Lightnews — Scholar-powered news

RyotaK @ryotak.net · Jan 27

I published a blog post about six vulnerabilities in Git/GitHub-related projects. They all result in credential leakage when cloning a malicious repository, so be sure to update the Git installation!

flatt.tech/research/pos...

Clone2Leak: Your Git Credentials Belong To Us

Introduction Hello, I’m RyotaK ( @ryotkak ), a security engineer at GMO Flatt Security Inc. In October 2024, I was hunting bugs for the GitHub Bug Bounty program. After investigating GitHub Enterprise...

flatt.tech

1 7

RyotaK @ryotak.net · Dec 10

Thank you so much for reading it!

1

RyotaK @ryotak.net · Dec 7

Thank you for reading it ;)

RyotaK @ryotak.net · Dec 7

If you're interested in the technical details, I wrote the blog post here: flatt.tech/research/pos...

For the further details, please check out the announcement from the OpenWrt team: lists.openwrt.org/pipermail/op... (2/2)

Compromising OpenWrt Supply Chain via Truncated SHA-256 Collision and Command Injection

Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at Flatt Security Inc. A few days ago, I was upgrading my home lab network, and I decided to upgrade the OpenWrt on my router.1 After ac...

flatt.tech

8 16

RyotaK @ryotak.net · Dec 7

[PSA]
If you're using OpenWrt router and have used the Attended sysupgrade, firmware-selector.openwrt[.]org or CLI upgrade previously, I recommend you to re-flash your firmware.

Due to a security issue, it was possible to pollute the firmware images delivered to these tools. (1/2)

1 2 10

RyotaK @ryotak.net · Dec 7

OpenWrtのビルド用サーバーに脆弱性を報告しました。

Attended sysupgrade、firmware-selector.openwrt[.]orgあるいはCLIからのアップグレードを過去に実施した場合、改ざんされたファームウェアが配信された可能性が完全には否定できないため、ファームウェアの再更新を推奨します。

技術的解説についてはこちらの記事をご確認ください。 flatt.tech/research/pos...

公式からの発表はこちらをご覧ください。 lists.openwrt.org/pipermail/op...

Compromising OpenWrt Supply Chain via Truncated SHA-256 Collision and Command Injection

Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at Flatt Security Inc. A few days ago, I was upgrading my home lab network, and I decided to upgrade the OpenWrt on my router.1 After ac...

flatt.tech