DrWhax

professional troublemaker

Website: https://jurrevanbergen.nl/
Hart voor Internetvrijheid: https://hviv.nl/
Languages: NL/EN/ES
GPG: 0x2C9686C23DF31CBF602F2906748800B2AB826D05

Public Key

npub120rgyy958erd46qnwx6kzqw8nw4u3pu2kvhf283s5vmu2hy5d8ksnwcg2p

NIP-05 Address

drwhax_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqs9835zzz6ru3k6aqfhrdtpq8reh27gs79txt54rcc2xd79tj2xnmgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dssskevr

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub120rgyy958erd46qnwx6kzqw8nw4u3pu2kvhf283s5vmu2hy5d8ksnwcg2p

Show more details

Last Notes

2026-10-21 16:43:46 UTC

RE: https://fedi.katze.sh/@elise/117479383739450605
More PHP bugs coming! :-)
#note1hk7…qxfy

2026-09-11 13:58:01 UTC

Presenting the QuickLogin attack against Omarchy. Think again, is leaving your FDE laptop unattended a good idea? Let's have a look!
Make DHH cry again!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/252/755/116/395/920/original/0116192c718e8e90.mp4

2026-08-26 17:48:36 UTC

RE: https://todon.eu/@CrimethInc/117162698930485347
Absolutely insane move from the U.S government.
#note1zcp…h0qg

2026-08-02 12:06:15 UTC

Insane and inhumane: "YC founder asks desperate job seekers to tattoo themselves for an interview"
https://sfstandard.com/2026/07/30/lemonlime-tattoo-job-interview/

2026-07-29 23:49:52 UTC

RE: https://infosec.exchange/@drwhax/116997238394916522
Maybe confirmation bias, but an interesting read nevertheless https://www.propublica.org/article/anthropic-mythos-microsoft-software-vulnerabilities
#note1uux…fcu4

2026-07-28 17:39:01 UTC

Excellent trolling of a city council in Arizona: https://www.404media.co/casa-grande-arizona-flock-city-council/

2026-07-28 10:56:21 UTC

I know Mastodon hates LLM's and AI. So here goes!
I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.
The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.
I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.
I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.
The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.
I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.
I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.
Please run an LLM over your code base if it's internet facing or something critical, we thank you!
Can't wait for the discussions on this!

2026-07-21 23:42:23 UTC

In a major victory for digital rights and common sense, the Court of Justice of the European Union (CJEU) has officially categorized Virtual Private Networks (VPNs) as "lawful technical tools" while establishing new boundaries for online copyright disputes.
The landmark judgment — handed down in July 2026 — stems from a complex legal battle over the online publication of Anne Frank's historical manuscripts. At its core, the case forced Europe's top judges to answer a highly technical question: if a publisher actively tries to block visitors from a specific country, are they still breaking the law if a user sneaks past the digital border using circumvention software?
According to the CJEU, the answer is no. As long as a website employs "state-of-the-art" geo-blocking technology, the publisher cannot be held liable for copyright infringement simply because a determined reader decides to fire up the best VPN to bypass the restrictions.
https://www.techradar.com/vpn/vpn-privacy-security/vpns-are-lawful-technical-tools-says-eu-court-in-landmark-anne-frank-copyright-ruling

2026-07-03 14:16:09 UTC

- reply

better call the army when you find a perfume bottle in the attic....

2026-07-03 14:13:12 UTC

"this property was involved in the Novichok event that took place in 2018"
https://www.rightmove.co.uk/properties/90003912#/?channel=RES_BUY

2026-07-01 12:44:47 UTC

- reply

if you go next year let me know!

2026-07-01 12:23:39 UTC

It's that time the year again: https://tbd.camp #notacamp

2026-06-22 12:35:05 UTC

RE: https://infosec.exchange/@drwhax/116784053242482184
Anyone with a Pinebook Pro who could give me this number? :)
#note13hz…gnwt

2026-06-20 19:20:34 UTC

Could anyone with an RK3399 give me the output of: cat /sys/kernel/debug/*/dwc3*/regdump | grep GHWPARAMS3

2026-06-08 12:36:51 UTC

Tomorrow is my last day at Amnesty International's Security Lab. I left to do my own thing. More on that soon!! For now i'm going on a sabbatical for a couple months.

2026-05-14 23:29:05 UTC

tfw you want to report bugs but their issue tracker isnt accepting sign-ups

2026-05-11 22:09:35 UTC

- reply

https://github.com/kiriwalawren/nixflix/ :)

2026-05-08 10:11:59 UTC

Well, that's a new captcha...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/538/413/545/120/722/original/a77db2984e76095b.png

2026-04-22 14:02:46 UTC

Boards of Canada announced their new long play album, named Inferno, scheduled for release on May 29th.
https://www.youtube.com/watch?v=I9h6fJg-KoA
https://bleep.com/release/590960-boards-of-canada-inferno

2026-04-22 11:47:03 UTC

Incredible, there's cryptocurrency scams happening against ships trying to pass through the strait of hormuz, the scammers are pretending to be iranian security services and get firms to pay cryptocurrency for safe passage.
Bound to happen, but, YIKES.
https://www.reuters.com/world/middle-east/scam-messages-offering-ships-safe-transit-through-hormuz-security-firm-warns-2026-04-21/

2026-04-17 12:29:59 UTC

Seems Boards of Canada used airgaps before it was cool. https://www.discopogo.co/archive/boards-of-canada-boards-of-the-underground

2026-04-12 19:39:28 UTC

Bye bye Orban 💯

2026-04-08 12:54:41 UTC

Microsoft stopped signing the Veracrypt driver. https://sourceforge.net/p/veracrypt/discussion/general/thread/9620d7a4b3/
(which is why we need a full userspace replacement for a much longer time, the average user don't understand FUSE)

2026-04-07 16:55:38 UTC

Does anyone still have the Phineas Phisher has a posse SVG?

2026-04-06 15:05:16 UTC

RE: https://mastodon.social/@zackwhittaker/116357924981342417
Another spyware manufacturer avoiding jail time.
#note1kcg…dxw8

2026-03-22 10:21:00 UTC

When you link a new device against Signal desktop you're now enable to make the choice to sync message history or not to the new device. Fancy.

2026-03-15 01:27:23 UTC

Understandable
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/230/583/098/278/041/original/25debb49894a767e.png

2026-03-12 11:04:39 UTC

I love open-source ITAR violations: https://hackaday.io/project/205190-open-source-plfm-radar-up-to-20km-range

2026-03-09 14:12:28 UTC

Does anyone have recommendations for a wired video-camera that also might not backconnect to some weird chinese IP and I can wire into home-assistant?

2026-03-06 10:06:58 UTC

The FBI got compromised, again. Their wiretap system got compromised, again?!
https://edition.cnn.com/2026/03/05/politics/fbi-investigating-cyber-breach-critical-surveillance-network

2026-02-11 23:05:30 UTC

Someone made... UEFI Bindings for JavaScript 🤷
"Promethee loads script.js from the boot volume and runs it. That script is your bootloader. If you can do it with UEFI services, you can do it in JavaScript."
https://codeberg.org/smnx/promethee

2026-02-06 16:32:26 UTC

Another alleged stalkerware software maker got compromised and someone leaked all their customers on a cybercrime forum.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/024/565/088/970/754/original/811fb06fb379027c.png

2026-02-06 15:55:35 UTC

AMD delivering HTTP only updates in 2026 is quite something: https://mrbruh.com/amd/

2026-02-02 17:33:35 UTC

So i'm looking at having a single node that can pull metrics ala netdata from various hosts connected over Tailscale.
What do people recommend as the new hotness?
I read Victoriametrics is good and just relies on good 'ol Prometheus and Grafana which looks good? Any opinions?

2026-01-26 15:30:31 UTC

RE: https://infosec.exchange/@metacurity/115962097678433029
I mean good, but what about DOGE lol
#note1jr3…9dkf

2026-01-18 15:22:48 UTC

- reply

In addition, the leader of the Liberal Initiative party was accused of sexual assault, he's poised to be one of the three candidates to top the election today. https://www.reuters.com/world/europe/portugal-votes-tight-presidential-race-with-far-right-poised-reach-runoff-2026-01-18/

2026-01-18 15:13:19 UTC

Portugal's presidential election is today. It's quite a read: https://www.theguardian.com/world/2026/jan/16/portugal-presidential-election-satirical-candidate-vieira

2026-01-08 17:08:53 UTC

You know, maybe *dont* put your firebase credentials in your webpack for your OSINT avatar company.

2026-01-06 10:55:46 UTC

Yesterday I tried to get ACARS messages through RTL-SDR. My antenna might not be ready for this. However, ADSB 1090 was well received! If you have an rtl-sdr laying around and want to try out yourself without wrestling on Linux and have a Chromium like browser, you can hookup your rtl-sdr through WebUSB and see airplanes flying around you: https://www.deepcobalt.com/labs/sdr-aircraft-monitor/ (you might also have to be somewhat close to an airport I guess...)

2025-12-27 20:37:16 UTC

RE: https://infosec.exchange/@lorenzofb/115793035450206285
Great to see the folx from AccessNow's helpline being featured, they do really important work and deserve all our praise and support we can give them.
#note19r5…v8pm

2025-12-21 15:57:51 UTC

It looks very likely that the Dutch government will remove the
"naturalisation from abroad after 3 years of marriage" from the law. :(
Unfortunately, this was the plan to get my wife an EU passport and she wouldn't have to deal with visas all the time and she would have an easier time being here in the EU. Ugh!

2025-12-16 12:12:28 UTC

Great write-up of how an supposed encrypted messenger, Converso, was not encrypted at all and every conversation could be decrypted. https://crnkovic.dev/testing-converso/

2025-12-04 13:50:08 UTC

The upcoming recession due to the AI bubble burst will be truly something, in the worst possible way.

2025-11-27 01:21:15 UTC

Great write-up by Jamestown on AI skepticism within the PRC. https://jamestown.org/prc-elites-voice-ai-skepticism/

2025-11-18 13:52:47 UTC

Make the internet decentralised again!

2025-11-10 16:44:42 UTC

Portugal faces general strike on the 11th of December due to proposed labour reform package. ✊ https://www.portugalresident.com/portugal-faces-first-general-strike-in-a-decade-due-to-proposed-labour-reform-package/

2025-11-05 16:39:49 UTC

"An eBPF Loophole: Using XDP for Egress Traffic" https://loopholelabs.io/blog/xdp-for-egress-traffic

2025-10-20 12:21:31 UTC

incredible takedown by the oatmeal on AI art https://theoatmeal.com/comics/ai_art

2025-10-20 11:58:16 UTC

- reply

outdone yourself with this one

2025-09-22 21:33:41 UTC

We got WeChat tactics to avoid shadowbanning on tiktok now in the west!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/250/088/529/191/478/original/9e7b9f14584426b4.jpg

2025-09-16 22:41:51 UTC

Phoenix: Rowhammer Attacks on DDR5 with Self-Correcting Synchronization https://comsec.ethz.ch/research/dram/phoenix/
ETHZ pulled off another Rowhammer attack.

2025-09-15 19:24:44 UTC

This new glass interface on MacOS Tahoe is really not doing it for me.

2025-09-01 13:13:10 UTC

" Legal LTE Network at Home for $100 " https://lantian.pub/en/article/modify-computer/legal-lte-network-at-home-for-100-bucks.lantian/

2025-08-26 15:09:21 UTC

Incredible how small computers are pretty beefy now. top one is a gmktec nucbox g5 with 12gb of ram, 512gb ssd, and an N97. Intel NUC for size comparison.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/095/689/632/775/829/original/b3ff26ae4b5454b7.png

2025-08-19 11:30:39 UTC

- reply

sending you a successfully pwned the fbi.gov award soon! :)

2025-08-19 11:10:35 UTC

"Ukraine gives award to foreign vigilantes for hacks on Russia" https://www.bbc.com/news/technology-68722542
ehhh...

2025-08-09 19:53:12 UTC

Where is the NoisySquare? #why2025

2025-08-08 00:13:23 UTC

Is Digi Espana the isp to go? please say yes

2025-08-02 23:14:12 UTC

Lisbon Airport customs really only targets people of color and brazilians for bag checks. Tonight was the same story for the racists.

2025-07-28 10:58:44 UTC

We're launching a pretty cool thing at the Global Gathering in case anyone's gonna be there!
More info to be revealed then :)

2025-07-28 10:41:21 UTC

i love boomers trying to come up with solutions like "age verification". Teenagers have ample time to find ways around it, unlike boomers.
Can't these politicians be forced to build affordable housing instead?

2025-07-16 19:31:40 UTC

"Zuckerberg says Meta will build data center the size of Manhattan in latest AI push" https://www.theguardian.com/technology/2025/jul/16/zuckerberg-meta-data-center-ai-manhattan

2025-06-17 13:45:27 UTC

Thanks for bailing out the airlines the last couple years. Also, your flight is delayed or cancelled now? Less compensation is being discussed for you: https://www.theportugalnews.com/news/2025-06-16/end-of-free-hand-luggage-on-eu-flights-approaching/98628

2025-06-17 08:37:33 UTC

- reply

oh dont worry, saturday is normally included and light work on sunday as well :))))

2025-06-17 07:47:32 UTC

Its a beautiful day for 10 hours of construction noise!

2025-06-10 16:08:11 UTC

Please help Maung Sawyeddollah complete his studies in the U.S. Maung is a former refugee who is now the first Rohingya to study at NYU. https://www.gofundme.com/f/help-a-rohingya-student-complete-his-education
Please donate or share!

2025-06-09 17:37:51 UTC

- reply

only fun things happen at the AIVD

2025-06-09 17:27:31 UTC

I love getting a FOIA result after the ministry of interior who processes for the dutch intel service, saying they cant read the PDF, while the intel service can and just send me a 479 pages document on leftist activism in the Netherlands between the 80's through 2001.
Also as PDF here: https://respubca.home.xs4all.nl/pdf/PR-DEF.pdf
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/654/576/632/089/945/original/518407297256a0a6.png

2025-06-07 04:07:54 UTC

Everytime I think, oh, this should be easy. I find out it's not.. turns out registrering my marriage in the Netherlands will take at least 10 months before they even look at the request :D

2025-05-20 14:55:05 UTC

- reply

related:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/540/733/811/800/374/original/a71c690ca802b9a3.png

2025-05-13 11:28:54 UTC

https://www.portugalresident.com/psp-police-agent-suspended-after-opening-fire-on-bus-injuring-one-of-passengers/
"“The armed driver disappeared at the time, but (once the bus driver had reached the local police station and told the story), the PSP realised that the shooter was one of their operatives. The agent was arrested shortly afterwards, and disarmed, before being delivered to PJ police who are investigating the case”, writes Correio da Manhã this morning."

2025-05-03 12:34:29 UTC

https://www.theportugalnews.com/news/2025-05-03/demand-for-radios-soars-by-4594/97333
Radios are back!

2025-04-28 22:10:16 UTC

We got electricity back in Lisbon! Some small observations:
- 5g continued to work for a couple hour just fine, only after 15:00 did it become spotty and sometimes wouldn't work at all. I wonder if one of the celltowers wasn't as affected but saturated as it might've been located at a hospital, which generators I could hear.
- The streets were calm when I went to throw the trash in the early evening. Lots of confused tourists trying to find a place to eat something at (it was all closed).
- fridge was still completely cool when we opened it 7 hours into the power outage. Good to know!
- Turns out my radio was not charged..
- We had candles and matches ^_^
- I should really get an emergency balcony solar generator for times like these..
- In times like these, i'm happy we cook on gas and not electricity...
#blackout

2025-04-26 21:06:21 UTC

U.S. attorney for D.C. accuses Wikipedia of ‘propaganda,’ threatens nonprofit status
Trump appointee Ed Martin accuses the online encyclopedia of “allowing foreign actors to manipulate information and spread propaganda to the American public.”
https://www.washingtonpost.com/technology/2025/04/25/wikipedia-nonprofit-ed-martin-letter/ (pw bypass: https://archive.ph/JozhY)

2025-04-16 08:07:37 UTC

Saw a non-portuguese guy commenting on why enviromentalists need to shut up about the new airport location for a new Lisbon airport. Guy used to work in oil well drilling, lol. Ok buddy.

2025-04-12 11:40:06 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/324/795/534/436/389/original/73d15fdefa4b89ab.png

2025-04-07 07:01:08 UTC

never gonna be able to buy a house

2025-03-26 12:25:52 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/228/720/310/515/079/original/005aef5c64ed14b7.png

2025-03-24 18:42:30 UTC

"Dutch bus manufacturer to make military equipment for the Dutch MoD" https://www.rtl.nl/nieuws/politiek/artikel/5500475/unieke-samenwerking-tussen-defensie-en-machine-en-autobouwer-vdl
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/218/872/179/732/056/original/634663c3ee1a5d63.png

2025-03-24 17:21:55 UTC

If I was an U.S journalist, i'd change my name on Signal to just be initials of someone high in the Trump administration in the hope to get added to Signal groupchats.

2025-03-21 14:03:45 UTC

excited to announce that a windows update bricked my entire desktop

2025-03-16 09:53:43 UTC

If you're in Luxembourg.. then come to Festival Des Migrations in Kirchberg, we'll talk spyware at 5pm today. https://festivaldesmigrations.lu/dimanche-festival-clae
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/171/497/720/903/671/original/af666e1c3b4e705b.png

2025-03-13 17:42:49 UTC

Cool stuff for sale on Ebay! "1216428-301 Lockheed Martin Target ECM Combiner Circuit Card Assembly"
https://www.ebay.com/itm/203918329141

2025-03-10 13:35:05 UTC

"France pushes for law enforcement access to Signal, WhatsApp and encrypted email"
https://www.computerweekly.com/news/366619707/France-pushes-for-law-enforcement-access-to-Signal-WhatsApp-and-encrypted-email#:~:text=Law%20permits%20police%20use%20of%20spyware&text=Police%20will%20also%20have%20powers,the%20intervention%20of%20a%20judge

2025-03-04 13:30:32 UTC

Not now Portugal
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/104/400/399/831/036/original/38596e131a311234.png

2025-03-02 23:44:35 UTC

Revealed: at least 25 UK ‘spy cops’ had sex with deceived members of public. https://www.theguardian.com/uk-news/2025/mar/02/revealed-at-least-25-uk-spy-cops-sexual-relations-deceived-women #spycops

2025-02-24 18:57:14 UTC

- reply

g0d has a pro version now?

2025-02-24 18:55:41 UTC

- reply

thoughts and prayers AV

2025-02-24 18:52:32 UTC

- reply

h0lyExfil

2025-02-14 18:51:55 UTC

Should I get a standing desk?

2025-01-21 18:15:31 UTC

- reply

if only we had fact checkers, that'll fix the entire issue!

2025-01-21 11:43:38 UTC

absolutely incredible how the media has learned nothing from the first trump admin dog whistles and cant even recognize a full blown nazi greeting in the 2nd one.

2024-12-29 22:09:09 UTC

> having dinner with partner
> me: did you break any crypto today?
> her: actually... I found an interesting target today
Coming in a paper to you in 2025

2024-12-27 23:12:23 UTC

- reply

hit toot, please protect them by donating to their defense fund: https://www.ccc.de/en/updates/2024/das-ist-vollig-entgleist

2024-12-27 22:45:44 UTC

extremely based slide to end on for the train hackers #38c3
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/727/211/223/720/952/original/7fed244661a127e5.png

2024-12-27 12:01:05 UTC

At #38c3 what's good

2024-12-19 17:46:42 UTC

Amnesty International is looking for a consultant to develop a draft policy paper for the organisation which evaluates how companies functioning as monopolies can affect people's ability to enjoy human rights. This is a 25-day assignment, in January 2025. #jobs https://careers.amnesty.org/jobs/vacancy/competition-law-and-human-rights-policy-research-consultancy-4052/4080/description/

2024-12-16 11:47:58 UTC

Tech Guide: Detecting NoviSpy spyware with AndroidQF and the Mobile Verification Toolkit (MVT). https://securitylab.amnesty.org/latest/2024/12/tech-guide-detecting-novispy-spyware-with-androidqf-and-the-mobile-verification-toolkit-mvt/

2024-12-07 01:40:11 UTC

I love it when V.C funded firms beg for IOC's on stage to.... sell more licenses. Sorry buddy, work harder!

2024-12-05 15:21:12 UTC

The #38c3 Fahrplan is out! I'm scheduled for 14:45–15:45 on 28/12 to talk about the last year in digital threats against civil society. Including a new not yet published report 👀 https://fahrplan.events.ccc.de/congress/2024/fahrplan/talk/LR3GTU/