Мир сегодня с "Юрий Подоляка"

Труха⚡️Україна

Паглядзець

Николаевский Ванёк

Паглядзець

Мир сегодня с "Юрий Подоляка"

Паглядзець

Труха⚡️Україна

Паглядзець

Николаевский Ванёк

Паглядзець

vx-underground

The largest collection of malware source, samples, and papers on the internet.
Password: infected
https://vx-underground.org/

Рэйтынг TGlist

ТыпПублічны

Вертыфікацыя

Не вертыфікаваны

Надзейнасць

Не надзейны

Размяшчэнне

МоваІншая

Дата стварэння каналаJul 30, 2020

Дадана ў TGlist

Sep 22, 2023

Я ўладальнік канала

Гісторыя змяненняў

Статыстыка Тэлеграм-канала vx-underground

Падрабязней

Падпісчыкаў

47 014

24 гадз.

2 3075.2%Тыдзень

2 5635.8%Месяц

2 9636.7%

Індэкс цытавання

0

Згадкі1Рэпостаў на каналах0Згадкі на каналах1

Сярэдняе ахоп 1 паста

4 053

12 гадз.3 611

7.7%24 гадз.4 053

23%48 гадз.6 694

84.8%

Узаемадзеянне (ER)

4.71%

Рэпостаў37Каментары0Рэакцыі154

Узаемадзеянне па ахопу (ERR)

8.92%

24 гадз.

2.85%Тыдзень

2.89%Месяц

2.71%

Ахоп 1 рэкламнага паста

4 958

1 гадз.65913.29%1 – 4 гадз.1 71834.65%4 - 24 гадз.2 95659.62%

Падрабязней

Падключыце нашага бота да канала і даведайцеся пол аўдыторыі гэтага канала.

Усяго пастоў за 24 гадзіны

1

Дынаміка

Апошнія публікацыі ў групе "vx-underground"

Усе пасты

21.04.202520:49

wtf why this dissin us

20.04.202516:52

Happy Easter

He has AMD Ryzen

20.04.202506:46

We've seen a bunch of dorks on Twitter use this meme format to insert mathematics and physics stuff into the Chad thought bubble.

Hate to be the bearer of bad news, but if you've ever actually spent your day doing something "intellectual intensive", your brain requires brain rot. You physically cannot brain science non-stop everyday. Do gym bros stay in the gym 24/7? Do athletes train 24/7? No. You need down time. The brain is (in some capacity) a muscle too which requires training.

The only people we've seen brain science hardcore non-stop are one of the following (sometimes multiple):

1. Autistic nerds (not memeing), some autistic people have God levels of focus
2. ADHD nerds, if you get them on that weird hyper-focus stuff they'll lock in for like, 4 days and not bathe or eat
3. Nerds on drugs, more common than you'd think, but the nerds abusing amphetamines (or nootropics in general) lock in pretty hard too, until they crash out and they're worthless slabs of meat for like, a week or more

Anyway, the entire point of this micro-rant is to tell some of you to not be brain washed by pseudo-intellectual grifters on social media. The entire part of braining is to have fun, explore, and learn. It isn't a competition, it isn't a "lOoK hOw SmaRt i Am" competition, it isn't a race to who can do the newest and coolest research.

When you're bored of a video game do you force yourself to like it? Same as brain stuff — you might try to force yourself through the boring parts, but eventually you'll be like, "this shit is lame", and move onto something you like more.

Look at cat pictures, laugh at edgy memes, understand there is time for braining and there is time for brain rot.

Okay, talk to you later, love you, mwah kissies kissies
-smelly smellington

20.04.202506:33

20.04.202506:04

One of my fondest memories of Lockbit ransomware group was when Lockbit ransomed a small nonprofit healthcare clinic in South America.

They begged him to decrypt the machines so they can provide treatment to people in need. They primarily provided healthcare to people in remote areas who have little to no money, education, or work.

Lockbit said: "If you have money for computers, you have money to pay me"

Wow, truly a heartwarming moment. Very cool.

19.04.202521:10

Please drink and drive responsibly

19.04.202521:09

Removed weird balloon thing from car. Now can safely store beer in car

18.04.202517:49

18.04.202517:09

Hello,

We've removed the post on the Bubble zero day. The purpose of the post was to draw attention to the issue — which was indeed addressed.

As a recap, 2 researchers published a paper on Bubble-dot-io and how to exploit it. Bubble ignored them. We were requested to relay the issue loudly so it was addressed. It was addressed. Bubble asserts they do not consider this an exploit because this is the result of users failing to RTM and follow the Bubble security guidelines.

I will personally take the L that it was a stretch to classify this as zero day when this is the result of users not following the Bubble best practices guide. It does not impact Bubble in totality.

tl;dr 2 guys 1 bubble

18.04.202515:13

They also called us an embarrassment and said our post is borderline malicious because it is misleading because (or the researchers, whoever), did not read the security guidelines.

18.04.202515:11

Bubble-dot-io employees have responded.

Bubble (or individuals representing the company) assert the code we shared yesterday is not a zero day exploit and we (or the researchers mentioned) failed to take appropriate measures to read the documentation provided by Bubble

In summary, they state each user is responsible for the security of their data and users must follow the appropriate Bubble-dot-io security guidelines. The issues we relayed yesterday do not impact Bubble-dot-io in totality, rather these are customers who failed to follow the guidelines

18.04.202504:17

https://github.com/demon-i386/pop_n_bubble

18.04.202504:17

In 2024, 2 security researchers discovered a flaw in Bubble-dot-io, a self-described AI-based app development and publishing service.

Upon discovering the vulnerability, these 2 researchers notified Bubble. Unfortunately, for whatever reason, this fell on deaf ears.

These individuals subsequently did a talk on the vulnerability, published a proof-of-concept, and even wrote a paper on it. The code and paper show how easy it is to compromise websites and/or applications on Bubble. Despite all of this, Bubble still did nothing.

These 2 individuals then contacted me to request I relay the message loud and clear: you need to fix your software immediately.

In essence, this exploit allows the execution of arbitrary requests to the applications Elastic search which allows data dumping and/or exfiltration.

The applications encryption workflow is performed in the front-end, because Bubble-dot-io uses fixed IV's (shared between ALL clients), exploiting Bubble-dot-io is possible due to the creation of arbitrary payloads by abusing the recovery keys.

All tables can be dumped, including custom tables defined as "custom.(table_name)".

Furthermore, it's possible to attack other clients from Bubble-dot-io because the application does all hosting internally (shared).

- Cryptography keys do not rotate, hence an attacker can reuse the same keys in new Elastic searches
- Timestamps are not verified
- Attackers can enumerate customer subdomains by fuzzing *.bubbleapps-dot-io domain, making identification of targets easier
- If domain doesn't match target, response header will return correct target in 'X-BUBBLEAPP-NAME'

Please note the time date stamp in the attached images.

See subsequent post for link to paper and proof-of-concept.

18.04.202504:05

Chat, it's Friday.

Please hold.

18.04.202500:37

We've got a 0day exploit.

The 0day impacts an organization which provides managed services for Danone, SeaGate, Unity, Shopify, Paramount Pictures, HubSpot, Amazon, PWC, Yamaha, L'Oreal

The exploit was reported, but the vendor ignored it.

Chat, do we drop a 0day on a Friday?

Усе пасты

Рэкламаваўся0 секунда

15.04.202516:48PvmpGvng

1.1K

Рэкламаваўся2 гадзіна

13.04.202511:47/g/‘s Tech Memes

23.5K

Рэкламаваўся0 секунда

05.04.202521:15Мам, я DPO

176

Падрабязней

Рэкорды

06.03.202506:44

54.1KПадпісчыкаў

17.08.202423:59

200Індэкс цытавання

03.04.202523:59

23.5KАхоп 1 паста

26.10.202423:59

8KАхоп рэкламнага паста

05.03.202510:09

140.96%ER

03.04.202523:59

53.04%ERR

Развіццё

Падрабязней

Падпісчыкаў

Індэкс цытавання

Ахоп 1 паста

Ахоп рэкламнага паста

ERR

Падрабязней

Папулярныя публікацыі vx-underground

Усе пасты

18.04.202500:37

21.04.202520:49

wtf why this dissin us

08.04.202519:39

Hello,

"Sean" has informed us that, somewhere in the midst of our kitty cat collection, is a photo of a cute doggie making homophobic remarks.

This is terrible news. The entire collection is contaminated.

07.04.202517:24

Chat, we've got a problem.

Over 5,000 people are trying to download our kitty cat collection file. It is 159GB.

What is 159GB x 5,000 downloads at the same time? Unironically, we are DDoSing ourselves with cat pictures.

22.03.202516:34

When I first made vx-underground in May, 2019, one of the first people to discover the site was a person named "Santa". They messaged me and said they liked my website.

Approx. once a year "Santa" says Hello to me.

No idea who they are

18.04.202517:49

06.04.202522:10

About 2 weeks ago privacy nerds on Reddit began reporting they're unable to watch YouTube videos when using a VPN. YouTube displays a "VPN/Proxy Detected" warning.

Initially it was displayed on desktop computers, however it is now being displayed on mobile devices too.

22.03.202503:31

Hello, how are you?

I have to break some bad news (kind of).

Previously, b0t stepped down. Bradley is (sort of) stepped down — his Father is on his death bed and Bradley is acting as his primary caretaker. I'll also be gone soon. My son Smelly Smellington Jr will be born in May, 2025.

Our other staff members are part time, or only staff "as needed", so ... I don't know what the future holds for vx-underground.

This is not the end. This is turbulence. This project, website, things we do for fun, will always be around. But, I cannot ensure consistency like I have historically.

I see the comments criticizing us (or rather, me specifically), for the lack of focus on malware and instead primarily posting "memes". Sorry. I'm spread too thin. I also wish I had more focus on malware.

Anyway, I'm still working on restoring virus-dot-exchange. 24,000,000 malwares. Most updates soon.

Cheers,
- smelly smellington

Выдалена06.04.202501:59

05.04.202515:47

On April 1st, 2025 (No April Fools), the Russian FSB (Federal Security Service of the Russian Federation, Федеральная служба безопасности Российской Федерации), conducted a raid in St. Petersburg, Russia, on an IT facility named "Aeza Group".

Aeza Group is (rumored) to provide network infrastructure for Russia's Doppelgänger propaganda network. The location raided was once the home for Yevgeny Prigozhin's Wagner Center (tl;dr no idea who is stating these rumors, it's just news articles and Telegram).

Law enforcement agents allege the CEO, Yuri Bozoyan, and two employees of the organization, Maxim Orel and Tatyana Zubova, were arrested for aiding, abetting, or facilitating criminals groups. More specifically, the FSB asserts Mr. Bozoyan and his co-conspirators trafficked narcotics at large scale.

Additionally, it was (rumored) Aeza Group provided infrastructure for "darknet" groups and malware groups. However, we have been unable to find substantial evidence to support these claims other than various news articles (tl;dr who the fuck is saying this?).

A photo of the arrest was shared online.

09.04.202517:06

wtf python imports are tariffed

16.04.202504:21

If we had $1,000,000/yr, Bradley and I would travel to Russia to physically meet Lockbit in person and challenge him to a Yu-Gi-Oh duel to end his operations

31.03.202521:41

A video was shared online today of a person named "Dave" being violently assaulted for their cryptocurrency. This is a continuing trend of violent crime associated with cryptocurrency.

03.04.202502:56

Ransomware groups will be raising extortion demands 10% due to Tariffs

19.04.202521:09

Removed weird balloon thing from car. Now can safely store beer in car

29.03.202515:22

Today Microsoft announced Windows 11 will require a Microsoft account to create a local profile on the computer. They will be removing the bypass option available in the installation command prompt.

There will still be workarounds, but they're making it harder

Увайдзіце, каб разблакаваць больш функцый.