Enjoy when humans are using machines in unexpected ways. I break stuff and I do stuff.
Public Key
npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Profile Code
nprofile1qqs0hnway63d6sl2v0vg5xdzkqdls9guumvk6cvqs5yn2pmswq7ac2cpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsd2r77v
Show more details
Published at
2026-10-04T12:16:48Z Event JSON
{
"id": "b6fde272e1b8fb7f9da182662628b3ea0cae4a58b7446e7d4b5289bfefe3f183" ,
"pubkey": "fbcddd26a2dd43ea63d88a19a2b01bf8151ce6d96d61808509350770703ddc2b" ,
"created_at": 1791116208 ,
"kind": 0 ,
"tags": [
[
"proxy",
"https://infosec.exchange/users/adulau",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "{\"name\":\"Alexandre Dulaunoy\",\"about\":\"Enjoy when humans are using machines in unexpected ways. I break stuff and I do stuff.\\n\\nThe other side is at @a (photography, art and free software at large)\\n\\n#infosec #opensource #threatintelligence #fedi22 #threatintel #searchable\",\"picture\":\"https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/295/362/026/663/569/original/0ef3f34cedf9edaa.jpeg\",\"banner\":\"https://media.infosec.exchange/infosec.exchange/accounts/headers/109/295/362/026/663/569/original/0d9f9b4df999ad65.jpeg\",\"nip05\":\"[email protected] \",\"fields\":[[\"Website\",\"https://www.foo.be\"],[\"GitHub\",\"https://github.com/adulau\"],[\"Matrix\",\"@adulau:matrix.circl.lu\"],[\"ORCID\",\"https://orcid.org/0000-0002-5437-4652\"],[\"PGP FP\",\"6BB5 6353 1D99 F112 4C00 8C4F 815D 4786 1ECB 73D5\"],[\"Other Mastodon\",\"https://paperbay.org/@a\"]]}" ,
"sig": "adced42c50cdb4d3d6bf8c2dd3d375b90c3f9f149962af6f921aaa38c4b376200eaf876fd0d668a5571f4d247c54bb413178a30729ef7b0a95f515f4516db97a"
}
Last Notes npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy I still don’t understand why some bots try to enumerate everything via the Vulnerability-Lookup API when full dumps, including all metadata, are available in one shot: npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy If someone comes to me today preaching about “post-quantum” security issues, I’ll remind them of the current state of security: the npm ecosystem gets abused daily, CI pipelines run left and right with full access to cloud services, so-called security devices like F5 and Ivanti are exposed (and compromised) to the internet, mailboxes get compromised just to change an IBAN in a PDF, and a simple phone call is still enough to get someone to hand over an MFA code. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy I'm happy to announce the long-awaited first release of misp-modules-cli version 1.0.0. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy @nprofile…fm04 It’s actually quite simple: we have a compromised server (VPS or similar) running installed software. My goal was to compare the official SBOM with the system to determine which files belong to the official distribution and which do not. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy Have you ever tried doing digital forensics using an SBOM or even just gathering evidence for a technical investigation from one? npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy The Greenland sea cables are probably being closely monitored, but redundancy seems minimal likely limited to OneWeb satellite connectivity and some VSAT links. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy @nprofile…duyn The EU is documenting threat-actor activity linked to the GRU operating in Europe. A factual, analytical effort to record observed behaviors and campaigns. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy French government always talks about technological sovereignty… npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy Why it matters to create and maintain open-source infrastructure for security monitoring including collection of forums and malicious communication channels. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy BRICKSTORM Backdoor npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy GCVE-BCP-02 Published - Version 1.3 (2025-12-09) npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy ML-KEM Mythbusting npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy MISP core format has been updated with a new field to track first-time publication, and a new IETF Internet-Draft has been published. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy @nprofile…3s22 npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy I think the best summary until now about Post-quantum cryptography is from Peter Gutmann in the cryptography mailing-list. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy Imagine a threat intelligence report that concludes, ‘The target is three hops away, therefore it is the correct one.’ This is the method the Pentagon reportedly uses today: not only to identify targets, but also to justify and execute strikes. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy One year, I had a chat with the fine people @nprofile…sj5h during the @nprofile…r828 conference, and they were wondering why we didn't create an open source website for all the different rules (YARA, Suricata, and many others) — a place to allow comments, reviews, bundling, and integration with @nprofile…3gfz. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy « Eavesdropping on Internal Networks via Unencrypted Satellites » npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy Imagine working in your country’s cybersecurity center or CERT, and suddenly being reassigned to border control and deportation duties. Something is clearly broken and dangerously so. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy Understanding the Efficacy of Phishing Training in Practice npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy A new open source cyber-range platform released at the @nprofile…w5se and presented at the cybersecurity track. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy Finally a useful magic quadrant npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy When I added the threat-actor @nprofile…39xm galaxy type on Mar 4, 2016, I didn’t expect that, years later, vendors would still invent new names for already known threat actors, avoid using UUIDs, reuse similar names for different actors, and create confusing names by mixing tools or software used by the actors. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy I love the @nprofile…qkly Security Advisory Database because they actually preserve the data from rejected advisories including the original information and the reason for rejection. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy @nprofile…e54t Could you add an UUID by default in the Nova rule format? I'm starting to write a @nprofile…39xm object for Nova rules ;-) npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy Curious about all the open source and projects developed by @nprofile…70r3 ? npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy « Cloudflare 1.1.1.1 Incident on July 14, 2025 » npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy Wrapped up an energising Vulnerability Lookup workshop during @nprofile…70r3’s Virtual Summer School 2025. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy VLAI: A RoBERTa-Based Model for Automated Vulnerability Severity Classification. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy Love it when regulation kicks us in the ass. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy After all the hype and headlines, STUXNET still takes the crown. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy Today at the @nprofile…crvk conference, we’re presenting Draugnet, an open-source, lightweight submission tool designed to make sharing cyber threat intelligence easier. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy Something that’s been bothering me for years in the security world: why do researchers demand bug bounties for vulnerabilities in open source projects, when the very contributors maintaining and fixing those issues get nothing, just goodwill? npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy The latest executive order from Trump administration removed the following sentence from a previous executive order. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy Many are complaining about CISA removing the RSS feed for KEV. Just a reminder: we expose a lot of the API via RSS and Atom in vulnerability-lookup. KEV is included. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy @nprofile…e54t Remind me of A/V products not willing to have custom YARA rules in their engine. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy @nprofile…e54t I was just looking into it, that’s awesome! (I also have some ideas on where to integrate it in the coming weeks.) npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy @nprofile…e54t So, could we expect something like Sigma to block or filter LLM interactions? Is there already a standardized format for this? npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy @nprofile…e54t I've been wondering about something for a while. We know that SQL injection has been relatively easy to block compared to preventing prompt injection in LLMs, yet we still see SQL injection vulnerabilities after 30 years of defensive and secure coding practices. Do you think it's realistic to assume we'll be able to effectively filter and protect exposed LLMs? npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy @nprofile…70r3 and by the way, we just launched 🔗 https://gcve.eu/ npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy Just a reminder: Vulnerability Lookup isn’t just about finding CVEs. It supports the full chain, collection from multiple sources, continuous distribution, and allocation within a coordinated vulnerability disclosure (CVD) process. 100% open source. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy Large Language Models are Unreliable for Cyber Threat Intelligence. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy @nprofile…gu7x @nprofile…s0yq Even before ;-) npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy This is hilarious. For years, people criticized PGP for its usability and security risks. And now, after a decade of UX design, Signal introduces usernames, without any visibility into who you're adding. What could possibly go wrong? npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy With the shutdown of Radio Free Asia, which funded the Open Technology Fund (OTF)—a key supporter of @nprofile…5mmt and other open-source projects—what impact will this have on the broader open-source ecosystem? npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy We are excited to announce that CIRCL has three open positions available. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy I find this vulnerability hilarious npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy @nprofile…r0kn 😢 npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy @nprofile…qtg4 En effet. SimpleX est assez nouveau dans l’arène des solutions libres. Il y a un seul dev derrière ou plusieurs? Dans les commits cela me semble plutôt une seule personne. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy @nprofile…qtg4 Il ne faut pas oublier que l’on parle de technologies propriétaires dans la majorité des cas. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy Super happy to see the open source sysdiagnose joining the hackathon.lu held in Luxembourg on April 8th and 9th, 2025. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy We imported the data from Black Basta Ransomware group leak into AIL and there are many interesting aspects. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy The scary part is when frustration builds around a specific issue. While discussing with @nprofile…4m2u about the challenges with CPE values, I used @nprofile…39xm as an example, since we are also the software vendor. CPEs are messy because their creation sources vary, different entities or individuals reporting vulnerabilities. So, it's not always the fault of the CNA or the vendors. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy @nprofile…5k2y The « bias » one is hilarious. So many reports, manuals, and memos mention the word. From Europe, it just looks like ignorance is tearing everything down, like a massive autodafé. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy Dark Distillation: Backdooring Distilled Datasets without Accessing Raw Data. npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy Vulnerability Report – January 2025 npub1l0xa6f4zm4p75c7c3gv69vqmlq23eeked4scppgfx5rhqupams4sdlcq8n Alexandre Dulaunoy The Cisco Product Security Incident Response Team (PSIRT) became aware of additional attempted exploitation of this vulnerability in the wild... for Cisco Adaptive Security Appliance Software - CVE-2020-3259
