This is a reminder to ask my friends here, please take Omicron seriously.

As someone who has dealt with having chronic illness for years that are nearly identical to long COVID symptoms; it is really really hard

Quality of life is something you don't appreciate until it's lower
I have #fibromyalgia and some days I can't physically get out of bed, and that's because of pain, or fatigue.

My pain comes in 2 types:
Phantom Sunburn
Torture Compression

The 1st feels identical to like an Arizona sunburn, except no skin color and putting on aloe doesn't help
The crushing feels like having rubber bands on your limbs that keeps getting tighter and tighter and you can't take them off.

Sometimes I imagine a steamroller crushing my legs is how it feels.

And these are not my worse symptoms

The fatigue is what kills me.
I can get through the pain, it's awful, and there's some days I can't, but I usually fight against it.

The fatigue you can't fucking win.

Imagine feeling perfectly fine, opening your fridge and and then feeling like you ran a mile after you close it.

It randomly happens
The fatigue is a monster that lurks and it takes me whenever it wants, to the umbral darkness I am pulled.

I does what it wants, and even with amphetamines, modafinil, and other CNS drugs it will still take you down

And don't forget the brain fog.... The
You know that feeling when you look at a word that looks like it is spelled wrong but you know it is right?

That's what my brain fog is but with entire subjects.

You suddenly can't remember or think how things work even though you know them, you just can't explain them
And these are just 3 of my symptoms, I won't even get into them phantom psoriasis, photophobia, and the others I get

Fibromyalgia is likely due to an autoimmune disorder, and it seems long term COVID can trigger very much the same kind of hell quality
Quality of life is everything, cherish it.

I know I would have if I had known it would get this bad

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Greg Linares

Greg Linares Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @Laughing_Mantis

20 Dec
#Log4J Worm is ITW

@vxunderground has a sample of the self propagating worm using log4j as a vector.

It installs a Mirai bot which makes sense to targeting embedded Linux devices

Looks like it uses user-agent for exploitation and modifies the binary before sending (?)
From what I can quickly reverse engineer it looks like this malware is targeting mainly Huawei routers

Very very similar to CVE-2017-17215

For reference:

securitynews.sonicwall.com/xmlpost/new-wa…
This variant will quickly get modified and used and repurposed to exploit other hardware and devices.

Welcome to the age of the log4j worms everyone.

🪵🪱
Read 9 tweets
13 Dec
#log4j theoretical worm depending on propegation speed might just blend in with the noise for a while.

Ideally right now reducing attack surface should be everyone's top priority

Unfortunately we are dealing with a bug with unprecedented vectors.
Everyone right now shouldn't even focus on worm capabilities because exploitation is so wide spread right now it doesn't even increase your risk level, attackers are doing nearly identical to what worm activity would be like.

Traffic congestion and network bottlenecking tho...
Historically if we look at worm activity it took roughly a week to 14 days for them to be widespread & developed

However those in the past didn't use logic flaws & required memory corruption exploits which are less reliable & complex payloads.

This is much lower skill ceiling
Read 5 tweets
12 Dec
#Log4J based on what I've seen, there is evidence that a worm will be developed for this in the next 24 to 48 hours.

Self propagating with the ability to stand up a self hosted server on compromised endpoints.

In addition to spraying traffic, dropping files, it will have c2c
Biggest hurdle appears to be implementing a JDK gadget to enable code execution on limited env.

That is currently being researched by several groups.
Honestly I'm kinda surprised it isn't finished yet, but I have seen at least 3 groups (Eastern euro, .ru and .cn) that are investigating options to do this.

Goals appear varied: financial gain via extortion as well as selling access to compromised hosts to RaaS groups
Read 7 tweets
12 Dec
#Log4J Data Exfiltration & Env Var List 🧵

I will use this thread to discuss env variables I have seen being used in the wild alongside log4j exploitation from both remote & in local subnets

This isn't a complete list but it will give you an idea what attackers are looking at
In addition to the AWS variables I have discussed earlier I am also seeing these:

For Hadoop I am seeing threat actors attempt to query the following env vars

HADOOP_HOME
HADOOP_CLIENT_OPTS
HADOOP_SHELL_EXECNAME
HADOOP_USER_PARAMS
HADOOP_SECURE_CLASSNAME
HADOOP_SECURE_USER
For postgress I am seeing several attempts:

PGPASSWORD
PGDATABASE
PGPASSFILE
PGHOST
PGSSLKEY
Read 6 tweets
11 Dec
PSA: attackers aren't just using #log4j attacks on internet facing devices.

Groups I'm monitoring are going back to compromised networks and using it on subnets and on internal devices *very* successfully

Insider threat is also an viable avenue of exploitation
Update: here's what vectors internal threat actors are using to gain access via #log4j exploits:

Email/inbox monitoring services
Network inspectors
Internal web servers
SSL inspectors
Couchdb(?) Logging services
Asset management services
XML parsing services
Email: sending log4j in subjects to null addresses or internal

Network: spamming STUN, ARP, UDP, and MDNS traffic with log4j in packets

SSL: setting up malicious SSL servers and waiting for connections

Dropping log4j in xml files that are being referenced or ingested
Read 4 tweets
11 Dec
To add on to what @dildog is referencing with AWS vars and log4j

Here is a list of the AWS envs that I've seen attackers attempt to dump from the target machine

docs.aws.amazon.com/cli/latest/use…
So when you see the "You just got RCE and you use it to info dump" people, please kindly remind them that RCE isn't always as fancy as they would love to think
Read 8 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

:(