temper, especially in a difficult situation.”

The timing of this word couldn’t have come more perfectly. Oh how I love words with deep meanings and relevancy. Reflection on this word requires deep study of how you “show up” for yourself in critical times of uncertainty in your life. Whatever that looks like for you. My hope is that you will take time to take deep breaths to center you back to your “why” your “purpose”. As you face difficult situations in your current environment, my hope that you will give yourself grace and permission to escape into a space of calmness. My hope is that you will excuse yourself to go to a space that allows you to think clearly and bring about evidence in your brain that reminds you that you are smart, brave, loved, and a possibilitarian. When life is handing you lemons, may you take the lemons and squeeze out all the sour juice and add flavors of sweetness that drowns out the sour juice in your mind.
Solarwinds Orion and Sunburst
By: Shahid Sharif
Tags: Solarwinds, Sunburst, Trojan, Vulnerability, Backdoor

Introduction

US departments of Commerce and Treasury were victims to the same threat vector that was exploited at FireEye. As organizations that have Solarwinds Orion installed conduct forensics on their environment, we will see the impacts of this backdoor. Brian Krebs has posted a list of organizations that were using Orion in this blogpost U.S. Treasury, Commerce Depts. Hacked Through SolarWinds Compromise

Solarwinds recently filed an SEC report indicating that, while they have over 300,000 customers, fewer than 18,000 customers were running the trojanized version of the Orion software.

My post, Asset Management! Why is it Important in Cyber Security? highlights the importance of asset management and this attack is the prime example.

Who was behind this attack?

The stealth with which the perpetrators executed this attack has the signatures of Cozy Bear or APT29. Which seems to operate with a light malware footprint, avoids detection, prioritizing stealth, and going at lengths to blend with normal network activity. was behind this attack. APT29 is believed to the supported by Russia’s SVR or FSB.



However, it is still unclear who was behind this attack. Security researchers a busy pinning the tail on the donkey and are calling this donkey what they will. For instance, FireEye is calling this APT UNC2452, whereas Palo Alto Unit42 is calling it SolarStorm. to avoid crediting the wrong APT.

What should the customers do?

The backdoor, Sunburst, was introduced in Solarwinds Orion software builds 2019.4HF → 2020.1.1 which were released between March 2020 and June 2020.

Solarwinds is advising its clients to update to version 2020.2.1.HF2, which is scheduled to be released on 15th December 2020.

Microsoft and FireEye have already released updates to their security platforms to detect and neutralize Sunburst.

How did this happen?

This is by far the most sophisticated supply-chain attack. FireEye calls this malware sunburst

This malware has been embedded in SolarWinds.Orion.Core.BusinessLayer.dll by AP29 around March 2020. The impacted builds are 2019.4HF → 2020.1.1 which were released between March 2020 and June 2020.

This malware remains dormant for up to a period of two weeks, after which it wakes up and makes contact to a domain avsvmcloud[.]com to retrieve and execute commands. The capabilities include the ability to transfer and execute files, reboot ad disable systems services on the target host. To avoid detection all communications are masqueraded as the Orion Improvement Program (OIP) protocol.

It has been observed delivering multiple payloads, mostly focused on memory-only droppers, such as the FireEye-dubbed TEARDROP and Cobalt Strike BEACON.

References
身為 Web 工程師，你一定要知道的幾個 Web 資訊安全議題
By: 莫力全 Kyle Mo
Tags: Csrf, Web Security, Security, Web Development, Vulnerability

Learn more. Medium is an open platform where 170 million readers come to find insightful and dynamic thinking. Here, expert and undiscovered voices alike dive into the heart of any topic and bring new ideas to the surface. Learn more

Make Medium yours. Follow the writers, publications, and topics that matter to you, and you’ll see them on your homepage and in your inbox. Explore
‘Sound of Metal’ is About Losses and Restarts — In Many Ways
By: Akos Peterbencze
Tags: Life Lessons, Television, Vulnerability, Movies, Self

FILM I DRAMA

‘Sound of Metal’ is About Losses and Restarts — In Many Ways

Photo: Amazon Studios

There is a scene in Darius Marder’s movie where an addict desperately tries to convince his girlfriend that everything’s going to be ok. He says he will fix this, and things will go back to normal. Normal means a life in which he’s not deaf.

Ruben (Riz Ahmed) is a heavy-metal drummer who loses more than seventy percent of his hearing overnight. He grows mad, frustrated, angry, and looks for a quick solution. He sees a doctor who tells him there isn’t one. His girlfriend Lou (Olivia Cooke) finds a place for him, a community of deaf addicts, run by a wise old man named Joe (Paul Raci).

At first, Ruben doesn’t want to stay because he thinks it won’t help. The people in this place are learning to accept their disability and how to live with it. He’s not ready to embrace that. He blindly believes that an expensive surgery will give back his hearing, and that’s all that matters. A slight chance that things go back to normal.

Lou disagrees. She thinks that Ruben will spiral back into old habits and starts using again. She realizes that leaving him in this group is the only option to support him. Hesitantly, but he stays and begins to settle into a life of silence.
Boundaries
Tags: Self Reflection, Setting Boundaries, Listen To Your Body, Vulnerability, Boundaries

Boundaries are important. This sounds ironic coming from someone who values vulnerability, but respecting your space, your feelings, and what you really want and need has nothing to do with vulnerability. In fact, I’d argue that being able to communicate and set a boundary with someone is a form of vulnerability.

But the way that boundaries differ — and can be beneficial — is when you need to take a step back to honor yourself. Our body gives us signs and signals when we feel unseen or unheard in a situation. when we feel uncomfortable or that we don’t want to be in a certain situation. These circumstances don’t have to mean the worst situation and they don’t have to be dire. In fact, they are often small. What’s important is that we honor what it is we are feeling. The only way to do this is by taking a step back and giving yourself the space to feel what you’re feeling. to ask yourself questions and uncover what your body is trying to tell you.

You will find that here, your body and your mind will thank you for listening. You’ll be at peace for letting yourself be.

What are you doing to honor your feelings currently?
CVE-2020-35338
By: Jeya Seelan
Tags: Bug Bounty, It, Infosec, Cybersecurity, Vulnerability

Use of Default Credentials to Unauthorised Remote Access of Internal Panel of WMT

Title: Use of Default Credentials to Unauthorised Remote Access of Internal Panel of WMT

👨🏼‍💻Discovered by Jeya Seelan S

📝Published on 14/12/2020.

💉CVE-2020-35338

📄Vulnerable version ≤ 20.2.8

🔗Vendor Homepage: https://www.mobileviewpoint.com/

CVE Link: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35338

https://vuldb.com/?id.166154

Bug Description:

A vulnerability in the WMT Playout Server’s Web Administrative Interface on Version 20.2.8 and Below Could allow an Unauthenticated Remote User to access a sensitive part of the system with a high privileged account.

This Vulnerability is Due to the Presence of Default Account that has a default Password “pokon” in it. An attacker could exploit this vulnerability by using this default account to connect to the affected system. A successful exploit could allow the attacker to obtain read and write access to system data, including the configuration of the affected devices. The attacker would gain access to a sensitive portion of the system and have full administrative rights to control the device. Leading to Increase in the Severity of the Vulnerability.

Attack Vector:

A Malicious attacker could exploit this vulnerability by remotely Logging in to an affected system by using the Default Credentials.

Steps to Reproduce:

Go to The Playout Server Login page

2. Leave the Username Field blank

3. Enter “pokon” on Password Field and Click Sign in

4. Now You are Redirected to the Administrative Panel Where You can Able to Read and Control the Device and also Able to change the device’s Configuration Remotely.

Proof Of Concept:

Dorks to Find

You Can Use the Below Dorks to Find the Devic Affected By this CVE. Be Responsible Before Exploiting this Bug.

Shodan - http.title:WMT

Google — intitle:”WMT” inurl:7071

Cencys : 80.http.get.title: WMT

Thank You for Reading :)
It is difficult, so fucking difficult being a sensitive soul.
Tags: Poetry, Sensitivity, Love, Heartbreak, Vulnerability

It is difficult, so fucking difficult being a sensitive soul. It’s embarrassing, frustrating, time-consuming and at times, slightly scary when you find your heart in a permanent state of flux.

I am ridiculously sensitive and even worse, admittedly, I’m highly judgemental of sensitive people. Which of course, hurts my own feelings. I am of the generation of girls that grew up with the “strong woman” complex. I did not want to be a crying, lipgloss wearing, twilight loving, pathetic teenage girl. But alas here I am. Smoking cigarettes to Vance Joy and a Team Edward fanatic.

I spent so long starving myself, falling in love with beautifully out of reach people that I knew would break my heart and desperately, relentlessly trying to be anyone but myself. I hated that my favourite colour was pink, that I enjoyed Buzzfeed quizzes, that I wanted to do an English degree in college and of course that I would burst into tears if someone looked at me the wrong way.

But I see things differently now.

My sensitivity is perhaps my greatest strength. My lack of “coolness” the very reason why I find it so easy to talk to new people. Because it’s tiring isn’t it? Being cooler, thinner, smarter and “deeper” than everyone else. I am perfectly happy to play the role of the erratic and flamboyant nerd these days.

I’m sick of trying not to feel.

I’m sick of writing articles that I think will make me a more interesting person so that people will fall in love with a version of me that doesn’t exist and I will get hurt again. I have decided on a policy of Radical Honesty. Of crying when I am sad, telling people I love them when I really love them and not saying it when I don’t. I have decided that my hurt feelings aren’t a reason to have an identity crisis.

Sensitivity is dangerous and it must be channeled correctly. I am a writer,a lover and great cherished of art. But I am also moody and unreliable. But I’m sick of being ashamed. I’m sick of prétention. This world is too broken and this life is too painful to value irony.

It is our emotions, our tears and fierce conviction of love that makes us invincible. I will be hurt. Over and over again. But I love deeper and stronger than the weak. It is a price I am willing to pay.

Extremity is the only worthwhile policy.

Love with your whole heart. Stop being a coward. Stop being so terrified of vulnerability. And if you find yourself sneering at the criers, the loud and passionate ones, the heartbroken and the disgustingly in love. Just know, they are the lucky ones.
25. Being Loved
By: Paul Ince
Tags: Customer Relationships, Vulnerability, Brene Brown, Marketing

I didn’t quite expect the reaction I received from the last letter. I appreciate every reply.

Honestly, not much has changed in the last fortnight, although the kids are back at school and that’s a huge relief.

Looking back, I think it’s helpful to break down what I’ve actually learnt from the replies I’ve received, and maybe why it was a good idea to be open in a letter — to some people I’ve never even met in person.

Receiving support from others, even an acknowledgement, a recognition of the problem or a ‘you’ve got this’ reply, has been uplifting. There is something about knowing that other people understand what you’re going through. Or, if they don’t, that they can show empathy towards you.

These human emotions, or ways of expressing oneself, are powerful. And yet, I don’t think we use them enough.

At the risk of sounding a bit ‘woo’, I think of Brené Brown’s work with vulnerability. She says:

“Staying vulnerable is a risk we have to take if we want to experience connection.”

We all want to make connections, right? Yes, I’m translating this into a business scenario. You see, ultimately, I don’t think there is any difference between how we connect emotionally with someone, no matter what the circumstances are. In the last few weeks I’ve received support from friends, family, colleagues, teachers and clients. When I think about it, there is no difference in how that support has been offered.

Why? Because I’m willing to be open with them. I have a better, closer working relationship with all my clients as a result of 2020. It’s set the standard for who I want to work with going forward.

You don’t need a sob story to do this, you can be the instigator, asking your customers how they are doing, offering to help, understanding and showing empathy. Exactly the same as how many people did at the beginning of the pandemic. We should use our new experience and build better business relationships that focus on our ability to act in a humane way to one another.

We’ve all gone through so much this year. As it comes to a close, there is hope for 2021, as there is for every new year. Now is a good time to review the relationships that you have and think about how you can deepen them.

This is the final letter before Christmas so, however you celebrate it, or if you do not, stay safe and well. Thank you for being a friend and letting me write to you in 2020.

With love

Paul

Sign up to receive letters directly by visiting bizpaul.com/letters
Fake Blood From Party City
By: Obinna Morton
Tags: Reciprocity, Self Improvement, Voice, Truth, Vulnerability

Fake Blood From Party City

Image courtesy of Pixabay

The blank page, again. It’s so threatening because I never know if I want to speak, if my words are what I feel you’ve earned. So I only write what is an even exchange. I don’t think I’ll use the word fair — it’s too light-skinned for me.

Now, where was I?

Yesterday I cried while I was in the middle of The Nutcracker. I surrendered. I was dancing only Flowers, and everyone else had multiple roles. I just went to the bathroom and back room near the costume area and cried.

Everything became clear and in real-time in the way that real-time can be slow motion because you’ve surrendered.

Image courtesy of Giphy.com

I saw the — and won’t tell people’s lives. But I’ll just say that I felt the weight of it all. The dancers who were all in relationships, or pregnant. The dancers who were younger than me by 10+ years. Them all coming from middle class plus homes, something I never had growing up. I am not them, and yesterday, I felt like I was stuck, that I’m not seen.

The fact that I am dark-skinned and everyone else is light-skinned. This is a micro-aggression I feel from me to them sometimes, too. When I struggle to feel good enough.

I get it that I was injured and I’m still recovering. So maybe that’s it. I don’t know but I don’t fit here. It’s not my world. I cried.

So when a person comments on my poem where I bore my soul about the difficulties of getting older, and they give smiley faces and thanks for the “food for thought.” Quit the bullshit. I’m crying, and you give me smiley faces? What the fuck?
To Be Open & Vulnerable, To Be Frowned Upon
By: Sabila Elsa Cerelia
Tags: Society, Bruises, True Self, Vulnerability, Hidden

Locked doors, repressed emotions & hidden faces.

Those are the common elements that adhere to humanity these days.

To be open & vulnerable is not something that humanity chases anymore. Everybody has been religious in hiding their true selves for so long. A fear of being rejected, a fear of being judged, a fear, a fear & a fear. So many fears that an opportunity to be understood and loved could not be seen by a naked eye.

To be open & vulnerable is to be frowned upon. But, to be alive is to try not to die. This has already portrayed how hard life is when death is always far and near. Life is hard.

Dear humans, why does one complicate life when it already is? Why do we cover our bruises so much? Why do we resist to reveal it?

Without letting it out in the open, our bruises would never heal.

It would stay painful forever, if you don’t give it a chance to heal.
Embracing The Mess Within
By: Rumana Zs
Tags: Empathy, Love, Vulnerability, Soul, Self

Embracing The Mess Within

From goals, ambitions, directions, plans, failures, setbacks, heartbreaks, and uncertainty to acceptance, vulnerability, fortitude, strength, tears, inconsolable giant bucket and tubs full of tears, a rare and open breeding ground of my humanity, empathy, and lack of visibility- this year has been all about the giant colossal mess of a human being that I am.

Rare in its nature, isolating, astute and trite, bitter, sordid, angry, a giant ball of energy, the uncertainty of the human mind that I have, from the colorless odorless bland days of dark clouds hovering right above my head, a window that is a portal to the other world.

I have found in me a child, a still very young child, a still very stubborn child, a still very emotional child, a still very empty feeling child, a still very dreamy-eyed child, a very gusto-filled child, a still very solitude loving child.

I have discovered love, so much love that it has become a force driving my energy. The center of my being has been rattled by this force of energy that exists inside me.

There is a wonder woman inside me and then there is a child inside me. There is a man inside me and then there is a mother inside me.

I have awakened to my very vast soul that has felt so shallow and so small. I have discovered a terse attitude of my nature that is nothing that any expectations can ever find fulfilling to receive.

There has been a sudden gush of truth, overflowing, flooding, filling all the corners and the spacelessness in all the spaces within and outside me.

My abundance has started feeling small and my shallowness has started feeling large.

In the faces that once were where I recognized friendships, connections, love, and belonging, I have discovered an aloofness, a kind of separation of the being from all beings that constituted the parts of me that were once my own.

The places of my giving have been overtaken by redundancies. Redundancies of my capacity of giving, redundancies of my capacities of accepting, redundancies of my ability to put one, someone, anyone above myself.

I have a new found love for some verses that speak to my soul
Stored XSS in Google connected Apps EML, MHT Viewer with Drive
By: Rishu Ranjan
Tags: Security, Cybersecurity, Technology, Vulnerability, Google

This is the story about a live bug that is still there with Google connected App EML, MHT Viewer with Drive. The motive for this blog is to make people aware and avoid using the above mentioned Google connected App.

The above app will be suggested if you open eml file over the drive.

suggested apps for eml file

Steps to reproduce

1. Generate the eml file(test.eml) with malicious XSS payloads.

test.eml code

2. Upload the file to drive and authorize with your google account and open it with mhtviewer.booogle.net

test.eml uploaded on drive

3. Observe that the malicious JS is executed.

confirm(document.domain)

confirm(document.cookie)

Attack scenario

Cross Site Scripting (XSS) on the website also hurts the reputation of the organization as it is possible to tamper with the content of the webpage being shown to the users.

Due to its persistent nature, this vulnerability can affect a large number of users. An attacker will be able to easily compromise a bulk of users instead of targeting individual users. In this scenario, an attacker can send malicious email as attachment (eml) file to different users and the victim will open with the suggested vulnerable app and then let the victim to perform the malicious activity on his behalf.

Google Explanation

Google Reply

This is the reply from Google which is valid. I tried to contact the 3rd party App owner but hard luck. Please share this with others to refrain them from using this app. Suggestions are welcome.

Peace out!
Friendship
By: Brett Beitlich
Tags: Positive Thinking, Mindfulness, Kindness, Culture, Vulnerability

What is friendship and how is it defined? There are actions and attributes that each of us look for in those we us the reserved “friend” title for. My own characteristics include someone who looks out for me like I would look out for them. What that equates to is understanding friendship is not just something which happens when times are good, I need someone around when I am reeling away in my own mind and someone there to help me redirect myself towards positivity. Another characteristic is kindness, simply put I need to be around those in which act in the directions of constant kindness. This means if there is an elderly person needing assistance across the street, I know my current friends would gladly help that person out. The last characteristic is consistency, that does not mean I need some even keeled person who shows no emotion, far from it. I think of it more in the nature of my friends know themselves and they are consistent with who they want to be, and they are proud of it. They are comfortable in their own skin and are exactly that when we are around one another. This characteristic is by far the hardest to come by, as so many of us currently seek the approval of others around us.

I write about this topic because of the constant barrage of negativity we find ourselves in currently in history. I have seen recently people post on social media that they cannot and will not be friends with someone who has a difference in opinion around religion, politics or careers. Are we so individualistic we cannot see past ourselves and appreciate the differences of others in the world? Are we so set in our ways, we want nothing but those around us to think, act and be what we are? I chose the opposite and I appreciate the fact my current circle will allow me to have a difference in opinion and state it in a conversation that is productive and heard.

Friends are those around you which make you become more than you are and support you during that development. It may not always be the sweetest of words whispered, but they are told and come from a heart that is supportive and critical in helping you become more than you think of yourself. Friendship is holding onto the moments which make up our own being and knowing those moments are precision enough to be shared when together. That means stories of fun times, pictures of adventures together and sharing those moments. It also means having the discretion to keep secret when a friend is struggling and not exposing those times for the benefit of a “like” on social media.

As you travel this journey of life, I encourage you to look at the current circle in which you find yourself. Are those around you contributing to your greatness or are they there to find the faults in the decisions you make and use that negativity to make themselves feel better. Find a group that loves you for you, hold on to them tight, show them how important they are to you and I am sure they will do the same in return.
Stop yourself before you repeat yourself. https://medium.com/illumination/me-to-be-me-and-you-to-be-you-807b2512e928
By: Tree Langdon
Tags: Self Improvement, Change, Relationships, Vulnerability, Allowance

Learn more. Medium is an open platform where 170 million readers come to find insightful and dynamic thinking. Here, expert and undiscovered voices alike dive into the heart of any topic and bring new ideas to the surface. Learn more

Make Medium yours. Follow the writers, publications, and topics that matter to you, and you’ll see them on your homepage and in your inbox. Explore
Showing that we care
By: Jean-Marie Buchilly
Tags: Coronavirus, Vulnerability, Leadership, Angela Merkel

Angela Merkel’s speech of 09.12 2020 about Coronavirus and related end of year’s risks

Communications about maintaining or strengthening the measures in connection with the crisis of Covid are coming from everywhere these days.

However, Angela Merkel is doing it in a different way.

She does not only expose facts and figures.

She shows that she cares.

And that makes the difference.

When we show that we care, we can connect with people in a way that no facts and figures can do.

Showing that we care is vulnerability.

And great leaders know how important it is to unleash the power of vulnerability.
Magnified
By: Spoonful Of Stardust
Tags: Loss, Poetry, Love, Vulnerability, Love Letters

Photo by Noelle Otto from Pexels

Perhaps missing you is easier than missing her now

You’re accessible

And tangible

And somewhere to be found

She’s gone from here

So searching wouldn’t do any good

So instead I’ll attach to you

More value than I probably should

My feelings for you are still real

They’re just magnified

By the other feelings of abandonment that I try to hide

And when I admit them I feel like it seems so cliche

Past trauma doesn’t excuse behaviour today

Yet here I am so triggered that I could fucking scream

Part of me wants to stay composed

And the other wants to cause a scene

A piece of me is broken

But don’t worry, another part of me is tough

So rough around the edges, but I’m afraid its not enough

I want to heal all of the open wounds

But I’ll keep all of the lessons

Perhaps the turbulence is how the universe

Reminds us that we are sentient
Confirm an email address belonging to a specific user
By: Abdellah Yaala
Tags: Vulnerability, Facebook Security

Confirm an email address belonging to a specific user

Privacy is important, and after reading this vulnerability, you will know that Facebook gives privacy a great priority

One link enables me to exploit this vulnerability and got $ 5k. alhamdulilah

Too many emails received from facebook contain link to unsubscribe from notifications :

https://www.facebook.com/o.php?k=AS3fdO_cSPoc5dlMxoE&u=userid&mid=midparameter

I look at html form i see e parameter i add it to the previous link, i notice if email is belonging given user in u parameter the response was normal (including secondary emails ), but if i enter the wrong email i get <this page isn’t available > as response

https://www.facebook.com/o.php?k=AS3fdO_cSPoc5dlMxoE&u=userid&e=email&mid=midparameter

Then I reported the vulnerability,

I received a bounty of 5000$

Thanks facebook security team .

Thanks .
Friendship and Vulnerability
By: Kyle Reynolds
Tags: People, Friends, Relationships, Vulnerability, Friendship

Friendship has always been a struggle for me.

For most of my life I have not had many friends. I have had especially few close friends.

I am not good at making friends. I am not outgoing. I am not particularly sociable. If you talk to me I will talk to you but I am not the kind of person who will start a conversation with someone that they do not know.

I enjoy the things that I enjoy and that has often been enough to fulfill me. Aside from my wife, having people in my life is not really something I thought about much.

People are complex. People have the capacity for cruelty. This is especially true when we are young. But we make just as many mistakes when we are adults as well.

Having friends is valuable but it also makes you vulnerable. When you let someone inside your walls, you become vulnerable to pain that is unlike any kind of physical pain.

After not having many friends in my life I reached appoint where I wanted to try to make new friends. I was fortunate to find a community of people with shared interests. They accepted me and we became friends.

Some people in this community became some of the closest friends I have had in my life.

People who are closest to you however can also cause you the most pain.

If things go sideways in a friendship you can be left feeling sadness, pain, resentment, and animosity.

This does not negate all the good things that were created in friendship but it can overshadow everything like a storm cloud.

Holding on to those negative feelings can create bitterness and make enjoying the same parts of life you used to love challenging.

If the opportunity to heal a wound and repair a friendship presents itself take it. Let go of the pain and suffering.

You will have an opportunity to transform a storm cloud into a rainbow. You will be able to have a chance to restore the joy you once felt. It will lighten your soul. Good people make mistakes. People deserve second chances.

Opening oneself up to possibly be hurt again is not easy, but we are better for it. Forgiveness is our true nature.

Do not punish someone for a lifetime for their mistakes.

Friendship is risky. Allowing people into your life on a deep level is risky.

Friendship can create the highest of highs or the lowest of lows.

Friendship is a risk worth taking. Friendship is what makes us human.
DarkIRC Botnet Exploiting Oracle WebLogic Vulnerability
By: Isha Kudkar
Tags: Cybersecurity, Information Security, Oracle, Botnet, Vulnerability

Experts suggested that the DarkIRC botnet is actively concentrated on hundreds of uncovered Oracle WebLogic servers in order to exploit the CVE-2020–14882 remote code execution (RCE) vulnerability fixed by Oracle two months ago.

According to a Juniper Threat Labs report, over 3000 oracle weblogic servers are easily reachable over the Internet based on Shodan stats and allows attackers to execute malicious code on targeted servers.

The most interesting is that DarkIRC malware currently being sold on hack forums for $75, and attackers are continuously targeting potentially vulnerable WebLogic servers using at least 5 different payloads.

The threat actor promoting the DarkIRC botnet on HackForums is going with the aid of using the name Freak_OG and began advertising it starting in August 2020.

A packer is used to hide the malware’s actual intentions and to avoid detection. The packer additionally functions anti-analysis and anti-sandbox , whether it is running in virtualized environments like VMware, VirtualBox, VBox, QEMU, and Xen.

The bot, which installs itself in the %APPDATA% folder as Chrome.exe and creates an autorun access for entry, some of its functions are as follows :-

Browser Stealer

Keylogging

Bitcoin Clipper

DDoS

Slowloris

RUDY (R-U-DeadYet?)

TCP Flood

HTTP Flood

UDP Flood

Syn Flood

Worm or spread itself in the network

Download Files

Execute Commands

Furthermore, it’s able to launch distributed denial of service (DDoS) attacks, of command execution, and of spreading itself on the network, as a worm.

Commands supported through the bot permit it to steal browser passwords, spread via mssql or RDP (brute force), start/cease flood attacks, make an upgrade in the bot, retrieve version or username of the attacked system, fetch and execute (and remove), get IP address, spread through USB or SMB, steal Discord tokens and uninstall itself.

The attack sends an HTTP GET request to a vulnerable WebLogic server, which will execute a powershell script to download and execute a binary file hosted cnc[.]c25e6559668942[.]xyz The payload is a 6MB .NET file.

Bitcoin Clipper allows the malware to change the copied bitcoin wallet address to the attacker’s bitcoin wallet address. This essentially allows it to steal bitcoin transactions on the attacked system.

Juniper Threat Labs stated“This vulnerability was fixed by Oracle in October 2020 and a subsequent out of cycle patch was also released in November to fix a hole in the previous patch. We recommend affected systems to update it,”
To Deal With Problems and Fears, Use Your Mind, Body, and Heart
By: Marta Brzosko
Tags: Inspiration, Big Self, Vulnerability, Fear, Self

To Deal With Problems and Fears, Use Your Mind, Body, and Heart

Photo by Jéan Béller on Unsplash

Dear Big Selfer,

(Yes, you have the Big Self inside of you, whether or not you can see it right now.)

For the past five years, I’ve been trying to live a more conscious life. December 2015 marked what I think of as my “spiritual initiation.” This is not a time and place to tell the whole story — but in short, I met someone who opened my eyes to a whole new understanding of reality.

Since then, I’ve been doing what I could to tap into my full potential, my Big Self. A huge part of this journey was about facing and overcoming personal obstacles. Who doesn’t know the debilitating power of fear, anxiety, or insecurity? And who hasn’t asked themselves:

How can I find a reliable strategy to face my inner demons?

Most of us want a proven recipe, a way that we can use and be sure it’ll work regardless of the circumstances. Some people swear by mindfulness meditation. Others highlight the importance of (micro)habits, working out, therapy, journaling, or another method that helps them most of the time.

But when it comes to your demons, there’s no bulletproof way. You need to adjust your methods. You need to observe, inquire, and experiment. Ultimately, you need to employ your whole being — your mind, body, and heart — and let them work through your struggles together.

This is what I learned from reading Big Self's writings over the past week. Here’s the best of what our writers had in stock.
Facebook Leak Referrer Data
By: Neilmark Ochea
Tags: Bug Bounty, Disclosure, Hacking, Facebook, Vulnerability

I’m glad you’re here. Please have fun reading (@nmochea).

While finding a facebook vulnerability I visited this interesting link with a back uri parameter endpoint

https://facebook.com/privacy/checking/blocking/?back_uri =

So I view the source code and read it. After reading it i found out the url endpoint in the source code does not passing by linkshim, so by adding

https://mydomain.com/login.php

at the endpoint the result like this

https://facebook.com/privacy/checking/blocking/?back_uri = https: //mydomain.com/login.php

you can easily redirect the facebook page without linkshim the redirect works.

What is Linkshim

Every time a link is clicked on the site, the link will check that the URL against Facebook has its own internal list of malicious links, along with the lists of numerous external partners including McAfee, Google, Web of Trust, and Websense. If Facebook detects that a URL is malicious, Facebook will display an interstitial page before the browser actually requests the suspicious page.

Read the full explanation in this note: www.facebook.com

Setup

User: UserOne {Owner: UserOne }

Environment: owner UserOne

Platform: Facebook sites

Step to Reproduce

From any web browser goto www.facebook.com , login as UserOne.

Open this facebook link

https://facebook.com/privacy/checking/blocking/?back_uri=https%3a%2f%2fmydomain%2ecom%2flogin%2ephp

From the left top header click back button

Then facebook page redirect to without linkshim

https://mydomain.com/login.php

Vulnerability Disclosure

Oct-13-2020: I reported this vulnerability issue in facebook whitehat page.

Oct-13-2020: The Facebook team reproduces & investigates regarding the vulnerability issue.

Oct-16-2020: The vulnerability has been patched by adding linkshim.

Oct-22-2020: Bounty Rewarded
I’m Now Respecting My Own Space for a Unique Growth Pace
By: Monica Villanueva
Tags: Growth, Healing, Life Lessons, Strength, Vulnerability

I am starting to accept that it’s always okay to not be at my best when I am not yet done healing.

I am no longer forcing myself to be strong nor to give my best when I am hitting rock bottom. I am no longer scared of my own woundedness because the healing processes from all these wounds are the ones that weave my authenticity. The truth is, all of us are in need of healing. We have allowed certain parts of us to be left wounded and scarred. I am now allowing my wounds to show because all along, I have been using my idea of strength just to hold myself together when I am internally breaking.

I am learning that the strength of my character is not determined by my ability to give unearned love and is rather based on my ability to love in a way that respects my own limits.

I have already outgrown the people who are invalidating my pain and I would no longer allow their words and actions to get the best of me and my authenticity. From now on, I would never ever take for granted the people who helped me face the pain head-on and allowed the tears to flow during the times I’ve been struggling a lot to hold them back. It’s about time to do myself the favor of validating my pain and welcoming the normalcy of it.

It’s about time to stop forcing myself into the lives of the wrong people who have never seen me worthy of letting in — to give myself space to fully heal and to build on true strength. I am now walking a path with the bricks laid down by my unique experiences that tell so many healing stories about how I became who I am now. I am done trying to prove myself to everyone who always told me that I am weak because everything I have survived is already enough to tell that I am not.

It’s about time for me to acknowledge the growth that I’ve reached and that has prepared me for the journey ahead of me, so I would no longer be haunted by who I used to be — the one who allowed people to steal the life out of me.

It may have taken me a lot of mistakes before I realized all of this, but I don’t feel sorry for myself that I had to experience the worst and be at my worst, as those were the ways for me to understand that I am indeed capable of knowing better.
Facebook Push Notification Linkshim Bypassed
By: Neilmark Ochea
Tags: Bug Bounty, Bypass, Facebook, Vulnerability, Hacker

I’m glad you’re here. Please have fun reading (@nmochea).

While browsing and finding facebook vulnerability I accidentally found this facebook push notification link

https://facebook.com/notifications/client/push/enabled/?ref=

when I visited the facebook link something strange the whole facebook page has blank, there’s nothing here hmm so I view the source code and read it to analyze

Snippet below

upsell:null, redirectUrl:"{}", enabledUrl:null

The redirectUrl are vulnerable to open redirect by adding link in the endpoint parameter so I quickly check if the url have endpoint parameter and yess

Vulnerable Parameter

?ref=

I add my website on the endpoint parameter but nothing happened hmm so I try to bypassed using url encode

https%3a%2f%2fmydomain%2ecom%2flogin%2ephp

but still nothing happened and then I add more %2f to the web url

https://facebook.com/notifications/client/push/enabled/?ref=https%3a%2f%2f%2fmydomain%2ecom%2flogin%2ephp

then Boomm the facebook page redirect to my website

https://mydomain.com/login.php

although I trying to perform xss but its already filtered by hex encoding and my knowledge is not enough to bypassed the hex filters.

What is Linkshim

Every time a link is clicked on the site, the link will check that the URL against Facebook has its own internal list of malicious links, along with the lists of numerous external partners including McAfee, Google, Web of Trust, and Websense. If Facebook detects that a URL is malicious, Facebook will display an interstitial page before the browser actually requests the suspicious page.

Read the full explanation in this link: www.facebook.com

Setup

User UserOne

Step to Reproduce

From any web browser login as UserOne and go to

https://facebook.com/notifications/client/push/enabled/?ref=

Now insert website on the parameter endpoint the result look like this

https://facebook.com/notifications/client/push/enabled/?ref=https://mydomain.com/login.php

Add more slash / and then encode the website url to url encode and insert to the endpoint parameter

https://facebook.com/notifications/client/push/enabled/?ref=https%3a%2f%2f%2fmydomain%2ecom%2flogin%2ephp

Hit enter it will redirect to www.mydomain.com/login.php linkshim finally bypassed.

Timeline

Sep-22-2020: I reported this vulnerability issue in facebook whitehat page.

Sep-23–2020: The Facebook team reproduces & investigates regarding this vulnerability issue.

Sep-28-2020: I provided more details regarding this vulnerability issue.

Oct-08-2020: The vulnerability issue has been patched.

Oct-21-2020: Bounty rewarded.

Thanks for reading this article, I hope you guys learn something new today. Please share this article to spread the knowledge.
Remote Sensitive Data Exposure over *.unesco.org, thanks to Options Bleed
By: Piyush Raj
Tags: Bug Bounty, Security, Cybersecurity, Hacking, Vulnerability

Date reported — 02–07–2019

# Vulnerable Software — Apache

# CVE: CVE-2017–9798 / USN-3425–1 “OptionsBleed”

# Type — P1:Sensitive Data Exposure + P5:Fingerprinting/Banner Grabbing

# Domain Affected — *.unesco.org

# Tested — https://en.unesco.org (193.242.192.49)

Summary

Options Bleed is a use after free error in Apache HTTP that causes a corrupted Allow header to be constructed in response to HTTP OPTIONS requests which helped in seeking the direct leak of sensitive data through a misconfigured server-status module, mod_status which Apache web server exposes for displaying metrics.

Reproducibility

Due to its nature the bug doesn’t appear deterministically. It only seemed to appear on busy servers. Sometimes appeared after multiple requests.

Options Bleed on *.unesco.org

Impact

Anyone can set a worker and can extract & enumerate all the sensitive file paths regularly. The files exposed can be accessed directly.

Proof of concept
An Opportunity to Carry on Someone’s Dream
By: The Mustard Seed Mission
Tags: Social Work, Taiwan, Charity, Dreams, Vulnerability

Samuel, 18, has come to the crossroads where he is about to become a college student, a real milestone in his life, but he is hesitating and hesitant. Facing the family situation, he started to ponder about whether to give up opportunity for college….

Samuel’s father is a foreigner, whose occupation is defined as a “blue collar worker” in society. He works in a construction site undertaking high-risk tasks, but his salary is still meager that can barely support the family. Samuel’s mother is unable to go out to work due to the sequelae of spondylolisthesis for many years. Unfortunately, there are still elderly grandma and young sister to take care of at home. Samuel, who grew up in a financially disadvantaged environment, never complained, but spontaneously became independent. He vows to help reduce the financial burden of the family.

In fact, Samuel was not as independent and sensible as he is now. He was a child with poor self-control of emotions. When he was in elementary school, he came to the church. He felt deeply loved and cared there. Life to him was usually overwhelmed by difficulties like the dark clouds covering the sky, but at church, he discovered a new sky full of care and tolerance. Samuel was learning the positive and peaceful communication method, and gradually dissolving the barriers in the heart. The family members also felt the change of Samuel’s personality along the way.

Through the planning and practice of various activities with peers, Samuel learns to unite and cooperate, tolerate each other, and be trained to serve younger children. He also discovered his own interest in music and became a guitarist in the church. These various experiences make Samuel a happy individual and enjoy a different life perspective.

Samuel, who is about to enter university coming year, hopes to be admitted to art or architecture major. Nevertheless, in the face of real-life challenges, he chooses to give up his dream. Seeing the difficulties in Samuel’s family, the church decided to help him apply for scholarship provided by the Mustard Seed Mission to help him reduce his financial burden and give himself a chance to receive a higher education. Samuel also said, “I hope I will eventually have the ability in the future to help people who are as financially disadvantaged as me.”

The Mustard Seed Mission is helping young people from underprivileged families to study uninterruptedly as well as reduce the financial burden of the family. Because of the opportunity to continue their education, they will carry on positive attitude, and learn to be independent while eventually getting rid of poverty.

Together, we can turn around children’s lives through the help of education and provide them with an opportunity for change.

SUPPORT NOW