Harry Sintonen

Infosec consultant at REVƎЯSEC https://reversec.com - Coding, Research + various other interests

Public Key

npub1q2dlxhrrazeq2ezqps9txhlr799ud3j07m3m58q32fcm6pfm06xqf7d56p

NIP-05 Address

harrysintonen@infosec-exchange.mostr.pub

Profile Code

nprofile1qqsq9xlnt3373vs9v3qqcz4ntl3lzj7xce8ldca6rsg4yudaq5aharqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds56nxun

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1q2dlxhrrazeq2ezqps9txhlr799ud3j07m3m58q32fcm6pfm06xqf7d56p

Show more details

Last Notes

2026-10-23 09:41:19 UTC

For some reason, the CVE-2026-111497 buffer overflow vulnerability in the #brotli decoder is mostly associated with #nodejs, but this is a far wider issue. Brotli compression is supported by many client-side applications processing HTTP responses. While some of them have sandboxes and a quick update cycle (read: web browsers), many don't. In particular, many devices and applications using #curl / libcurl are affected and must be updated ASAP.
https://github.com/advisories/GHSA-9v8h-qqgm-4m35
https://nvd.nist.gov/vuln/detail/cve-2026-111497
#infosec #cybersecurity #CVE_2026_111497

2026-10-22 19:12:20 UTC

The week only keeps getting better... apparently, multiple not yet fixed Linux kernel vulnerabilities were disclosed by accident when they were posted to the public mailing list rather than the private one. Oops.
https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities
#infosec #cybersecurity

2026-10-20 20:28:30 UTC

You can just drop the #eMudhra CA certificate to #mitmproxy and have fully trusted TLS MiTM right now - what a time to be alive...
https://docs.mitmproxy.org/stable/concepts/certificates/#the-mitmproxy-certificate-authority
#pentesting #cybersecurity #infosec

2026-10-20 19:50:48 UTC

The long term impact of this #eMudhra intermediate CA cert private key disclosure: It is now possible to perform TLS MiTM to millions and millions of older #IoT devices (or other devices that won't or can't get updated). The root certificate that has signed the affected intermediate certificate was added to trust stores in about beginning of 2019 (*). It expires only in 18-feb-2043.
This opens the avenue for all kinds of nasty things.
*) https://bugzilla.mozilla.org/show_bug.cgi?id=1442337
#infosec #cybersecurity

2026-09-29 11:57:39 UTC

You peeps remember when it was a big deal that #CVE ID format would have to be changed because more than 9999 vulnerabilities would get reported per year?
Simpler times, eh…
https://www.cve.org/Resources/Media/Archives/OldWebsite/data/board/archives/2007-01/msg00000.html
#infosec #cybersecurity

2026-09-29 10:32:16 UTC

#Debian [DSA 6528-1] linux kernel #security update has fixes to 1313 CVEs.
https://lists.debian.org/debian-security-announce/2026/msg00441.html

2026-08-26 12:28:41 UTC

So yeah #Debian DSA 6466-1 fixed 239 CVEs. Were any of them of practical impact? No freaking idea.
https://lists.debian.org/debian-security-announce/2026/msg00377.html
#enshittification
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/161/768/503/065/179/original/fda7427b4b7d10c3.png

2026-08-14 09:24:28 UTC

- reply

The reason #macOS zip command is not vulnerable is that #Apple fixed this issue years ago (in 2008) already: https://github.com/apple-oss-distributions/zip/blob/zip-11.1/zip/patch-Apple
It is unclear why the fix didn't get reported upstream.

2026-08-14 08:43:22 UTC

I recently discovered a command injection vulnerability (CWE-78) from Info-ZIP (zip). Advisory: https://sintonen.fi/advisories/infozip-test-option-command-injection.txt
The fix is now available in #Debian as DSA 6439-1: https://lists.debian.org/debian-security-announce/2026/msg00350.html
Other platforms shipping zip command should also pick up the patch: https://sources.debian.org/data/main/z/zip/3.0-16/debian/patches/fix-command-injection.patch
NOTE: macOS included zip command is not affected.
#advisory #vulnerabilityresearch #cybersecurity #infosec

2026-08-09 09:07:08 UTC

It appears that AI companies target open source contributors with their marketing spam:
"we noticed you contributed to curl/curl — thanks for helping build open source. We're running a small program for Github OSS contributors and would love to invite you.
You'll receive $25 in XXXXXXXXX credits to use frontier AI models (this time YYYYY) through a single OpenAI-compatible endpoint."
#enshittification

2026-07-25 10:13:13 UTC

Back when the "internet" involved expensive phone calls and modems, someone figured out that a video backup system (VBS) could be used to distribute hundreds of megabytes of "backups" between friends by shipping a VHS cassette in a padded envelope.
You just needed a VCR (everyone had one), and a small harness that could sample the video signal from the VCR for the software to decode.
Interestingly, the Video Backup System website is still up: http://www.hugolyppens.com/VBS.html
I'm sure someone used this thing for actual backup purposes as well...

2026-07-17 09:16:51 UTC

LG monitors quietly install adware. https://www.youtube.com/watch?v=Q9uefFYe6bM
#privacy #enshittification

2026-07-16 09:48:56 UTC

#Amazon #CloudFront seems to having global issues.
https://health.aws.amazon.com/health/status
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/929/022/117/978/877/original/a4b847e2f78c9d19.png

2026-06-30 20:29:19 UTC

No, the libssh2 vulnerability CVE-2026-55200 isn't end of the world.
1. You need to defeat ASLR to successfully exploit it. The PoC works only when you disable ASLR. In most realistic use cases you need additional off-band infoleak from the app using libssh2.
2. You also must somehow convince the victim to connect to your malicious server, OR compromise some existing server to perform the attack.
Calling this a "CRITICAL VULNERABILITY" is dumb.

2026-06-26 08:54:57 UTC

The value from #goose hashtag is immeasurable...
... but at least 71.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/815/564/099/821/538/original/ce00b84611837e6d.png

2026-06-25 13:01:39 UTC

- reply

@nprofile…3n63
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/810/871/199/978/364/original/70a7cd42f918944e.png

2026-06-21 07:47:19 UTC

I have consistently refused to engage AI in any tasks that require mental effort. Intuitively, I felt that it leads to laziness and eventual deterioration of problem-solving skills. I still consistently challenge myself by solving already solved problems - not because they haven't been solved well already - but in order to maintain my skills. I can only recommend this approach.
https://www.nature.com/articles/d41586-026-01947-1

2026-06-18 22:12:06 UTC

Heads up to anyone using #AMD CPUs in a setting where Transparent Secure Memory Encryption (TSME) is critical: AMD has disabled this feature for consumer AMD products as of the latest AGESA updates. The feature is now only available for "PRO" CPU variants.
https://arstechnica.com/security/2026/06/users-cry-foul-after-amd-stripped-memory-crypto-from-its-consumer-cpus/
#enshittification

2026-06-10 08:12:32 UTC

I, for one, hail our EU overlords for staying their ground and not bending over to Apple.
This EU regulation did not come as a surprise to anyone, and definitely not to Apple. Yet they decided to go all knee-jerky about it.
Food for thought: If you cannot implement an AI feature in an interoperable and safe manner, it likely should not be implemented at all.

2026-06-09 22:23:31 UTC

Significant number of vulnerabilities fixed in #OpenSSL - https://openssl-library.org/news/secadv/20260609.txt
The most serious one is CVE-2026-45447: Use-After-Free in the PKCS7_verify() Function that could lead to remote code execution in some conditions.
#CVE_2026_45447

2026-06-05 09:44:37 UTC

Credits and debit cards issued in Finland have two checksums instead of just one. The outer checksum is the standard luhn-mod-10 as usual, but the inner checksum is another method (variation of IBM Check with 7 1 3 multipliers). So why is this interesting?
The two checksums make it far easier to resolve partial card numbers. For example if you take a picture of your card by hiding 3 digits with you finger, such masked card number can be resolved to about 12 possibilities.
TL;DR: Never post pictures of your Finnish debit/credit card, even when hiding some of the digits.
I have no knowledge if cards elsewhere might have similar double-checksum feature.

2026-06-03 12:51:16 UTC

- reply

"Github Copilot customers report up to 100-fold price hikes — AI sticker shock bites as Microsoft switches to usage-based pricing"
https://www.tomshardware.com/tech-industry/artificial-intelligence/github-copilot-customers-suffer-from-sticker-shock-as-microsoft-switches-to-usage-based-pricing-customers-report-up-to-100-fold-price-hikes

2026-06-01 12:42:09 UTC

This rasdaemon code is clearly missing some else statement(s). Thus any MCI_STATEUS_UC is reported as "Uncorrected, software containable error." no matter if those other flags are set or not. https://github.com/mchehab/rasdaemon/issues/251
#programming #bug
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/674/881/825/046/034/original/43c5aa36c9394d61.png

2026-05-30 15:49:38 UTC

- reply

This is the first major release in three years and constitutes some of the most extensive amount of changes ever. See the extremely long change log at https://morphos-team.net/releasenotes/3.20
Yes, it is somewhat technical and detailed at times, but condensing three years of work to mere "fixes and improvements“ would feel like demoting the amount of love that went into it.

2026-05-30 15:42:09 UTC

We've released #MorphOS 3.20 https://morphos-team.net/news

2026-05-30 12:30:51 UTC

CVE-2026-47187: Symlink escape - rogue SFTP server -> local file read/write
Severity: Critical (CVSS 9.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N)
CWE: CWE-59 (Improper Link Resolution Before File Access)
A rogue SFTP server can return symlink targets (absolute paths or relative "../../../" escapes) that sshfs passes to the kernel unchanged. The kernel resolves them on the client's local filesystem, so an ordinary "cp" through the mountpoint can read local files back to the server or write server-controlled bytes to local files. transform_symlinks does not cover relative targets.
https://www.openwall.com/lists/oss-security/2026/05/30/3
#CVE_2026_47187

2026-05-29 14:20:55 UTC

- reply

About 70% of human traffic towards cloudflare is using PQC - https://radar.cloudflare.com/post-quantum

2026-05-29 14:11:08 UTC

- reply

The next larger visible disruption will likely be when it is finally decided that non-PQC connections are considered too insecure. This will likely lead to a phase-out similar to what happened with SHA1 signatures over ten years ago.
- https://security.googleblog.com/2014/09/gradually-sunsetting-sha-1.html
- https://blog.mozilla.org/security/2014/09/23/phasing-out-certificates-with-sha-1-based-signature-algorithms/
- https://blog.cloudflare.com/sha-1-deprecation-no-browser-left-behind/

2026-05-29 14:06:46 UTC

Most web browsing has been using post-quantum secure algorithms for years now.
Why? Browsers and large CDNs have pushed for post-quantum key agreement implementations, such as X25519MLKEM768.
This has been a great success: No one needed to change or configure anything, or even know about it. This is the best kind of security: unobtrusive and transparent, without requiring user involvement for deployment.
#pqc #pqcryptography #cybersecurity #infosec
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/658/239/926/494/258/original/990304676eb76f64.png

2026-05-27 17:58:09 UTC

- reply

@nprofile…anez Indeed, I may have fallen to this same trap. I'll figure out the truth and amend the post as it appears this might not quite be the end of the landline just yet.

2026-05-27 17:26:52 UTC

- reply

@nprofile…anez https://yle.fi/a/74-20205277 (in finnish)

2026-05-27 14:14:08 UTC

- reply

@nprofile…990l Area codes. They used to be longer too, covering smaller areas. In 1996 they were consolidated to larger areas with just 2 digits.

2026-05-27 14:06:26 UTC

Finland shuts down the last landline (copper) telephone network on 2026-06-30. I don't remember when I last used a landline. I did have ADSL for some time, but it was never used for voice, only data. My last landline phone call must've been sometime in the late 90s.

2026-05-27 08:50:23 UTC

I spotted a bug in getgroups() function call in #MorphOS shared POSIX compatibility libc ixemul. In short: The function misbehaves when passed (0, NULL) and returns -1 with errno EFAULT rather than the number of groups. While I will fix the bug for the future, I also needed to figure out a way to mitigate this issue for installations that do not have the update.
Patching every single app that uses getgroups(0, NULL) would of course work, but it would be terrible amount of manual labor. One hack would be to create a define for the getgroups() that'd magically handle the situation. Rather than going for these, I figured out rather neat way to handle this instead:
Since ixemul function calls are calling a shared library functions via stubs, I instead patched the stub generation code for getgroups function. When the stub assembly is generated it now injects the following code before the actual branch to the function code:
cmp 3,0
bne 0,.L1
cmp 4,0
bne 0,.L1
li 4,1
.L1:
Effectively the above is #powerpc assembly for:
if (size == 0 && list == NULL) list = (gid_t *) 1;
This ensures that the function will always be called with non-zero list parameter, effectively working around the issue.
Is it a hack? Oh yes. Did I spend a huge amount of time actually patching other code manually before figuring out this hack? Oh yes.
It's still rather neat hack, even if a bit late to the game!
#development #coding

2026-05-25 09:40:40 UTC

People have trouble judging their own abilities or the accuracy of reporting. So is it that weird that they also place unwarranted trust in large language models?
AI literacy should be taught to everyone (and not just children).

2026-05-24 18:05:38 UTC

- reply

@nprofile…de2d I might not have been clear enough in my messagiong: I initially got my IP banned for hitting the whois server hard. It was a (obvious) mistake, and I rectified it by creating this tooling.

2026-05-24 15:18:10 UTC

- reply

@nprofile…p4sq Nah, while it has good qualities it's way too janky for public consumption.

2026-05-24 12:06:08 UTC

I still run my custom local RIPE WHOIS service. This service allows me to perform extremely fast WHOIS searches. I wrote this tool in early 2010 when I wanted to enrich logs with network name information, and understandably my IP address was quickly blocked by the online WHOIS service.
The service has three parts:
1. Generating the network.db from RIPE DB dump.
2. Network service to allow queries to the data.
3. Tool that enriches any IP address in its input with the network name in brackets.
Generating the database:
- Fetch RIPE DB from ftp
- Parse and insert the data to SQLite database
curl ftp://ftp.ripe.net/ripe/dbase/split/ripe.db.inetnum.gz | gzip -cd | ./createnetworkdb.pl
Service:
- Load the whole database to memory, and serve it over localhost port. The internal search structure is a PATRICIA radix tree, but to conserve memory it uses 24-bit indices rather than pointers. The service consumes only 474MB memory when holding the whole RIPE DB (Note however, that not all WHOIS information is loaded to memory, only key parts).
- The super simplified API accepts socket connections and reads 4-byte input (IP address in network byte order) and returns JSON object with the WHOIS information.
- Implemented in C (mainly to allow precise control over data structures and thus memory consumption).
Tool:
- Python filter tool that matches IP addresses from stdin and performs query from the service. For each IP it replaces its IP with IP[networkname].
Bonus: The network.db SQLite database can be queried directly to extract other kinds of information out of it. For example, searching IP ranges that match specific network name patterns has proven quite useful.
I'm sure many people have created something similar over the years. However, I had a lot of fun making this thing to be able to process tens of thousands of queries per second.

2026-05-24 09:26:43 UTC

- reply

https://kb.synology.com/en-ca/DSM/tutorial/Plan_Change_2026_Active_Insight "Understanding the Active Insight pricing changes"

2026-05-24 09:25:06 UTC

"To better align Active Insight with long-term product development and customer usage, we are updating our pricing strategy."
#synology #enshittification

2026-05-24 08:21:23 UTC

- reply

So what happened? AI did. The Internet Bug Bounty program was inundated by LLM findings. This diluted the rewards and placed insane pressure on actual humans who have to process the filings. This is likely is one the main reasons the programme shut down.
This is why we can't have nice things.

2026-05-24 08:06:10 UTC

- reply

And yes "The bounty amount is determined at time of reward, NOT the initial vulnerability submission. This is a dynamic bounty table that will change regularly based on the number of participating partners."
It still feels wrong.

2026-05-24 07:49:13 UTC

Back in January I reported two low level vulnerabilities to Internet Bug Bounty #hackerone program. At the time the reward for a low level findings was $600.
I was just rewarded 2 x $68 bounty after 5 months. This is what I call a dick move.
#bugbounty
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/626/961/393/265/585/original/77371f94d9e3fb59.png

2026-05-22 13:11:03 UTC

#Signalapp doesn't actually delete messages when they're deleted (either manually or by automation). The message deletion is written to Write-ahead Log, and the data is only truly deleted once Signal is restarted or threshold of 1000 pages is reached. For macOS Signal application, extra complication arises from the fact that the signal message database can be backed up before the database consolidation occurs. Large amount of the supposedly already deleted messages could be recovered from the device or backups.
This concerns use cases where deleting messages actually getting removed in timely manner is of high importance and recovery of the deleted messages could lead to grave consequences.
TL;DR: If you don't care about deleted messages being actually deleted you don't need to worry.
Full advisory at: https://sintonen.fi/advisories/signal-deleted-but-not-forgotten.txt
#fulldisclosure #infosec #cybersecurity

2026-05-22 06:00:04 UTC

- reply

@nprofile…f072 @nprofile…kyv9 Indeed, they are.

2026-05-22 05:50:24 UTC

All my attempts to communicate a vulnerability in #Signalapp have failed - I have not received any response to my multiple messages to them. Good people have tried to forward my concern to them (and I am thankful for your efforts and help), yet this has been to no avail.
I am disappointed in the lack of communication from Signal. I will be disclosing the full details of the issue later today (with end-user mitigations), after the six-month anniversary of the initial report.

2026-05-19 14:54:21 UTC

- reply

Fixed by https://github.com/curl/curl/pull/21675

2026-05-19 11:32:51 UTC

I finally was able to track down a busyloop bug in #curl multi interface.
I've know about this bug for years now, but I have never been able to reproduce it outside of our #MorphOS operating system.
I was finally able to do it though. The key: smaller socket receive buffer. Most modern systems have huge socket buffers and this hides the bug. The issue will likely get triggered quite easily on older or embedded systems where smaller socket buffers are more common.
https://sintonen.fi/src/misc/curl-multi-busyloop-poc.c
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/601/013/361/697/587/original/430caae62c861e6b.png

2026-05-18 14:29:55 UTC

- reply

The music and the graphical effect is clever hack using a bytebeat https://viznut.fi/texts-en/bytebeat_algorithmic_symphonies.html

2026-05-18 14:12:46 UTC

This 16-byte intro "Wake Up!" from HellMood has nice music https://www.youtube.com/watch?v=MvycyU-kLjg
#demoscene

2026-05-17 21:12:32 UTC

- reply

@nprofile…qq5a I work on everything pretty much: Low level kernel (quark, exec, dos, etc), OS components (disk based libraries, devices etc), both C standard libraries (libnix & ixemul), SDK (porting various GNU things using ixemul, but also perl, python etc), compiler toolchains (binutils, gcc), and apps. It has been 26 years, so I likely have forgotten many things I've done. I also host (and maintain) some of the infrastructure, for example the build system, bugtracker and beta download server.

2026-05-17 14:26:33 UTC

It just dawned on me that I've now worked on the #MorphOS operating system for more than half my life, 26 years.
While it is a hobby, it's a rather serious one.

2026-05-15 19:38:40 UTC

- reply

@nprofile…kxkt heh that was a lot of typos. fixed!

2026-05-15 18:57:54 UTC

- reply

#Debian has released kernel update that fixes this vulnerability.
Debian stable (trixie) kernel update: https://lists.debian.org/debian-security-announce/2026/msg00185.html
Debian oldstable (bookworm) kernel update: https://lists.debian.org/debian-security-announce/2026/msg00186.html

2026-05-15 08:29:42 UTC

- reply

kernel.yama.ptrace_scope = 2: Only admin can use ptrace, as it required CAP_SYS_PTRACE capability.

2026-05-15 08:27:06 UTC

Local file exposure #vulnerability in linux kernels:
https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn
Apparently this issue was already identified in 2020 but wasn't fixed back then.
Mitigation:
- runtime:
sysctl -w kernel.yama.ptrace_scope=2
- To make the migiration persistent:
echo "kernel.yama.ptrace_scope=2" | sudo tee /etc/sysctl.d/01-harden-ptrace.conf
WARNING: This migation may break existing functionality. Test before deploying.
#infosec #cybersecurity

2026-05-13 21:43:49 UTC

- reply

The only silver lining is that RCE requires Address Space Layout Randomization (ASLR) being defeated (or being disabled in the first place).

2026-05-13 21:34:28 UTC

CVE-2026-42945 Heap-based Buffer Overflow in #nginx combined with the linux kernel LPEs is "not great" as we say in the industry.
https://depthfirst.com/nginx-rift
#CVE_2026_42945

2026-05-13 16:03:18 UTC

- reply

Here's are some examples of neat things you can do to the traffic with simple python scripts: https://docs.mitmproxy.org/stable/addons/examples/
#mitmproxy

2026-05-13 15:47:20 UTC

#mitmproxy has gotten super cool. It has become my swiss army knife for security assessments as of late.
Sometimes you can't set HTTP or SOCKS proxy, nor can you easily get MiTM to forward packets. But if you can DNS spoof (or set the endpoint address directly) you can redirect the traffic to to mitmproxy.
The reverse proxy mode supports wide range of protocols (among all kinds of http(s)). See https://docs.mitmproxy.org/stable/concepts/modes/#reverse-proxy
There are multitudes of applications for this: Debugging, recording and replaying traffic, applying realtime transformations (such as fuzzing) on the fly etc. Love it!

2026-05-13 12:32:24 UTC

- reply

@nprofile…3c0m The problem there is that the attacker can replace the thing asking for passphrase with a malicious one that records the passphrase for later unlocking by the attacker (or delivers the passphrase to the attacker off-band).
Secureboot (with appropriate TPM2 PCR policy) can at least prevent these kinds of malicious modifications.
Of course this cannot protect someone replacing the entire device with a malicious one that is only tasked to steal your passphrase.
If such attacks are in your threat model you have a safe where you keep your devices when not in your supervision.

2026-05-13 12:15:13 UTC

- reply

Just to be absolutely clear: #LUKS with TPM unlocking is equally vulnerable to various attacks. You should definitely use TPM+PIN with LUKS as well. See systemd-cryptenroll --tpm2-with-pin=yes
https://wiki.archlinux.org/title/Systemd-cryptenroll#Trusted_Platform_Module

2026-05-13 11:51:18 UTC

Now it is a great time to ensure you've updated your #UEFI #Windows #SecureBoot Certificate Authority to 2023 versions. The old keys from 2011 are set to expire in June 2026.
Quoting microsoft:
"Devices that haven’t received the newer 2023 certificates will continue to start and operate normally, and standard Windows updates will continue to install. However, these devices will no longer be able to receive new security protections for the early boot process, including updates to Windows Boot Manager, Secure Boot databases, revocation lists, or mitigations for newly discovered boot level vulnerabilities.
Over time, this limits the device’s protection against emerging threats and may affect scenarios that rely on Secure Boot trust, such as BitLocker hardening or third-party bootloaders. Most Windows devices will receive the updated certificates automatically, and many OEMs provide firmware updates when needed. Keeping your device current with these updates helps ensures it can continue receiving the full set of security protections that Secure Boot is designed to provide."
https://support.microsoft.com/en-gb/topic/windows-secure-boot-certificate-expiration-and-ca-updates-7ff40d33-95dc-4c3c-8725-a9b95457578e

2026-05-13 11:35:31 UTC

- reply

@nprofile…2y0d Any solution that unlocks the encryption automatically without user having to provide "something you know" (*) is vulnerable to attacks by definition.
*) "something you have" may be good enough, for example some token or USB key. In this case you need to accept the risk of the attacker gaining access to the token, however.

2026-05-13 11:07:56 UTC

Yet another #BitLocker "exploit" circulating.
This is a friendly reminder that if you set your system to just unlock with TPM alone, the system is not protected against determined attacker. TPM cannot protect your system unless if you configure the system to request PIN as well.
See: https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/countermeasures
#infosec #cybersecurity

2026-05-13 08:20:10 UTC

"A high-tech entrepreneur allows wealthy sportsmen to hunt inmates in a virtual-reality prison."
Oh, it is a movie?
https://www.imdb.com/title/tt0112764/

2026-05-13 08:05:55 UTC

Why is charge limit #iPhone 15+ feature?
https://support.apple.com/en-us/108055
#Apple
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/566/227/306/943/225/original/633854f10e7cde23.png

2026-05-11 13:25:23 UTC

- reply

@nprofile…fu2c In terms of energy and resource consumption, very likely so.

2026-05-11 08:41:47 UTC

- reply

@nprofile…awyv None.

2026-05-11 07:09:45 UTC

Vulnerabilities found from #curl:
#Mythos: 1
Me: 30
- https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/
- https://sintonen.fi/advisories/

2026-05-11 07:09:15 UTC

Vulnerabilities found from #curl:
#Myrhos: 1
Me: 30
- https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/
- https://sintonen.fi/advisories/

2026-05-08 08:47:52 UTC

- reply

@nprofile…mej2 Sure if you executed that particular exploit you definitely must restore the /etc/passwd afterwards.

2026-05-08 07:53:32 UTC

- reply

Note that if you tested the exploit locally and then applied the workaround your system will retain the tampered kernel cache and will remain vulnerable even when the module is no longer in memory and cannot no longer be loaded.
You can use sudo sh -c "echo 3 > /proc/sys/vm/drop_caches" to flush the exploit from memory. Rebooting will also work, of course.

2026-05-07 20:21:32 UTC

- reply

@nprofile…825s They will be loaded by the kernel automatically on demand. So apply the mitigation until kernel update is available.

2026-05-07 19:56:41 UTC

Apparently there's yet another #LinuxKernel Local Privilege Escalation #vulnerability. There's a mitigation that disables esp4, esp6 and rxrpc modules.
https://www.openwall.com/lists/oss-security/2026/05/07/8
#infosec #cybersecurity

2026-05-07 15:06:07 UTC

#mastodon
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/533/905/780/855/026/original/7cfbb916ae788713.png

2026-05-06 10:41:34 UTC

#Debian stable #apache2 package 2.4.66-1~deb13u2 already includes the fix for CVE-2026-23918.
You an verify this by apt-source apache2
and then checking out apache2-2.4.66/debian/patches/bug1125368.patch
The security tracker at https://security-tracker.debian.org/tracker/CVE-2026-23918 currently has wrong information. This is likely due to automation based on version numbers alone.
#CVE_2026_23918
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/527/187/277/365/389/original/3213e9861ef0c30c.png

2026-05-04 17:18:52 UTC

Several vulnerabilities in #Apache HTTP Server 2.4 have been fixed in release 2.4.67. The most severe of these are:
- CVE-2026-23918: Apache HTTP Server: http2: double free and possible RCE on early reset
- CVE-2026-24072: Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr
- CVE-2026-33006: Apache HTTP Server: mod_auth_digest timing attack
https://httpd.apache.org/security/vulnerabilities_24.html
#CVE_2026_23918 #CVE_2026_24072 #CVE_2026_33006 #infosec #cybersecurity

2026-05-03 14:41:16 UTC

- reply

@nprofile…7x2u This reminds me of a certain provider who used to have a pre-created user on the default Linux image with a password the same as the username. The user was in sudoers.
So even if you changed the root password, all systems set up with that image remained trivially exploitable over ssh.

2026-05-03 12:51:42 UTC

- reply

Certainly, it was a different time back then, but the huge spying incidents related to the US nuclear program had already happened. It boggles my mind that Los Alamos National Laboratory would just hand out any hardware to third parties, rather than just destroying it.

2026-05-03 12:35:06 UTC

Los Alamos nuclear secrets "leaked" in LPG-21 magnetic disk memory:
https://www.youtube.com/watch?v=IBjh0SaA5dc
I guess securely wiping storage media wasn't a thing eh?
#retrocomputing #usagielectric

2026-04-30 19:16:06 UTC

Reminder to anyone using #ApacheCamel SCP/SFTP connections: Apache Camel does not perform host identity validation unless you explicitly configure "StrictHostKeyChecking" as "yes". The default value for "StrictHostKeyChecking" is "no". If you do not explicitly configure this option as "yes", the connections are susceptible to
meddler in the middle attacks.
What is the impact of such insecure configuration?
If you are using SSH password authentication, the attacker in a privileged network position can perform full MiTM, grab the username and password, and thus gain authenticated access to the target server.
If you use a key-based authentication, the attacker cannot perform full MitM. However, they can still present a fake server and, in case of upload, steal the uploaded files. In case of download, the malicious server can present fake or malicious files for download.
So, any configuration that could get intercepted MUST always specify the host identity and use "StrictHostKeyChecking" "yes". Even configurations in secured networks should use "yes" for additional security.
Unfortunately, the Apache Camel documentation isn't clear on this topic, and the OpenSSH's similar option and its default value working in a different manner can easily lead to confusion and insecure configurations.

2026-04-30 18:32:19 UTC

- reply

You can use the following the check if the mitigation has been applied correctly:
python3 -c 'import socket; s=socket.socket(38,5,0);
try:
s.bind(("aead","authencesn(hmac(sha256),cbc(aes))"))
print("AEAD interface present")
except OSError:
print("AEAD interface disabled")'

2026-04-30 06:37:05 UTC

Mitigation to #CVE_2026_31431 / #copyfail :
- If kernel config has CONFIG_CRYPTO_USER_API_AEAD=m:
echo "install algif_aead /bin/false" | sudo tee /etc/modprobe.d/disable-algif.conf; sudo rmmod algif_aead
- If kernel config has CONFIG_CRYPTO_USER_API_AEAD=y:
Add "initcall_blacklist=algif_aead_init" to the kernel command line and reboot.
https://www.openwall.com/lists/oss-security/2026/04/30/2

2026-04-27 20:24:48 UTC

- reply

https://github.blog/news-insights/company-news/github-copilot-is-moving-to-usage-based-billing/
"GitHub Copilot is moving to usage-based billing - the current premium request model is no longer sustainable"

2026-04-27 07:28:23 UTC

- reply

How accurate is Road to Vostok vs real locations, you ask? Very. These are just a couple of examples.
The locations aren't 100% 1:1 though, to accommodate smoother gameplay, but you can see familiar places all the time.
#roadtovostok
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/475/408/749/916/732/original/287f2a2c2ca03667.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/475/425/107/339/174/original/2d2397d22ac0e8f3.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/475/436/860/743/932/original/d01554f088ba1b79.png

2026-04-26 23:19:48 UTC

Road to Vostok is so accurate in locale and setting, it's uncanny. I grew up in a town next door, and did my military service in Hamina (many, many moons ago). https://store.steampowered.com/app/1963610/Road_to_Vostok/
#roadtovostok

2026-04-24 00:52:57 UTC

- reply

In other news: UK Biobank health data listed for sale in China, government confirms https://www.bbc.com/news/articles/cpvxgl3n138o

2026-04-24 00:45:31 UTC

Finnish medical data is available for researchers, unless if you specifically opt-out. I have, you should, too.
https://findata.fi/en/about-findata/your-data-rights/#how-can-I-exercise-my-rights
#privacy #medicaldata #secondaryuseofdata

2026-04-24 00:07:42 UTC

If you upgraded to #OpenSSH 10.1 or later and suddenly have trouble connecting to a server, try: ssh -o ipqos=af21 user@host
If that works, then the network is unhappy about the Expedited Forwarding IP QoS (this is the new default IPQoS for interactive connections with OpenSSH 10.1 and later. -o ipqos=af21 restores the IPQoS used by earlier OpenSSH versions).

2026-04-23 15:18:56 UTC

- reply

OpenSSL will likely say that you should check version as well - but would it be that terrible to keep these negative defines around, even if the support is fully axed?

2026-04-23 15:16:36 UTC

#OpenSSL 4.0.0 removed all traces of SSL3 support - including the OPENSSL_NO_SSL3_METHOD define that indicates that SSL3 methods are not available.
This define is used by a lot of code to see if they should try to use SSLv3_client_method() or not. Example: https://github.com/mirror/wget/blob/8775506f632f14404e4755dbae679dea07abf12a/src/openssl.c#L229

2026-04-23 10:58:09 UTC

- reply

@nprofile…umgj @nprofile…kyv9 I of course included PoC. This is no my first ride.

2026-04-22 21:06:25 UTC

I've tried to report a security vulnerability to @nprofile…kyv9 for months now (first attempt was 2025-11-23 to the official security-at email address). I haven't gotten any response from them, even after repeated attempts. This is highly frustrating.
Is there a way to reach them? I don't need any kind of special treatment, just someone acknowledging that the message has been received would be okay.
#signalapp

2026-04-22 14:24:25 UTC

- reply

@nprofile…gvek No amount of AI can protect one from human stupidity.

2026-04-22 09:51:20 UTC

- reply

If this sounds bloody obvious to you, that is because it is. Yet, it seems to be forgotten by many these days.

2026-04-22 09:48:48 UTC

Not every security adjacent bug is an exploitable vulnerability.

2026-04-21 16:10:00 UTC

Apparently, AI capacity outages are hitting users big time. You can't get resources even with money. Daily tokens run out in hours, and weekly by Tuesday.
The only remedy for this will be to hike prices by a lot.
Or... just not use AI.

2026-04-21 10:29:44 UTC

#Yammer (oh sorry I meant "Viva Engage communities") will be enabled in #Teams for everyone, by default. Unless if you opt out at org level: https://mc.merill.net/message/MC1218423
Here's how you can turn this thing off: https://learn.microsoft.com/en-us/MicrosoftTeams/teams-viva-experiences#how-to-set-viva-engage-experiences-in-teams
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/442/214/798/988/301/original/3f78ec1112a56eac.png

2026-04-21 10:09:42 UTC

Some parts of #POSIX are just bewildering. As an example statvfs/fstatvfs:
Someone decided that it is a good idea to standardize getting filesystem statistics. That's a great idea!
But they failed to specify what the several fields in "struct statvfs" actually mean:
fsfilcnt_t f_files Total number of file serial numbers.
fsfilcnt_t f_ffree Total number of free file serial numbers.
fsfilcnt_t f_favail Number of file serial numbers available to non-privileged process.
unsigned long f_fsid File system ID.
Most systems interpret "serial number" as "inode". But this is wholly unportable, and many file systems don't have such concept to begin with. What to do if these numbers cannot be determined? The documentation doesn't even attempt to clarify what f_fsid is supposed to be.
What was the point in including such ambiguous platform dependant fields to begin with? The result is that these fields cannot be interpreted to contain anything sensible.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/442/107/881/656/190/original/73ff133af4f6886c.png