D3hydrate
LightNews LightNews
banner
en3k.bsky.social
D3hydrate
@en3k.bsky.social
86 followers 690 following 5 posts
FG's, art, compassion for all
Posts Replies Media Videos
Reposted by D3hydrate
fuzzychef.org
Trump/Musk just laid off the entire VA info security team, in the middle off the night, this weekend.
Post from Jonathan Kamens: Before I was fired tonight, I was in charge of information security for VA.gov, which has millions of users per month and stores and processes huge amounts of veterans' personal information. I've been told by people I've worked with that I'm the best at what I do of anyone they've ever worked with. Now there will be _no one_ in charge of information security for VA.gov. Does this seem like improving government efficiency?
February 16, 2025 at 4:30 PM
Reposted by D3hydrate
jamellebouie.net
the single most un-american and anti-constitutional statement ever uttered by an american president
February 15, 2025 at 6:39 PM
Reposted by D3hydrate
twlldun.bsky.social
Let’s see what motivates this guy to join DOG…oh
February 16, 2025 at 10:54 AM
Reposted by D3hydrate
ragingspirit.bsky.social
Somewhat related fresh horror. This has layers on top of layers of infosec dysfunction.

samcurry.net/hacking-subaru
Introduction On November 20, 2024, Shubham Shah and I discovered a security vulnerability in Subaru’s STARLINK connected vehicle service that gave us unrestricted targeted access to all vehicles and customer accounts in the United States, Canada, and Japan. Using the access provided by the vulnerability, an attacker who only knew the victim’s last name and ZIP code, email address, phone number, or license plate could have done the following: Remotely start, stop, lock, unlock, and retrieve the current location of any vehicle. Retrieve any vehicle’s complete location history from the past year, accurate to within 5 meters and updated each time the engine starts. Query and retrieve the personally identifiable information (PII) of any customer, including emergency contacts, authorized users, physical address, billing information (e.g., last 4 digits of credit card, excluding full card number), and vehicle PIN. Access miscellaneous user data including support call history, previous owners, odometer reading, sales history, and more. After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously. Enumerating Employee Emails Using LinkedIn, we did a quick search for “Subaru STARLINK” and found a few employees who appeared to be software engineers. After getting their names, we Googled and found that Subaru emails are in the following format: [first_initial][last]@subaru.com We tossed the few emails that we’d pieced together into the “getSecurityQuestion.json” endpoint and hit send. On the fourth attempt, we got a response back! <label for="securityQuestionId"> <span class="securityQuestionText">What city were you born in?</span> </label> The jdoe@subaru.com (redacted) email was valid! We went back to the reset password endpoint and hit send. HTTP Request POST /forgotPassword/resetPassword.json HTTP/1.1 Host: portal.prod.subarucs.com { "email": "jdoe@subaru.com", "password": "Example123!", "passwordConfirmation": "Example123!" } HTTP Response HTTP/1.1 200 Date: Wed, 20 Nov 2024 03:02:31 GMT Content-Type: application/json Connection: close X-Frame-Options: SAMEORIGIN Content-Length: 9 "success" It worked! We tried logging in. We had successfully taken over an employee’s account, but there was now a 2FA prompt to actually use the website. It was custom, so we tried to see if there was anything to do to bypass it. Bypassing 2FA We tried the simplest thing that we could think of: removing the client-side overlay from the UI. Match $('#securityQuestionModal').modal('show'); Replace //$('#securityQuestionModal').modal('show'); After removing the client-side overlay, we clicked around and the whole app seemed to function normally. All of the buttons worked, and were returning server-side data.
January 23, 2025 at 10:23 PM
Reposted by D3hydrate
wario64.bsky.social
Follow @wario64.bsky.social and repost for a chance to win 1 of 5 Steam codes for ANTONBLAST. Giveaway ends December 7th, 6 PM PT.

Game is available now on Steam store.steampowered.com/app/1887400/...
December 3, 2024 at 7:21 PM
Reposted by D3hydrate
trans.bsky.social
i made a high fidelity remaster of an old @bradneely.bsky.social video that i love 💕
November 18, 2024 at 4:49 PM
Reposted by D3hydrate
sharpiepls.com
deactivating your twitter account doesn't delete your tweets.

and even if you manually go through and delete everything you see, twitter doesn't let you access anything past your first 3000 tweets through your browser

this program is the only thing that worked for me (with over 76k tweets lmao)
GitHub - lucahammer/tweetXer: Delete all your Tweets for free
Delete all your Tweets for free. Contribute to lucahammer/tweetXer development by creating an account on GitHub.
github.com
November 10, 2024 at 12:45 PM
Reposted by D3hydrate
maxberger.bsky.social
God grant me the serenity to accept I am cooked,

The courage to say fuck it we ball,

And the wisdom to know when we are so back
November 11, 2024 at 2:24 AM
Reposted by D3hydrate
piranhartist.bsky.social
Putting this out for others as much as for myself right now ❤️
November 7, 2024 at 3:58 PM
Reposted by D3hydrate
amtrax.bsky.social
I can’t believe this gave me as much hope as it did
November 6, 2024 at 12:57 PM
en3k.bsky.social
Had a 70 yr old coworker tell me about how he lost his money in a bad stock scam in his younger years, then proceeded click on side ads and buy really patriotic shirts on the work computer. Some people just can't stop being scammed, unfortunately by the worst people😬
sharpiepls.com dapurplesharpie @sharpiepls.com · Nov 7
teaching the elderly to click every phishing link in their emails TO OWN THE CONSERVATIVES 😭
November 7, 2024 at 9:13 PM
Reposted by D3hydrate
sharpiepls.com
teaching the elderly to click every phishing link in their emails TO OWN THE CONSERVATIVES 😭
November 7, 2024 at 7:38 PM
Reposted by D3hydrate
josephcox.bsky.social
New from 404 Media: police freaking out at iPhones stored for forensic examination mysteriously rebooting themselves. This makes brute forcing much harder. Cops hypothesize Apple pushed an update that tells nearby iPhones to reboot if not on phone network www.404media.co/police-freak...
Police Freak Out at iPhones Mysteriously Rebooting Themselves, Locking Cops Out
Law enforcement believe the activity, which makes it harder to then unlock the phones, may be due to a potential update in iOS 18 which tells nearby iPhones to reboot if they have not been in contact ...
www.404media.co
November 7, 2024 at 8:03 PM
Reposted by D3hydrate
wafflethekodiak.bsky.social
gotta keep going no matter what happens
November 6, 2024 at 11:40 AM
Reposted by D3hydrate
mattdoyle.bsky.social
One note, just to be safe: BlueSky's DMs aren't encrypted. Don't put stuff there that you wouldn't want to be made public.
November 6, 2024 at 2:56 PM