SECURITY NEWS THREAD

Last one reached thread limit US intelligence agency wants SURVEILLANCE UNDERWEAR that can collect video, audio and geolocation data https://theintercept.com/2023/09/02/smart-epants-wearable-technology/

What's the point of this image?

>>22534 Article doesn't even mention underwear, just smart pants. The intercept is becoming a tabloid. Hard to take them seriously after the Reality Winner fuarrrk up.

>IARPA contracts for the SMART ePANTS program have gone to five entities. As the Pentagon disclosed this month along with other contracts it routinely announces, IARPA has awarded $11.6 million and $10.6 million to defense contractors Nautilus Defense and Leidos, respectively. So this is money laundering, right?

https://www.securityweek.com/apple-patches-3-zero-days-likely-exploited-by-spyware-vendor-to-hack-iphones/

https://www.bleepingcomputer.com/news/security/us-and-japan-warn-of-chinese-hackers-backdooring-cisco-routers/

>>22534 X.org Hit By New Security Vulnerabilities - Two Date Back To 1988 With X11R2 I think this ""only"" affects libx11 and not the Xorg server. https://www.phoronix.com/news/XOrg-Vulnerabilities-Since-1988 CVE-2023-4911: Looney Tunables – Local Privilege Escalation in the glibc’s ld.so >"discovered a buffer overflow vulnerability in GNU C Library’s dynamic loader’s processing of the GLIBC_TUNABLES environment variable." https://blog.qualys.com/vulnerabilities-threat-research/2023/10/03/cve-2023-4911-looney-tunables-local-privilege-escalation-in-the-glibcs-ld-so https://nvd.nist.gov/vuln/detail/CVE-2023-4911 Before you ask, Musl is not affected. Form the qualys article: "It’s likely that other distributions are similarly susceptible, although we’ve noted that Alpine Linux remains an exception due to its use of musl libc instead of glibc.". Void, Gentoo and Alpine have musl versions of the OS. ( TODO: find out what Snap packages and Flatpak packages still use the affected versions of libraries. ) A Robot vacuum recorded a woman on the toilet. How did screenshots end up on Facebook? >In the fall of 2020, gig workers in Venezuela posted a series of images to online forums where they gathered to talk shop. The photos were mundane, if sometimes intimate, household scenes captured from low angles—including some you really wouldn't want shared on the Internet. >In one particularly revealing shot, a young woman in a lavender T-shirt sits on the toilet, her shorts pulled down to mid-thigh. >The images were not taken by a person, but by development versions of iRobot's Roomba J7 series robot vacuum. They were then sent to Scale AI, a startup that contracts workers around the world to label audio, photo, and video data used to train artificial intelligence. https://www.technologyreview.com/2022/12/19/1065306/roomba-irobot-robot-vacuums-artificial-intelligence-training-data-privacy/ I'm now more paranoid than ever about IoT! The WebP 0day >CVE-2023-4863, was a heap buffer overflow in the WebP image library >"Google is aware that an exploit for CVE-2023-4863 exists in the wild." https://blog.isosceles.com/the-webp-0day/ 90s Vulns In 90s Software (Exim) - Is the Sky Falling? https://labs.watchtowr.com/exim-0days-90s-vulns-in-90s-software/ Defining the memory safe problem Good article. https://alexgaynor.net/2023/oct/02/defining-the-memory-safety-problem/ The Terminal Escapes: Engineering unexpected execution from command line interfaces ( Your terminal emulator can be potentially compromised with ASCII control chars. ) https://www.gresearch.com/blog/article/g-research-the-terminal-escapes/

Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11 >https://github.com/curl/curl/discussions/12026

23andMe Cyberbreach Exposes DNA Data, Potential Family Ties On Oct. 1, a post was published on the forum with a link to a sample of allegedly “20 million pieces of data” from the genetic testing company, claiming that it was “the most valuable data you’ll ever see.” The first leak included 1 million lines of data, but on Oct. 4, the threat actor began offering bulk data profiles ranging from $1 to $10 per account in batches of 100, 1,000, 10,000, and 100,000 profiles. The information leaked in the breach includes names, usernames, profile photos, gender, birthdays, geographical location, and genetic ancestry results. https://www.databreaches.net/23andme-cyberbreach-exposes-dna-data-potential-family-ties/

Google Proposes New mseal() Memory Sealing Syscall For Linux >https://www.phoronix.com/news/Linux-mseal-Memory-Sealing Linus' response: https://lore.kernel.org/lkml/CAHk-=whFZoap+DBTYvJx6ohqPwn11Puzh7q4huFWDX9vBwXHgg@mail.gmail.com/ Theo de Raadt's response to Linus: https://lore.kernel.org/lkml/55960.1697566804@cvs.openbsd.org/ Why not just copy mimmutable(2) from OpenBSD? >https://man.openbsd.org/amd64/mimmutable.2 It's simply: int mimmutable(void *addr, size_t len); P.S. pledge(2) and unveil(2) should be copied to Linux! They are just so simple to use (and people would start using them because of that!) OpenBSD's built-in memory leak detection >https://www.drijf.net/malloc/ Another reason to port your C and C++ programs to OpenBSD!

Happening: quite a bit of the workings of LockBit Ransomware Group are being exposed in the coming days (Febuary 21-23). Short summary: Information regarding money operations, affiliate infrastructure, various tools, etc. will be released. The back end has been pwnd, including source code. Info via VX-Underground Twitter: https://nitter.mint.lgbt/vxunderground/status/1759953386756006043#m https://www.databreaches.net/developing-lockbit-disrupted-by-law-enforcement/

KeyTrap This is old news but... New-ish DNS (actually DNSSEC) vulnerability released. It affects all server programs that use DNSSEC, since the bug is in the spec itself. >https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50387 >https://www.athene-center.de/en/keytrap (I recommend you read the PDF report.) >https://www.potaroo.net/ispcol/2024-03/keytrap.html Tor project introduces WebTunnel (a new type of Tor bridge) It mimics regular HTTPS traffic to avoid detection. >https://blog.torproject.org/introducing-webtunnel-evading-censorship-by-hiding-in-plain-sight/ R*ddit will start selling data to Google Google will use the data to train their AI. >https://www.theverge.com/2024/2/22/24080165/google-reddit-ai-training-data

GoFetch : Breaking Constant-Time Cryptographic Implementations Using Data Memory-Dependent Prefetchers Overview >GoFetch is a microarchitectural side-channel attack that can extract secret keys from constant-time cryptographic implementations via data memory-dependent prefetchers (DMPs). >We show that DMPs are present in many Apple CPUs and pose a real threat to multiple cryptographic implementations, allowing us to extract keys from OpenSSL Diffie-Hellman, Go RSA, as well as CRYSTALS Kyber and Dilithium. In other words, taken from wikipedia, >GoFetch is a family of cryptographic attacks on recent Apple silicon CPUs that exploits the CPU's on-chip data memory-dependent prefetcher (DMP) to investigate the contents of memory. CPUs affected include the M1, M2, M3 and A14 series system-on-a-chip processors. Note that the attacks are theoretically possible on Intel's Alder Lake CPUs, but it's unreliable at best on those platforms and unproven if possible. >The authors of GoFetch state that they were unable to make their exploit work on the Intel Raptor Lake processor they tested due to its more limited DMP functionality. TL;DR Researchers found an attack akin to Specter, but on Apple Silicon CPUs. This time, they got a really cute mascot :) Sources https://gofetch.fail/ https://en.wikipedia.org/wiki/GoFetch

>>22534 >NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary code via a bug that is unrelated to memory corruption. https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-29937 >Flipping Pages: An analysis of a new Linux vulnerability in nf_tables and hardened exploitation techniques https://pwning.tech/nftables/

Backdoor in upstream xz/liblzma leading to ssh server compromise >After observing a few odd symptoms around liblzma >(part of the xz package) on >Debian sid installations over the last weeks (logins with >ssh taking a lot of >CPU, valgrind errors) I figured out the answer: > >The upstream xz repository and the xz tarballs have >been backdoored. > >At first I thought this was a compromise of debian's package, but it turns out >to be upstream. https://www.openwall.com/lists/oss-security/2024/03/29/4 Damn.

>>23710 Also worth noting it's because OpenSSH got patched for some systemd bullshit. So non-systemd distributions are most likely not affected since the exploit seems to target sshd only.

>>23710 Holy soykaf. Thank god I don't use systemd. Also, this isn't a great look on the maintainers: https://github.com/tukaani-project/xz/commit/af071ef7702debef4f1d324616a0137a5001c14c

>>23710 The same account has "contributed" to libarchive also! >https://github.com/libarchive/libarchive/commit/e37efc16c8665f405182dd77eb1bbb32376f5484 read the commit message.

>>23710 My goal isn't to spread any FUD, but imo for now distros running newer versions like arch aren't safe to use. If there's any active malicious code (unknown) still in the package, the time for the bad actor to try and get anything out of it is RIGHT NOW before their backdoor is completely gone. I'd refrain from using these systems for now just in case.

>>23710 I found a good article about the backdoor. >https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27 Apparently, the backdoor won't be active if all these 3-4 conditions aren't met: 1) you need a backdoored version of xz utils/liblzma. 2) you need to use systemd. 3) you need to have OpenSSH server patched with ability to use systemd-notify 4) you likely also maybe need to use glibc as your system libc?? I'm not 100% sure. But keep in mind that there aren't any throughout analysis of the backdoor yet! Here is a write up about the events that lead to the backdoor getting added: https://boehs.org/node/everything-i-know-about-the-xz-backdoor

>>23734 Haven't updated my system in years, I should be fine right?

LINUX HAD SSH BACKDOORS FOR THE LAST YEARS STOP USING IT following questions >is whonix ok, route it through tor? or not because tor is c1a-occupied? >can we still use apple or its insecure even if the only apps you use on an iphone are proton and signal, by the very means of the fact that its apple?

I'll preach some words of caution regarding XZ being backdoored, but They are applicable to any vuln that have been discovered, really. Update your threat model and review it to see if it is still necessary after a couple months or when you hear more positive development. >>23736 Likely safe. The more recent your xz/liblzma version is (if used), the more prone you are to have the backdoor. I don't know where to look for when it got first commited so I can't tell which versions at which date are generally fine. >>23747 >is whonix ok IMO, The most recent versions of whonix are most likely released with the vulnerability since whonix uses systemd. >can we still use apple Unsure. I lean on it being safe to use still. because of the specific requirements layed out by >>23734 and also because I can't identify how the backdoor would be used on apple phones and regular apple machines used by the common man. From what I know, correct me if i'm wrong, It targets the SSH protocol. I don't know why you would use SSH on your phone unless it is used for IoT products. Or for interfacing with your computer/server. (Something I used to do) I don't know how you could use that CVE through signal/proton if it is possible to. The machines most prone to this CVE are machines that uses (or, to an extent, can use) SSH under a specific set of conditions. (From my understanding) (Sage because my post isn't specifically news worthy)

>>23747 >LINUX HAD SSH BACKDOORS FOR THE LAST YEARS STOP USING IT Correction: Only systemd users did.

>>23748 No, this is stupid. Whonix bases off debian stable. Debian stable wasn't affected by the disclosed backdoor. And if there were more malicious commits, they would have likely been found by now.

>>23750 My mistake. I just looked up if whonix uses systemd, based my answer from there and assumed the worst. I don't use that distro nor do i know it that well beyond the idea of it.

SSSL - Hackless SSL bypass for the Wii U Source: https://github.com/PretendoNetwork/SSSL >On March 1, 2021 Nintendo released Wii U firmware version 5.5.5. This update updated the Wii U's SSL verification and recompiled all RPLs (though no code changes were made). The exact purpose for this update is unknown, as nothing of significance was changed, and no other changes were made in this update. With the changes to SSL verification, Nintendo introduced a bug which allows for the forging of SSL certificates. These forged certificates will be seen as "Nintendo Signed" and, due to an existing bug with how the Wii U handles CA common names, will be accepted by all domains. What can it do in a practical application? Source: https://pretendo.network/blog/4-8-24 >Found by our very own shutterbug, this exploit allows users to connect to Pretendo Network from a stock Wii U, with no homebrew or custom firmware at all; only a DNS change! >[...] Select services which use their own SSL libraries are unsupported. This includes several 3rd-party titles like WATCH_DOGS and YouTube, as well as titles which run in an embedded browser like TVii, the eShop, and the Miiverse applet. Miiverse functionality IN GAMES is still supported through SSSL! >SSSL is only available for Wii U systems running firmware version 5.5.5 or higher. SSSL is not available for 3DS users. TL;DR An SSL cert. forgery exploit was discovered back in October of 2021 in firmware patch 5.5.5 and onward for the WiiU. The searchers involved held onto the exploit until support for the system was discontinued. With this, stock WiiU consoles, in this instance, are now able access third party servers. Reviving online support for the console without the need to mod/install homebrew on the console.

In case Lainons have been living under a rock for the past 8 hours, major computer outages and service interruptions including to airlines, medical, and ISPs https://en.wikipedia.org/wiki/2024_CrowdStrike_incident

Microsoft seems to have successfully avoided their part of the blame for the Crowdstrike disaster. Yes, it was a software error by Crowdstrike that caused the bluescreens all over the world. But the practice of pushing out mandatory updates all at once without asking made it almost inevitable that something like this would happen, and will probably happen again.

>>24445 > [...] their part of the blame I just don't think they have any blame, and it's not realistic or fair for people to expect MS to vet every single EDR driver. I'm not saying you in particular think this, but it's a common sentiment being passed around right now. Do we really want to live in a world where one single team at MS has ultimate authority over all drivers? They already can barely run MSRC competently and only seldomly update their blacklisted driver list. > But the practice of pushing out mandatory updates all at once without asking made it almost inevitable that something like this would happen and will probably happen again. I could not agree more. This is the problem with software that updates all clients simultaneously, like you said, and I agree that this was inevitable. This will absolutely happen again if companies don't change the deployment architecture. Unfortunately, CrowdStrike drew the short straw. Even more unfortunate is the sheer breadth of reach CS has which made this much, much worse.

Windows July security updates send PCs into BitLocker recovery >Microsoft warned that some Windows devices will boot into BitLocker recovery after installing the July 2024 Windows security updates. Source : https://www.bleepingcomputer.com/news/microsoft/windows-july-security-updates-send-pcs-into-bitlocker-recovery/ July Windows Server updates break Remote Desktop connections >Microsoft has confirmed that July's security updates break remote desktop connections in organizations where Windows servers are configured to use the legacy RPC over HTTP protocol in the Remote Desktop Gateway. Source : https://www.bleepingcomputer.com/news/microsoft/july-windows-server-updates-break-remote-desktop-connections/ I learned about the first news at work when some employee entered my office with their personal PC asked me to help/guide em thru the steps. Poor lad was panicking about it. At least we were able to get the key from their M$ acc but imagine if you never had one. Proves that M$ don't need a third party to fuarrrk up their own OS lmao. Not surprised, just disappointed.

https://www.reuters.com/world/europe/telegram-messaging-app-ceo-pavel-durov-arrested-france-tf1-tv-says-2024-08-24/ >PARIS, Aug 24 (Reuters) - Pavel Durov, billionaire founder and CEO of the Telegram messaging app was arrested at the Bourget airport outside Paris on Saturday evening, TF1 TV and BFM TV said, citing unnamed sources. >Durov was travelling aboard his private jet, TF1 said on its website, adding he had been targeted by an arrest warrant in France as part of a preliminary police investigation. >TF1 and BFM both said the investigation was focused on a lack of moderators on Telegram, and that police considered that this situation allowed criminal activity to go on undeterred on the messaging app. Is it over for Telegram for real this time? Will the government backdoor it to surveil "criminals?"

>>24633 News like these tend to turn the platform into a honeypot effective weeks before their release, but it's not like Telegram was safe to begin with. This is just law enforcement getting lazy.

>>24633 Telegram is backdoored since years. It's just that EU countries want their piece of the pie.

>>24637 Where is the evidence for this?

>>24639 https://buttondown.email/cryptography-dispatches/archive/cryptography-dispatches-the-most-backdoor-looking/

As of September 2 2024, Tor is now connecting to a random guard node and sending 20-30 packets even when EntryNodes is set Can anyone else confirm? Set two EntryNodes in torrc, check Wireshark on idle Linux system, the only connections should be to those two nodes.

Well, in torrc I enabled Log debug-err syslog After reading through the logs trying to figure out what was happening, reading the entire Tor manual for client options, and some of the source code, I've found the solution: ClientBootstrapConsensusFallbackDownloadInitialDelay 6 Why is this a 0 second delay by default, but the similar option ClientBootstrapConsensusAuthorityDownloadInitialDelay is a 6 second delay by default? Why did this issue suddenly start today, with zero changes/updates to my system in weeks? It obviously happened network side Why does deleting the Tor state file fix it, but only in the first run?

>>24704 >>24706 I'm a novice when it comes to understanding the technological side of things, so perhaps my question might sound foolish: What's the consequence of this? Does this mean that even when a connected terminal is idle, the terminal stills sends packets to a random guard node? >Why did this issue suddenly start today, with zero changes/updates to my system in weeks? It obviously happened network side Perhaps unrelated, but I read on here that fuu-chan disabled Tor-posting on September 1st, and now this? Suspicious..

>>24708 Well it's never had this behavior before. My idea is maybe the network changed in such a way that it triggers that fallback that by default is at 0 seconds, using some other guard node because it's trying before you connect to your normal guards. If I try two guard nodes it randomly selected itself, it still decides to use another though, so it's not an issue with the nodes I'm selecting. After observing the traffic, it doesn't _seem_ to be malicious. It picks a random wide assortment of guard nodes, and only sends 20-30 packets each time you start Tor, and it shows it doing this in the logs, saying it's downloading consensus data or something. The log does complain about a specific authority called longclaw. There's only 10 authorities btw https://metrics.torproject.org/rs.html#search/flag:authority They're all in western glownigger countries too. If you controlled all 10 servers you'd totally break the Tor network.

Leaks claim that Facebook smartphone apps are listening to users microphone. This is not the first time this has happened. >https://futurism.com/the-byte/facebook-partner-phones-listening-microphone >>24704 >>24709 Semi-related but you probably could Five Eyes countries in torrc: >https://wiki.gentoo.org/wiki/Tor#Rules_for_Tor_circuits I don't know what drawbacks does this sort of config have, however.

>>24711 Suspicious timing. This comes right after Zuckerburg did an interview expressing regret for colluding with the FBI to censor the Hunter Biden laptop story during the last election.

>>24704 Are you saying that Tor dropped long-term entry nodes (guards)?

>>24723 No. What was happening was each time Tor (not TBB) started it would connect to a different random guard node and transfer 20-30 packets, but from then on the rest of the traffic would be your normal set of guard nodes. It also doesn't happen as of today. It was completely network side like I said. It had nothing to do with the selected guards, it did it regardless of what guards you have. I monitor my traffic like this every day though for years and have never seen Tor behave like this, so this is why I was concerned. I still don't think Tor should be "falling back" to other random guards for seemingly no reason, I do consider that to be a bug.

>>24728 >it would connect to a different random guard node and transfer 20-30 packets Are you sure it is connecting to guard nodes and not directory authorities?

>>24730 Yes, there's only 10 directory authorities bro It was a random wide assortment of guard nodes, it didn't appear to be from any one person/country. I checked them on Tor's public relay list. https://metrics.torproject.org/rs.html

>>24728 Interesting. If you decide to report this upstream, please share the link here.

New RAMBO (Radiation of Air-gapped Memory Bus for Offense) attack steals data using RAM in air-gapped computers >RAMBO involves malware manipulating the RAM's memory access patterns to generate controlled electromagnetic emissions that transmit data. The emitted data is encoded into "1" and "0," represented in the radio signals as "on" and "off," which can then be intercepted by a nearby receiver using a Software-Defined Radio (SDR). >RAMBO can achieve data transfer rates of up to 1,000 bits per second, making it suitable for stealing small amounts of data like keystrokes and passwords. The maximum effective range of the attack is about 7 meters (23 feet), depending on the speed and error rate of the transmission. Although higher transmission speeds are possible, they lead to lower signal quality. Saw this while reading up on intel explorer at work while bored. I didn't even know such an attack was actually possible. Honestly still find it hard to believe. Source with more info : https://www.bleepingcomputer.com/news/security/new-rambo-attack-steals-data-using-ram-in-air-gapped-computers/

>>24748 >To conduct the Rambo attack, an attacker plants malware on the air-gapped computer to collect sensitive data and prepare it for transmission. If there's already malware on your computer that is so sensitive it's *airgapped* you have way bigger issues. And even if so: tinfoil should be enough to stop radio transmissions.

>>24748 What if we did that but just used house wiring instead?

>>24749 That's true and it's an attack that isn't relevant for most people, although I could see it being relevant for some niche cases. Exfiltrating data off of air gapped industry control systems that were infected with usb drops (like stuxnet) or via (offline) malicious firmware updates is an obvious one. Malicious (or compromised) manufacturers of hardware tokens/keys/wallets could also use it to leak the private key on the device in a way that's very unlikely to be noticed and could probably even be disguised to look like normal radiation. Maybe I will make a proof of concept for such a device one day. It sounds fun.

>>24755 >Exfiltrating data off of air gapped industry control systems that were infected with usb drops (like stuxnet) You can't exfiltrate the data if you can't get a human asset close enough to the hardware to plant the SDR receiver. And if you can get a human asset that close to the hardware you don't need the usb drop. It's such a gimmick it's hard to find a real world scenario where this makes sense.

>>24758 Except the multiple times POC infiltration of a sneakernet was proven by poisoning the Python toolchain.

Details of Israel's pager and walkie talkie attacks across Lebanon https://www.dropsitenews.com/p/israel-lebanon-hezbollah-pager-attack It appears the Israelis planted explosives in the devices using a front company prior to their delivery to Lebanon. Exact mechanism to trigger the explosions is still unknown.

>>24758 I agree with you to an extent which is why I prefaced that post by saying it's relevant in only niche situations. However: >You can't exfiltrate the data if you can't get a human asset close enough to the hardware to plant the SDR receiver This is not necessarily true. You only need to get the SDR receiver close enough. There are plenty of ways to do this without a controlled human asset. An obvious low cost, low effort, and low risk way would be sneaking the receiver into an employee's workbag when they're offsite so that they unknowingly carry it in. If supply chain attacks are on the table, you could intercept equipment on route to the target and plant the SDR receiver in it. Plenty of ways to do it if you're the least bit imaginative >And if you can get a human asset that close to the hardware you don't need the usb drop. even if you did need to get a human asset close to the equipment, getting an asset in who makes no physical contact with the air gapped machine is easier and much more inconspicuous than having someone physically access the device every time you want to exfiltrate data.

>>24633 Telegram Agrees to Share User Data With Authorities for Criminal Investigations Source : https://thehackernews.com/2024/09/telegram-agrees-to-share-user-data-with.html >In a major policy reversal, the popular messaging app Telegram has announced it will give users' IP addresses and phone numbers to authorities in response to valid legal requests in an attempt to rein in criminal activity on the platform. If anyone is still on telegram, what are you doing, but also it is never too late to turn back.

>>24805 wow I wonder how that happened I am sure it has nothing to do with the recent arrest of pavel durov by the french and possible threats made to his person

>>24805 Which messenger doesn't?

>>24808 XMPP self hosted onion/i2p server with logs in RAM like Mullvad does or any public onion/i2p server with OMEMO used. Take in mind XMPP doesn't have good seemless encrypted group chat like Signal or Matrix but both Signal and Matrix are way too centralized for my taste.

>>22642 >Your terminal emulator can be potentially compromised with ASCII control chars. I want to post more since it's kind of scary that you can still get pwned by reading a logfile with cat Escape sequences can be also used to attack Docker containers, for example (if it sends logs to your terminal). You also can get compromised if you use nslookup or curl wrong domains/links. This is separate problem from the badness that is piping curl to sh aka curl $URL123 | sh (piping curl to sh can make you vulnerable to MITM attacks or the site can be compromised). * old email about previous research => https://marc.info/?l=bugtraq&m=104612710031920&w * BlueHat 2023: Houdini of the Terminal with David Leadbeater => https://www.youtube.com/watch?v=iIHw0KWgzAs * DEF CON 31 - Weaponizing Plain Text ANSI Escape Sequences as a Forensic Nightmare => https://www.youtube.com/watch?v=3T2Al3jdY38 * DEF CON 31 - Terminally Owned - 60 Years of Escaping => https://www.youtube.com/watch?v=Y4A7KMQEmfo btw: This works on Windows, MacOS, BSD and Linux. The behavior varies between terminal emulators used (because they can also support rarely used control sequences). You should try to find a terminal emu that supports the least amount of escape sequences (I'm thinking about switching to st). You should also start removing all escape sequences from log files before you cat them or process them. You can write a macro for your text editor (Vim, Emacs) or you can write a script in Python or Perl to delete them before you open or process the files. But note that using cat is also often unnecessary because you can (and should) use a pager (less) or your favorite text editor to read files.

>You can write a macro for your text editor (Vim, Emacs) or you can write a script in Python or Perl to delete them before you open or process the files. Could you make a wrapper for cat that does that or would it require root?

IBM “works with” Saudi Arabia and Israel https://theintercept.com/2024/09/04/ibm-ceo-israel-saudi-arabia-ethics/

>>24748 https://en.wikipedia.org/wiki/Tempest_%28codename%29 While a proof of concept may be alarming to some, it's already been thought of for a long time, and there is an entire field dedicated to stopping it. >>24805 This is genuinely concerning, also German media reports that the German government either backdoored or deanonymized TOR users, although I haven't done much research on the subject, it would be another huge blow to privacy. That time TOR accidentlied all users with an update and their pandering to "human rights" under dictators instead of general privacy and security years ago were huge red flags their project was not doing well.

>>24841 Guard node discovery has alway been a thing and even curent Tails doesn't protect you against it.

24841 >I don't know much about it, but some unspecified reports from some unspecified media claim that the German government is doing things it doesn't actually have the capability to do... I'm really worried! lol >24842 >Guard node discovery has alway been a thing and even curent Tails doesn't protect you against it. The only thing I can think of that knowing your guard node might be useful for is attempted traffic correlation attacks. And those aren't very successful even by the nation-states that have the resources to try them. Besides, to see what guard node you're using, they already have to know your ip address, so what's the point? Some of this Tor FUD is so stupid I feel embarrassed for the people posting it.

>>24812 Even more sh fun? shell wildcard expansion (un)safety > https://seclists.org/oss-sec/2024/q4/56 tl;dr You can't use grep text * You should start using grep text -- * The -- part signals grep (and other programs) that there aren't any further cmdline options after it. Also, test shell wildcards with echo first! Google Warns of Actively Exploited CVE-2024-43093 & CVE-2024-43047 in Android > https://thehackernews.com/2024/11/google-warns-of-actively-exploited-cve.html Meta Permits Its A.I. Models to Be Used for US Military Purposes > https://www.nytimes.com/2024/11/04/technology/meta-ai-military.html Hacking cars in JavaScript (Running replay attacks in the browser with the HackRF) > https://charliegerard.dev/blog/replay-attacks-javascript-hackrf/ PS. RTL-SDR is really cool! You can use one without a Ham radio license=> rtl-sdr.com

>>24843 >The only thing I can think of that knowing your guard node might be useful for is attempted traffic correlation attacks. It's about denonymizing hidden services. Once they know the guard node they can raid the datacenter and add logging to the entry guard server to find out the real IP address of the onion site. The original attack performed by German police was against ricochet which was a Tor based instant messenger where everybody is an onion service.

PROOF THAT THE FBI DOES COLD BOOT ATTACKS (takes your RAM out and dumps it, your encryption passwords are stored in RAM btw) >Because the laptop was on, FBI Computer Forensic Examiner Jordan Warnock was able to retrieve the computer’s RAM data through a forensic procedure and save that data. >Trooper Scott Haugaard of the Nebraska State Patrol, an investigator specializing in computer forensics, forensically examined an exact copy of Croghan’s hard drive and “RAM dump.” https://www.courtlistener.com/opinion/4780823/united-states-v-beau-croghan/

>>25505 How do you red text? Also these aren't COLD BOOT ATTACKS. Cold boot attacks you use an upside down can off can duster to freeze the ram to slow the decay of the volatile memory. Then boot either with a USB using your tools on the targets laptop or use a surrogate system with RAM riser and your tools you dump the ram and hopefully get the keys. In that doc it said the laptops were "on".

>>25506 >these aren't COLD BOOT ATTACKS >>25505 >Warnock was able to retrieve the computer’s RAM data through a forensic procedure and save that data. That's the cold boot part.

I'm sure these are very stupid questions and I apologize for that. 1. Would bleachbit -c system.memory and/or bleachbit -c system.cache mitigate this vulnerability? I know that the latter (cache) command destabilizes my os, so I only use it as part of my shutdown script. 2. After closing any encrypted containers and presumably freeing any memory containing encryption keys, would it be possible to overwrite all available memory by just writing a simple program that assigns all free memory to variables, in a language that zeroes out all variables? I hope these questions are not too idiotic.

>>25522 man sdmem SDMEM(1) General Commands Manual SDMEM(1) NAME sdmem - secure memory wiper (secure_deletion toolkit) SYNOPSIS sdmem [-f] [-l] [-l] [-v] DESCRIPTION sdmem is designed to delete data which may lie still in your memory (RAM) in a secure manner which can not be recovered by thieves, law en‐ forcement or other threats. Note that with the new SDRAMs, data will not wither away but will be kept static - it is easy to extract the necessary information! The wipe algorithm is based on the paper "Se‐ cure Deletion of Data from Magnetic and Solid-State Memory" presented at the 6th Usenix Security Symposium by Peter Gutmann, one of the lead‐ ing civilian cryptographers.

>>25524 Thank you very much. That looks like the perfect answer to my question. Cheers.

Since I'm only interested in zeroing-out free ram rather than using multiple passes, the -ll option is appropriate for me. I'm flushing buffers and caches first: sync; echo 3 > '/proc/sys/vm/drop_caches'; sdmem -ll It comes back with "Killed", which looks like a normal Linux out-of-memory thing. Seems to work ok and doesn't screw anything up, so I can keep using the computer. Much thanks.

>>25527 Yeah after your done watching Ero guro you can just watch a long torrented video of latest holy wood garbage and that will overwrite your RAM.

>>25505 A similar risk exists with swap files, where sensitive data ends up stored on disk. Encrypting the swap files helps against this. Incidentally, memory encryption is a thing too, e.g. AMD SME. https://www.kernel.org/doc/Documentation/x86/amd-memory-encryption.txt Apparently Ryzen CPUs support it: $ cpuid | rg SME: SME: secure memory encryption support = true Apparently you can enable per-page, but I've no idea how. I also read it uses a fixed key fused into the CPU (instead of a randomly generated key), which makes it kinda useless.

>>25564 >I also read it uses a fixed key fused into the CPU (instead of a randomly generated key), which makes it kinda useless. Where do you get that from? The docs you linked say each VM gets its own key. >SEV guest VMs have the concept of private and shared >memory. Private memory is encrypted with the guest-specific key,

>>25576 I got it from https://forums.whonix.org/t/enable-secure-memory-encryption-sme-kernel-parameter-mem-encrypt-by-default/10393#post_5 >Pass. This feature is useless because it is tied to an encryption key hardcoded into the machine by the CPU manufacturer, I’ve also read security attacks against it over the years so never bothered following it much. It appears the comment is wrong for AMD SME at least, properly reading the PDF linked in the comment below I now see: >The encryption key used by the AES engine with SME is randomly generated on each system reset and is not visible to any software running on the CPU cores. https://www.amd.com/content/dam/amd/en/documents/epyc-business-docs/white-papers/memory-encryption-white-paper.pdf Ditto for Intel TME: >The encryption key used for Intel TME uses a hardware random number generator implemented in an Intel® SOC. https://www.intel.com/content/www/us/en/developer/articles/news/runtime-encryption-of-memory-with-intel-tme-mk.html

>>24812 >>25082 spooky. >You should also start removing all escape sequences from log files before you cat them or process them. would that be possible for gui text editors like kate or are they not relevant for attacks like these? >>25102 if the server runs on a ramdisk it shouldn't be an issue outside of cold boot attacks, and even then the server could be configured to wipe the ram if power is interrupted.

>>25581 >if the server runs on a ramdisk it shouldn't be an issue outside of cold boot attacks, and even then the server could be configured to wipe the ram if power is interrupted. this is the least brainrot reply i have heard in awhile keep cooking them non mid replies blud

>>22534 insect sized robots are reality! https://www.youtube.com/watch?v=H6q6pYZ9Fho

>>22534 Hexchat git repo is archived. They have stopped updating it. Switch to quassel or weechat/irssi/whatever!

>>25760 Literally why. As long as it works I'm gonna use it.

4chan got pwned. Does anyone here care?

>>26161 it's been mentioned on the data breach thread

>>26161 4chan is basically useless except for porn and lurking. You can't post there with a VPN unless you sign up with a normal person email address and pay for a pass with easily-traceable crypto, and torposting isn't allowed. Moderation is overzealous and arbitrary. I'm glad it's dead, should've happened ages ago.

https://www.404media.co/the-signal-clone-the-trump-admin-uses-was-hacked/ yet another reminder to not trust centralized chat applications

sudo will be replaced by a clone written in Rust (sudo-rs) in Ubuntu 25.10 >https://trifectatech.org/blog/memory-safe-sudo-to-become-the-default-in-ubuntu/

How is Telegram connected to the FSB? Investigation: https://www.youtube.com/watch?v=s7pnANMPigg

>>26562 modern computer doesn’t even had a front-side bus even if it wouldn’t work in Telegram

>>26293 doas is much better anyways

>https://www.pcmag.com/news/this-ai-is-outranking-humans-as-a-top-software-bug-hunter An AI bot called xbow is now the top ranked bug bounty hunter on hackerone. You know that high paying career you were hoping for in cybersecurity? LOL.

>>26586 >thousands of GET uri based xss repots >bug bounty >high paying career idk, try to touch grass, be more calm you know, maybe try to bang a girl but stop posting this peace of soykaf if you don't know what are you posting about

>>26586 >op-ed by person who knows nothing about security >incapable of analyzing the findings of Xbow >quotes hacker news post >calls Xbow Xbox >one of the sources links to the URL "v" Quality modern journalism. >You know that high paying career you were hoping for in cybersecurity? LOL. Retard lain with the snide remark about the $300k/year product (whatever the real non VC backed price would be) that needs human supervision stealing $70k jobs. These tools, like software development co-pilots or Tesla self-driving need experts to guide them and evaluate their work, for now. Think critically for a second, if it raked in all the bug bounty, would you think they'd ever share their technology? https://www.bloomberg.com/news/articles/2025-06-24/one-of-the-best-hackers-in-the-country-is-an-ai-bot >Now, the year-old startup has raised $75 million in a new funding round led by Altimeter Capital, with participation from existing investors Sequoia Capital and NFDG. Yeah, I'm sure this isn't another >E-commerce giant Amazon's "Just Walk Out" technology allowed customers to bypass traditional checkouts at its stores, and the company relied on 1,000 Indian human workers to do the job manually Oh my, the team is all white males, this is very problematic. https://xbow.com/

>>26588 Just because some AI startups have been scams or comic relief doesn't mean they all are. Look at the damn hackerone leaderboard: https://hackerone.com/leaderboard?year=2025&quarter=2&owasp=a1&country=US&assetType=WEB_APP&tab=vdp Intelligent lains please read what it actually does: https://xbow.com/blog/xbow-globalprotect-xss/ It's found xss, sqli, ssrf, leaked secrets. Don't underestimate what's going on.

>>26588 >team is all white males false advertising

>>26586 this is fuarrrked up, so EVERYONE might starve in a distant future

Unless users take action, Android will let Gemini access third-party apps >"Starting today, Google is implementing a change that will enable its Gemini AI engine to interact with third-party apps, such as WhatsApp, even when users previously configured their devices to block such interactions." >"An email Google sent recently informing users of the change linked to a notification page that said that “human reviewers (including service providers) read, annotate, and process” the data Gemini accesses." >"" Apparently, even ADB can't always uninstall it but you can still try, adb shell pm uninstall com.google.android.apps.bard src: https://arstechnica.com/security/2025/07/unless-users-take-action-android-will-let-gemini-access-third-party-apps/

>>22534 AUR Chaos malware: an analysis >https://www.mh4ckt3mh4ckt1c4s.xyz/blog/aur-chaos-malware-analysis/ tl;dr version: * There were malicious packages in Arch User Repo (AUR) that installed remote access tool (RAT). * The known malware packages are: librewolf-fix-bin, firefox-patch-bin, zen-browser-patched-bin, minecraft-cracked, ttf-ms-fonts-all, vesktop-bin-patched, ttf-all-ms-fonts. * There might be even more malware on the AUR! * Be sure to always review all package PKGBUILD files, even when you are updating AUR packages that were previously to be known to be good. * I suggest using rua or yay AUR helper because they can show diff views of AUR packages.

>>26918 I've been also hearing about the AUR being down pretty frequently on top of other issues for the last couple of months now. Sounds like to me that a bunch of arch users are about to distrohop to something new.

>>26919 We might be entering Gentoo golden age any day now.

>>26919 they're being hit with a ddos to make them switch to cloudflare so nsa can data harvest

Google wants to make sideloading Android apps safer by verifying developers’ identities* *even if it’s outside the Play Store >Developers who distribute apps outside the Play Store will need to verify their identity through the new Android Developer Console that Google is currently building. >Rolling out in phases starts from September 2026 >https://www.androidauthority.com/android-developer-verification-requirements-3590911/ Remember that Play Protect can already catch malware and it could be improved. This is just increased control from Big Brother Google.

TOR Project Releases Official Android VPN App — The maintainers of the TOR Project have released an official VPN app that allows Android users to route all their traffic through the Tor network: https://play.google.com/store/apps/details?id=org.torproject.vpn via https://support.torproject.org/tr/tor-vpn/introduction/

>>27174 What's the difference between this and Orbot?

https://old.reddit.com/r/TOR/comments/1ni5drm/the_fbi_couldnt_get_my_husband_to_decrypt_his_tor/ Will running nodes ever stop being a flight risk? This seems like the most obvious flaw in the protocol but it's not being addressed.

>>27176 Seems like they rewrite codebase to Java (looking into their GitHub)... And... that's all?

>>27182 >tor exit node operator v&ed for no reason he was a gud boy dindunothin There is way more to that particular story. He was arrested for violating his probation conditions. The reason he had probation conditions is because he threw a tantrum at work and destroyed some servers from a former employer. >The FBI couldn't get my husband to decrypt his Tor nodes, so they told a judge he used his GRAPHICS DRIVER to access the "dark web" Part of his probation conditions was that he had to install Fed spyware on all his devices. He installed Tor inside a virtual machine to get around this. Spice is a protocol for transferring graphics data between a VM host and guest, like VNC or remote desktop. It's not a "graphics driver" but you can understand why a lawyer might call it that. It's not really the gocha the defense is pretending it is.

holy fuarrrking bingle. what?! :3 Christopher Domas finally remembered hist github password. https://github.com/xoreaxeaxeax/mchammer Last time he spoke on Defcon 2018 on x86 backdoors he announced a new way for discovering undocumented MSRs with secret knocking using micro-architectural timing side-channel attacks (yes, there are secret MSRs hidden behind secret knocking on x86, many are shared among AMD and Intel but hidden from the public). He promised to make hist PoC public after the conference, but never did. He disappeared from the internet on all of his public accounts. After some time his Linkedin profile changed his employer to Intel... Seven years later the legend is back.

>>27281 damn that is a throw back and a half, did not expect to hear that name on this forum his talks were great

>>27281 holy soykaf he's still alive, wow

>In 2023, gyrovague publicly doxxes the archive.today admin(s). The contact info used to register archive.today was also used to register some cybercrime-related sites (carding, etc). It's also worth noting that kiwifarms is cited as one of the sources for another claim. >In November 2025, feds subpoena the archive. The media notices, and, among other things, links to that doxx. btw, the 404 media article is, uh, interesting? it links archive.today to GamerGate, which seems like a great way to stir up soykaf. >Jan 8th: One of the names from the original doxx sends a GDPR complaint to wordpress.com about said doxx. The author decides that a request to take down the article is "entirely lacking in actionable detail" (?), and gets Gemini to write some bullshit about how the doxx is in the public interest. Wordpress.com eats it up. The reason this was only done then was that "His action was not a GDPR violation until recently. The mentioned people got EU citizenship". >Jan 9th: webmaster@archive.today directly emails gyrovague with a request to take the doxx down "at least for 2-3 months". archive.today doesn't receive an answer, they start DDoSing the blog in question. >Jan 15th: gyrovague notices the email in their spam folder, saying they "would be more inclined to cooperate if you were not simultaneously sending me legal cease and desist letters and attempting to DDOS my site." They ask what in particular should be deleted. >Jan 25th: gyrovague gets no answer. They decide that "taking the blog post down entirely is not an option" (without justification), and decide to double down. "if you don't cease the DDOS, I'll have to publish a follow up blog post, a copy of which is attached for your review." >Jan 26th: archive.today responds, saying that the only response from gyrovague they've received was the AI generated response to the GDPR complaint. "now there is no other option but to escalate the matter in various ways." >archive.today threatens to create a gay dating app (???) named after gyrovague's real last name, and to write an investigation on gyrovague's supposed Nazi grandfather. gyrovague doesn't like being doxxed, so they redact that out. >gyrovague posts this https://gyrovague.com/2026/02/01/archive-today-is-directing-a-ddos-attack-against-my-blog/

>>27722 https://archive-is.tumblr.com/tagged/patokallio

>>27723 Wikipedia blacklists archive.is after the controversy, wants to remove 695,000 links (!) https://en.wikipedia.org/wiki/Wikipedia:Archive.today_guidance

Google Attributes Axios npm Supply Chain Attack to North Korean Group UNC1069 https://thehackernews.com/2026/04/google-attributes-axios-npm-supply.html Google has formally attributed the supply chain compromise of the popular Axios npm package to a financially motivated North Korean threat activity cluster tracked as UNC1069. "We have attributed the attack to a suspected North Korean threat actor we track as UNC1069," John Hultquist, chief analyst at Google Threat Intelligence Group (GTIG), told The Hacker News in a statement. "North Korean hackers have deep experience with supply chain attacks, which they've historically used to steal cryptocurrency. The full breadth of this incident is still unclear, but given the popularity of the compromised package, we expect it will have far reaching impacts." The development comes after threat actors seized control of the package maintainer's npm account to push two trojanized versions 1.14.1 and 0.30.4 that introduced a malicious dependency named "plain-crypto-js" that's used to deliver a cross-platform backdoor capable of infecting Windows, macOS, and Linux systems.

Claude Code Source Leaked via npm Packaging Error, Anthropic Confirms https://thehackernews.com/2026/04/claude-code-tleaked-via-npm-packaging.html Anthropic on Tuesday confirmed that internal code for its popular artificial intelligence (AI) coding assistant, Claude Code, had been inadvertently released due to a human error. "No sensitive customer data or credentials were involved or exposed," an Anthropic spokesperson said in a statement shared with CNBC News. "This was a release packaging issue caused by human error, not a security breach. We’re rolling out measures to prevent this from happening again." The discovery came after the AI upstart released version 2.1.88 of the Claude Code npm package, with users spotting that it contained a source map file that could be used to access Claude Code's source code – comprising nearly 2,000 TypeScript files and more than 512,000 lines of code. The version is no longer available for download from npm. Security researcher Chaofan Shou was the first to publicly flag it on X, stating "Claude code source code has been leaked via a map file in their npm registry!" The X post has since amassed more than 28.8 million views. The leaked codebase remains accessible via a public GitHub repository, where it has surpassed 84,000 stars and 82,000 forks.

CPUID Breach Distributes STX RAT via Trojanized CPU-Z and HWMonitor Downloads > The incident lasted from approximately April 9, 15:00 UTC, to about April 10, 10:00 UTC Affected versions include at least... - CPU-Z (version 2.19) - HWMonitor Pro (version 1.57) - HWMonitor (version 1.63) - PerfMonitor (version 2.04) src: https://thehackernews.com/2026/04/cpuid-breach-distributes-stx-rat-via.html

CVE-2026-31431 : All linux kernel version from 2017 to today are affected. CVE-2026-31431, (AKA "Copy Fail") is a straight-line logic flaw from an old optimization bit that was introduced years ago. It targets the authencesn template library using the AF_ALG (some cryptographic API) and splice() together in page-cache write. The optimization never checks if the page has been messed with white in memory. The exploit needs to be performed locally, so there's no risk of remote attacks by itself. Servers are the most interesting target for this exploit. Small and stealthy (for now). There's little practicality for personal, single user machines. From https://copy.fail/ : >An unprivileged local user can write 4 controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root. >What is not affected? >Will not affect: dm-crypt / LUKS, kTLS, IPsec/XFRM, in-kernel TLS, OpenSSL/GnuTLS/NSS default builds, SSH, kernel keyring crypto. These all use the in-kernel crypto API directly — they don't go through AF_ALG. >AF_ALG is a userspace front door to the kernel crypto API. Disabling it does not slow anything that wasn't already calling it; for the things that were, performance falls back to a normal userspace crypto library, which is what almost everything else already does. >For untrusted workloads (containers, sandboxes, CI), block AF_ALG socket creation via seccomp regardless of patch state. From that same site, They released an example of a script that performs the attack. A full detailed write up is linked down the page of the site.

ABSOLUTELY fuarrrkING INSANE > The researcher described YellowKey as "one of the most insane discoveries I ever found," likening the BitLocker bypass to functioning as a backdoor, as the bug is present only in the Windows Recovery Environment (WinRE), a built-in framework designed to troubleshoot and repair common unbootable operating system issues. > YellowKey affects Windows 11 and Windows Server 2022/2025. At a high level, it involves copying specially crafted "FsTx" files on a USB drive or the EFI partition, plugging the USB drive into the target Windows computer with BitLocker protections turned on, rebooting into WinRE, and triggering a shell by holding down the CTRL key. https://github.com/Nightmare-Eclipse/YellowKey

>>27927 Linux seems really unreliable. My confidence in it is waning.

>>27957 If it's of any conciliation : when a major CVE on linux breaks out, like copy fail, dirty frag or their copycats, updates specifically for the exploits roll out quickly. We are likely going to see more of these pop up with AI assisting researchers. We are in for a wild ride, lainon. >>27956 >How to reproduce : >Copy the FsTx folder to "YourUSBStick:\System Volume Information\FsTx" as is and make sure to use a filesystem that's compatible with Windows >Plug the USB stick in your target windows computer with bitlocker protection turned on. >Reboot to Windows Recovery Environment Agent (you can do that by holding SHIFT and clicking on the restart button using your mouse) >Once you click on the restart button, lift your finger off the SHIFT key and hold CRTL and do NOT lift your finger off it. >If you did everything properly, a shell will spawn with unrestricted access to the bitlocker protected volume. pic rel wtf it can't be that easy

>>27957 This is the natural result of focusing solely on "muh performance" while only pretending to care about security. Same moronic motivation modern C compilers will happily break your code because you have a signed integer overflow. Even though optimizations at a high level have far higher impact than literal micro-optimizations, but it's hard to focus on that when you need to deal with endless bullshit. In the end it takes a whole new language with appropriate "safety" culture to finally start mitigating this, but I'm sure you're already aware of the discourse around it. It also wouldn't be nearly as bad if microkernels were taken seriously but nooo "muh performance" let's put literally millions of lines of C in a giant blob in a single privilege space. What could go wrong? Present Day, Present Time! AHAHAHAHAHA! FWIW one of the main reasons microkernels have "bad" performance is because both Intel and AMD kept dragging their feet on PCID(/ASID). Hell, AMD still doesn't have PCID on their latest desktop processors (at least, not zen3, which does have INVPCID but not PCID???). IOMMU would also be a great help, but is disabled by default on most hardware it seems?

>>27956 The guy got derezzed on github, a week or two ago, and on gitlab shortly after making an account there. people are rumoring that they might have been threatened by micro$lop to do the ban. I think gitlab is covering their ass pro-actively so they don't get fuarrrked by micro$lop first. it's the same thing, anyway. just indirectly. Watch his blog carefully, lain. especially on the 14th of july. some soykaf is going down. he has a nice track record of delivering 0-days, and this looks very personal. https://deadeclipse666.blogspot.com/2026/05/july-14th.html

>>28040 Interesting. Gotta mark that day on my calendar. Hopefully he'll accomplish what he's set about on doing. I wanna hear bones being smashed to pieces.

>>26171 The porn is dreadful

Well, it is BitLocker again The exploit works as follows: - Copy an XML file ("unattend.xml") and a recovery folder containing another XML file ("Recovery/WindowsRE/ReAgent.xml) to the root of the recovery partition. - Reboot to Windows Recovery Environment (WinRE) by holding Shift while clicking Restart in the Windows power menu. And Nightmare Eclipse also says: > This was an accidental discovery, it took a total of 4 hours to find this. > If you ever attempted to use Windows Defender Offline Scan, you're automatically vulnerable to a bitlocker bypass. I'm unsure if you can still trigger the bug without ever using the offline scan feature, because you can definitely via https://deadeclipse666.blogspot.com/2026/06/greatxml-bitlocker-that-seems-to-only.html and https://git.projectnightcrawler.dev/NightmareEclipse/GreatXML and https://github.com/MSNightmare/GreatXML

>>28091 Man, bitlocker is such a joke. Speaking of this guy, he also released a Defender exploit he called RoguePlanet https://github.com/MSNightmare/RoguePlanet >The exploit is a race condition, so it's a hit or miss. I have managed to get a 100% success rate on some machines while it struggled to work on others. >I want to make one thing very clear. All Windows Server installations are vulnerable as well, you just need to redesign the exploit. >The race condition part is a bit interesting, I believe (but not sure) that a redesign of the PoC can make it achieve a 100% success rate regardless of the conditions but honestly I'm done with this bug. >If the exploit succeeds, a SYSTEM shell will be spawned unrelated to the exploit mentioned, he's dialing back his threats on july 14th and going radio silence for a bit. Oh well. Wondering what he's going to work on in the mean time...

>>28097 Ping of Death! I expect smth like that CVE-2026-49494 or Windows-95 65K+ packet of death. But don't know, he looks like he could make something even cooler

Its over guys **Anthropic’s powerful Mythos AI reportedly breached ‘almost all’ NSA classified systems within a few hours during red-team test — report sheds more light on the U.S. government's sudden ban on the flagship models** https://www.tomshardware.com/tech-industry/artificial-intelligence/anthropics-powerful-mythos-ai-reportedly-breached-almost-all-nsa-classified-systems-within-a-few-hours-during-red-team-test-report-sheds-more-light-on-the-u-s-governments-sudden-ban-on-the-flagship-models

>>28119 probably fake. the government is entirely corrupt, it's just a big marketing stunt.

>>28119 Not sure I believe this. I think this is propaganda to make China scared. Not that I'm against doing that But big if true

The vichan repository is now archived, following a recent vichan soysphere board hacking and discussion about vichan vulnerability (Angeleno, the maintainer, has been an admin of that board in the past, so it's definitely not a coincidence). Angeleno's commit reads: https://github.com/vichan-devel/vichan/commit/ec2784c94893d6a3ff4a6d7766041affffdd365a "Vichan has reached its end of life. many of us have lost interest in the project, and the current direction of the internet has not been good for imageboards, whether its ID verification laws, big social media companies killing competition, or Google being hostile towards smaller sites. There are other imageboard engines out there but even if you use them, these are still issues you will need to think about if you start an imageboard or UGC website. You can still install or fork vichan, but do so at your own risk." For an article about the hack: https://secapedia.org/index.php/The_Great_Vichan_Crisis Note that the hacker remains at large and claims to have a dozen 0days. Other people claim to know the exploits and that forks are also affected after testing. Appleman, is it finally time to migrate to something else than vichan?

>>28200 Is this the end of lainchan.org?

good. lainchan is like kicking dead whales down the beach now. what a dump

>>28201 More like the end of every altchan since they all run a vichan fork. There's only a handful running something else.

>>28203 It can't surely be that bad? right??????

>>28202 >Posted on lainchan >>28204 Probably not, seems reserved to soysphere soykafflinging and only one person so far is abusing the "exploits" (which we don't really know the details of). Is there even any point in migrating?

>>28097 > Wondering what he's going to work on in the mean time Released! https://blog.projectnightcrawler.dev/posts/2026-07-14-legacyhive-public-disclosure/ https://github.com/MSNightmare/LegacyHive