Nisaba Solutions retweeted
An OpenSSH bug that took 46 years to ripen!
1980
UNIX puts * in the password field of system accounts. The idea is simple: it’s not a real hash, so it can’t be brute-forced and you can’t log in with a password.
2012
The musl libc developers decide that returning NULL from crypt() on failure is dangerous - programs often forget to check it and crash with a segfault. So they return an error string instead.
Guess which one?
The same asterisk: *.
Three weeks later they add a length limit: passwords longer than 256 bytes burn CPU. Anything longer is rejected. And since it’s an error, crypt() returns *.
2016
OpenSSH fixes a timing attack (CVE-2016-6210). If a user doesn’t exist, the server still hashes the password with a fake/borrowed salt so an attacker can’t tell valid usernames by response time.
2022
Alpine Linux changes the locked root password in /etc/shadow from ! to * so SSH keys work properly on cloud images.
… and the loop closes!
You connect over SSH as root (whose shadow entry is *).
You type any password longer than 256 characters (e.g. 300 As).
crypt() hits the length limit → returns * → OpenSSH compares it with the value in the database → that value is also * → you’re in as root.
That chain took 46 years (!!!) to complete.
Every individual change was reasonable. Together they produced a perfect * == * authentication bypass (CVE-2026-123158, nicknamed *sshole). Fixed in OpenSSH 10.6p2 and Alpine packages.
🚨 Critical OpenSSH flaw allows passwordless account access using any password over 256 characters
sshhole.com
A newly disclosed vulnerability dubbed *sshole has been discovered in OpenSSH installations using musl libc, potentially allowing attackers to bypass authentication and gain access to accounts that should reject password logins entirely.
The flaw affects certain configurations of Alpine Linux, OpenWrt, Buildroot, and Yocto where PAM is disabled and password authentication remains enabled. Under specific conditions, attackers can authenticate to locked accounts using arbitrary passwords between 257 and 1,024 characters.
The researcher demonstrated that affected Alpine Linux cloud images could allow attackers to gain root privileges through a passwordless administrative account.
OpenSSH 10.6p2 addresses the issue. Administrators are urged to update immediately or disable SSH password authentication until patches can be applied.
Nisaba Solutions retweeted
🤖 Private, Agentic & Non-Custodial: The B2P Central MCP Integration 🚀
How do we give autonomous AI agents access to real-time, non-KYC liquidity without compromising privacy or security?
In our latest blog post, we introduce the official B2P Central Model Context Protocol (MCP) Server, a bridge connecting AI workflows directly to peer-to-peer markets:
📖 blog.b2p-central.com/Connect…
#Bitcoin #AIAgents #MCP #Privacy #NoKYC #B2PCentral #Sovereignty #P2P
Nisaba Solutions retweeted
“ Si un État ne parvient pas à vaincre la criminalité, c’est parce que l’État est complice, ou parce que certaines parties de l’État le sont. Une fois que l’État se libère de cette complicité et agit avec force contre les criminels, il les vainc.”
- Nayib Bukele
Nisaba Solutions retweeted
🤖 AI Agents, Meet Sovereign Finance.
We are excited to launch the official B2P Central MCP Server! 🚀
AI agents and automated workflows can now query real-time, non-KYC liquidity across our entire aggregator suite:
🔹 P2P Bitcoin Offers
🔹 Crypto Swaps
🔹 Lend & Borrow
🔹 Gift Cards
🔒 Sovereignty & Security by Design:
• 0% Trackers | 0% Logs | 100% Non-Custodial
• Direct, private access to market rates and liquidity
• Strict safety: Sensitive actions and executions require explicit user validation
Bring sovereign P2P liquidity to your AI stack today!
🔗 Connect your agent: b2p-central.com/#/mcp
#Bitcoin #Privacy #MCP #AIAgents #NoKYC #B2PCentral #Sovereignty #P2P #Monero
Nisaba Solutions retweeted
Exploring new ways to buy and sell Bitcoin?
B2P Central has just updated its comparison directory to include @telegram P2P (Wallet) alongside our existing decentralized and non-custodial options.
We believe in transparency, giving you the facts on reliability, ToS, privacy, and KYC terms so you can choose the right tool for your threat model.
Compare all providers now:
b2p-central.com/#/trade/buy
#Bitcoin #P2P #CryptoPrivacy #SelfCustody #B2PCentral
Nisaba Solutions retweeted
🛡️ Your ultimate command center for sovereign financial tools!
B2P Central brings together four core privacy-focused services into a single, tracker-free dashboard:
1️⃣ P2P Bitcoin Deals: Compare peer-to-peer buy and sell offers from platforms like @bisq_network , @hodlhodl , @RoboSats.
2️⃣ Crypto Swaps: Instantly compare rates across multiple swap providers to get the best deal for your trades.
3️⃣ Lend & Borrow: Access Bitcoin-backed liquidity without selling your sats, comparing offers from @HodlHodl, @CoinRabbit, and @BTCBacked_ .
4️⃣ Gift Cards: Spend digital assets seamlessly by comparing gift card options from @Trocador and @BitRefill
🔒 100% Free | 0% Cookies | 0% Trackers
🚀 Explore all features: b2p-central.com
#Bitcoin #Privacy #NoKYC #P2P #B2PCentral #Sovereignty #Monero
Nisaba Solutions retweeted
🎁 Spend your crypto, your way!
Say goodbye to platform-switching. We are thrilled to announce that Gift Cards are now officially live on B2P Central! 💳✨
You can now instantly compare and purchase gift cards from top-tier providers like @TrocadorApp and @bitrefill directly through a single, streamlined interface.
Whether you're shopping for everyday essentials, tech, travel, or entertainment, spend your crypto seamlessly while maintaining your privacy and finding the best value. No unnecessary friction—just pure financial freedom. 🌍⚡️
👉 Explore the new feature now: b2p-central.com/#/gifts
Nisaba Solutions retweeted
Comparing crypto swap options shouldn’t require a browser tab collection 😏
B2P Central ( @B2PCentral ) has integrated the @letsexchange_io API, expanding the range of swap offers available through its Crypto Swap Finder 🔄
More options to compare. Fewer places to check. Your tabs can relax for a minute.
Read the full story below 👇
go.letsexchange.io/b2p-centr…
#LetsNews #LetsPartner
Nisaba Solutions retweeted
B2P Central ( @B2PCentral ) has integrated the @letsexchange_io API to expand the crypto swap options available through its platform.
The integration expands the range of swap offers available within B2P Central’s Crypto Swap Finder through the LetsExchange API, helping users compare more available options in one interface.
LetsExchange supports 6,000+ digital assets across 300+ blockchain networks and works with 20+ external swap providers.
Learn more about the integration below.
go.letsexchange.io/b2p-centr…
#LetsNews #LetsPartner
Nisaba Solutions retweeted
On est en france, le hacker discute avec la DGFIP, c'est normal.
Tout est normal.
Nisaba Solutions retweeted
one more ... ☹️
⚠️ Important NoOnes Wind-Down Update,
This is one of the most difficult announcements we have ever had to make. After more than three years, NoOnes is beginning to wind down its operations. We worked tirelessly to resolve and remove the sanctions affecting NoOnes, but unfortunately, we were unable to do so. The sanctions caused us to lose essential partners and led blockchain monitoring providers to classify NoOnes-related transactions as high risk, making it extremely difficult to continue operating.
Nisaba Solutions retweeted
🛡 New Feature Alert: The B2P Central Lend & Borrow Comparator is Live!
We are excited to announce the next step in our roadmap toward building the ultimate command center for financial sovereignty. You can now compare crypto lending and borrowing offers directly on B2P Central.
Put your sats to work or access liquidity without selling your stack, all while maintaining the privacy standards you expect from us.
Current Providers:
✅ @hodlhodl: Experience non-custodial, peer-to-peer lending secured by multi-sig escrow.
✅ @CoinRabbitLoans: Fast and simple landing solutions to unlock the value of your assets.
This is just the beginning. We are working to integrate more providers soon to ensure you always find the best sovereign rates in the market
🚀 Explore the new comparator now: b2p-central.com/#/lendborrow
#Bitcoin #Privacy #Lending #Borrow #B2PCentral #Sovereignty #NoKYC
Nisaba Solutions retweeted
Another sad news: a major figure in the ecosystem is retiring. RIP @lnp2pBot 😢
Comunicado
Lamentamos comunicarles que el día que no queríamos que llegara ha llegado: @lnp2pBot llega a su fin.
Como comunicamos hace pocos días, @lnp2pBot ha sido atacado desde el primer día, las pérdidas que hemos sufrido las hemos asumido por el simple hecho de seguir dándole el servicio que se merecen nuestros fieles usuarios. Sin embargo los hechos se han precipitado y aunque llevamos meses trabajando para mejorar la seguridad del bot no contamos con los recursos para enfrentar un ejercito de script kiddies armados con modelos de IA.
Por todo esto hemos tomado la dura y penosa decisión de detener indefinidamente todo tipo de actividad de @lnp2pBot, con efecto inmediato.
Una vez más las pérdidas son nuestras. Nos comunicaremos con los pocos usuarios que tienen pagos pendientes para resolver esos casos particulares. No habrá ni un solo usuario afectado económicamente.
El bot nació como nuestra legítima defensa ante gobiernos autoritarios que pretenden obligar a los usuarios en entregar todo tipo de información personal con la excusa de que es por su propio bien. Muchas veces pensamos que eran ellos quienes iban a lograr cerrar al bot. Irónicamente no fue ningún gobierno autoritario quien lo logró sino probablemente algunos de nuestros propios usuarios.
A todos nuestros usuarios.
¡Gracias totales!
Nisaba Solutions retweeted
This bug is the worst since BTCPay was created. I am devastated about the loss incurred.
@craigraw saved a lot of people by pointing us to the right direction after being drained, so we could fix and communicate as fast as we could. Even AI scans didn't find the issue.
Nisaba Solutions retweeted
There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds.
Please update your BTCPayServer to 2.4.2 by going to Admin Dashboard -> Server -> Maintenance -> Update & verify the 2.4.2 version string in the footer.
If you are unable to update right away, turn off your BTCPay Server to prevent unauthorized access until you can update.
Nisaba Solutions retweeted
Times are tough. Now that @Boltzhq —one of the key players in the Bitcoin ecosystem—has had to temporarily pause its operations, we hope it won’t be permanent.
For those searching how to swap BTC <-> Lightning, B2P Central can help to find the best option.
b2p-central.com/#/swap-crypt…
Nisaba Solutions retweeted
Another exciting new feature for the B2P Central plugin for @BtcpayServer : Allow your clients to pay with altcoins and stablecoins, and receive payment in BTC! It works exactly like the Exolix plugin—but this time, you can choose your preferred provider for on-chain and Lightning payments!
Check here how it works : github.com/Nisaba/btcpayserv…
