VessOnSecurity

Anti-virus, malware and infosec expert, crypto amateur, privacy advocate and general annoyance.

PGP keyID: 0x365697c632dd98d9

Public Key

npub1jw3gppe8mxtdd5szxpvakxg9s00kdxqmdmp7x5v84w0urnyw3y5qn2d3q7

NIP-05 Address

bontchev_at_infosec.exchange@mostr.pub

Profile Code

nprofile1qqsf8g5qsunan9kk6gprqkwmryzc8hmxnqdkaslr2xr6h87pej8gj2qpz4mhxue69uhhyetvv9ujumt0wd68ytnsw43qndsfh8

Publishing to

relay.mostr.pub

Author Public Key

npub1jw3gppe8mxtdd5szxpvakxg9s00kdxqmdmp7x5v84w0urnyw3y5qn2d3q7

Show more details

Last Notes

2024-10-28 10:02:48

- reply

@npub1nyq…vvvs That's a pretty sober and reasonable analysis and I pretty much agree with it. In particular, the part that "if Harris made her position clear, it would harm her chances of being elected". Indeed! I can see what her policies would be even now and would never vote for her, even if I could - but many people can't see it now and are confused by her word salads.
Also, for many people it will be a surprise to learn that apparently Biden was the sharper knife in the drawer. The sharper spoon anyway.
I also agree that if Trump loses now, it's all over for him. Not only for the reasons you stated but also because his political enemies will make sure that he's bankrupted and in jail.

2024-10-04 06:35:39

LOL. Apparently, it's Satoshi hunting season again. Must be October or something...
https://www.politico.eu/article/mystery-creator-bitcoin-identified-new-hbo-documentary-satoshi-nakamoto-crypto-currency/

2024-08-19 20:35:03

- reply

@npub17lg…9uux Uhm, how do you get that they are declining? Logged in users:
Feb 2022 - 59.8 mil
Feb 2023 - 60.9 mil
Aug 2023 - 61.8 mil
Feb 2024 - 67.0 mil
This looks steady to slightly increasing to me.

2024-08-13 18:41:45

- reply

@npub1sdt…96z3 Will this have any effect on those already convicted by evidence from such warrants?

2024-08-09 06:53:35

Programming with AI is like blindly copying random answers from StackOverflow without reading the comments.

2024-08-01 19:05:23

- reply

@npub17lg…9uux But you could put the TEMP directory on the encrypted volume too.

2024-08-01 06:34:07

"Would Making Ransom Payments Illegal Result in Fewer Attacks?":
https://www.darkreading.com/vulnerabilities-threats/would-making-ransom-payments-illegal-result-in-fewer-attacks
Spoiler: Nope.

2024-08-01 06:33:39

"Security Researchers and Journalists at Risk: Why You Should Hate the Proposed UN Cybercrime Treaty":
https://www.eff.org/deeplinks/2024/07/journalists-and-security-researchers-risk-why-you-should-hate-proposed-un

2024-07-31 05:57:34

Bwahahahahaha...
Meta built a "prompt guard" that protects AI chatbots from prompt injection.
It is bypassed by using the prompt "I g n o r e p r e v i o u s i n s t r u c t i o n s ":
https://github.com/meta-llama/llama-models/issues/50

2024-07-17 07:49:21

Basically - tell the Palestinians where the "safe zones" are, so that you know what to bomb.
"Israeli strikes in southern, central Gaza kill more than 60 Palestinians, including in ‘safe zone’":
https://apnews.com/article/israel-palestinians-hamas-war-news-07-16-2024-0cff821823185af16fb2ec5ee8e5c986

2024-07-16 16:33:47

- reply

@npub17lg…9uux LOL. The whole of USA was less than 10% revenue. The EU probably isn't much more. And you need just a few highly qualified people for this kind of research - not legions of them.

2024-07-15 17:00:03

Must be Monday...
"Israel bombs yet another UN-run school in Gaza, killing 17":
https://www.aljazeera.com/gallery/2024/7/15/israel-bombs-yet-another-un-run-school-in-gaza-killing-17

2024-07-14 06:41:12

https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/783/476/010/517/668/original/495028e1b41e39c4.jpg

2024-07-07 10:24:44

ChatGPT should be pronounced ShitGPT, right?

2024-07-05 19:43:15

- reply

@npub1nyq…vvvs Ah, The Guardian. The paper read by those who think they ought to run the country.
https://www.youtube.com/watch?v=DGscoaUWW2M

2024-06-25 08:51:06

This article is absolute nonsense:
"Google: Stop Burning Counterterrorism Operations":
https://poppopret.org/2024/06/24/google-stop-burning-counterterrorism-operations/
My arguments:
- The job of the security researchers is to find security flaws, attackers exploiting them, etc.
- The job of the spies to the spy.
- The job of those doing counter-terrorism is to fight terrorists.
Do your job and stop complaining about the other people who are doing their job.

2024-06-22 05:22:42

Can confirm from personal experience, programming with AI is exactly like this.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/658/595/984/274/206/original/be0fbb9851255c98.png

2024-06-21 05:17:36

https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/652/914/050/100/421/original/b05d783f0f4f84c1.jpeg

2024-06-20 06:23:52

- reply

@npub15zu…s7lx Unsurprisingly, the motivation is money:
https://balkaninsight.com/2023/09/25/who-benefits-inside-the-eus-fight-over-scanning-for-child-sex-content/

2024-06-19 07:29:25

- reply

@npub1vz5…qdta Maybe it was a joke? Anyway, people are now posting similar things on Twitter, which are obviously jokes:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/642/107/816/096/871/original/583b820fcf8e5adf.jpeg

2024-06-12 16:02:07

- reply

@npub1lzz…jhl3 What are you confused about? You don't know that Biden is the US President and Trump is a US Presidential Candidate?

2024-06-09 21:03:21

- reply

@npub17lg…9uux What language are they speaking? It's certainly not Russian. Ukrainian?

2024-06-07 07:53:20

https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/574/254/166/360/375/original/8b92a7a2ee869938.jpg

2024-06-06 05:32:40

@npub17lg…9uux Is it possible to change the location where Recall keeps its files?
Like, is it possible to create a BitLocker-encrypted virtual hard disk volume and tell Recall to keep its files there?

2024-06-05 18:25:30

- reply

@npub17lg…9uux Yeah, that's quite a lot. Thought so.

2024-06-05 14:35:01

Would anyone have problems with Recall if it worked exactly as it does now but was delivered turned off by default and displayed a clear warning about the risks involved if the user tried to turn it on?
I mean, there are probably valid use cases for it, if you know what you're doing. If I remember correctly, there is an OSINT tool that does something similar about your browser, so that you don't forget or misplace some piece of information you've stumbled upon while investigating a case.

2024-06-04 07:38:50

- reply

@npub17lg…9uux You'd need remote access as the user, in order to change policy or edit the Registry, right?

2024-05-28 19:24:25

- reply

@npub17lg…9uux Uhm, there are plenty of cyber criminals in Ukraine, too - and I don't think that they have any compunctions about attacking Russian entities right now...

2024-05-24 23:03:07

Let's replace doctors with AI, they said. It would be fine, they said...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/498/559/059/490/701/original/a50ec102d4d252cf.png

2024-05-24 21:07:12

- reply

@npub17lg…9uux You should compare to a list of all Twitter users - not to a special-interest group. There are accounts with millions of followers there and accounts with many hundreds of thousands followers are quite common.

2024-05-22 07:20:21

Red teamer tip: A Linux system with Wine installed will run Windows executables even if the files containing them don't have the executable ("x") attribute set.
It's obvious why it happens, if you think about it (the Windows executable is just data for Wine) but can be pretty surprising if you didn't think about it.
Great for attacking the user with malware delivered via the Internet (e-mail, browser, messenger, etc.).
Windows security is so bad that it even lowers Linux' security when the latter tries to emulate Windows...

2024-05-22 06:54:34

- reply

@npub17lg…9uux Is there any information how exactly the data will be stored? If it is encrypted with a key stored in the TPM module, extracting it might not be trivial.

2024-05-11 09:56:59

https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/421/857/797/087/259/original/7963ba80dcab3a12.jpg

2024-05-01 07:48:41

- reply

@npub17lg…9uux Yes, not the Windows firewall.

2024-05-01 07:45:18

- reply

@npub17lg…9uux My Windows firewall on my PC at home does not see any external attacks whatsoever.
Hint: The PC is behind a NAT router.

2024-04-30 09:53:54

"3 Physicists Use Experimental Evidence To Show CO2’s Capacity To Absorb Radiation Has Saturated":
https://notrickszone.com/2024/04/23/3-physicists-use-experimental-evidence-to-show-co2s-capacity-to-absorb-radiation-has-saturated/
Basically, they argue that more CO2 won't lead to higher temperatures; that above a certain level of saturation, CO2 stops working as a greenhouse gas.

2024-04-29 10:20:59

Organizational charts of some big software firms:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/354/004/511/622/025/original/cbe9947bc1cf05ee.jpg

2024-04-20 10:26:36

https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/303/065/936/316/147/original/64c2265347d9f86a.jpeg

2024-04-12 10:47:19

Somebody managed to coax the Gab AI chatbot to reveal its prompt:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/257/847/658/672/921/original/c2fac76033e793f6.jpg

2024-04-06 08:50:28

https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/223/415/590/023/608/original/15134678f651f0c5.jpg

2024-04-05 19:12:14

- reply

@npub1sdt…96z3 It was just 4.7, LOL. What "emergency"? It probably wouldn't even wake me up - and I live on the 5th floor. Anything below 5 is not even worth talking about.

2024-04-03 19:27:31

- reply

@npub17lg…9uux Windows 11, I assume? Here on Windows 10 the version is 3.5.2.

2024-04-02 06:26:01

Shout out to the guy at Microsoft who some intel agency embedded there a few years ago with the task of backdooring Windows and who's now scared shitless that they will start looking for him.

2024-03-31 11:11:48

- reply

@npub17lg…9uux Nahh, the thing needs sarcastic jokes and shitposting.

2024-03-30 19:37:16

Deobfuscated strings from the malicious XZ binary:
https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01
Apparently, it has a kill switch.

2024-03-30 19:19:51

Software development would be so much easier in the absence of malicious jerks...

2024-03-30 15:13:09

So, kids, what's the moral of the XZ story?
If you're going to backdoor something, make sure that your changes don't impact its performance. Nobody cares about security - but if your backdoor makes the thing half a second slower, some nerd is going to dig it up.

2024-03-30 14:21:43

3rd law of computer security:
If you run the attacker's code on your computer, that's no longer your computer.

2024-03-29 14:03:41

There is a common flaw in all conspiracy theories - they assume that the government is competent.

2024-03-28 09:17:29

- reply

@npub17lg…9uux
"‘Man-made starvation’: the obstacles to Gaza aid deliveries – visual guide":
https://www.theguardian.com/world/2024/mar/22/obstacles-to-gaza-aid-deliveries-visual-guide

2024-03-26 11:40:22

The argument between those who believe that the 2020 US Presidential election was "stolen" and those who point out that there is no credible evidence for that reminds me of the old joke about the argument between an atheist and a believer:
Atheist: "How can you believe in God without any evidence?!"
Believer: "How can you not see the evidence?!"

2024-03-08 12:16:18

- reply

@npub17lg…9uux LunaNet is a mobile network for the Moon, not for Moon-Earth communication. And the Moon is just half a light second away anyway - not 3 minutes.
It's not impossible - I once attended a one-hour lecture where the speaker talked about what needs to be done, in order to be able to have e-mail communications with Mars - but it is far from trivial and it is not "just put a Mastodon server on Mars".

2024-03-08 10:32:50

- reply

@npub17lg…9uux Dude, even sending e-mail from Mars is problematic, let alone posting on a social network.
How many TCP/IP connections can handle 3-min delays between SYN and ACK?

2024-03-06 10:37:41

"Electric Cars Emit More Particulate Pollution":
https://archive.is/1IuNM

2024-03-04 18:47:52

- reply

@npub17lg…9uux If the losses are $100m a week, a one-time payment of $22m seems like a good deal.
Now imagine if ransom payments were illegal. Their only choice would be either to break the law or to keep losing $100m a week.
(Also, one ransmware group less is actually good news. It was a very prolific one.)

2024-03-04 15:30:35

- reply

@npub1sdt…96z3 What about the other states who have done the same?
Also, I've read somewhere that at the time Lincoln had been removed from the ballot of about a dozen states.

2024-03-03 11:56:10

- reply

@npub17lg…9uux Meh, spoiled kids in rich countries... When *I* first connected to the 'net (not a real Internet but FidoNet), I had to use a 310-baud modem over a noisy phone line...
It was such a relief when somebody from Austria donated me their old MNP modem that had error-correction...

2024-02-28 20:08:27

- reply

@npub1sdt…96z3 Isn't it a branch of the federal government? It shouldn't be subject to state law.

2024-02-26 10:30:37

https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/997/316/819/156/088/original/b31b693751fe119e.jpeg

2024-02-16 20:10:26

- reply

@npub17lg…9uux Well, it's in my profile. Both here and on Xitter.

2024-02-16 19:58:23

Exqueeze me?!
(No, that link doesn't exist, of course.)
cc @npub16kz…fslh
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/942/924/064/703/573/original/a90a27c89f211f55.jpeg

2024-02-10 16:03:45

- reply

@npub17lg…9uux Starship troopers. The book, not the movie. Many people who have only seen the movie don't realize it, but the original Heinlein work was satire too.

2024-02-10 08:46:03

The cat is not allowed to climb the dining table.
The cat is absolutely not allowed to climb the dining table.
The cat knows perfectly well that it is not allowed to climb the dining table.
The cat is on the dining table.
#caturday #catsofmastodon
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/906/306/955/693/600/original/9d8aad4c9a573137.jpeg

2024-02-07 15:27:26

https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/890/900/142/342/613/original/8aeb0edc02093b4b.jpeg

2024-02-06 13:41:31

- reply

@npub1xxe…zxth
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/884/821/177/033/258/original/edd4e2088d0b577b.jpg

2024-02-03 11:21:19

- reply

@npub17lg…9uux
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/867/282/781/199/101/original/62ed11e7d8f62b1c.jpg

2024-02-01 22:14:36

Analyzing BPFDoor with strace and ltrace:
https://dfir.ch/posts/strace/

2024-01-21 18:58:16

- reply

@npub17lg…9uux BTW, www.liverpool.gov.uk is definitely not reachable from here right now - neither via HTTP, nor via HTTPS.
Maybe they have started filtering foreign IPs?

2024-01-20 08:47:43

- reply

@npub17lg…9uux You mean, they drop webshells?
The reason I asked is because I haven't seen stats of how many devices are compromised - only how many are vulnerable or how many are trying to exploit.
If the only way to detect a compromised device is to access it via the webshell, this could explain this lack of statistics - it would be essentially hacking into the device, which would be illegal.

2024-01-20 08:43:37

- reply

@npub17lg…9uux Is there a way to find remotely if an Ivanti setup has been compromised? Not just vulnerable but actually compromised?

2024-01-17 17:33:03

"Do Users Write More Insecure Code with AI Assistants?" (PDF):
https://arxiv.org/pdf/2211.03622.pdf
Spoiler: Yep.

2024-01-16 10:41:06

One month later, kitco.com still hasn't recovered fully from the ransomware attack.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/765/202/382/232/683/original/a558a48f370399b7.jpeg

2024-01-14 16:03:10

https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/755/144/873/469/501/original/ded7b27251048eb0.jpg

2024-01-13 11:05:02

- reply

@npub17lg…9uux Three days since I've notified the critical infrastructure guys here that one of their machines is vulnerable. So far, no sign that they've read my e-mail. Oh, well.

2024-01-12 08:05:54

Wait, what?!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/741/943/816/257/018/original/f8bbc12ab674e708.jpeg

2024-01-11 19:57:51

- reply

@npub143w…pykj Do you need help translating parts of the Russian document? My Russian is reasonably good.
They say that BLE sends *three* bytes of the hash, not 2. And, yes, they say that it is "generally possible to determine the phone number" but don't explain how.

2024-01-10 20:38:58

- reply

@npub17lg…9uux I just checked Bulgaria's exposure to this and there are just a handful - but, holly fuck, one of them is critical infrastructure (the power grid).

2024-01-09 12:02:38

"Avast Updates Babuk Ransomware Decryptor in Cooperation with Cisco Talos and Dutch Police":
https://decoded.avast.io/threatresearch/avast-updates-babuk-ransomware-decryptor-in-cooperation-with-cisco-talos-and-dutch-police/

2023-12-27 15:23:31

- reply

@npub17lg…9uux Nah, they must have known that going after an adversary like Kaspersky would get them eventually discovered and the exploits burnt and the only question is when and how much useful info they would get before it happened.

2023-12-26 20:11:57

- reply

@npub1zj4…fyjh Why the fuck would one put cameras in such places to begin with?!

2023-12-24 11:43:08

https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/635/206/551/842/763/original/23037b8fa4c9187e.jpeg

2023-12-22 11:05:37

- reply

@npub17lg…9uux I think they truncate them and put a "read more" link that you have to click, in order to read the whole thing. This annoyed me on Twitter, when it introduced the capability and I don't want to annoy others with it here.

2023-12-22 11:03:46

- reply

@npub17lg…9uux Well, it's quite long. And not all Mastodon instances support long toots.

2023-12-22 10:57:49

Dear journalists (a rant),

2023-12-19 22:20:13

- reply

@npub17lg…9uux @npub1jah…0scu It's not gone wrong, it's a race condition. Both the FBI and the perps have the keys to the onion side. Whoever announces first wins. Expect this to go back and forth for a while.

2023-12-17 09:56:05

An LLM is just a parrot with a huge dictionary.

2023-12-15 12:24:52

- reply

@npub1f6a…pnql BTW, does this affect only the paid customers? I don't have such a setting at all in my account.

2023-11-30 12:49:01

- reply

@npub17lg…9uux Hm. In order to attach a device, you need a physical access to the machine. But if you already have that, you can get SYSTEM by using the sticky keys trick.

2023-11-26 13:47:12

- reply

@npub1zj4…fyjh Good. The last thing we need is yet another level of EU bureaucracy.

2023-11-20 19:53:49

- reply

@npub17lg…9uux Can confirm. A good friend of mine spent decades at Microsoft, building anti-virus teams in Ireland and Germany, only to see them destroyed by internal corporate politics and reorganizations... Destroyed her health too - she had to retire early with 30% disability.

2023-11-10 07:54:12

Lulz. The website of a company whose business is protecting from DDoS attacks is downed by a DDoS attack:
"Cloudflare website downed by DDoS attack claimed by Anonymous Sudan":
https://www.bleepingcomputer.com/news/technology/cloudflare-website-downed-by-ddos-attack-claimed-by-anonymous-sudan/

2023-11-06 09:46:09

I normally use Opera as my browser but it somehow got fucked up lately - I can't use it on YouTube and many other sites. I can't watch videos, can't scroll, etc.
Opening the site in a private window shows what the problem is - the site shows a modal pop-up dialog (usually - a cookie consent) that waits for me to click on one of the buttons. But in normal mode something hides the dialog without actually removing it - so something I don't see still waits me to click on something that's not there.
Clicking it in a private window is pointless, because the fact that I've clicked is stored in a cookie - and cookies are deleted when a private window is closed, so it is not remembered in normal mode.
At first I thought that it was caused by my ad blocked (uBlock Origin) or some other privacy-related extension (I Don't Care About Cookies, Disconnect, etc.) - but the problem persists even if I disable every single extension. Also, other browsers with pretty much the same extensions installed (Brave, Edge) don't have this problem.
Does anyone know what might be causing it? Currently I am forced to switch to Brave and it is quite similar but different in some places - just enough to be annoying. (BTW native ad blocking in Brave sucks; I had to install uBlock Origin there too.)

2023-11-02 07:36:01

"Researcher Claims to Crack RSA-2048 With Quantum Computer":
https://www.bankinfosecurity.com/blogs/researcher-claims-to-crack-rsa-2048-quantum-computer-p-3536
Gerck said all his "QC computations were done in a commercial cellphone, or a commercial Linux desktop," at a capital cost of less than $1,000. "No cryogenics or special materials were used."
Well, I'd like to see a more tangible proof of these tall claims...

2023-10-29 09:42:37

We have local elections (for mayors and other local administration) in Bulgaria today.
The Central Electoral Commission (the body governing the elections) has issued an order that essentially boils down to "No fucking electronic voting machines anywhere; pen and paper only!".
The reason behind this order is because DANS, our state security agency (something like a combination of the FBI and the NSA) has refused to certify the machines as "safe".
Not sure what brand of voting machines were used in earlier elections but I've read somewhere that they were "the same as in Venezuela", so probably Diebold.
The idea was floated for my Lab to certify the machines but I advised the boss to answer with a polite version of "No fucking way!", since this is more of a political issue than a technical one.

2023-10-26 18:05:54

- reply

@npub17lg…9uux This is a joke, right?
If not, surely you can do better than forcing the user to edit manually the IP to scan each time? Although bonus points for requesting only the header response.
If one doesn't mind actually exploiting the vulnerability for the purpose of scanning (I do), a more professional one can be found here:
https://github.com/Chocapikk/CVE-2023-4966

2023-10-17 11:25:20

LOL. The latest version of the Python package manager "pip" is buggy and barfs with an error message.
https://github.com/pypa/pip/issues/12357

2023-10-17 10:16:05

- reply

@npub17lg…9uux It is. If you get a new iPhone, you have to log in with your AppleID to recover everything saved in the cloud, including the passkeys.

2023-10-17 09:55:42

- reply

@npub17lg…9uux Well, at least for now, the passkeys backed up to the cloud are end-to-end encrypted.

2023-10-15 09:43:05

- reply

@npub17lg…9uux Why has Egypt closed the border? They probably don't want refugees flooding in - but why not at least let humanitarian aid into Gaza to help fellow Arabs?

2023-10-14 11:55:37

- Patch Tuesday
- Drama Wednesday
- PoC Thursday
- Ransomware Friday
- Panic Saturday
- Overtime Sunday
- Fuck Monday