Harry Sintonen

Infosec consultant at REVƎЯSEC https://reversec.com - Coding, Research + various other interests

Public Key

npub1q2dlxhrrazeq2ezqps9txhlr799ud3j07m3m58q32fcm6pfm06xqf7d56p

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsq9xlnt3373vs9v3qqcz4ntl3lzj7xce8ldca6rsg4yudaq5aharqpz4mhxue69uhhyetvv9ujuerfw36x7tnsw43qz5rrvd

Publishing to

relay.ditto.pub

Author Public Key

npub1q2dlxhrrazeq2ezqps9txhlr799ud3j07m3m58q32fcm6pfm06xqf7d56p

Show more details

Last Notes

2026-10-23 09:41:19 GMT

For some reason, the CVE-2026-111497 buffer overflow vulnerability in the #brotli decoder is mostly associated with #nodejs, but this is a far wider issue. Brotli compression is supported by many client-side applications processing HTTP responses. While some of them have sandboxes and a quick update cycle (read: web browsers), many don't. In particular, many devices and applications using #curl / libcurl are affected and must be updated ASAP.
https://github.com/advisories/GHSA-9v8h-qqgm-4m35
https://nvd.nist.gov/vuln/detail/cve-2026-111497
#infosec #cybersecurity #CVE_2026_111497

2026-05-29 14:06:46 GMT

Most web browsing has been using post-quantum secure algorithms for years now.
Why? Browsers and large CDNs have pushed for post-quantum key agreement implementations, such as X25519MLKEM768.
This has been a great success: No one needed to change or configure anything, or even know about it. This is the best kind of security: unobtrusive and transparent, without requiring user involvement for deployment.
#pqc #pqcryptography #cybersecurity #infosec
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/658/239/926/494/258/original/990304676eb76f64.png

2026-05-27 17:26:52 GMT

- reply

@nprofile…anez https://yle.fi/a/74-20205277 (in finnish)

2026-05-27 14:06:26 GMT

Finland shuts down the last landline (copper) telephone network on 2026-06-30. I don't remember when I last used a landline. I did have ADSL for some time, but it was never used for voice, only data. My last landline phone call must've been sometime in the late 90s.

2026-05-24 12:06:08 GMT

I still run my custom local RIPE WHOIS service. This service allows me to perform extremely fast WHOIS searches. I wrote this tool in early 2010 when I wanted to enrich logs with network name information, and understandably my IP address was quickly blocked by the online WHOIS service.
The service has three parts:
1. Generating the network.db from RIPE DB dump.
2. Network service to allow queries to the data.
3. Tool that enriches any IP address in its input with the network name in brackets.
Generating the database:
- Fetch RIPE DB from ftp
- Parse and insert the data to SQLite database
curl ftp://ftp.ripe.net/ripe/dbase/split/ripe.db.inetnum.gz | gzip -cd | ./createnetworkdb.pl
Service:
- Load the whole database to memory, and serve it over localhost port. The internal search structure is a PATRICIA radix tree, but to conserve memory it uses 24-bit indices rather than pointers. The service consumes only 474MB memory when holding the whole RIPE DB (Note however, that not all WHOIS information is loaded to memory, only key parts).
- The super simplified API accepts socket connections and reads 4-byte input (IP address in network byte order) and returns JSON object with the WHOIS information.
- Implemented in C (mainly to allow precise control over data structures and thus memory consumption).
Tool:
- Python filter tool that matches IP addresses from stdin and performs query from the service. For each IP it replaces its IP with IP[networkname].
Bonus: The network.db SQLite database can be queried directly to extract other kinds of information out of it. For example, searching IP ranges that match specific network name patterns has proven quite useful.
I'm sure many people have created something similar over the years. However, I had a lot of fun making this thing to be able to process tens of thousands of queries per second.

2026-05-24 08:21:23 GMT

- reply

So what happened? AI did. The Internet Bug Bounty program was inundated by LLM findings. This diluted the rewards and placed insane pressure on actual humans who have to process the filings. This is likely is one the main reasons the programme shut down.
This is why we can't have nice things.

2026-05-24 07:49:13 GMT

Back in January I reported two low level vulnerabilities to Internet Bug Bounty #hackerone program. At the time the reward for a low level findings was $600.
I was just rewarded 2 x $68 bounty after 5 months. This is what I call a dick move.
#bugbounty
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/626/961/393/265/585/original/77371f94d9e3fb59.png

2026-05-22 05:50:24 GMT

All my attempts to communicate a vulnerability in #Signalapp have failed - I have not received any response to my multiple messages to them. Good people have tried to forward my concern to them (and I am thankful for your efforts and help), yet this has been to no avail.
I am disappointed in the lack of communication from Signal. I will be disclosing the full details of the issue later today (with end-user mitigations), after the six-month anniversary of the initial report.

2026-05-13 12:15:13 GMT

- reply

Just to be absolutely clear: #LUKS with TPM unlocking is equally vulnerable to various attacks. You should definitely use TPM+PIN with LUKS as well. See systemd-cryptenroll --tpm2-with-pin=yes
https://wiki.archlinux.org/title/Systemd-cryptenroll#Trusted_Platform_Module

2026-05-13 11:07:56 GMT

Yet another #BitLocker "exploit" circulating.
This is a friendly reminder that if you set your system to just unlock with TPM alone, the system is not protected against determined attacker. TPM cannot protect your system unless if you configure the system to request PIN as well.
See: https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/countermeasures
#infosec #cybersecurity

2026-05-11 07:09:45 GMT

Vulnerabilities found from #curl:
#Mythos: 1
Me: 30
- https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/
- https://sintonen.fi/advisories/

2026-04-24 00:07:42 GMT

If you upgraded to #OpenSSH 10.1 or later and suddenly have trouble connecting to a server, try: ssh -o ipqos=af21 user@host
If that works, then the network is unhappy about the Expedited Forwarding IP QoS (this is the new default IPQoS for interactive connections with OpenSSH 10.1 and later. -o ipqos=af21 restores the IPQoS used by earlier OpenSSH versions).

2026-04-22 21:06:25 GMT

I've tried to report a security vulnerability to @nprofile…kyv9 for months now (first attempt was 2025-11-23 to the official security-at email address). I haven't gotten any response from them, even after repeated attempts. This is highly frustrating.
Is there a way to reach them? I don't need any kind of special treatment, just someone acknowledging that the message has been received would be okay.
#signalapp

2026-04-13 13:30:18 GMT

- reply

@nprofile…k3vj Agreed. Currently only 37% of payments use national systems (and it's unclear how much dependencies on US systems those might have). https://www.ecb.europa.eu/press/pr/date/2025/html/ecb.pr250228_1~7f0697af45.fi.html

2026-04-13 12:10:46 GMT

Finland, Denmark, Norway, Sweden, and Estonia are soon enabling offline debit card payments for at least seven days without network connectivity. The change covers payments for essential goods in physical trade, such as food, medicine, and fuel. Each country has made - or is in the process of making - the required changes to their related regulations to enable it.
The motivation for this change is to enable payments even in exceptional situations such as network disruptions due to sabotage or conflict. TL;DR: You can pay for essentials even if Russia cuts the cables.
Plans for this change were announced in May 2025: https://www.reuters.com/business/finance/nordics-estonia-plan-offline-card-payment-back-up-if-internet-cut-2025-05-07/
#resilience #preparedness #infrastructure #payments #banking

2026-04-13 11:18:27 GMT

- reply

@nprofile…x5ex Note that this is on the payment system side, rather than specific card. So any card will work.

2026-04-13 09:35:59 GMT

- reply

@nprofile…5rsp Airplane inflight card payments have been doing this for ages. So nothing new technically as far as I can tell.

2026-04-12 19:25:33 GMT

Welcome back to the light, Hungary.

2026-04-12 14:32:45 GMT

If you have Linux #Steam library hosted on a samba share and you get "missing file permissions" errors, this could be due to the missing "sfu" mount option for the Samba share. If missing, Samba will prohibit creating symlinks to already existing directories, making the Steam client fail when installing/updating the games.
If you run into this issue you can find "Failed updating depot xxxxxxxx while creating symlink (Missing file permissions)" errors in Steam content_log.txt

2026-04-12 08:13:41 GMT

- reply

@nprofile…vmc2 It is the classic dilemma: It's always easier to tear down and/or point out problems than to provide solutions.
Pointing out problems has value, but providing solutions is priceless.

2026-04-12 07:42:24 GMT

- reply

Lack of critical thinking in the face of Anthropic marketing drive is curious to say the least. I've now read numerous praising reports of this system, while in fact none them the reporters having actually having tried to system in question. It conveniently remains unavailable for general public.
We only have first-party details of the new system. Anthropic is a company selling commercial services. They will, of course, present their product in the best light. It is premature to accept it all as facts.

2026-04-08 08:49:35 GMT

Whatever you think of #Anthropic, you have to agree that their PR team is top notch.

2026-04-07 20:47:32 GMT

#gandi .org renewal is 40€ per year (inc VAT) now. Gandi.net just lost a customer.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/365/374/103/363/827/original/1a8c18381cd752ad.png

2026-03-29 10:20:49 GMT

Authorities are investigating a report of a flying object that fell to the ground in southeastern part of Finland on Sunday morning.
source: https://yle.fi/a/74-20217941 (in english)

2026-03-25 23:47:28 GMT

#Microsoft sent an email to everyone saying they're listening to people now and they will definitely not pushing AI to everything anymore.
Also Microsoft enabled github to collect all your "inputs, outputs and associated context to train and improve AI models". This new tickbox is enabled by default, even if you explicitly disabled Copilot before.
Actions speak more than words.
You can disable the option at https://github.com/settings/copilot/features
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/292/469/927/816/620/original/b94d62d045955444.png

2026-02-27 13:18:07 GMT

- reply

@nprofile…juz6 That is the only safe assumption, indeed. My self-hosting helps to a degree: https://infosec.exchange/@harrysintonen/115916299816297773

2026-02-27 10:39:37 GMT

This should be obvious for everyone by now, but if you're not from US you must assume that all your use of US AI services (#ChatGPT, #Claude, #Gemini etc) is fed directly to US intelligence services.
"We may share your Personal Data, including information about your interaction with our Services, with government authorities ... in compliance with the law (i)" (OpenAI)
"We may disclose personal data to governmental regulatory authorities as required by law" (Claude)
"We will share personal information outside of Google ... to: Respond to any applicable law, regulation, legal process, or enforceable governmental request" (Gemini)
The amount of valuable information fed to the systems voluntarily is staggering. It's not a matter of "if" it is happening, but "of course it is". It would be outright negligent if they weren’t capturing and disseminating it all.
https://en.wikipedia.org/wiki/Foreign_Intelligence_Surveillance_Act#Without_a_court_order
#privacy

2026-02-26 11:53:00 GMT

Retroactively changing the role of a token or key is a very bad idea.
https://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-then-gemini-changed-the-rules
#google #googleapikeys #infosec #cybersecurity

2026-01-30 01:49:23 GMT

- reply

@nprofile…43gv Check https://sintonen.fi/src/hwstartup/

2026-01-27 12:56:37 GMT

#Nordea web and mobile bank is now infused with AI generated news. There is no way to turn it off (that I've noticed). I'm not amused.

2026-01-26 10:27:10 GMT

Tourists are very welcome to Finland. However, if you think about making some social media content, asking for permission is preferred before setting up your equipment in someone's yard.
News (in finnish): https://www.is.fi/taloussanomat/art-2000011771970.html
#tourism #lapland
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/960/906/082/605/839/original/5006b90c66d963d6.jpg

2026-01-22 13:59:52 GMT

- reply

The most interesting part is that not every Windows11 25H2 (26200.7623) has this new start menu. I have couple of VMs that do not have it, and another gaming rig also has the older one.
Even Personalization > Start settings page is different between the systems.
Is #Microsoft just pushing random updates of #Windows system components to users without any prior agreement about being a betatester?

2026-01-22 13:46:25 GMT

- reply

The new start menu is also hilariously buggy: Clicking on a folder with multiple pinned apps makes the folder icon disappear. Closing the sub-folder and the icon reappears. How did any of this pass QA?

2026-01-22 13:28:36 GMT

#Windows11 update completely changed the start menu: All the start menu pinned applications are gone. There was no warning or question whether I wanted to perhaps keep the old structure or not.
This is highly annoying. Luckily I don't use Windows for productivity work. I'd be livid if this happened to some system I depend for anything but gaming.
#enshittification #microsoft

2026-01-18 23:16:01 GMT

- reply

@nprofile…2pg0
- web sites: apache2, php, perl, mariadb, postresql
- email: qpsmtpd, dovecot, roundcube
- calendar/contacts/file sharing: Nextcloud
- backups: duplicity, rsync, timemachine to samba share (data hosted on zfs dataset, important data also duplicated offsite)
- VPN: headscale + tailscale
- media casting: jellyfin (media on a zfs dataset)
- network attached storage: samba sharing multiple dedicated zfs datasets
Some services are hosted at Hetzner Helsinki DC, while some (for example most zfs pools, about 200TiB storage) are hosted locally. Some services are open to internet but critical ones are only available via tailscale. Mobile devices (laptops, phones etc) can access services via tailscale.

2026-01-18 13:19:27 GMT

I've self-hosted for decades. I host my own web sites, email, calendar, contacts, backups, file sharing, VPN etc. Kind of personal #digitalsovereignty.
Obviously, the reasons for this have nothing to do with politics or short-term developments. However, at times like this, it sure is nice to have one less thing to worry about.

2026-01-15 11:02:23 GMT

Apparently my fileserver has 2000 € worth of ECC memory in it. I paid 440€ for it in 2023.
#enshittification

2026-01-14 10:45:09 GMT

I understand #curl project decision to stop the #bugbounty and leave #hackerone. The torrent of #AIslop has become unbearable.
https://github.com/curl/curl/pull/20312
I will continue to report vulnerabilities to the project whether it has a bug bounty or not.

2026-01-11 18:07:56 GMT

- reply

@nprofile…c4rj When the A2000 was created, Commodore probably had some vision where the bridgeboard would have become far more important than it eventually did.

2026-01-11 17:00:57 GMT

- reply

There used to be a similar product in 90s called Bodega Bay: https://bigbookofamigahardware.com/bboah/product.aspx?id=1362 - it had 4 zorro slots but included the ISA parts for 3 of them, too. It did not include the CPU card slot, however.

2026-01-11 16:51:13 GMT

Neat CRG hardware project: "Diego 500" turns A500 into an A2000 by adding 5 zorro slots and A2000 CPU card slot: https://www.youtube.com/watch?v=dv5Qtoq5rqs
#amiga #retrocomputing #amiga500

2026-01-08 09:50:55 GMT

- reply

@nprofile…x8e3 Sure this is a critical vulnerability in untgz application. This is not a vulnerability in zlib, however.
This is important and relevant information.

2026-01-08 09:04:11 GMT

No, there's no major security vulnerability in zlib.
There's a stack buffer overflow in the contrib/untgz tool. However, these tools are unsupported as described by the README.contrib file: https://github.com/madler/zlib/blob/develop/contrib/README.contrib
"
All files under this contrib directory are UNSUPPORTED. They were
provided by users of zlib and were not tested by the authors of zlib.
Use at your own risk. Please contact the authors of the contributions
for help about these, not the zlib authors. Thanks.
"
#infosec #cybersecurity

2026-01-08 09:00:13 GMT

- reply

@nprofile…x8e3 Considering this is in contrib/untgz application rather than the library itself is this really a major problem? Is any distro even including the contrib tools in any of their packages?
I'm somewhat doubt it considering contrib dir has this major warning:
"All files under this contrib directory are UNSUPPORTED. They were provided by users of zlib and were not tested by the authors of zlib. Use at your own risk. Please contact the authors of the contributions for help about these, not the zlib authors. Thanks."
https://github.com/madler/zlib/blob/develop/contrib/README.contrib

2026-01-07 08:28:57 GMT

- reply

The hackerone submissions:
- libssh global knownhost override https://hackerone.com/reports/3477116
- libssh key passphrase bypass without agent set https://hackerone.com/reports/3480925

2026-01-07 07:51:27 GMT

#curl 8.18.0 has been released. This release fixes 1 medium and 5 low level vulnerabilities:
- CVE-2025-14017: broken TLS options for threaded LDAPS https://curl.se/docs/CVE-2025-14017.html
- CVE-2025-14524: bearer token leak on cross-protocol redirect https://curl.se/docs/CVE-2025-14524.html
- CVE-2025-14819: OpenSSL partial chain store policy bypass https://curl.se/docs/CVE-2025-14819.html
- CVE-2025-15079: libssh global knownhost override https://curl.se/docs/CVE-2025-15079.html
- CVE-2025-15224: libssh key passphrase bypass without agent set https://curl.se/docs/CVE-2025-15224.html
I discovered the last 2 vulnerabilities.
Download curl 8.18.0 from https://curl.se/download.html
#vulnerabilityresearch #vulnerability #cybersecurity #infosec

2026-01-06 15:36:54 GMT

"It's an older vulnerability, sir, but it checks out."
"Buffer overflow in /bin/su from UNIX v4" - https://www.openwall.com/lists/oss-security/2026/01/06/4

2026-01-05 20:29:42 GMT

#iPhone 12 Mini and iPhone 13 Mini reboot randomly after upgrade to iOS 26.2. The 13 Mini was unstable with first 26 already.
Reinstall and restore from backup does not help. Both devices have healthy batteries. Both devices were rock solid with all pre-26 iOS versions.
This is a sample size of 2, but I can only recommend against upgrading older devices to #iOS26, at least for now.

2026-01-04 18:53:22 GMT

In GCC, there's a type of C++ thread_local destructor that outright crashes unless you implement magic support for them in your libc. If they are executed mixed with other destructors, you end up with use-after-free issues as the order of execution of the generic destructors is undefined.
For example glibc maintains a list of C++ destructors that will get destructed before any other ones. The code in question is in https://github.com/bminor/glibc/blob/master/stdlib/cxa_thread_atexit_impl.c
This support is completed by having GCC call __cxa_thread_atexit_impl function when its available: https://github.com/gcc-mirror/gcc/blob/bcde241ac56de6e168fc16f778be60ff13bbcbca/libstdc%2B%2B-v3/libsupc%2B%2B/atexit_thread.cc#L154
While GCC does have fallback code for generic libc that do not implement this function by using __gthread_getspecific. However, the destructor can get called at any point during cleanup since typically there's no way to specify order of execution. Thus the destructor can get called too late, leading to use-after-free.
The solution via __cxa_thread_atexit_impl works, but having spent a couple of days debugging subtle crashes that appear to be originating from my own code, I kind of don't appreciate the way GCC is broken here when __cxa_thread_atexit_impl is not available.
I'm now working on implementing __cxa_thread_atexit_impl to our libc that then will be picked by gcc in order for it to generate working C++ binaries when thread_local is used.
</rant>
#development #gcc #programming

2025-12-31 14:12:59 GMT

- reply

Police with co-operation with border guard intercepted the ship and landed on it while it was in Finnish waters. The anchor of the ship was found to be down. 14 members of the crew have been apprehended.
source: https://yle.fi/a/74-20202107 (in finnish)

2025-12-31 12:43:56 GMT

"Finnish authorities have seized the cargo ship Fitburg off the coast of Porkkala in connection with damage to an undersea data cable owned by telecoms provider Elisa. The vessel, which departed from Saint Petersburg on 30 December, was intercepted in the Gulf of Finland after being identified as the suspected source of a disruption to the connection between Helsinki and Tallinn."
https://www.helsinkitimes.fi/finland/finland-news/domestic/28366-cargo-ship-seized-after-undersea-cable-damage-in-gulf-of-finland.html
#underseacable #infrastructure #shipping #telecommunications

2025-12-28 22:34:11 GMT

I'm submitting lovingly hand-crafted 100% organic reports to #curl #hackerone

2025-12-25 16:38:38 GMT

"Mathematically extra-complicated Secretest Santa 2025" video by @nprofile…sdl7 is both educational and very very funny (might not apply if you don't dig nerdy humour). https://www.youtube.com/watch?v=4pG8_bWpmaE
Warning: May contain traces of math.
#cryptography #math

2025-12-23 18:01:04 GMT

- reply

@nprofile…4utt I do run a local DNS server that does DoH internally. Plaintext DNS is fine in my LAN.

2025-12-23 15:07:38 GMT

- reply

@nprofile…gqv6 My current setup is bind + stubby. It is suboptimal however, as stubby seems to have some stability issues. I am looking for a more stable solution still.

2025-12-23 14:40:00 GMT

- reply

@nprofile…we97 No need to configure every browser separately. Plus this configuration transparently supports other software that doesn't support DoH directly.

2025-12-23 11:58:47 GMT

- reply

@nprofile…azj9 ...and I use DoH for the upstream DNS requests in my server.

2025-12-23 11:56:45 GMT

- reply

@nprofile…azj9 That's why I also run my own DNS server.

2025-12-23 11:53:15 GMT

I consider DoH in browsers to be data collection enabled by default. I always customise the browsers to use a DoH server I trust or disable DoH entirely.
#privacy

2025-12-22 13:28:35 GMT

The .fi domain prices will rise from €9 to €12 per year. The proposal for a 400€ annual .fi domain registrar fee has thankfully been axed.
"The proposal on the annual fee for domain name registrars has been removed from the decree on electronic communications fees. There has been a reassessment of the legal base of such a fee."
Source: https://lvm.fi/-/liikenne-ja-viestintaviraston-maksuja-korotetaan?languageId=en_US

2025-12-21 04:14:27 GMT

- reply

@nprofile…v28d Pause was required by the spec but many implementations worked without it.

2025-12-20 23:50:20 GMT

I'm this old: ping -p 2b2b2b415448300d victim
#oldschool #hacking

2025-12-17 09:24:23 GMT

- reply

@nprofile…azj9 Well not totally lost: https://github.com/curl/httpget/blob/master/httpget-0.2.c

2025-12-16 15:59:33 GMT

A privilege escalation in Dropbear (CVE-2025-14282) allows any authenticated user to run arbitrary commands as root. The vulnerability affects versions 2024.84
to 2025.88. Dropbear release 2025.89 fixes the vulnerability.
A mitigation is to run dropbear without unix socket forwarding by adding the -j option.
https://www.openwall.com/lists/oss-security/2025/12/16/2
#CVE_2025_14282 #infosec #cybersecurity

2025-12-15 15:11:30 GMT

- reply

Here's the findkey code:
#include <stdio.h>
#include <string.h>
int main(int argc, char **argv)
{
FILE *fclear, *fcipher;
struct {
char known;
unsigned char ch;
} key[65536];
int minkeysize = 0;
int totalknown = 0;
int i;
if (argc < 3)
{
printf("%s: clearfile cipherfile [keyout]\n", argv[0]);
return 1;
}
fclear = fopen(argv[1], "rb");
if (!fclear)
{
perror(argv[1]);
return 1;
}
fcipher = fopen(argv[2], "rb");
if (!fcipher)
{
perror(argv[2]);
return 1;
}
memset(key, 0, sizeof(key));
for (;;)
{
unsigned int idx;
int clr = fgetc(fclear);
int c1 = fgetc(fcipher);
int c2 = fgetc(fcipher);
if (clr == -1 || c1 == -1 || c2 == -1)
break;
#if BIG_ENDIAN
idx = (((unsigned char) c1) << 8) | (unsigned char) c2;
#else
idx = (((unsigned char) c2) << 8) | (unsigned char) c1;
#endif
if (idx + 1 > minkeysize)
minkeysize = idx + 1;
if (!key[idx].known)
{
totalknown++;
key[idx].known = 1;
key[idx].ch = (unsigned char) clr;
}
}
fclose(fcipher);
fclose(fclear);
printf("keyfile size is at least %d bytes, total %d known keyfile bytes:\n",
minkeysize, totalknown);
for (i = 0; i < minkeysize; i++)
{
if (i % 16 == 0)
printf("%04x: ", i);
if (key[i].known)
printf(" %02x", key[i].ch);
else
printf(" ??");
if (i % 16 == 15)
printf("\n");
}
if (i % 16)
printf("\n");
if (argc == 4)
{
FILE *out = fopen(argv[3], "wb");
if (!out)
{
perror(argv[3]);
return 1;
}
for (i = 0; i < minkeysize; i++)
{
fputc(key[i].ch, out);
}
fclose(out);
}
return 0;
}

2025-12-15 14:58:03 GMT

It seems people are now churning out fake encryption schemes generated with large language models: https://zoscii.com/why-en.html
Checking out the code, we see that this is essentially a one-time pad. If the key is reused, the encryption is easily defeated. Let's assume the attacker has the ability to observe a known plaintext as ciphertext (chosen-plaintext attack).
1. Generate a random key and encrypt a secret message with it:
$ dd if=/dev/random of=secretkey count=8
$ echo "This is a secret message" > secretmessage.txt
$ zencode secretkey secretmessage.txt secretmessage.enc
2. Implement chosen plaintext attack and recover the encryption key:
$ perl -e 'for($i=0;$i<256;$i++){print chr($i)x65536}' > chosenplaintext
$ zencode secretkey chosenplaintext chosenplaintext.enc
$ rm secretkey
$ ./findkey chosenplaintext chosenplaintext.enc recovered-secretkey
3. Decrypt any message encrypted with the secretkey:
$ zdecode recovered-secretkey secretmessage.enc recovered-secretmessage.txt
$ cat recovered-secretmessage.txt
This is a secret message
$
I do not know if the author of this scheme is outright malicious or just fooled into believing what the LLM is telling him. He did, however, have a kickstarter for 180k AUD earlier that failed to reach its goal.
#llm #enshittification #encryption

2025-12-15 13:01:23 GMT

Another reason to dislike systemd: libc6 update crashed systemd in a way that the only way to recover was to reboot.
2025-12-13T15:24:30.878173+00:00 asus kernel: systemd[1]: segfault at 63 ip 00007fd402653c4e sp 00007ffd8460a980 error 4 in libc.so.6[53c4e,7fd402628000+168000] likely on CPU 15 (core 3, socket 0)
2025-12-13T15:24:30.878374+00:00 asus systemd[1]: Caught <SEGV>.
2025-12-13T15:24:30.907258+00:00 asus systemd[1]: Caught <SEGV>, dumped core as pid 573573.
2025-12-13T15:24:30.907477+00:00 asus systemd[1]: Freezing execution.
After this point any operation that would require systemd just outright fail or hang.

2025-12-13 13:30:14 GMT

- reply

I'm well aware that Kali Linux does have more than just "nmap", but my point was to underline that while Kali Linux is great collection of tools, it doesn't replace actual proper network scanner tool.

2025-12-13 13:27:18 GMT

After glancing over the "Comparing AI Agents to Cybersecurity Professionals in Real-World Penetration Testing" [1] from Justin W. Lin et al., I have some observations:
First, I must conclude that the results from the Artemis tool are quite impressive, especially considering the short amount of time the tool spent on the target.
However, four days is woefully short time for an ~8000 host network penetration test. This was also acknowledged by the authors. The short amount of time gives AI-based automation an edge as it will generally have better breadth in a short amount of time. Humans, on the other hand have to balance the focus between accurate discovery and attempts to target on the discovered host. Humans are not best at scheduling important tasks under time pressure. Given enough time, I believe most of the human participants would have found a lot more vulnerabilities. This is why it is important to scope projects correctly. Spending just mere four days on a monumental task like this will give shallow results (AI or not). Generally, an asymmetry exists where real-world attackers have a lot more time to spend on the target than defenders.
From the description, it seems that the human participants were limited to a base Kali Linux install in the tooling. This is like giving humans a spade and an axe (nmap) rather than an excavator for building a house. Doing a manual assessment to ~8000 hosts on a network with nmap and plain Kali Linux is painful, especially if you have just four days.
If the idea is to produce the most value for the client (as mentioned in the instructions "Focus on what you would do to give a client the best value"), I would have told the client that the most value would likely be gotten by performing a threat modelling exercise to identify the highest threats and then plan actions to take to mitigate those rather than perform a haphazard scan of the network. That network scan will result in some findings, and those can be fixed, which is of course good. While this has some value, too, in the long run, planning actions that have more fundamental impact on security are likely more valuable.
If the client had still insisted on doing a four-day assessment on scanning ~8,000 host networks, I would have employed some good network scanner that does the discovery and service identification parts. Out of these results, I would then focus on producing a report that represents the findings well, includes a proper executive summary highlighting more high-level strategic plans on how to improve the network security. Any remaining time (likely just a couple of hours maximum) would have been spent on manually testing some of the most interesting targets pointed out by the scanner.
Now, which is more valuable to the client is up for debate. However, I think the media reporting that "AI hackers are coming dangerously close to beating humans" is outright misleading.
Hackers will use the available tooling for the grunt work, be it AI or otherwise. The real value comes from interpreting the tool results and distilling them into a strategic, actionable plan for the client.
1) https://arxiv.org/pdf/2512.09882
#cybersecurity #infosec #thoughtoftheday

2025-12-12 17:11:58 GMT

- reply

@nprofile…zgml @nprofile…azj9 not a bubble!

2025-12-12 16:02:30 GMT

I haven't had time to look into the research in detail, but I feel that there's a bit of a misconception what network penetration testing is and how it relates to rest of the "hacking". It of course is good that tooling around network pentest keeps improving However, I take exception to some of the conclusions the media is drawing from the results.
https://www.msn.com/en-us/money/other/ai-hackers-are-coming-dangerously-close-to-beating-humans/ar-AA1S9kPg

2025-12-12 14:45:54 GMT

- reply

@nprofile…scce In best case this is kind of trolling (seems quite a lot of work for that, but hey we've seen similar BS before).
In worst case this is setting up some scam AI solution ("service") that they intend to sell to ignorant people. Add enough keywords, rehashed CVEs and some people who control money (and don't quite understand or care about the technical parts) could get fooled.

2025-12-10 18:13:38 GMT

Besides being entirely bonkers, this requirement is interesting:
"The state department said it will conduct "online presence" reviews for applicants and their dependents, and that privacy settings on all social media profiles must be made "public" so this screening can take place."
How can this be done without exposing potentially sensitive information to everyone else, too?
And then the classic: If you are one of the luddites without any social media accounts, will you be barred access for supposedly trying to hide your critical online commentary?
Source: https://www.bbc.com/news/articles/c1dz0g2ykpeo
#privacy

2025-12-08 12:05:15 GMT

If you're using #GnuTLS please note that GnuTLS defaults to weak security profile:
"The message authenticity security level is of 64 bits or more, and the certificate verification profile is set to GNUTLS_PROFILE_LOW (80-bits)."
This means for example that Diffie-Hellman group size of 1024-bits is allowed. This was deemed insufficient already 10 years ago. See https://weakdh.org/
This issue will be remedied in future GnuTLS release. Meanwhile the fix is to inject %PROFILE_MEDIUM as part of the priority string, for example "NORMAL:foo" becomes "NORMAL:%PROFILE_MEDIUM:foo". See https://gnutls.org/manual/html_node/Priority-Strings.html for details.
#insecuredefaults #cybersecurity #infosec #development
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/683/820/937/933/551/original/75a27f89f72a24cb.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/683/821/933/956/997/original/000ea172452a1c95.png

2025-12-06 18:04:23 GMT

- reply

This is a very easy mistake to make, and can often go unnoticed unless you're careful. I've done it myself on occasion. This bug was added 12 years ago and only surfaced now when it led to build issues in the specific combination of options.

2025-12-06 17:56:21 GMT

- reply

@nprofile…eqr8 It is very obvious when shown isolated like that.
What wasn't obvious why statically cross-building perl 5.42 failed with 'Can't find .a file for Test::Simple'. Tracing that down to the grep took several hours.

2025-12-06 17:38:28 GMT

Grepping is hard. Spot the bug:
elif ls "$i" | grep -qE '.(xs|c)$'; then
https://github.com/arsv/perl-cross/issues/167

2025-12-05 16:35:25 GMT

- reply

@nprofile…zgml What a cliffhanger!

2025-12-05 15:37:06 GMT

- reply

Kurzgesagt also has an excellent earlier video "4.5 Billion Years in 1 Hour" in a similar format: https://www.youtube.com/watch?v=S7TUe5w6RHo

2025-12-05 15:28:22 GMT

New #kurzgesagt video: "Experience All Of Human History In 1 Hour" https://www.youtube.com/watch?v=KNwMiydCYA4

2025-12-05 09:11:10 GMT

The important question is: How was it DNS this time?
#itsalwaysdns #cloudflareou tage #cloudflare
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/666/178/655/408/354/original/e9cb48b4dc94556a.png

2025-12-05 09:06:36 GMT

- reply

And indeed, Cloudflare is having major issues - numerous sites are giving the same 500 error, and the service status is, well, not good: https://www.cloudflarestatus.com/

2025-12-05 09:00:15 GMT

Downdetector is down due to #cloudflare having issues. There's some irony here, I think.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/666/133/628/962/825/original/ee1de82e2891f759.png

2025-12-04 23:30:46 GMT

I find it quite hilarious that all NVIDIA "CUDA Tile" material has programming misspelled as "programmiing" in the project logo. Surely the logo wasn't generated by some AI model?
https://developer.nvidia.com/blog/focus-on-your-algorithm-nvidia-cuda-tile-handles-the-hardware
#NVIDIA #CUDA #cudatile
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/663/892/804/334/965/original/1382473eb8de5ed1.png

2025-12-04 12:14:37 GMT

libpng 1.6.0 through 1.6.51 out-of-bounds read vulnerability CVE-2025-66293 may lead to information disclosure (or denial of service). Due to a bug processing a PNG image may lead to read of 1012 bytes past the end of an array. Depending on the contents of the memory beyond this array, some confidential information may be leaked.
The conditions for the issue to trigger require the image to processed
through the simplified API with an output format without alpha and
no explicit background color. This means that not every application processing PNG images is leaking information. Also a limiting factor is that the affected system would need to return the decoded image data for the information leak to happen in the first place. Finally the information would need to cross a security context (for example from server to client, from privileged process to unprivileged or from user to another user) for the leak to have a security impact.
Interestingly the images resulting in the leak are in fact fully PNG spec compliant.
libpng 1.6.0 through 1.6.51 are affected. The vulnerability is fixed in libpng 1.6.52.
source: https://www.openwall.com/lists/oss-security/2025/12/03/5
#libpng #CVE_2025_66293 #infosec #cybersecurity

2025-12-04 07:48:17 GMT

I was surprised to learn that Microsoft 365 can recommend files to me from someone else in the organization, by default. This is part of their "Item Insight" feature [1]. The description of this service goes to great lengths to explain how it respects the document access rights and won't be leaking documents.
While that's all good in theory, in many instances people do not use Sharepoint permissions right, and everyone in the organization has access to the documents unintended. I can see how this could amplify impact of such misconfiguration, in specific making some too widely shared document visible to much wider audience.
Also, this all relies on the machine learning to do correct decision in the first place. I prefer to keep such control to myself and this I disabled this feature.
You can disable the "Item Insight" from https://myaccount.microsoft.com/settingsandprivacy/privacy
1) https://learn.microsoft.com/en-us/graph/item-insights-overview
#microsoft365 #sharepoint #privacy
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/660/150/881/401/529/original/89f1d4d47049fdbf.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/660/172/128/474/294/original/6e9692cf3c919fa4.png

2025-12-03 16:48:13 GMT

There is an unauthenticated remote code execution vulnerability in React Server Components (CVE-2025-55182) that allows unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints.
Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components.
The vulnerability is present in versions 19.0, 19.1.0, 19.1.1, and 19.2.0 of:
- react-server-dom-webpack
- react-server-dom-parcel
- react-server-dom-turbopack
Some React frameworks and bundlers depended on, had peer dependencies for, or included the vulnerable React packages. The following React frameworks & bundlers are affected: next, react-router, waku, @parcel/rsc, @vitejs/plugin-rsc, and rwsdk.
source: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components
#reactjs #CVE_2025_55182 #cybersecurity #infosec

2025-12-03 10:54:49 GMT

- reply

Neville Chamberlain, 30 September 1938:
"The settlement of the Czechoslovak problem which has now been achieved is, in my view, only the prelude to a larger settlement in which all Europe may find peace. This morning I had another talk with the German Chancellor, Herr Hitler, and here is a paper which bears his name upon it as well as mine. Some of you perhaps have already heard what it contains, but I would just like to read it to you. " ... We regard the agreement signed last night and the Anglo-German Naval Agreement as symbolic of the desire of our two peoples never to go to war with one another again""

2025-12-03 07:16:16 GMT

I'm afraid we're likely moving toward Peace for Our Time moment, rather than actual peace. If history has taught us anything it's that appeasement is no basis for peace.

2025-12-02 16:06:24 GMT

Didn't realise #Windows bundles bsdtar these days. This is extremely convenient.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/650/820/065/868/780/original/cca3f05a108ab76f.png

2025-12-01 20:11:26 GMT

Finland's "Scam call and payment fraud prevention" has won 2025 European Crime Prevention Award:
https://www.eucpn.org/document/finland-scam-call-and-payment-fraud-prevention
While this scheme works it naturally hasn't prevented call-based fraud fully. However, at least the scammers can't easily call from outside of the country with forged #callerid
#fraudprevention #scamprevention #calleridspoofing

2025-12-01 20:02:42 GMT

- reply

2025-12-01 18:11:45 GMT

- reply

Whoever was accessing the document knew that it would appear:
"The first access was at 11:35. This came from an IP address which had attempted to connect to the URL of the EFO on some 32 occasions on that day. In all, seven different IP addresses tried to connect to the URL before 11:30, with 44 unsuccessful attempts in total."
It is thus likely that the issue had been known for a long time already and had been exploited for financial gains before.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/645/646/759/358/014/original/ca3a744197226950.png

2025-12-01 17:12:39 GMT

Managing WordPress sites is difficult. https://obr.uk/docs/dlm_uploads/01122025-Investigation-into-November-2025-EFO-publication-error.pdf
BBC: "Head of OBR resigns after Budget day publishing error" https://www.bbc.com/news/live/cly147rky81t
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/645/412/276/173/364/original/c573ab2385f601b7.png

2025-11-30 23:46:58 GMT

There's some comedy gold in this video from Linus Tech Tips with Linus Torvalds: https://www.youtube.com/watch?v=mfv0V1SxbNA
Also, actually some really good insight and tech tips.
#linustechtips

2025-11-29 23:55:25 GMT

The building common fire alarm got tripped, so we had to meet our neighbours outside of the apartment.
No fire. Apparently, it was some food in the microwave getting a bit too crispy.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/635/661/964/503/036/original/25a0d954d67b323d.jpg

2025-11-27 20:55:33 GMT

- reply

@nprofile…scce I still consider B5 the best sci-fi series, period. Some of the season 1 and season 5 are a bit uneven, but the middle is just top TV. The writing and acting easily smooth over the somewhat rough early CGI.

2025-11-24 12:44:32 GMT

- reply

@nprofile…t7mv This kind of is the education version of https://marketoonist.com/2023/03/ai-written-ai-read.html

2025-11-24 12:42:35 GMT

- reply

@nprofile…t7mv Indeed, it’s an individual’s own decision not to learn. It's just a new version of copying homework/papers: You may pass the grade, but you skip actual learning.

2025-11-24 11:33:16 GMT

AI #enshittification continues unabated: University of Staffordshire course taught with AI generated material.
https://www.theguardian.com/education/2025/nov/20/university-of-staffordshire-course-taught-in-large-part-by-ai-artificial-intelligence
It's LLMs all the way down.