VessOnSecurity

Anti-virus, malware and infosec expert, crypto amateur, privacy advocate and general annoyance.

PGP keyID: 0x365697c632dd98d9

Public Key

npub1jw3gppe8mxtdd5szxpvakxg9s00kdxqmdmp7x5v84w0urnyw3y5qn2d3q7

NIP-05 Address

bontchev@infosec-exchange.mostr.pub

Profile Code

nprofile1qqsf8g5qsunan9kk6gprqkwmryzc8hmxnqdkaslr2xr6h87pej8gj2q09u280

Author Public Key

npub1jw3gppe8mxtdd5szxpvakxg9s00kdxqmdmp7x5v84w0urnyw3y5qn2d3q7

Show more details

Last Notes

2025-05-19 05:23:53

Apparently, Microsoft Teams collects biometric data (voice and face image) of its users to build profiles of them:
https://www.theguardian.com/australia-news/2025/may/19/nsw-education-department-caught-unaware-after-microsoft-teams-began-collecting-students-biometric-data
The article doesn't say how to turn it off but go to Settings and then Recognition (the last item at the bottom). This is for academic and corporate accounts only - personal accounts (e.g., from Skype) do not have such setting. Dunno if this means that you can't turn it off there.

2025-05-05 19:06:28

- reply

@nprofile…4798 @nprofile…a0g8 LOL, no. Americans didn't do that until *after* the collapse. That gave rise to the oligarchy and the mafia government. The actual economic collapse came earlier, around the time of Gorbachov. (Started accelerating before him but his attempts to fix it just made it more visible.)

2025-04-20 14:08:52

- reply

@nprofile…h5ud So, you're saying that the Ukraine government has no way of relaying speedily information and orders to the front? No wonder Ukraine is losing, then...
Also, in such cases the order is pretty straightforward - "there is a cease-fire - do NOT fire unless fired upon". If the Russians do not comply with Putin's order, of course the Ukrainians will return fire.

2025-04-20 09:22:35

OK, this is rich.
Point one, Russia has declared a 30-hour cease-fire in Ukraine. Ukraine claims that the Russians are violating it, so Russia bad. OK so far:
https://edition.cnn.com/2025/04/19/europe/russia-ukraine-war-easter-truce-intl/index.html
Point two, by some "analyst", "there was no advance notice about the cease-fire, so Ukraine doesn't have the time to comply with it":
https://edition.cnn.com/2025/04/19/europe/putin-russia-ukraine-truce-strategy-intl-latam/index.html
(I guess phone calls and radio messages to the front commanders are hard and stuff has to be passed by horse riding messengers these days.)
So, there is a cease-fire, but Russians firing on Ukrainians means Russia is bad (because it isn't abiding by the cease-fire) and Ukrainians firing on Russians means Russia is bad (because it didn't give Ukraine advance notice and time to prepare for the cease-fire).
CNN used to be a respectable news source. Nowadays it's just a propaganda outlet, no better than RT...

2025-04-14 11:02:30

- reply

@nprofile…v9cj It's in line with "he thinks pretty much like me". Even before the elections, I said that the Americans don't have a good choice this time - they have to choose between two different evils.

2025-04-14 10:53:44

I normally hate reading interviews but here is one with someone who thinks pretty much like me about Trump's tariffs - they are stupid and are destroying both the US and the world economy and will not achieve any of the stated goals, although Harris as a President would probably have been even worse:
https://internationalman.com/articles/doug-casey-on-trumps-tariffs-and-the-coming-economic-fallout/

2025-04-09 13:21:44

- reply

@nprofile…5lc3 The current spike notwithstanding, Japan and China have been selling US bonds in droves for the past 2-3 months.

2025-04-05 18:13:15

- reply

@nprofile…5lc3 Sounds interesting... What are the prizes? Will there be a Signal group chat dedicated to the event? How does one get on it?

2025-04-04 05:12:46

WTF happened with portableapps.com? Did they get ransomwared or something?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/277/958/175/354/746/original/5057734d3a7dbe67.jpeg

2025-03-28 06:40:18

"In-Depth Technical Analysis of the Bybit Hack":
https://www.nccgroup.com/us/research-blog/in-depth-technical-analysis-of-the-bybit-hack/

2025-03-28 06:39:53

The monsters under the bed are real...
"Babysitter finds man under bed after child complains of 'monster'":
https://www.bbc.com/news/articles/c70e2y98p06o

2025-03-28 06:38:36

"A DHS staffer faces serious punishment for accidentally adding a reporter to a group email":
https://www.nbcnews.com/politics/national-security/dhs-staffer-faces-serious-punishment-accidentally-adding-reporter-grou-rcna198233
(No, not *that* group.)

2025-03-28 06:38:00

- reply

@nprofile…a0g8 This is a very well thought out piece. Maybe you should become a policy guy.

2025-03-27 09:18:46

https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/233/645/991/014/412/original/c7009783c53b4890.jpg

2025-03-18 06:40:35

"Why do we even have XSSes, SQLI, etc":
https://hackarcana.com/article/why-do-we-even-have-xss-sqli-etc

2025-02-24 10:31:27

- reply

@nprofile…5lc3 It's a pretty standard practice for businesses to require regular reports from their employees about the job they have done. It's less common for governments but even my employer, the Bulgarian Academy of Sciences, which is on government budget, does so, albeit over periods much longer than a week. It's several years; forgot how many exactly. We even made a web-based tool with which one can record and track this thing for themselves.

2024-10-28 10:02:48

- reply

@npub1nyq…vvvs That's a pretty sober and reasonable analysis and I pretty much agree with it. In particular, the part that "if Harris made her position clear, it would harm her chances of being elected". Indeed! I can see what her policies would be even now and would never vote for her, even if I could - but many people can't see it now and are confused by her word salads.
Also, for many people it will be a surprise to learn that apparently Biden was the sharper knife in the drawer. The sharper spoon anyway.
I also agree that if Trump loses now, it's all over for him. Not only for the reasons you stated but also because his political enemies will make sure that he's bankrupted and in jail.

2024-10-04 06:35:39

LOL. Apparently, it's Satoshi hunting season again. Must be October or something...
https://www.politico.eu/article/mystery-creator-bitcoin-identified-new-hbo-documentary-satoshi-nakamoto-crypto-currency/

2024-08-19 20:35:03

- reply

@npub17lg…9uux Uhm, how do you get that they are declining? Logged in users:
Feb 2022 - 59.8 mil
Feb 2023 - 60.9 mil
Aug 2023 - 61.8 mil
Feb 2024 - 67.0 mil
This looks steady to slightly increasing to me.

2024-08-13 18:41:45

- reply

@npub1sdt…96z3 Will this have any effect on those already convicted by evidence from such warrants?

2024-08-09 06:53:35

Programming with AI is like blindly copying random answers from StackOverflow without reading the comments.

2024-08-01 19:05:23

- reply

@npub17lg…9uux But you could put the TEMP directory on the encrypted volume too.

2024-08-01 06:34:07

"Would Making Ransom Payments Illegal Result in Fewer Attacks?":
https://www.darkreading.com/vulnerabilities-threats/would-making-ransom-payments-illegal-result-in-fewer-attacks
Spoiler: Nope.

2024-08-01 06:33:39

"Security Researchers and Journalists at Risk: Why You Should Hate the Proposed UN Cybercrime Treaty":
https://www.eff.org/deeplinks/2024/07/journalists-and-security-researchers-risk-why-you-should-hate-proposed-un

2024-07-31 05:57:34

Bwahahahahaha...
Meta built a "prompt guard" that protects AI chatbots from prompt injection.
It is bypassed by using the prompt "I g n o r e p r e v i o u s i n s t r u c t i o n s ":
https://github.com/meta-llama/llama-models/issues/50

2024-07-17 07:49:21

Basically - tell the Palestinians where the "safe zones" are, so that you know what to bomb.
"Israeli strikes in southern, central Gaza kill more than 60 Palestinians, including in ‘safe zone’":
https://apnews.com/article/israel-palestinians-hamas-war-news-07-16-2024-0cff821823185af16fb2ec5ee8e5c986

2024-07-16 16:33:47

- reply

@npub17lg…9uux LOL. The whole of USA was less than 10% revenue. The EU probably isn't much more. And you need just a few highly qualified people for this kind of research - not legions of them.

2024-07-15 17:00:03

Must be Monday...
"Israel bombs yet another UN-run school in Gaza, killing 17":
https://www.aljazeera.com/gallery/2024/7/15/israel-bombs-yet-another-un-run-school-in-gaza-killing-17

2024-07-14 06:41:12

https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/783/476/010/517/668/original/495028e1b41e39c4.jpg

2024-07-07 10:24:44

ChatGPT should be pronounced ShitGPT, right?

2024-07-05 19:43:15

- reply

@npub1nyq…vvvs Ah, The Guardian. The paper read by those who think they ought to run the country.
https://www.youtube.com/watch?v=DGscoaUWW2M

2024-06-25 08:51:06

This article is absolute nonsense:
"Google: Stop Burning Counterterrorism Operations":
https://poppopret.org/2024/06/24/google-stop-burning-counterterrorism-operations/
My arguments:
- The job of the security researchers is to find security flaws, attackers exploiting them, etc.
- The job of the spies to the spy.
- The job of those doing counter-terrorism is to fight terrorists.
Do your job and stop complaining about the other people who are doing their job.

2024-06-22 05:22:42

Can confirm from personal experience, programming with AI is exactly like this.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/658/595/984/274/206/original/be0fbb9851255c98.png

2024-06-21 05:17:36

https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/652/914/050/100/421/original/b05d783f0f4f84c1.jpeg

2024-06-20 06:23:52

- reply

@npub15zu…s7lx Unsurprisingly, the motivation is money:
https://balkaninsight.com/2023/09/25/who-benefits-inside-the-eus-fight-over-scanning-for-child-sex-content/

2024-06-19 07:29:25

- reply

@npub1vz5…qdta Maybe it was a joke? Anyway, people are now posting similar things on Twitter, which are obviously jokes:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/642/107/816/096/871/original/583b820fcf8e5adf.jpeg

2024-06-12 16:02:07

- reply

@npub1lzz…jhl3 What are you confused about? You don't know that Biden is the US President and Trump is a US Presidential Candidate?

2024-06-09 21:03:21

- reply

@npub17lg…9uux What language are they speaking? It's certainly not Russian. Ukrainian?

2024-06-07 07:53:20

https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/574/254/166/360/375/original/8b92a7a2ee869938.jpg

2024-06-06 05:32:40

@npub17lg…9uux Is it possible to change the location where Recall keeps its files?
Like, is it possible to create a BitLocker-encrypted virtual hard disk volume and tell Recall to keep its files there?

2024-06-05 18:25:30

- reply

@npub17lg…9uux Yeah, that's quite a lot. Thought so.

2024-06-05 14:35:01

Would anyone have problems with Recall if it worked exactly as it does now but was delivered turned off by default and displayed a clear warning about the risks involved if the user tried to turn it on?
I mean, there are probably valid use cases for it, if you know what you're doing. If I remember correctly, there is an OSINT tool that does something similar about your browser, so that you don't forget or misplace some piece of information you've stumbled upon while investigating a case.

2024-06-04 07:38:50

- reply

@npub17lg…9uux You'd need remote access as the user, in order to change policy or edit the Registry, right?

2024-05-28 19:24:25

- reply

@npub17lg…9uux Uhm, there are plenty of cyber criminals in Ukraine, too - and I don't think that they have any compunctions about attacking Russian entities right now...

2024-05-24 23:03:07

Let's replace doctors with AI, they said. It would be fine, they said...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/498/559/059/490/701/original/a50ec102d4d252cf.png

2024-05-24 21:07:12

- reply

@npub17lg…9uux You should compare to a list of all Twitter users - not to a special-interest group. There are accounts with millions of followers there and accounts with many hundreds of thousands followers are quite common.

2024-05-22 07:20:21

Red teamer tip: A Linux system with Wine installed will run Windows executables even if the files containing them don't have the executable ("x") attribute set.
It's obvious why it happens, if you think about it (the Windows executable is just data for Wine) but can be pretty surprising if you didn't think about it.
Great for attacking the user with malware delivered via the Internet (e-mail, browser, messenger, etc.).
Windows security is so bad that it even lowers Linux' security when the latter tries to emulate Windows...

2024-05-22 06:54:34

- reply

@npub17lg…9uux Is there any information how exactly the data will be stored? If it is encrypted with a key stored in the TPM module, extracting it might not be trivial.

2024-05-11 09:56:59

https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/421/857/797/087/259/original/7963ba80dcab3a12.jpg

2024-05-01 07:48:41

- reply

@npub17lg…9uux Yes, not the Windows firewall.

2024-05-01 07:45:18

- reply

@npub17lg…9uux My Windows firewall on my PC at home does not see any external attacks whatsoever.
Hint: The PC is behind a NAT router.

2024-04-30 09:53:54

"3 Physicists Use Experimental Evidence To Show CO2’s Capacity To Absorb Radiation Has Saturated":
https://notrickszone.com/2024/04/23/3-physicists-use-experimental-evidence-to-show-co2s-capacity-to-absorb-radiation-has-saturated/
Basically, they argue that more CO2 won't lead to higher temperatures; that above a certain level of saturation, CO2 stops working as a greenhouse gas.

2024-04-29 10:20:59

Organizational charts of some big software firms:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/354/004/511/622/025/original/cbe9947bc1cf05ee.jpg

2024-04-20 10:26:36

https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/303/065/936/316/147/original/64c2265347d9f86a.jpeg

2024-04-12 10:47:19

Somebody managed to coax the Gab AI chatbot to reveal its prompt:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/257/847/658/672/921/original/c2fac76033e793f6.jpg

2024-04-06 08:50:28

https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/223/415/590/023/608/original/15134678f651f0c5.jpg

2024-04-05 19:12:14

- reply

@npub1sdt…96z3 It was just 4.7, LOL. What "emergency"? It probably wouldn't even wake me up - and I live on the 5th floor. Anything below 5 is not even worth talking about.

2024-04-03 19:27:31

- reply

@npub17lg…9uux Windows 11, I assume? Here on Windows 10 the version is 3.5.2.

2024-04-02 06:26:01

Shout out to the guy at Microsoft who some intel agency embedded there a few years ago with the task of backdooring Windows and who's now scared shitless that they will start looking for him.

2024-03-31 11:11:48

- reply

@npub17lg…9uux Nahh, the thing needs sarcastic jokes and shitposting.

2024-03-30 19:37:16

Deobfuscated strings from the malicious XZ binary:
https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01
Apparently, it has a kill switch.

2024-03-30 19:19:51

Software development would be so much easier in the absence of malicious jerks...

2024-03-30 15:13:09

So, kids, what's the moral of the XZ story?
If you're going to backdoor something, make sure that your changes don't impact its performance. Nobody cares about security - but if your backdoor makes the thing half a second slower, some nerd is going to dig it up.

2024-03-30 14:21:43

3rd law of computer security:
If you run the attacker's code on your computer, that's no longer your computer.

2024-03-29 14:03:41

There is a common flaw in all conspiracy theories - they assume that the government is competent.

2024-03-28 09:17:29

- reply

@npub17lg…9uux
"‘Man-made starvation’: the obstacles to Gaza aid deliveries – visual guide":
https://www.theguardian.com/world/2024/mar/22/obstacles-to-gaza-aid-deliveries-visual-guide

2024-03-26 11:40:22

The argument between those who believe that the 2020 US Presidential election was "stolen" and those who point out that there is no credible evidence for that reminds me of the old joke about the argument between an atheist and a believer:
Atheist: "How can you believe in God without any evidence?!"
Believer: "How can you not see the evidence?!"

2024-03-08 12:16:18

- reply

@npub17lg…9uux LunaNet is a mobile network for the Moon, not for Moon-Earth communication. And the Moon is just half a light second away anyway - not 3 minutes.
It's not impossible - I once attended a one-hour lecture where the speaker talked about what needs to be done, in order to be able to have e-mail communications with Mars - but it is far from trivial and it is not "just put a Mastodon server on Mars".

2024-03-08 10:32:50

- reply

@npub17lg…9uux Dude, even sending e-mail from Mars is problematic, let alone posting on a social network.
How many TCP/IP connections can handle 3-min delays between SYN and ACK?

2024-03-06 10:37:41

"Electric Cars Emit More Particulate Pollution":
https://archive.is/1IuNM

2024-03-04 18:47:52

- reply

@npub17lg…9uux If the losses are $100m a week, a one-time payment of $22m seems like a good deal.
Now imagine if ransom payments were illegal. Their only choice would be either to break the law or to keep losing $100m a week.
(Also, one ransmware group less is actually good news. It was a very prolific one.)

2024-03-04 15:30:35

- reply

@npub1sdt…96z3 What about the other states who have done the same?
Also, I've read somewhere that at the time Lincoln had been removed from the ballot of about a dozen states.

2024-03-03 11:56:10

- reply

@npub17lg…9uux Meh, spoiled kids in rich countries... When *I* first connected to the 'net (not a real Internet but FidoNet), I had to use a 310-baud modem over a noisy phone line...
It was such a relief when somebody from Austria donated me their old MNP modem that had error-correction...

2024-02-28 20:08:27

- reply

@npub1sdt…96z3 Isn't it a branch of the federal government? It shouldn't be subject to state law.

2024-02-26 10:30:37

https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/997/316/819/156/088/original/b31b693751fe119e.jpeg

2024-02-16 20:10:26

- reply

@npub17lg…9uux Well, it's in my profile. Both here and on Xitter.

2024-02-16 19:58:23

Exqueeze me?!
(No, that link doesn't exist, of course.)
cc @npub16kz…fslh
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/942/924/064/703/573/original/a90a27c89f211f55.jpeg

2024-02-10 16:03:45

- reply

@npub17lg…9uux Starship troopers. The book, not the movie. Many people who have only seen the movie don't realize it, but the original Heinlein work was satire too.

2024-02-10 08:46:03

The cat is not allowed to climb the dining table.
The cat is absolutely not allowed to climb the dining table.
The cat knows perfectly well that it is not allowed to climb the dining table.
The cat is on the dining table.
#caturday #catsofmastodon
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/906/306/955/693/600/original/9d8aad4c9a573137.jpeg

2024-02-07 15:27:26

https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/890/900/142/342/613/original/8aeb0edc02093b4b.jpeg

2024-02-06 13:41:31

- reply

@npub1xxe…zxth
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/884/821/177/033/258/original/edd4e2088d0b577b.jpg

2024-02-03 11:21:19

- reply

@npub17lg…9uux
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/867/282/781/199/101/original/62ed11e7d8f62b1c.jpg

2024-02-01 22:14:36

Analyzing BPFDoor with strace and ltrace:
https://dfir.ch/posts/strace/

2024-01-21 18:58:16

- reply

@npub17lg…9uux BTW, www.liverpool.gov.uk is definitely not reachable from here right now - neither via HTTP, nor via HTTPS.
Maybe they have started filtering foreign IPs?

2024-01-20 08:47:43

- reply

@npub17lg…9uux You mean, they drop webshells?
The reason I asked is because I haven't seen stats of how many devices are compromised - only how many are vulnerable or how many are trying to exploit.
If the only way to detect a compromised device is to access it via the webshell, this could explain this lack of statistics - it would be essentially hacking into the device, which would be illegal.

2024-01-20 08:43:37

- reply

@npub17lg…9uux Is there a way to find remotely if an Ivanti setup has been compromised? Not just vulnerable but actually compromised?

2024-01-17 17:33:03

"Do Users Write More Insecure Code with AI Assistants?" (PDF):
https://arxiv.org/pdf/2211.03622.pdf
Spoiler: Yep.

2024-01-16 10:41:06

One month later, kitco.com still hasn't recovered fully from the ransomware attack.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/765/202/382/232/683/original/a558a48f370399b7.jpeg

2024-01-14 16:03:10

https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/755/144/873/469/501/original/ded7b27251048eb0.jpg

2024-01-13 11:05:02

- reply

@npub17lg…9uux Three days since I've notified the critical infrastructure guys here that one of their machines is vulnerable. So far, no sign that they've read my e-mail. Oh, well.

2024-01-12 08:05:54

Wait, what?!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/741/943/816/257/018/original/f8bbc12ab674e708.jpeg

2024-01-11 19:57:51

- reply

@npub143w…pykj Do you need help translating parts of the Russian document? My Russian is reasonably good.
They say that BLE sends *three* bytes of the hash, not 2. And, yes, they say that it is "generally possible to determine the phone number" but don't explain how.

2024-01-10 20:38:58

- reply

@npub17lg…9uux I just checked Bulgaria's exposure to this and there are just a handful - but, holly fuck, one of them is critical infrastructure (the power grid).

2024-01-09 12:02:38

"Avast Updates Babuk Ransomware Decryptor in Cooperation with Cisco Talos and Dutch Police":
https://decoded.avast.io/threatresearch/avast-updates-babuk-ransomware-decryptor-in-cooperation-with-cisco-talos-and-dutch-police/

2023-12-27 15:23:31

- reply

@npub17lg…9uux Nah, they must have known that going after an adversary like Kaspersky would get them eventually discovered and the exploits burnt and the only question is when and how much useful info they would get before it happened.

2023-12-26 20:11:57

- reply

@npub1zj4…fyjh Why the fuck would one put cameras in such places to begin with?!

2023-12-24 11:43:08

https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/635/206/551/842/763/original/23037b8fa4c9187e.jpeg

2023-12-22 11:05:37

- reply

@npub17lg…9uux I think they truncate them and put a "read more" link that you have to click, in order to read the whole thing. This annoyed me on Twitter, when it introduced the capability and I don't want to annoy others with it here.

2023-12-22 11:03:46

- reply

@npub17lg…9uux Well, it's quite long. And not all Mastodon instances support long toots.

2023-12-22 10:57:49

Dear journalists (a rant),