BrianKrebs

Independent investigative journalist. Covers cybercrime, security, privacy. Author of 'Spam Nation,' a NYT bestseller. Former Washington Post reporter, '95-'09. Signal: briankrebs.07
krebsonsecurity @ gmail .com
Linkedin: https://www.linkedin.com/in/bkrebs

website: https://krebsonsecurity.com

Public Key

npub1vc39pnjdqd77zzdxff4qyv8h3x0ey2mkx33c3vl8egr0a9ysxkxsk0axsh

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsxvgjseexsxl0ppxny56szxrmcn8uj9dmrgcugk0nu5ph7jjgrtrgpqq0e8xlp

Publishing to

Author Public Key

npub1vc39pnjdqd77zzdxff4qyv8h3x0ey2mkx33c3vl8egr0a9ysxkxsk0axsh

Show more details

Last Notes

2026-04-15 17:57:39 CEST

- reply

haha love the spa idea. but attention spa sounds a bit like sensory deprivation tank and that fascinates but terrifies me also.

2026-04-15 17:53:58 CEST

If my attention span was any shorter today

2026-04-15 02:44:24 CEST

- reply

heh, yeah it's right up there with ERMAHGERD!

2026-04-15 01:58:26 CEST

- reply

I had to dig up this 2008 WaPo story from Archive since WaPo nuked all my blog posts from their site. It's about @npub19d7…5eak, the guy who registered donotreply.com.
https://web.archive.org/web/20110810225035/http://voices.washingtonpost.com/securityfix/2008/03/they_told_you_not_to_reply.html

2026-04-15 01:12:22 CEST

- reply

good reminder. i suck at hashtags.

2026-04-14 23:55:29 CEST

ZOMG! It's freakin Patch Tuesday again. And Microsoft has patched a staggering 167 security holes (think more people are using AI to find bugs, maybe?)
tl;dr: There's something for everyone today, like an Adobe Reader 0day that's apparently been exploited since at least November 2025; a SharePoint zero-day; and a fix for BlueHammer, and a Windows Defender bug for which there is working exploit code that no longer works if you install today's Windows updates (as per @npub12xh…zxeq).
https://krebsonsecurity.com/2026/04/patch-tuesday-april-2026-edition/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/405/281/966/806/831/original/f61414859dc60aae.png

2026-04-14 22:17:40 CEST

So @npub12xh…zxeq, is this CVE-2026-33825 the BlueHammer patch? https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-33825

2026-04-14 14:44:08 CEST

This discussion atop Hackernews right now about how someone bought 30 WordPress plugins and planted a backdoor in all of them has me wondering, is there a plugin that blocks plugins from being automagically updated if the plugin's ownership changes?
https://news.ycombinator.com/item?id=47755629#47756259

2026-04-13 18:21:12 CEST

- reply

Seems like good for the consumer, but also good for fraudsters, no?

2026-04-12 00:25:28 CEST

- reply

Growing up, my dad (a strong Catholic) used to welcome the Hare Krishnas, Jehovah's Witness, and the young men from the Mormon church who came by from time to time. He would sit out on the lawn and bring chairs out for everyone and offer peach daiquiris for them (they also refused). And then he'd try to convert them to Catholicism.

2026-04-11 22:37:31 CEST

- reply

as if a million souls just cried out for a new profession. no wait, a new use for their giant botnets.

2026-04-10 17:35:13 CEST

- reply

no, plagiarism is the sincerest form of flattery :)

2026-04-10 16:33:07 CEST

Someone posted this to the Breachforums telegram channel. Not sure who the others in this image are supposed to be, but it looks like the Breachforums admin Pompompurrin in the front. While supplies last....
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/380/886/041/684/912/original/3af7b6826e9fa90d.png

2026-04-09 21:48:51 CEST

- reply

probably if it's more than 5 years old, it's time to replace. Believe it or not, over time many little improvements in hardware and software make them more useful and often faster (particularly w/ newer wifi standards). Also, newer mesh router systems pretty much take the work out of patching the firmware, etc.

2026-04-08 18:16:49 CEST

- reply

I remember looking into this after it was first posted, but it was advertised as a private sale to the highest bidder. The thread is now gone, which means they probably found a buyer. They haven't responded to requests for more information. Here's the original text from the post, a la Kela.
"The data leak contains research across various fields
including Aerospace Engineering, Military Research,
Bioinformatics, Fusion Simulation, and more, from top
organizations such as AVIC, COMAC, NUDT, NWPU,
HUST, and others.
Total leak size: 10+ Petabytes
Price - 10 XMR to access the research list. A 􏃠 􏃳 􏃧 􏀂

Data Breach - China's National Super-
computing Center (NSCC) Research Facility HACKED !!!
Database 
The highest bidder will receive the full dataset (limited availability).
XMR Address -
453SPVPLypDdgzF5EoLHcXB4Bd74K9f92euDDjrcWqqY5RrkZeb4KsA1PzXPYY9pybg2h
TBeQt3LA8esv46GJAJAAPhT1W4
Mail - [email protected]
Telegram - @FlamingChina"

2026-04-07 20:10:02 CEST

New, from me: Hackers linked to Russia’s military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens from users on more than 18,000 networks without deploying any malicious software or code.
https://krebsonsecurity.com/2026/04/russia-hacked-routers-to-steal-microsoft-office-tokens/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/364/757/985/763/964/original/4111e74f07ee59bf.png

2026-04-06 17:40:50 CEST

New, by me: An elusive hacker who went by the handle “UNKN” and ran the early Russian ransomware groups GandCrab and REvil now has a name and a face. Authorities in Germany say 31-year-old Russian Daniil Maksimovich Shchukin headed both cybercrime gangs and helped carry out at least 130 acts of computer sabotage and extortion against victims across the country between 2019 and 2021. From the story:
UNKNOWN also gave an interview to Dmitry Smilyanets, a former malicious hacker hired by Recorded Future, wherein UNKNOWN described a rags-to-riches tale unencumbered by ethics and morals.
“As a child, I scrounged through the trash heaps and smoked cigarette butts,” UNKNOWN told Recorded Future. “I walked 10 km one way to the school. I wore the same clothes for six months. In my youth, in a communal apartment, I didn’t eat for two or even three days. Now I am a millionaire.”
https://krebsonsecurity.com/2026/04/germany-doxes-unkn-head-of-ru-ransomware-gangs-revil-gandcrab/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/358/510/805/464/240/original/052d98c5649a0d1c.png

2026-04-06 13:54:06 CEST

- reply

show me another provider who offers more in the way of multi-layered account security options. I prefer to set inbox to be as paranoid as I want it. YMMV.

2026-04-02 02:17:42 CEST

Totally went down a bunch of research holes after watching today's flawless Artemis II launch. There's probably a better, more complete video explaining what helium-3 is, why it's so rare and valuable and potentially useful that people are investing insane sums to one day pull of the feat of mining it on the Moon and returning it to Earth. But this one communicated a lot in 5 minutes, and I learned a lot. https://www.google.com/search?q=what+is+helium-3&oq=what+is+helium-3&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIHCAEQABiABDIICAIQABgWGB4yCAgDEAAYFhgeMggIBBAAGBYYHjIICAUQABgWGB4yCAgGEAAYFhgeMggIBxAAGBYYHjIICAgQABgWGB4yCAgJEAAYFhge0gEIMjY4MGowajeoAgCwAgA&sourceid=chrome&ie=UTF-8#fpstate=ive&vld=cid:79d9da97,vid:aJ3Pbitoy1k,st:0

2026-04-02 02:08:03 CEST

The POTUS' war on Iran is already bringing rationing of fuel and major disruptions in many countries, and how it's going to get a lot worse soon as the final shipments that made it thru the Strait start to arrive this week, the NYT reports. I admire (but do not share) this story's optimism of the potential for the Iran war to hasten more global adoption of renewables.
"Sri Lanka and Myanmar are rationing fuel. The Philippines has instituted four-day workweeks to conserve gasoline and electricity. Bangladesh briefly closed its universities to reserve power for homes and businesses. Across India, families and restaurants are cooking over wood fires for want of gas. Airlines are canceling flights."
"As painful as the first phase of the energy crisis set off by the war with Iran has been, what comes next will be worse. This week, the final deliveries of oil and liquefied natural gas to Asia that passed through the Strait of Hormuz before it was closed are expected to arrive. The last tanker shipments to Europe should land by mid-April. After that, many countries’ reserves of gasoline, diesel, liquid petroleum gas and natural gas will dwindle. The price of oil could soar as high as $200 a barrel if the war drags on."
Meanwhile, China -- which leads the world in battery technology production -- stands to massively gain from all this oil shock.
"As the Philippines declared a national energy emergency on March 24, car shoppers in Manila were crowding into showrooms of the Chinese carmaker BYD and purchasing E.V.s ."
Of course, here in the US we've largely said that we're just gonna keep making gas guzzlers and forget about all those pledges we made to invest in electric vehicles. Consumers in the US would be flocking to those BYD cars too if import duties didn't make them prohibitively expensive. Most of the big car makers in the US are hopelessly focused on people who don't bat an eyelash spending $60,000 (base price) for a new car or truck.
https://www.nytimes.com/2026/04/01/opinion/oil-crisis-iran-electric-solar.html

2026-04-01 21:16:23 CEST

- reply

yeah you really can't unsee that. thanks a lot.

2026-04-01 20:46:36 CEST

IDK who Deb Eskew is, but I certainly glanced askew when reading this. See how many red flags you can spot. This one seems to have them all:
-unbidden attachment (which couldn't be auto-scanned for malware btw)
-no actual greeting or salutation
-a password needed to unlock the attachment
-relevant (if a bit on-the-nose) social engineering involving a podcast ostensibly focused on fraud;
-Google is clearly glancing askew here, too, but kind of tapping out on a verdict because it ultimately made it through.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/330/924/197/339/594/original/ac20ac5d112ea872.png

2026-03-23 22:19:40 CET

Whoa, that escalated quickly. This just got sent out by the press folks at the Federal Communications Commission (FCC). The FCC says it has decided that all foreign-made consumer-grade Internet routers are henceforth prohibited from receiving FCC authorization and are therefore prohibited from being imported for use or sale in the United States.
"Update Follows Determination by Executive Branch Agencies that Consumer-Grade Routers Produced in Foreign Countries Threaten National Security
WASHINGTON, March 23, 2026—Today, the Federal Communications Commission updated its Covered List to include all consumer-grade routers produced in foreign countries. Routers are the boxes in every home that connect computers, phones, and smart devices to the internet. This followed a determination by a White House-convened Executive Branch interagency body with appropriate national security expertise that such routers “pose unacceptable risks to the national security of the United States or the safety and security of United States persons.”
"The Executive Branch determination noted that foreign-produced routers (1) introduce “a supply chain vulnerability that could disrupt the U.S. economy, critical infrastructure, and national defense” and (2) pose “a severe cybersecurity risk that could be leveraged to immediately and severely disrupt U.S. critical infrastructure and directly harm U.S. persons.”
"This action does not affect any previously-purchased consumer-grade routers. Consumers can continue to use any router they have already lawfully purchased or acquired."
"Producers of consumer-grade routers that receive Conditional Approval from DoW or DHS can continue to receive FCC equipment authorizations. Interested applicants are encouraged to submit applications to [email protected]."
Not sure how many consumer-grade routers will be left for sale if it really is a ban on approvals for any foreign-made consumer routers like they said, and not just a bunch of already restricted Chinese makers like Huawei and ZTE.
https://www.fcc.gov/document/fcc-updates-covered-list-include-foreign-made-consumer-routers
FCC's "covered list" of "thou shalt not entities": https://www.fcc.gov/supplychain/coveredlist

2026-03-23 22:10:18 CET

The Kimwolf botmaster Dort is currently spamming the living crap out of this Mastodon instance with messages claiming i'm a monster. Sorry @npub1vtx…e7wk. That's a lot of junk accounts and messages. I guess the visit he got from law enforcement didn't deter him much.

2026-03-23 17:10:20 CET

ICYMI (from the not-all-cyber-news-is-horrible dept), a cyberattack on a U.S. vehicle breathalyzer company has left drivers across the United States stranded and unable to start their vehicles. This story positively cries out for a headline-writing contest. TechCrunch reports:
"The company, Intoxalock, says on its website that it is “currently experiencing downtime” after a cyberattack on March 14. Intoxalock sells breathalyzer devices that fit into vehicle ignition switches, and is used by people who are required to provide a negative alcohol breath sample to start their car."
https://techcrunch.com/2026/03/20/cyberattack-on-vehicle-breathalyzer-company-leaves-drivers-stranded-across-the-us/

2026-03-23 16:49:13 CET

New, by me: 'CanisterWorm' Springs Wiper Attack Targeting Iran
A financially motivated data theft and extortion group is attempting to inject itself into the Iran war, unleashing a worm that spreads through poorly secured cloud services and wipes data on infected systems that use Iran’s time zone or have Farsi set as the default language.
https://krebsonsecurity.com/2026/03/canisterworm-springs-wiper-attack-targeting-iran/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/279/273/185/528/280/original/0a0896adbcdb36ca.png

2026-03-20 01:53:34 CET

New, breaking: Feds Disrupt IoT Botnets Behind Huge DDoS Attacks
The U.S. Justice Department joined authorities in Canada and Germany in dismantling the online infrastructure behind four highly disruptive botnets that compromised more than three million hacked Internet of Things (IoT) devices, such as routers and web cameras. The feds say the four botnets — named Aisuru, Kimwolf, JackSkid and Mossad — are responsible for a series of recent record-smashing distributed denial-of-service (DDoS) attacks capable of knocking nearly any target offline.
No word yet on which botmasters got a visit from feds, but the DOJ statement references law enforcement against against botmasters in Canada and Germany. Last month, I reported on a likely identity behind Dort, the main individual behind the Kimwolf botnet. The other suspect was a 15 y/o from Germany.
https://krebsonsecurity.com/2026/03/feds-disrupt-iot-botnets-behind-huge-ddos-attacks/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/258/762/468/524/130/original/99f730f77a43a287.png

2026-03-12 14:53:04 CET

- reply

That's what I was thinking. It would take a B for people today to go, "whoa"

2026-03-12 13:25:22 CET

Ever wondered how they came up with the value of the Bionic Man? I mean, $6 million is an oddly specific number. I guess back in 1973 that was an awful lot of money. I do wonder how much he would cost if he was made today, and if the new improved Steve Austin still goes "bwa-na-na-na-na" when he runs in slowmo.
https://www.youtube.com/watch?v=nexLuXODhr0

2026-03-12 13:08:46 CET

- reply

Added this as an update to the story on the wiper attack on medtech giant Stryker, which doesn't just sell medical devices: A number of hospitals have opted to disconnect from Stryker's online services to minimize risk from the attack, including LifeNet, a service used by countless hospitals to send EKGs etc. from emergency responders to the emergency room in advance of the patient arriving (to speed up treatment, minimize heart tissue damage, etc). Some states, e.g., Maryland, actually require the transmission of this information, and are asking providers who have disconnected from LifeNet to start using the phone to describe the results of EKGs recorded by emergency personnel in the field.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/216/122/258/867/183/original/17f2c36f5c39a7e2.png

2026-03-11 17:24:45 CET

Breaking, new, by me: Iran-backed Hackers Claim Wiper Attack on Medtech Firm Stryker
A hacktivist group with links to Iran's intelligence agencies is claiming responsibility for a data-wiping attack against Stryker, a global medical technology company based in Michigan. News reports out of Ireland, Stryker's largest hub outside of the United States, said the company sent home more than 5,000 workers there today. Meanwhile, a voicemail message at Stryker's main U.S. headquarters says the company is currently experiencing a building emergency.
From the story:
"Wiper attacks usually involve malicious software designed to overwrite any existing data on infected devices. But a trusted source with knowledge of the attack who spoke on condition of anonymity told KrebsOnSecurity the perpetrators in this case appear to have used a Microsoft service called Microsoft Intune to issue a ‘remote wipe’ command against all connected devices."
"Intune is a cloud-based solution built for IT teams to enforce security and data compliance policies, and it provides a single, web-based administrative console to monitor and control devices regardless of location. The Intune connection is supported by this Reddit discussion on the Stryker outage, where several users who claimed to be Stryker employees said they were told to uninstall Intune urgently."
https://krebsonsecurity.com/2026/03/iran-backed-hackers-claim-wiper-attack-on-medtech-firm-stryker/
#stryker #handala #intune #wiper #cybersecurity
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/211/464/307/859/938/original/3d348cfab9495ad4.png

2026-03-10 21:12:20 CET

The POTUS can't TACO his way out of the war he started now that the price of oil is spiking upwards, so he's loosening restrictions on Russian oil exports. Couldn't have come at a better time for his pal Putin.
"Mr. Bessent later said that the United States was considering lifting more sanctions on Russian oil. And President Trump on Monday said in a news conference that his administration was “waiving certain oil-related sanctions to reduce prices.”
https://www.nytimes.com/2026/03/10/world/middleeast/iran-war-putin-russia-energy-oil-prices.html

2026-03-10 20:42:49 CET

We've been weaning ourselves off ordering things from Amazon, so my wife went and ordered something big from a different retailer, who was actually advertising it at a lower price than Amazon. Well, after a week of waiting for the item to ship, it suddenly just arrived. Turns out the order was fulfilled through Amazon anyway.

2026-03-10 16:47:00 CET

- reply

if it matters, we are also one of the few news sites left on the interwebs that includes a full text RSS feed.

2026-03-09 17:43:48 CET

New, by me: How AI Assistants are Moving the Security Goalposts
AI-based assistants or “agents” — autonomous programs that have access to the user’s computer, files, online services and can automate virtually any task — are growing in popularity with developers and IT workers. But as so many eyebrow-raising headlines over the past few weeks have shown, these powerful and assertive new tools are rapidly shifting the security priorities for organizations, while blurring the lines between data and code, trusted co-worker and insider threat, ninja hacker and novice code jockey.
Read more (and boost please!):
https://krebsonsecurity.com/2026/03/how-ai-assistants-are-moving-the-security-goalposts/
#openclaw #AI #agentic #aiagents #lethaltrifecta
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/200/212/293/707/219/original/44864d04eae0af69.png

2026-03-03 21:26:08 CET

- reply

Yes! Or as I like to say, you don't have to protect what you don't collect.

2026-03-03 21:13:26 CET

Whoops. The data broker giant LexisNexis has suffered another data breach. LN says the data taken was no big deal. The group claiming credit for the breach claims otherwise, of course.
This brings back memories of previous breach stories. One of my first big scoops that made the WaPo dead tree edition's front page involved a breach at LexisNexis in 2005 that exposed >300k consumer records. That breach was from a group of 15-18y/os in the US who also social engineered T-Mobile into giving them access to Paris Hilton's cell phone and the nudes w/in.
https://web.archive.org/web/20160513195758/http://www.washingtonpost.com/wp-dyn/content/article/2005/05/19/AR2005051901854_pf.html
In 2013, I published a scoop about a LexisNexis breach that came from group of criminal hackers who had seized control over ssndob[.]ru, then the largest ID theft service in the underground. In that months-long investigation, we found the hackers had installed backdoors on servers at LexisNexis, Dun & Bradstreet, and Kroll and were using them as part of a small and custom data broker botnet.
https://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/

2026-03-03 17:23:53 CET

- reply

We all have a right to face our destructor!

2026-03-03 17:21:43 CET

Saw a few videos this morning of Iranian drones targeting US military bases and blowing shit up. I was struck by how loud and slow these things are. It's as if the loudest leafblower on the planet had wings and a propeller.
This AP News story has some good detail on Iran's response to its neighbors, which indicates the majority of the many, many missiles and drones Iran sent at or near the UAE were intercepted, but that some less defended places were still hit due to the volume of the missile/drone volley.
"Officials in Dubai in the United Arab Emirates said Sunday that air defenses had dealt with 165 ballistic missiles, two cruise missiles and more than 540 Iranian drones over two days. While officials said they intercepted all air attacks Saturday, debris from the knocked-down weapons sparked blazes at some of Dubai’s most iconic locations."
"Some Iranian drones flew as far as a U.K. military base in Cyprus. The runway at the Royal Air Force base in Akrotiri was struck by an Iranian drone Sunday, according to U.K. officials, and sirens blared there again Monday when two more drones heading toward the base were intercepted."
"State-of-the-art U.S. and Israeli air defense assets have proven efficient in intercepting most of Iran’s ballistic missiles launched at Israel. But the attacks using large numbers of cheap drones hit some softer targets lacking the same level of protection."
https://apnews.com/article/iran-us-israel-gulf-war-drone-49c8ea76358e579447ff839485f394ac

2026-03-03 16:49:03 CET

The POTUS is learning that you can't just TACO yourself out of a war that you JUST started, no matter how the market reacts. It turns out the market reacts badly to uncertainty, and the president just said he's going to keep bombing Iran for a few more weeks, maybe longer (probably if he'd said yeah we'll be wrapped up by April 20 the market would be like oh, okay cool). But it's not just everyone's savings and 401ks that are going to take a nosedive because of this war; a LOT of stuff that was already overpriced because of his arbitrary taxes is about to get way more expensive.

2026-03-03 16:04:02 CET

- reply

Because Conde Nast runs Ars and other properties like content treadmills? Reporters are expected to churn out a lot of content and clicks.

2026-03-03 15:57:11 CET

Found myself wincing while reading this story about how Ars Technica fired a reporter over fabricated quotations generated by an AI tool. What a mess. And a tough one to bounce back from. I get asked all the time how I use AI in my work, and my answer is always the same: I don't, for all the reasons I also don't delegate important research to others, plus a whole bunch of other good reasons. But I really am interested in the answer from other journalists, because I suspect I'm in the minority here.
From Futurism.com:
"In the post, Edwards said that he was sick at the time, and “while working from bed with a fever and very little sleep,” he “unintentionally made a serious journalistic error” as he attempted to use an “experimental Claude Code-based AI tool” to help him “extract relevant verbatim source material.” He said the tool wasn’t being used to generate the article, but was instead designed to “help list structured references” to put in an outline. When the tool failed to work, said Edwards, he decided to try and use ChatGPT to help him understand why.
“I should have taken a sick day because in the course of that interaction, I inadvertently ended up with a paraphrased version of Shambaugh’s words rather than his actual words,” Edwards continued. He emphasized that the “text of the article was human-written by us, and this incident was isolated and is not representative of Ars‘ editorial standards. None of our articles are AI-generated, it is against company policy and we have always respected that.”
https://futurism.com/artificial-intelligence/ars-technica-fires-reporter-ai-quotes

2026-03-03 14:29:12 CET

Well, we're batting 0 for like 200 on observing cool astronomical phenomena lately.
Total solar eclipse: Cloudy.
Northern Lights appear in Virginia! Cloudy.
Rare planetary conjunction happens. Cloudy.
Blood Moon from a lunar eclipse. Cloudy.
I'm sure when the aliens finally come park their giant death cruiser in front of our planet, it'll be cloudy then, too.

2026-03-02 17:11:09 CET

- reply

just search messages for krebson. reporting them all would take quite some time.

2026-03-02 17:05:44 CET

Someone has registered a ton of new accounts and is spamming with messages saying I'm a pedophile. Sorry @npub1vtx…e7wk

2026-02-25 21:19:36 CET

- reply

I'd argue that very few companies have any real appreciation for how many of their employees are already feeding API keys and other stuff into fairly new and questionable agentic AI tools or platforms. So many companies are like, oh we're taking a wait-and-see approach to adopting AI. Meanwhile, half their dev team is doing critical development work on shared servers that have no authentication or limited (no 2fa) auth.

2026-02-25 21:04:25 CET

Agentic AI-based services are the new Shadow IT. Change my mind.

2026-02-23 21:13:01 CET

Lol, most of these impressions were on a post I made about why you maybe shouldn't verify your LinkedIn account.
https://infosec.exchange/@briankrebs/116103192779110422
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/121/765/448/702/843/original/6b0533bf2483e729.png

2026-02-23 15:57:23 CET

Bloomberg did some terrific and deep reporting last week on how private equity debt likely contributed to a series of major compromises at Ivanti at the hands of China-backed hacker groups. They touch on several other examples, but it seems like the list could be quite long at this point.
https://www.bloomberg.com/news/features/2026-02-19/vpn-used-by-us-government-failed-to-stop-china-state-sponsored-hackers
https://archive.ph/BkzSX
The guys at the Risky Business podcast have been talking forever about major breaches and code compromises that occurred after various security companies were acquired by private equity firms and loaded with debt. They've argued (correctly, in my book) that when you see this happening with a vendor you use, it's a good signal to find a suitable alternative to whatever that platform does for you.

2026-02-10 23:28:17 CET

Yes, Windows (ab)users it's your favorite time of the month once again (ducks). Microsoft today released updates to fix more than 50 security holes in its Windows operating systems and other software, including patches for a whopping six "zero-day" vulnerabilities that attackers are already exploiting in the wild.
https://krebsonsecurity.com/2026/02/patch-tuesday-february-2026-edition/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/048/686/678/525/034/original/a72d44121d2b8d0e.png

2026-02-06 17:32:57 CET

When I saw the other journalists that were nominated, I didn't think there was a chance (e.g. ProPublica was nominated for their excellent investigative reporting uncovering the Pentagon's reliance on Chinese contractors for cloud work). I'm very flattered to be in such great company. Thank you to the Institute for Security and Technology (IST) for this award.
Last night's IST gala at the National Press Club was a stroll down memory lane in many ways. Ran into people I haven't seen in person for ages, and most of them have been involved in shaping cybersecurity policy for 25+ years.
It was also bittersweet because I spent a lot of time at the Press Club as a reporter at The Washington Post, and I'm still livid about the insanity of the 300 or so WaPo journalists who lots their jobs this week.
I'm particularly mystified by the decimation of the Post's Metro staff; despite its stature as a top source of national and international news, The Washington Post has always maintained a strong focus on what's going on in the DC area. When they merged washingtonpost.com with the dead tree edition in 2009 and eliminated my job, the mantra of the company was they wanted to be THE source of news about what's happening in the Nation's Capital, and how policy being made in DC affects the rest of the world. Here's part of what I told the audience last night:
"I horrified this week to see The Washington Post lay off 300 of its 800 remaining journalists -- the third major staff reduction in as many years. A lot of the cuts are deeply affecting the foreign and local metro staff; it's easy to forget the Watergate scandal started as a metro story. Probably we need several hundred more reporters digging into what this administration is doing, because Watergate frankly can't hold a candle to it all."
"I'm hoping all of the post-Posties will land in a better place soon, but I also hope they can keep doing their important work regardless of where it comes from. And I will continue to advocate for, support and encourage anyone who wants to go the independent route. I think journalism is going to be just fine for now, but I'm not sure I share the same view about many traditional news organizations. I hear from a lot of reporters considering the going out on their own worry about not having a big publication name to automatically open doors for them, or watch their backs legally, and those are certainly big adjustments of going solo. But you know what makes all that worth it? When you're breaking news that forces important people to answer hard questions, and the gatekeepers go, wait, who are you with again?"
https://www.linkedin.com/feed/update/urn:li:activity:7425373027145752577/?commentUrn=urn%3Ali%3Acomment%3A(activity%3A7425373027145752577%2C7425575747831947264)&dashCommentUrn=urn%3Ali%3Afsd_comment%3A(7425575747831947264%2Curn%3Ali%3Aactivity%3A7425373027145752577)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/024/623/073/463/045/original/df6c07ec86e63501.png

2026-01-30 17:52:35 CET

Finally got around to learning the song "Breathe" by Pink Floyd on the piano. The chord sequences are just dripping with chill. This song reminds me of Zepplin's "Rain Song," in that I could listen to it and play it for hours on end. Pink Floyd recorded this song with a guitar mostly doing the chords. It sounds amazing with the keyboard filling in, especially with some funky preset like 70s funk.
Breathe:
https://www.youtube.com/watch?v=jcz0YxYl6Ac&list=RDjcz0YxYl6Ac&start_radio=1
Quick and dirty tutorial on the chords (you can mess around within the chord in the right hand for a melody):
https://www.youtube.com/watch?v=apQRi_B5miE

2026-01-29 17:04:49 CET

IDK why, but I usually feel compelled to like someone's comment on LinkedIn before I tear into it with an opposing view. Feels more civil that way, I guess.

2026-01-26 18:10:54 CET

We knew this was coming, but now the clock is running. From Privacy International:
"Yesterday the Trump Administration announced a proposed change in policy for travellers to the U.S. It applies to the powers of data collection by the Customs and Border Police (CBP)."
"If the proposed changes are adopted after the 60-day consultation, then millions of travellers to the U.S. will be forced to use a U.S. government mobile phone app, submit their social media from the last five years and email addresses used in the last ten years, including of family members. They’re also proposing the collection of DNA."
PI linked to and summarized a Federal Register entry describing the proposed requirements:
-All visitors must submit ‘their social media from the last 5 years’
-ESTA (Electronic System for Travel Authorization) applications will include ‘high value data fields’, ‘when feasible’
‘telephone numbers used in the last five years’
-‘email addresses used in the last ten years’
-‘family number telephone numbers (sic) used in the last five years’
-biometrics – face, fingerprint, DNA, and iris
-business telephone numbers used in the last five years
-business email addresses used in the last ten years.
https://www.privacyinternational.org/news-analysis/5713/trump-administration-wants-your-dna-and-social-media
The Federal Register entry says comments are encouraged and
must be submitted (no later than
February 9, 2026) to be assured of
consideration
Federal Register entry: https://www.govinfo.gov/content/pkg/FR-2025-12-10/pdf/2025-22461.pdf

2026-01-06 20:11:40 CET

- reply

I don't even know where to start here. wow

2026-01-02 16:55:02 CET

From the Financial Times:
"Australia’s largest pension fund is planning to reduce its allocation to global equities next year, amid signs that the artificial intelligence boom in the US stock market could be running out of steam."
"John Normand, head of investment strategy at the A$400bn (US$264bn) AustralianSuper, told the Financial Times that not only did valuations of big US tech companies look high relative to history, but the leverage being used to fund AI investment was increasing “very rapidly”, as was the pace of fundraising through mergers, venture capital and public listings."
“I can see some forces lining up that we are looking for less public equity allocation at some point next year. It’s the basic intersection of the maturing AI cycle with a shift towards Fed[eral Reserve] tightening in 2027,” Normand said in an interview.
https://archive.is/hru63

2025-12-23 15:41:15 CET

When an entire class of technology states on the packaging that it was made in China but intended "for overseas use only," this should really give you pause before plugging it into your network.
You will find this verbiage on a lot of Android TV streaming boxes for sale at the major retailers. There's a very good reason the country that makes this crap doesn't want it on their own networks. My advice: If you have one of these Android streaming boxes on your network or get one as a gift, toss it in the trash. I'll have a lot more about this in the New Year, but these things are responsible for building out a botnet that currently has ~2M devices and is growing rapidly. https://blog.xlab.qianxin.com/kimwolf-botnet-en/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/769/390/783/483/982/original/bc84b9308c7e6db3.png

2025-12-11 19:17:46 CET

- reply

Headline writing contest: I was going to blow off the rest of this week after a few stories fell through and took the wind out of my sails. But this just seems too much like a gift, and I suck at writing headlines. Suggestions?

2025-12-11 18:57:51 CET

- reply

OMGOMGOMGOMG
https://www.reddit.com/r/AirForce/comments/1pie3px/plastered_all_over_the_pentagon_today/?chainedPosts=t3_1pijkwc
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/702/219/722/002/473/original/ca46092313764540.png

2025-12-08 19:53:41 CET

...and you're wasting even more of your life posting about your regrets at the Nazi bar. Still, they probably need to hear it most. Points for partial awakening. Hey, at least you made good money doing it, right?
"I wasted 8 years of my life in crypto"
"Over time however, I felt like I have lost my purpose in crypto. The initial siren songs of crypto’s transformative powers waned after working in the space full-time. I was disillusioned by my target customers and who I was really building for. I completely misunderstood what the actual users of crypto are v.s. just propaganda. Crypto purports that it helps decentralize the financial system, which I completely bought into, but in reality, it’s just a speculation and a gambling hyper-system that’s really just a mirror of what the economy is now."
"The reality hit me like a fucking truck. I am NOT building a new financial system. I built a casino. A casino that does not call itself a casino, but it is the biggest, online, multi-player 24/7 casino our generation has ever concocted. Some part of me wants me to feel proud that I contributed at least my 20s building this casino out. Another part of me literally feels like I wasted my entire 20s in this space. I wasted my life on this, but at least I made good money from it."
https://x.com/kenchangh/status/1994854381267947640

2025-11-20 22:08:32 CET

Watched the Kubrick classic 2001: A Space Odyssey on an international flight recently, and can confirm this movie is still best way to fall asleep on a plane.
Except the part where Hal (AI) goes rogue and starts killing the crew. I'm not proud of this, but I have frequent fantasies of being Dave, where I'm floating around inside AI's mind, disconnecting critical circuits while the machine gurgles "Daisy."

2025-11-20 19:45:14 CET

- reply

Welp, they rolled back the proposed changes put in place after the extent of the Salt Typhoon debacle became widely known (shocker). Sen. Mark Warner (D-Va.) is just stating the obvious here:
“The Salt Typhoon intrusion made clear that existing voluntary measures alone have not been sufficient to prevent sophisticated, state-sponsored actors from gaining long-term, covert access to critical networks. While collaboration with industry is essential, it must be paired with clear, enforceable expectations that reflect the scale of the threat."
"I am concerned that abandoning an enforceable, standards-based approach in favor of undefined ‘flexible’ solutions leaves us without a credible plan to address the gaps exposed by Salt Typhoon, including basic failures like credential reuse and the absence of multi-factor authentication for highly privileged accounts."

2025-11-20 16:56:21 CET

The Federal Communications Commission (FCC) is slated to vote today on a proposal to scrap cyber rules that the FCC began adopting during the Biden administration.
"The commission first declared that the 1994 Communications Assistance for Law Enforcement Act (CALEA) “affirmatively requires telecommunications carriers to secure their networks from unlawful access or interception of communications,” and then it proposed specific requirements that telecoms should have to meet."
https://www.cybersecuritydive.com/news/fcc-telecom-regulation-reversal-cantwell-letter/805906/
https://www.fcc.gov/November2025
Pay no mind to the fact that the FBI recently warned the public away from sharing sensitive information over the public telephone networks because they are all so completely owned by state-sponsored hackers China that they should not be trusted.
Also, try to ignore the fact that CALEA data is exactly what the Chinese hackers succeeded in gaining access to, including call and text message metadata.
We need 10x more oversight of ISPs and telephony providers, not less. What's clear is that what we've been doing to encourage telcos to care more about security is not working at all, but it's for damn sure they're not going to do it on their own.

2025-11-19 17:41:00 CET

- reply

I believe people who have turned off displaying their number of followers are given a -1 follower count.

2025-11-04 02:18:07 CET

Did you watch the unfuckingbelievable interview that 60 Minutes aired last night on Trump? The travesty is that the edited version should never have been edited, as we can see from viewing the transcript of the entire batshit crazy interview. Wherein Trump contradicts himself many times and claims he had no idea who Justin Sun even was before pardoning him for billions in crypto money laundering. The president even bragged that he got 60 Minutes' parent to pay him $15M, then suggested they could edit that out of the interview (which they dutifully did), even though he sued Paramount for editing out unflattering parts of an interview w/ VP Kamala Harris last year, and they caved because they wanted a merger to go through.
Mike Masnick at Techdirt has an excellent breakdown of the lunacy. I've been waiting to see how 60 Minutes was going to handle its next interview with the POTUS, and they didn't fail to disappoint.
https://www.techdirt.com/2025/11/03/60-minutes-edits-donald-trump-telling-them-60-minutes-should-edit-donald-trump-talking-about-how-60-minutes-paid-him-for-editing-kamala-harris/

2025-10-21 01:39:56 CEST

Took this photo last week w/ my iPhone 15 Pro while reclining just after sundown on St. Andrews Beach, a lovely (and almost deserted this time of year) stretch of coastline at the tail end of the Mornington Peninsula in Australia. Did not adjust any settings. Did not improve when I did, probably because I wasn't holding it steady enough. Still, it really is a marvel how far mobile phone cameras have come.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/409/122/601/146/774/original/5e5da30dbf0d8cf5.png

2025-10-08 15:58:22 CEST

- reply

Oh, good. So I guess I can disregard all the weird account emails and +1 bot calls I got yesterday? Coolcoolcool.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/338/883/341/653/974/original/a435ac8e502f80ba.png

2025-09-25 19:01:57 CEST

Whatever this is, it's probably not great. WaPo writes: Pete Hegseth orders rare urgent meeting of hundreds of generals, admirals
"Defense Secretary Pete Hegseth has ordered hundreds of the U.S. military’s generals and admirals to gather on short notice — and without a stated reason — at a Marine Corps base in Virginia next week, sowing confusion and alarm after the Trump administration’s firing of numerous senior leaders this year."
"The highly unusual directive was sent to virtually all of the military’s top commanders worldwide, according to more than a dozen people familiar with the matter. The directive was issued earlier this week, as a government shutdown looms, and months after Hegseth’s team at the Pentagon announced plans to undertake a sweeping consolidation of top military commands."
"In a statement Thursday, Pentagon spokesman Sean Parnell affirmed that Hegseth “will be addressing his senior military leaders early next week,” but he offered no additional details. Parnell, a senior adviser to the defense secretary, voiced no concerns about The Washington Post reporting on the meeting, scheduled for Tuesday in Quantico, Virginia."
https://www.washingtonpost.com/national-security/2025/09/25/hegseth-generals-quantico-meeting/

2025-09-21 18:50:15 CEST

All the feckless scheming by the Democrats isn't going to unseat the Orange Tyrant in the White House. It's going to take mass public demonstrations, extended work stoppages/strikes, govt shutdowns, and sustained and viral boycotts of companies that bent the knee for profit or because they have spineless leaders.
Not saying it's going to be easy, but violent resistance is not the answer, asthe Cheetoh-in-Chief would like nothing more than that. Nonviolent resistance works, and has a long history of unseating despotic leaders.
From today's NYT:
"President Trump demanded on Saturday that his attorney general move quickly to prosecute figures he considers his enemies, the latest blow to the Justice Department’s tradition of independence."
“We can’t delay any longer, it’s killing our reputation and credibility,” Mr. Trump wrote in a social media post addressed to “Pam,” meaning Attorney General Pam Bondi. “They impeached me twice, and indicted me (5 times!), OVER NOTHING. JUSTICE MUST BE SERVED, NOW!!!”
Mr. Trump named James B. Comey, the former F.B.I. director; Senator Adam B. Schiff, Democrat of California; and Letitia James, the New York attorney general, saying he was reading about how they were “all guilty as hell, but nothing is going to be done.”
"Asked later by reporters about his message for Ms. Bondi, Mr. Trump said, “They have to act. They have to act fast.”
https://www.nytimes.com/2025/09/20/us/politics/trump-justice-department-us-attorneys.html

2025-09-20 21:05:15 CEST

Happy DDoS-a-Versary to me. Today's Mirai-based botnet attacks are now launching attacks that are 20x the size of that first big Mirai attack.
https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/
Not long after I published that story, the Mirai botmasters turned up the heat and got me evicted from Akamai's network. I remember the next day interviewing different DDoS protection companies about their pricing and having to pick my jaw up off the floor each time. Many thanks to Akamai for all that attacks that they very much did protect me from over the years. And also thanks again to Google Shield for helping to keep my little site online ever since.
BTW, that Sept. 2016 attack, and the quick leaking of the botnet's source code by its 20-something overlords led me to pretty much cancel everything and spend 24/7 the next four months tracking these guys down. As I did that, I kept interviewing people who had just talked to the FBI. I published the longest story I'd ever written on Jan. 18, 2017, the same day the FBI raided the homes of the alleged authors. Who ended up being convicted and sentenced to helping the FBI catch cybercriminals, which is a really cool and rare success story.
https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/

2025-09-20 20:35:16 CEST

No, we're not going to limit COVID vaccines. We're just going to continue to sow fear, uncertainty and doubt in the minds of the public about whether it's safe or even available.
From NYT: "The federal vaccine committee appointed by Health Secretary Robert F. Kennedy Jr. voted unanimously on Friday to further limit access to Covid vaccines, recommending that adults 65 and older receive the shots only after discussing the potential benefits and risks with a health care provider."
"The panel also said that everyone from 6 months to 64 years old could get the vaccine after consulting with a provider. But it was unclear whether that contradicted the Food and Drug Administration’s authorization of the shots only for adults over 65 and younger people with certain health conditions."
"Together, the decisions raise questions about whether Americans can continue to walk into their neighborhood pharmacies for routine vaccinations or whether in some states they will first need a doctor’s permission."
https://www.nytimes.com/2025/09/19/health/cdc-vaccines-mmrv-hepatitis-b.html
It's a long time between now and November 2026. How many people will get sick and die unnecessarily before then because of this administration's utter disregard for and hostility toward science, hard data and smart people?

2025-09-16 16:11:19 CEST

Breaking, new, by me:
Self-replicating "Shai-Hulud" worm hits 180+ Software Packages
At least 187 code packages made available through the JavaScript repository NPM have been infected with a self-replicating worm that steals credentials from developers and publishes those secrets on GitHub, experts warn. The malware, which briefly infected multiple code packages from the security vendor CrowdStrike, steals and publishes even more credentials every time an infected package is installed.
https://krebsonsecurity.com/2025/09/self-replicating-worm-hits-180-software-packages/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/214/372/021/990/433/original/c7d2e23d5d541bfe.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/214/372/138/399/692/original/d90cfbc59323a49b.png

2025-09-13 16:30:19 CEST

The Great Firewall of China has apparently experienced a great data spill. > 500gb of source code, work logs and internal communication records were leaked. Some light reading for the weekend /s
https://gfw.report/blog/geedge_and_mesa_leak/en/

2025-09-12 17:08:02 CEST

Makes that TWO pitches I've received in the last 24h that included the delightful phrase "new AI-powered cloud security and compliance software."
There's so much to unpack here it's hard to know where to start (or stop), but it seems to suggest that some new AI-based technology has been devised to help close security compliance gaps. #1: Checking boxes is not where most organizations are failing. #2 Where are the basic standards of care for AI-based software that would give this untested technology the right to claim the ability to audit anything? Let alone itself.
The golden rule for physicians is "First, do no harm." Somehow, we've grown accustomed to security products and software that violate this basic idea six ways from Sunday.

2025-09-10 21:29:07 CEST

I'd pay for a high-quality handmade sketch (a good one, not some stick figures) that depicts what I desperately want to ask AI to devise just because I like the idea of asking it to imagine its own demise: I'm picturing a scene where the data centers have been overgrown with dangling vines and weeds creeping out of server cabinets, which have long ago been stripped for scarce parts in the battle against the machines. I'd settle for a more gently apocalyptic theme as well.

2025-09-10 17:34:58 CEST

- reply

Clearly, Wall Street is partying hard. Caught this via Stephen Colbert's show two nights ago (we usually watch them a day later): Cocaine levels in Nantucket sewage 50 percent above US average, health data reveals.
"This wastewater initiative, which builds on infrastructure developed during the COVID-19 pandemic, tests for cocaine, methamphetamine, nicotine, fentanyl, codeine, dihydrocodeine, hydrocodone, hydromorphone, morphine, oxycodone, oxymorphone, and tramadol."
"Cocaine levels in the sewage during the testing period were above both the national and regional average, topping more than 1,500 nanograms of substance per liter at points, the data showed."
https://www.boston25news.com/news/local/cocaine-levels-nantucket-sewage-50-above-us-average-health-data-reveals/P4QHYTYWUBDG5M23R2OXZUGZWY/

2025-09-06 20:18:40 CEST

As if POTUS' trade policies haven't directly caused this union in record time. Instead of admitting this was mostly his doing, he doubles down and tells India to go ahead and fuck off with their new friends.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/158/722/339/910/030/original/4ee6e02661af7397.png

2025-09-02 16:56:20 CEST

And just like that, the largest known DDoS has nearly doubled in size over the past couple of months. Cloudflare promises more details, and says the largest attack (11.5 terabits per second) came from Google Cloud.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/135/278/937/770/008/original/f472a9ab5eee73c4.png

2025-09-02 00:17:27 CEST

New, from me:
The recent mass-theft of authentication tokens from Salesloft, whose AI chatbot is used by a broad swath of corporate America to convert customer interaction into Salesforce leads, has left many companies racing to invalidate the stolen credentials before hackers can exploit them. Now Google warns the breach goes far beyond access to Salesforce data, noting the hackers responsible also stole valid authentication tokens for hundreds of online services that customers can integrate with Salesloft, including Slack, Google Workspace, Amazon S3, Microsoft Azure, and OpenAI.
https://krebsonsecurity.com/2025/09/the-ongoing-fallout-from-a-breach-at-ai-chatbot-maker-salesloft/
Incidentally, there has been some truly awful reporting perpetrated around the periphery of this story that needs to be called out as a irresponsible bullshit. Newsweek uncritically reported today the names of Google employees who were being threatened by the threat actors who claim (with little convincing evidence) to be responsible.
And Trend Micro's blog put out what I can only assume is AI-produced slop drivel because it basically claimed that a few hundred Google Workforce accounts that were exposed in this Salesloft breach suddenly meant billions of Gmail users were at risk. That Trend atrocity was then of course re-perpetrated to produce even more uncritical garbage "reporting" about this incident. I'm not linking to either, just needed to get that off my chest. It's truly remarkable when Google has to put out a statement talking everyone down off the ledge over this. Pro tip: if you don't track these groups for a living and you don't live and breathe this Com crap, you're probably not going to be able to just parachute in here and write a cool tech story that is also accurate.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/131/304/653/608/983/original/7cf2cf9fd205a6a7.png

2025-08-29 22:11:19 CEST

Love to see scambaiters credited in DOJ press releases about busted scammers.
YouTube Scambaiters Help Dismantle $65 Million Multinational Fraud Ring Targeting Thousands of Seniors
SAN DIEGO – Twenty-eight alleged members of a Chinese organized crime ring are charged in four federal grand jury indictments with participating in a massive $65 million fraud scheme targeting thousands of seniors across the United States—including a 97-year-old San Diego widow of a Holocaust survivor who lost her entire life savings.
Notably, YouTuber Pierogi from “Scammer Payback”— which is known for exposing scammers—played a crucial role in documenting key evidence. In a series of videos, Pierogi from Scammer Payback teamed up with two other YouTubers from “Trilogy Media” to publish videos on their respective YouTube channels.
In coordinated sting operations, Scammer Payback and Trilogy Media baited fraudsters, confronted them on camera, and published those videos to their respective YouTube channels. Videos posted in 2020 and 2021 helped law enforcement identify Zhiyi Zhang, Dudu Chen and Huajian Chen. All three are named in the indictments. The videos also helped shed light on how the conspiracy operated and led to the identification of high-level members of the organization.
https://www.justice.gov/usao-sdca/pr/youtube-scambaiters-help-dismantle-65-million-multinational-fraud-ring-targeting

2025-08-26 16:21:27 CEST

The cybersecurity community on Reddit responded in disbelief this month when a self-described Air National Guard member with top secret security clearance began questioning the arrangement they'd made with company called DSLRoot, which was paying $250 a month to plug a pair of laptops into the Redditor's high-speed Internet connection in the United States.
I spent a few days working with another researcher to dig into the history and provenance of DSLRoot, one of the oldest "residential proxy" networks with origins in Russia and Eastern Europe. Its proprietor used to call himself the "USProxyKing" on the forums, and built his proxy business through pay-per-install affiliate programs and by uploading booby-trapped cracked software and movies to the file-sharing networks.
https://krebsonsecurity.com/2025/08/dslroot-proxies-and-the-threat-of-legal-botnets/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/095/502/187/558/692/original/40706721aa351de4.png

2025-08-14 21:43:54 CEST

The FBI has published an evergreen advisory warning about cryptocurrency recovery scammers lurking everywhere. The minute you mention online that you might have lost money to a crypto scam, you will be flooded with come-ons from "recovery experts" who hold out the unlikely promise of recovering your funds -- for a fee.
These scammers prey on people who are understandably frantic after having just suffered a potentially life-altering financial loss, and are desperate for a quick solution. Far too many people who get burned by crypto get victimized a second time by these charlatans. I probably delete a dozen or more comments each week from my blog that are left by these dirtballs.
https://www.ic3.gov/PSA/2025/PSA250813
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/028/825/744/251/141/original/040169606035fb69.png

2025-08-14 15:21:03 CEST

- reply

I mean, look at this crap:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/027/316/689/980/444/original/a0be8fb0302cad56.png

2025-08-07 19:17:41 CEST

- reply

bottom line: the administration's actions will almost certainly result in Americans paying a LOT more for power in the coming years, as demand exceeds supply and major infrastructure investments are needed just to accommodate data center needs.
from an IEA report earlier this year:
"In the United States, power consumption by data centres is on course to account for almost half of the growth in electricity demand between now and 2030. Driven by AI use, the US economy is set to consume more electricity in 2030 for processing data than for manufacturing all energy-intensive goods combined, including aluminium, steel, cement and chemicals. In advanced economies more broadly, data centres are projected to drive more than 20% of the growth in electricity demand between now and 2030, putting the power sector in those economies back on a growth footing after years of stagnating or declining demand in many of them."
https://www.imf.org/en/Blogs/Articles/2025/05/13/ai-needs-more-abundant-power-supplies-to-keep-driving-economic-growth
From the IMF:
"The world’s data centers consumed as much as 500 terawatt-hours of electricity in 2023, according to the most recent full-year estimate by the Organization of the Petroleum Exporting Countries. That total, which was more than double the annual levels from 2015-19, could triple to 1,500 terawatt-hours by 2030, OPEC projects."
https://www.imf.org/en/Blogs/Articles/2025/05/13/ai-needs-more-abundant-power-supplies-to-keep-driving-economic-growth

2025-08-06 15:19:03 CEST

- reply

Probably the implication is that there would be a much more forceful and conspicuous presence of law enforcement officers in the city.

2025-08-06 01:05:59 CEST

WaPo reports Edward "Big Balls" Coristine was injured in a carjacking. Trump and Musk are using the incident to float the idea of taking federal control over Washington, D.C.
https://www.washingtonpost.com/dc-md-va/2025/08/05/trump-doge-worker-washington-dc-crime/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/978/657/443/138/205/original/5ad65c2c4f618134.png

2025-07-31 18:26:48 CEST

The constant CAPTCHAs and other "I-am-not-a-robot" tests from websites are annoying enough, without considering the reality that they really don't present much of a challenge for bots anymore. Wait till they have to pass age verification...
"Maybe they should change the button to say, "I am a robot"?
"On Friday, OpenAI's new ChatGPT Agent, which can perform multistep tasks for users, proved it can pass through one of the Internet's most common security checkpoints by clicking Cloudflare's anti-bot verification—the same checkbox that's supposed to keep automated programs like itself at bay."
"ChatGPT Agent is a feature that allows OpenAI's AI assistant to control its own web browser, operating within a sandboxed environment with its own virtual operating system and browser that can access the real Internet. Users can watch the AI's actions through a window in the ChatGPT interface, maintaining oversight while the agent completes tasks. The system requires user permission before taking actions with real-world consequences, such as making purchases. Recently, Reddit users discovered the agent could do something particularly ironic."
"The evidence came from Reddit, where a user named "logkn" of the r/OpenAI community posted screenshots of the AI agent effortlessly clicking through the screening step before it would otherwise present a CAPTCHA (short for "Completely Automated Public Turing tests to tell Computers and Humans Apart") while completing a video conversion task—narrating its own process as it went."
https://arstechnica.com/information-technology/2025/07/openais-chatgpt-agent-casually-clicks-through-i-am-not-a-robot-verification-test/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/948/771/263/439/809/original/5fa132d0f4ccb77c.png

2025-07-31 01:33:11 CEST

How to waste a day debunking someone else's scoop:
Someone forwarded me this recent story from Straight Arrow News (I publication I didn't previously know existed) which rather breathlessly claimed millions of cars were at risk from new custom firmware sold by a Russian hacker that would enable Flipper Zero users to unlock the doors and trunks of countless makes and models of different cars for a few hundred bucks. Basically, turn the Flipper into a sub-Ghz repeater that can intercept and replay the radio signal sent out when someone presses their car key fob.
https://san.com/cc/millions-of-cars-at-risk-from-flipper-zero-key-fob-hack-experts-warn/
I was skeptical of this story because I recalled reading a blog post from Flipper last year after the Canadian government said it was going to ban flippers. In response, Flipper Devices wrote:
"We are not aware of any officially confirmed cases of theft using a Flipper Zero. This is because the device has limited functionality and can't be used as a repeater to attack keyless entry systems. Flipper Zero is equipped with only one sub-1 GHz radio module, while keyless repeaters have 4 radio modules: one for communication with the car, another one for communication with the key fob, and two for communication between the repeaters."
https://blog.flipper.net/response-to-canadian-government/
It took several hours of questioning the Russian guy on Telegram for him to admit that using his firmware successfully requires additional radio units and other stuff not pictured in most of his sales videos.
https://www.youtube.com/@DjonixTV/videos
I asked him whether he was at all concerned that the Russian authorities might be interested in him, and he curtly replied that this was his concern, not mine. Later he asked why I'd asked this question.
It turns out, in one of his videos he replied to a comment by posting a Google Docs link to a spec and pricing sheet. Clicking "details" on the Google Docs file showed a username and author: [email protected]. Searching on this address in breach tracking services finds it is associated with multiple Russian government records saying the email belongs to a guy from Moscow named Danil Viktorovich Doragu who uses the phone number 79267824950. That phone number is tied to a Telegram account for user "r3df0xx," and a search on this username in Intel 471 finds Daniel has been selling custom firmware for Flipper devices for several years. Oh, and his LinkedIn profile includes a link to the GitHub account "DarkFlippers."
https://www.linkedin.com/in/daniil-dogaru-a58199208/

2025-07-03 18:49:28 CEST

This WaPo story about an increase in people sending AI note takers to Zoom meetings in their stead conjures up the scene from the awesome 1985 comedy, Real Genius, where by the end of the semester all of the chairs are filled with tape recorders and the professor has left a recording of the lesson playing at the front of the class.
https://www.washingtonpost.com/technology/2025/07/02/ai-note-takers-meetings-bots/
https://www.youtube.com/watch?v=EueMqc8i4GI

2025-06-27 00:37:21 CEST

- reply

Wait, hold the phone. Apparently, Big Balls is back in the...saddle? Wired reports he's been re-hired at the Social Security Administration.
https://www.wired.com/story/big-balls-social-security-administration/

2025-05-23 05:50:26 CEST

- reply

I know. I felt the same way. But please if your job is remotely related to security, pay attention and learn.

2025-05-23 04:43:55 CEST

Oh yay. Our dystopian AI agentic future is now at 4.0
https://news.ycombinator.com/item?id=44063703
For a clue at how new agentic AI is for most noobs (including me), agentic is not even technically a globally accepted word yet AFAICT.

2025-05-23 01:59:14 CEST

PSA: If you are not browsing the interwebs with a VPN enabled and you suddenly find your browser sessions are frequently stymied by constant CAPTCHA requests, that's one potential sign that your system may be compromised by something that is routing other peoples' Web traffic through your computer. It's not a dead giveaway of a compromise by any stretch, but it is something that you should probably investigate further.

2025-05-19 13:46:40 CEST

- reply

Hah! Well, Spanish still follows most other languages in making "left" sound bad in a lot of contexts. In Spanish, the word for left can mean twisted or deceptive. In Latin it's "sinistra/sinistrum" which is "sinister." To be "ambidextrous" is to be literally right-handed in both hands.
Can you tell I'm a lefty? :)

2025-05-07 14:35:56 CEST

A+ trolling by Harvard.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/466/571/289/448/814/original/7f85a64c6373fe20.jpg

2025-05-06 14:59:53 CEST

- reply

I'm weird about checksums, too. How hard is it for companies that make software to provide a checksum of the download?

2025-05-05 18:29:41 CEST

Enjoyed this post from Malwarebytes about how AI is getting creepy good at guessing the geo-location of photos/videos by analyzing the tiniest of clues.
When analyzing videos with audio, e.g., apparently just having a few birds chirping in the background can be enough to make a strong guess about where the video was recorded.
https://www.malwarebytes.com/blog/news/2025/04/ai-is-getting-creepy-good-at-geo-guessing?utm_source=iterable&utm_medium=email&utm_campaign=b2c_pro_oth_20250505_mayweeklynewsletter_v1_174617365504&utm_content=AI

2025-04-24 00:21:34 CEST

- reply

thanks, me too. I didn't grab the actual code though.

2025-04-16 23:33:59 CEST

Another area where the POTUS is setting up a constitutional challenge with the judicial branch:
"The Associated Press said in a court filing on Wednesday that the Trump administration had defied a federal judge’s order requiring the administration to restore the wire service’s full access to the White House."
"Lawyers for the The A.P. wrote that a White House spokesman had told A.P. reporters on Monday that they would continue to be excluded from the press pool — a small, rotating group of journalists who cover certain events in confined spaces at the White House — because the “case is ‘ongoing.’”
"For the last two months, The A.P.’s access to President Trump has been sharply curtailed over its refusal to refer to the Gulf of Mexico as the Gulf of America, the name that Mr. Trump designated for the body of water."
"In a temporary order last week, Judge Trevor N. McFadden of the Federal District Court in Washington, D.C., said the exclusion violated the First Amendment’s free-speech clause and instructed the White House to restore The A.P.’s access “immediately.”
https://www.nytimes.com/2025/04/16/us/politics/trump-ap-white-house-access.html

2025-04-16 17:33:53 CEST

Hey Parallels, thanks for giving me a heart attack this morning. Why are you asking to connect to an "account" page at account.parallels.cn"?? That's a nope. Thank goodness for Little Snitch firewall. Found exactly one discussion thread about this in an online search, and there were no responses except "yeah, I had the same question."
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/348/358/180/198/650/original/72e81d9a9a0c62c5.png