Laban Sköllermark @LabanSkoller@infosec.exchange (@LabanSkoller) header
Laban Sköllermark @LabanSkoller@infosec.exchange (@LabanSkoller) profile picture

Laban Sköllermark @[email protected]

@LabanSkoller

Penetration tester and IT security consultant. MSc in Computer Science and Engineering. He/him. 🏳️‍🌈

 Malmö, Sweden
labanskoller.se/
Joined February 2010
  • Tweets1.6K
  • Following248
  • Followers235
69Media
Photo by Laban Sköllermark @LabanSkoller@infosec.exchange (@LabanSkoller)Photo by Laban Sköllermark @LabanSkoller@infosec.exchange (@LabanSkoller)Photo by Laban Sköllermark @LabanSkoller@infosec.exchange (@LabanSkoller)Photo by Laban Sköllermark @LabanSkoller@infosec.exchange (@LabanSkoller)Photo by Laban Sköllermark @LabanSkoller@infosec.exchange (@LabanSkoller)Photo by Laban Sköllermark @LabanSkoller@infosec.exchange (@LabanSkoller)Photo by Laban Sköllermark @LabanSkoller@infosec.exchange (@LabanSkoller)Photo by Laban Sköllermark @LabanSkoller@infosec.exchange (@LabanSkoller)Photo by Laban Sköllermark @LabanSkoller@infosec.exchange (@LabanSkoller)
Good news! I've uploaded a new post about the most complex and beautiful vulnerability I've ever found, involving patching and uploading deprecated .jar libraries to get RCE on a big target. It's a very technical post, but I hope you like it ! :) hacefresko.com/posts/rce-on-…
A very fancy way to obtain RCE on a Solr server

A very fancy way to obtain RCE on a Solr server

hacefresko.com
6
105
2
402
24,676
The UK ordered Apple to implement back doors. Apple did the right thing and simply removed support for end-to-end encrypted iCloud storage for UK customers, keeping the rest of the world secure. Congratulations, UK! bbc.com/news/articles/cgj54e…
Apple pulls data protection tool after UK government security row

Apple pulls data protection tool after UK government security row

Customers' photos and documents stored online will no longer be protected by end-to-end encryption.

bbc.com
4
32
4
122
6,191
Veckans podd gästas av pentestaren @LabanSkoller. Han berättar om sitt jobb och om sin senaste upptäckt: en IoT-pryl som läckte hela wifi-nätverkets lösenord. nikkasystems.com/2024/10/04/… #BliSäker
Podd #268: S:et i IoT står för säkerhet – Nikka Systems

Podd #268: S:et i IoT står för säkerhet – Nikka Systems

Veckans podd gästas av pentestaren Laban Sköllermark. Han berättar om sin senaste upptäckt: en IoT-pryl som läckte hela wifi-nätverkets lösenord.

nikkasystems.com
1
2
4
182
Check out @bugch3ck AS/400 hacking talk at this year's @SEC_T_org 0x10sion! Topics included 🔴 Attacking Network Services 🔴 Privilege Escalation, and 🔴 Post-exploitation and Lateral Movement A must-see for all the pentesters and blue teamers! Video below 👇 #SECT2024
Image from WithSecure Consulting now Reversec (@withconsulting)
1
2
6
230
I recently "hacked" my smart air purifier 😆 Here's a blog post about it: jmswrnr.com/blog/hacking-a-s… I put a lot of effort into this one; I'm sure any tinkerers out there will find it very interesting! I'd appreciate any feedback or reposts 🙌
Hacking a Smart Home Device

Hacking a Smart Home Device

How I reverse engineered an ESP32-based smart home device to gain remote control access and integrate it with Home Assistant.

jmswrnr.com
7
30
3
94
11,359
I _love_ reading security research, and really appreciate the effort people put into producing it, but please for the love of Dog, add the date it was published! The tweet comes from a wasted morning trying to reproduce research that was obsoleted 4+ years ago 🤦
4
6
86
9,684
Replying to @safesecs @NikkiC360
@safesecs @NikkiC360
Image from Malwarebytes (@Malwarebytes)
10
143
16
638
82,159
Laban Sköllermark @[email protected] retweeted
shubs (@infosec_au) profile picture
shubs
@infosec_au24 Oct 2023
Citrixbleed: On Oct 10th, Citrix announced a security advisory for CVE-2023-4966, a sensitive information disclosure bug marked as CVSS 9.4 affecting Netscaler Gateway. The security research team at @assetnote was able to reproduce the vulnerability. Blog post here: assetnote.io/resources/resea… or you can find the exploit here: github.com/assetnote/exploit…
Image from shubs (@infosec_au)
2
142
7
443
97,957
Om jag vore red teamer så hade jag arrangerat alla mina bakdörrar i bokstavsordning. Shellsortering är viktigt.
2
4
157
Wow, won the @PwnieAwards for most innovative research. Having seen the awards over 10 years ago on my first Black Hat I’m incredibly honoured.
Image from stacksmashing (@ghidraninja)
Image from stacksmashing (@ghidraninja)
22
19
303
22,484
Mullvad’s Response to the "TunnelCrack" vulnerability disclosure. Except for iOS, we are unaffected by these findings mullvad.net/blog/2023/8/9/re…
Response to "TunnelCrack" vulnerability disclosure

Response to "TunnelCrack" vulnerability disclosure

Mullvad is mostly unaffected by the TunnelCrack VPN vulnerabilities. This is our response to the recently disclosed set of attack vectors on VPNs.

mullvad.net
4
15
1
142
15,580
For 25+ yrs police/military/intel agencies/critical infrastructr in 120 nations relied on TETRA radio standard to secure critical comms. But Dutch researchers examined secret algorithms used in TETRA and found something startling - an intentional backdoor wired.com/story/tetra-radio-…
Code Kept Secret for Years Reveals Its Flaw—a Backdoor

Code Kept Secret for Years Reveals Its Flaw—a Backdoor

A secret encryption cipher baked into radio systems used by critical infrastructure workers, police, and others around the world is finally seeing sunlight. Researchers say it isn’t pretty.

wired.com
29
726
114
1,680
556,913
Hjärtstopp hörni. Häromveckan åkte familjen hem från Schiphol. Mannen framför mig i säkerhetskontrollen ramlade raklång i backen. Min fru (som också är läkare) och jag vände honom på rygg - ingen reaktion. Några snarkande andetag och sen slutade han andas.
Image from Jörgen Strömberg (@jorgenstromberg)
103
284
44
2,606
375,840
When I read Ghost in the Wires in 2016 I thought, man I wish there was a podcast with stories like this. RIP Kevin Mitnick. You inspired me to tell stories like you did.
35
146
25
1,268
98,608
Laban Sköllermark @[email protected] retweeted
celesian (@c3l3si4n) profile picture
celesian@c3l3si4n3 Jul 2023
Sharing my experience with alias path traversals on nginx, and how we leaked sensitive data on Bitwarden and GCP with that. Along with that, we also released a tool called navgix to check for the presence of these vulnerabilities in an automated manner. labs.hakaioffsec.com/nginx-a…
7
99
3
226
29,551
Hittills har bara @piratpartiet, @Centerpartiet och @sdriks ställt sig på världens barns sida och tagit avstånd från det människorättskränkande och Barnkonventionsbrytande massövervakningsförslaget #ChatControl 2.0. Pinsamt och beklämmande! sverigesradio.se/artikel/reg… – at Malmo, Sweden
Regeringen vill kunna kontrollera alla digitala meddelanden | Sveriges Radio

Regeringen vill kunna kontrollera alla digitala meddelanden | Sveriges Radio

Regeringen stöder det omstridda EU-förslaget om att göra det möjligt att kontrollera alla digitala meddelanden som skickas mellan användare.

sverigesradio.se
1
36
3
127
9,291
I found a vulnerability that allowed me to unlock any @Google Pixel phone without knowing the passcode. This may be my most impactful bug so far. Google fixed the issue in the November 5, 2022 security patch. Update your devices! bugs.xdavidhu.me/google/2022…
Accidental $70k Google Pixel Lock Screen Bypass

Accidental $70k Google Pixel Lock Screen Bypass

bugs.xdavidhu.me
81
1,234
104
4,562
Why don't we release CVE numbers with pre-announcements? It would be very convenient to name tools and write docs and open issues in advance. The point of CVEs is to get everyone talking about the vuln with the same name, and we are all talking about it already. #OpenSSL
9
35
1
229
Just massive kudos for the person who created this Halloween squirrel feeder nitter.gq/Todd_Spence/status/144…
691
22,132
1,133
200,513
Halloween dress up ideas! Happy halloween everyone! #halloween #cybersecurity #funny
Image from Thomas Skjortan O (@skjortan)
1
2
Load more