Will Dormann

I play with vulnerabilities and exploits.
I used to be https://twitter.com/wdormann but Twitter has become unbearable, so here I am.

Public Key

npub1n3aew4nfpzqwqmws43pydswj06vu97wch6upnchrz4ku8ckc60nqfrk88f

NIP-05 Address

wdormann@infosec-exchange.mostr.pub

Profile Code

nprofile1qqsfc7uh2e5s3q8qdhg2csjxc8f8axwzl8vtawqeut332mwrutvd8espz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds8exhs6

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1n3aew4nfpzqwqmws43pydswj06vu97wch6upnchrz4ku8ckc60nqfrk88f

Show more details

Last Notes

2026-08-04 21:41:21 UTC

So, uh, Bugtraq is back?

2026-05-15 03:26:41 UTC

Are you sick of Linux vulnerabilities lately?
Good.
Here's ssh-keysign-pwn
You can read any root-owned files from an unprivileged account. CVE unknown. Was patched in the Linux kernel 11 hours ago
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/576/458/080/710/754/original/29d18f3b6724bbf8.png

2026-05-12 15:34:20 UTC

- reply

@nprofile…mej2 @nprofile…g4vn @nprofile…m4cn
The dialog is the detection of the EICAR TieringEngineService.exe and is definitely a part of the successful exploit flow.
It's just that at least for me, it never succeeds with updated defs. 🤷‍♂️
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/562/332/553/045/247/original/b9bd67ec41b20439.png

2026-05-12 15:27:43 UTC

- reply

@nprofile…mej2 @nprofile…g4vn @nprofile…m4cn
The executable bits for Defender are updated along with sigs.

2026-05-12 15:26:04 UTC

- reply

@nprofile…g4vn @nprofile…mej2 @nprofile…m4cn
Cloud-delivered protection ?
If so, then yeah, it's on.
It's the same stock Win11 VM that worked in April. Just with Defender updates installed.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/562/299/801/120/426/original/a8479e05a70d8d97.png

2026-05-12 15:12:13 UTC

- reply

@nprofile…m4cn @nprofile…mej2
I suspect that Microsoft pushed out Defender updates that mitigate the exploit.
With current definitions, I've not seen RedSun succeed. No matter how long I wait.
With old definitions, success is pretty quick.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/562/230/582/681/814/original/262483d424fd1700.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/562/231/063/519/567/original/0f68eaf9c05845c3.png

2026-05-11 16:50:34 UTC

Pwn2Own Berlin 2026 is rejecting working RCEs because organizers ran out of contest slots.
Visit a website in Firefox and get code execution? Rejected.
Strange days indeed.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/556/965/769/742/276/original/b9a64843c5927877.png

2026-05-11 15:48:35 UTC

- reply

And in case Dirty Frag wasn't unpatched enough for you, IKotas labs has found a new variant of Dirty Frag still captured as CVE-2026-43500
So far, patches have only landed in today's Linux 7.0.6 and 6.18.29.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/556/725/576/453/677/original/05425d2dfa560a23.png

2026-05-10 13:47:38 UTC

Remember the early days of Uber and Lyft, when rides were dirt cheap because the companies were operating at a loss in order to capture the minds/wallets of the masses?
The rug pull in the AI/LLM world when the companies adjust pricing to actually make a profit is going to be spectacular. Especially when you consider the numbers of people / orgs that are addicted to or dependent on such technology.

2026-05-09 02:46:37 UTC

- reply

@nprofile…44dh
The Red Hat mitigation works fine for protecting both Red Hat and Fedora.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/542/325/474/837/036/original/2ae865b9884a6a65.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/542/325/478/626/900/original/364aacfe14994515.png

2026-05-08 12:51:40 UTC

- reply

And just to clarify about "Dirty Frag" vs. "Copy Fail 2":
Dirty Frag is TWO vulnerabilities:
The xfrm-ESP Page-Cache Write vulnerability has been assigned CVE-2026-43284 and patched in mainline at f4c50a4034e6.
The RxRPC Page-Cache Write vulnerability has been reserved as CVE-2026-43500 for tracking; no patch exists in any tree yet.
Copy Fail 2 is a "clean room" rediscovery/exploitation of f4c50a4034e6 (CVE-2026-43284)
Since Copy Fail 2 was published to GitHub 1 hour earlier than Dirty Frag was published. The Dirty Frag writeup specifies that the embargo was broken, and as a result TWO vulnerabilities were disclosed.
Personally, I think that if you publish a patch for a vulnerability, and then you begin an embargo a week after it was published, that doesn't really count as an "embargo"? 🤷‍♂️
Fun stuff...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/539/036/774/988/462/original/9f13cc148d11f95d.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/539/036/777/452/524/original/350618b878990220.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/539/036/771/168/968/original/2469ed45c5fdc2a6.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/539/036/788/084/569/original/f16e1360d12cd8b2.png

2026-05-08 03:31:00 UTC

The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure.
Copy Fail: Publicity stunt where they claim to have done the right thing, yet didn't bother to tell a single distro vendor, and lied about updates being available.
Dirty Frag: Attempted to do proper coordination, including notifying the linux-distros mailing list. But the embargo was broken, so it was disclosed unexpectedly ahead of time.
Copy Fail 2: Discovered as an n-day by looking at kernel commit logs and Spender noticing that it was copyfail-class
Each path had basically exactly the same outcome (No fixes at publication time). 😂
#nevent1q…3fcv

2026-05-08 01:03:57 UTC

- reply

@nprofile…44dh
Indeed the DirtyFrag mitigation blocks Copy Fail 2.

2026-05-08 00:05:19 UTC

While it's raining Linux LPEs, I suppose it's worth mentioning Copy Fail 2:Electric Boogaloo
Unlike CopyFail, this one works against Ubuntu 26.04, as it was only patched a few days ago
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/536/013/872/295/710/original/c73948ac6f00b407.png

2026-05-07 20:47:15 UTC

- reply

CopyFail didn't affect Debian 12, and it has been said that this was not intentional, but rather due to an imcomplete backport
Interestingly, Debian 12 is also seemingly unaffected by Dirty Frag as well. (But Debian 11 and 13 are affected)
I'm curious if the Debian 12 behavior is by accident. 🤔
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/535/249/839/439/163/original/6c4651474c8f7d4a.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/535/250/899/718/771/original/28e7d7a2711c7e35.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/535/251/840/563/129/original/d246c5adfeee2dc7.png

2026-05-07 20:15:59 UTC

Did you like CopyFail, but were annoyed that it didn't work on distros with somewhat up-to-date kernels, like Ubuntu 26.04?
Don't worry. Dirty Frag has got your back!
From the advisory:
Because the responsible disclosure schedule and embargo have been broken,
no patches exist for any distribution. Use the following command to remove the
modules in which the vulnerabilities occur:
sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' >
/etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true"
From the Code:
* DirtyFrag chain — uid=1000 → root.
*
* 1. ESP path (authencesn AF_ALG --corrupt-only): overwrites the first
* 160 bytes of /usr/bin/su's page-cache with a static x86_64 root-
* shell ELF. Works on every distro tested regardless of PAM nullok
* or /etc/passwd contents — once invoked, the patched setuid-root
* /usr/bin/su just execs /bin/sh as uid 0.
*
* 2. rxrpc path (Ubuntu fallback): if AF_ALG is sandboxed and the ESP
* path can't reach the page cache, fall back to the rxrpc/rxkad
* nullok primitive that patches /etc/passwd's root entry empty.
* PAM nullok then accepts the empty password during `su -`.
*
* 3. Once either target is corrupted, spawn `/usr/bin/su -` inside a
* fresh PTY and bridge the user's tty to it. The bridge handles
* both the patched-su (no PAM at all) and the patched-passwd (PAM
* nullok) cases uniformly, and works even when the caller is in a
* background process group of an ssh-allocated PTY.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/535/100/196/553/539/original/aebe69ecb1afd946.png

2026-05-07 17:33:37 UTC

- reply

@nprofile…44dh
Not good enough. As mentioned in my earlier reply in this thread, even if you change association at the machine level, there's still default per-user associations that will override what happens in HKCR.
And as such, you're still in the boat of needing to do both per-user and machine-wide changes.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/534/487/986/260/308/original/149af4dc9dcae273.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/534/488/647/148/543/original/5b711f3aeca9a71f.png

2026-05-07 17:10:40 UTC

- reply

@nprofile…44dh
Not even SYSTEM has the ability to write that key.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/534/398/242/170/803/original/e4a41a5a1a3bbc14.png

2026-05-07 17:03:45 UTC

- reply

@nprofile…44dh
How does a mere mortal even modify that value (or what its target really is)?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/534/372/118/005/813/original/492703069e79fcf7.png

2026-05-07 16:54:35 UTC

- reply

@nprofile…44dh
And I'll admit that "disassociate .URL files from opening in Windows" is a touch more hand-wavy than it should be, I suppose.
When double-clicking a file in Windows, there's a little dance of system-wide file associations and user-specific file associations to determine how Windows should handle the file.
With a little bit of testing, I've determined that this seems to neuter .URL files:
Per-user:
To disassociate .URL files for the current user:
reg add HKCU\Software\Classes\.url /ve /d DisabledURLFile /f
reg add HKCU\Software\Classes\DisabledURLFile /ve /d "Disabled Internet Shortcut" /f
reg add HKCU\Software\Classes\DisabledURLFile\shell\open\command /ve /d "notepad.exe \"%1\"" /f
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url /f
To undo disassociation for the current user (i.e. you really need to be able to open .URL files):
reg delete HKCU\Software\Classes\.url /f
reg delete HKCU\Software\Classes\DisabledURLFile /f
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url /f
System-wide:
This is a bit weird, as even if you disassociate .URL files in the system-wide registry locations, you'll encounter user-specific bits that still know how to handle the files.
To disassociate .URL files system-wide:
In an elevated prompt:
reg delete HKLM\Software\Classes\.url.original /f
reg copy HKLM\Software\Classes\.url HKLM\Software\Classes\.url.original /s /f
reg delete HKLM\Software\Classes\.url /f
reg add HKLM\Software\Classes\.url /ve /d DisabledURLFile /f
reg add HKLM\Software\Classes\DisabledURLFile /ve /d "Disabled Internet Shortcut" /f
reg add HKLM\Software\Classes\DisabledURLFile\shell\open\command /ve /d "notepad.exe \"%1\"" /f
In a non-elevated prompt (i.e. for the current user):
reg delete HKCU\Software\Classes\.url /f
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url /f
To undo disassociation system-wide (i.e. you really need to be able to open .URL files):
reg delete HKLM\Software\Classes\.url /f
reg copy HKLM\Software\Classes\.url.original HKLM\Software\Classes\.url /s /f
reg delete HKLM\Software\Classes\DisabledURLFile /f
Personally, I think this is a bit overly complex. Perhaps somebody can chime in with some better advice?
I have seen a write-up on how to disable file associations for dangerous files, but in my simple world that's differently complicated. (I'm no Windows sysadmin)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/534/335/521/311/140/original/1c3552c5aa4bed7f.png

2026-05-07 15:08:43 UTC

- reply

@nprofile…44dh
Yep, that'd be an excellent protection.
There are indeed workflows that do use .URL files. In fact, a clean Windows 26H1 system comes with a .URL file.
But weighing the protection gained by neutering .URL files vs. the potential for an annoyed user, I think I know which wins.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/533/919/914/483/656/original/a0149f8e5f346ef0.png

2026-05-07 14:53:44 UTC

Let's talk about Windows .URL (InternetShortcut) files.
Last year there was discussion about a vulnerability in how Windows handles .URL files. Specifically, when a .URL file specifies a WorkingDirectory directive, an otherwise harmless app being launched would load DLLs from the remote (e.g. WebDAV) server specified. You know, being the current working directory of the app being launched and all. This vulnerability was being exploited in the wild, and it worked well because it bypassed annoying (to attackers) things like SmartScreen. Sure, it required the victim to click Open on a dialog saying Type: Unknown File Type (😂), but we all know that users are click-happy, so this is fine. Besides, the file clearly has a .pdf extension, so it should be safe (😂).
Microsoft recognized the vulnerability and published an update in the form of CVE-2025-33053.
If we were to believe the Microsoft documentation at the time,
When the user clicks the icon, the browser is launched and displays the site associated with the shortcut.
But wait...
How did this .URL file cause a program to be launched? The URL= parameter specifies a website address to be loaded in the browser.
Oh, naive child. Obviously a .URL file can directly point to code on a remote (e.g. WebDAV) server. This technique is also being exploited ITW as well.
I reported this to Microsoft, as this has the EXACT SAME IMPACT as CVE-2025-33053. So if that's a vulnerability, then this too is a vulnerability, right?
Bless your innocent soul. Per MSRC:
When the Shell invokes an app from a remote share, it's expected that you will see the legacy Windows Security prompt, not the SmartScreen one. SmartScreen Application Reputation (AppRep) evaluation applies to locally downloaded files that bear an Internet Zone mark of the web. It is not meant to apply to execution of files from Network Shares.
Okie dokie. I'm sure Windows users surely appreciate this. But what about the incorrect documentation? After my prodding, they updated the wording:
When the user clicks the icon, the URL path is opened by the handler application, typically the user's default web browser.
Leaving in the quite misleading first sentence:
The Internet shortcut object is used to create desktop shortcuts to Internet sites.
(An "Internet site" is a web page, right?)
How can CVE-2025-33053 warrant a CVE, while the behavior I described has the exact same trigger and impact is not CVE worthy? That's pretty easy. Microsoft assigns CVEs to updates, not vulnerabilities. They are the decider as to what is a vulnerability and what is not.
What can we do about it?
At the very least, turn off the Windows feature that hides file extensions, even if you have the option turned on to see file extensions. The disdain that Microsoft has for Windows users is tangible here. On what planet would I not want to see the actual extension of a file? Go to HKCU\InternetShortcut and delete the NeverShowExt value. After this, your pwned.pdf file will reveal its true self as being pwned.pdf.url.
More powerful protection would be to block the ability to receive .URL files via email, web browsers, etc. There is no workflow that I can imagine that requires a user to double-click on a .URL file that came from the internet.
This screen recording is a Windows 11 system that has no internet connectivity. The fact that no warning was displayed that SmartScreen cannot be reached is evidence that SmartScreen is not in play at all. And that dialog...
Do you want to open this file?
and
Type: Unknown File Type
Do you think that users are presented with enough information to make an informed security decision? Of course not. But obviously we all know that we can't rely on users making informed security decisions in general. Don't put users in that position.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/533/712/734/034/973/original/7873081a273e8a42.mp4

2026-05-05 20:35:47 UTC

From Kasperky Securelist:
DAEMON Tools software infected – supply chain attack ongoing since April 8, 2026
Per Kaspersky,
At the time of writing this article, the supply chain attack is still active.
While I haven't seen the associated network activity to daemontools[.]cc (registered March 27), I can confirm that at the very least a version of Daemon Tools Lite signed today (May 5) by AVB Disc Soft, SIA does indeed contain the C2 string in it.
I have seen some of the versions contact the C2 reported by Kaspersky (https://env-check[.]daemontools[.]cc), but not consistently.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/523/861/936/123/444/original/c27618c98e121494.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/523/861/047/150/523/original/5f43e9e93fb9381a.png

2026-05-04 20:34:40 UTC

Everything is a lie.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/518/208/672/071/533/original/90af9da8f584e654.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/518/209/431/136/643/original/686a19f61de9db62.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/518/210/823/676/970/original/2a1848312846ce5e.png

2026-05-03 16:00:40 UTC

- reply

@nprofile…0hde
This is the sort of convergence that concerns me.
Like, if I had Apple Intelligence enabled it's probably not reading and learning from my Signal messages? But how do I really know?
And what's to say that the way the world works today won't change tomorrow when companies get greedier in the slurping up of your for the purpose of making AI better.

2026-04-30 12:47:45 UTC

- reply

@nprofile…g4vn
TBH, when I first read your writeup, I didn't believe that it was from Microsoft, the company.

2026-04-29 18:37:29 UTC

So CopyFail CVE-2026-31431 is a thing.
If you're on the Ubuntu platform, 26.04 is not affected. If you're on another platform, check with your vendor.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/489/442/181/221/777/original/e03a85c201d4361a.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/489/455/070/545/988/original/98a9ca3459e8b30c.png

2026-04-27 12:12:01 UTC

- reply

@nprofile…4xpq
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/476/602/368/112/363/original/493e44b59638555d.png

2026-04-22 01:49:03 UTC

- reply

@nprofile…44dh
Even Recall, which nobody wanted, did its processing locally.
This sure is something.

2026-04-19 23:55:05 UTC

The folks at iTerm2 figured out a way to get arbitrary code execution as the result of cat <file>, which is... impressive?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/434/067/860/519/298/original/4cb433f6a295d12d.mp4

2026-04-19 13:51:12 UTC

- reply

@nprofile…adl2
My shortcut for launching Chrome has --disable-features=ExtensionManifestV2Unsupported,ExtensionManifestV2Disabled on the cmdline, so all the good blockers still work.
At least for now. 😂

2026-04-16 21:03:47 UTC

I thought that ClickFix was silly, but we've clearly entered the "please fire this footgun" stage of infosec.
https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/416/402/259/048/505/original/0e4d20443122cf0c.webp

2026-04-16 12:45:42 UTC

- reply

@nprofile…mej2
TBH, for code that doesn't include a .SLN file, I usually have minimal luck compiling it straight-up with cl.exe
In this case, I simply made a new Visual Studio 2022 project for a console app, and then replaced the .CPP file contents with what's in the GitHub repo. There are a slew of warnings, but it compiles.
<snip>
1>C:\Users\test\source\repos\test\test\test.cpp(431,11): warning C4267: 'initializing': conversion from 'size_t' to 'int', possible loss of data
1>C:\Users\test\source\repos\test\test\test.cpp(694,49): warning C4267: '=': conversion from 'size_t' to 'ULONG', possible loss of data
1>C:\Users\test\source\repos\test\test\test.cpp(696,92): warning C4267: 'argument': conversion from 'size_t' to 'ULONG', possible loss of data
1>C:\Users\test\source\repos\test\test\test.cpp(714,20): warning C4267: 'initializing': conversion from 'size_t' to 'DWORD', possible loss of data
1>C:\Users\test\source\repos\test\test\test.cpp(736,57): warning C4838: conversion from 'LONG' to 'DWORD' requires a narrowing conversion
1>Generating code
1>Previous IPDB not found, fall back to full compilation.
1>All 27 functions were compiled because no usable IPDB/IOBJ from previous compilation was found.
1>Finished generating code
1>test.vcxproj -> C:\Users\test\source\repos\test\x64\Release\test.exe
1>Done building project "test.vcxproj".
========== Build: 1 succeeded, 0 failed, 0 up-to-date, 0 skipped ==========
========== Build completed at 8:43 AM and took 01.818 seconds ==========

2026-04-16 02:27:28 UTC

From the same author as BlueHammer we now have RedSun.
This works 100% reliably to go from unprivileged user to SYSTEM against Windows 11 and Windows Server with April 2026 updates, as well as Windows 10, as long as you have Windows Defender enabled.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/412/016/760/812/126/original/af2cf09911b90b83.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/412/016/764/961/933/original/c70c00109489ea5a.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/412/016/775/721/000/original/3fe5485c2580eca2.png

2026-04-14 21:19:48 UTC

- reply

@nprofile…gu7x
Yup. It seems to make the race condition unwinnable.

2026-04-09 14:56:37 UTC

Let me get this straight...
The default setting for Signal on an iPhone allows law enforcement to see the content of all incoming messages, even after the app has been deleted? 🤔
https://www.404media.co/fbi-extracts-suspects-deleted-signal-messages-saved-in-iphone-notification-database-2/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/375/318/988/912/395/original/cd2e38defe89c4af.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/375/319/484/821/201/original/fe0e2e85e6dc2ef5.jpeg

2026-04-06 13:46:04 UTC

There's a new Windows 0day LPE that has been disclosed called BlueHammer. The reporter suggests that it's being disclosed due to how MSRC operates these days.
MSRC used to be quite excellent to work with.
But to save money Microsoft fired the skilled people, leaving flowchart followers.
I wouldn't be surprised if Microsoft closed the case after the reporter refused to submit a video of the exploit, since that's apparently an MSRC requirement now. 😂
Anyway, yeah, it works. Maybe not 100% reliably, but well enough...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/358/058/162/383/747/original/7d522a2d40cec255.png

2026-04-02 00:29:50 UTC

- reply

@nprofile…h3hp
"gave" is a weird way to spell "sold"

2026-03-09 23:00:37 UTC

My local hardware store just installed a vending machine out front of it, in case you need things when they're closed.
I love it.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/201/699/300/335/899/original/9c33a05602a61b0b.jpeg

2026-02-17 21:24:24 UTC

In the year 2026, it still appears that virt-manager cannot create snapshots of systems that use UEFI.
I haven't paid attention to this stuff for a while, but I have to assume that there's a sane and free modern replacement for virt-manager these days?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/088/072/387/382/464/original/9c10448802aa7b47.png

2025-08-19 21:10:36 UTC

Me: Ooh, my VeraCrypt install is out of date. I should probably update it.
Oh, that's why people don't update their software. Got it...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/057/479/409/716/544/original/446c63597c3af63b.png

2025-04-13 15:21:16 UTC

Last night I didn't have a phone charger handy, so I plugged my iPhone into a USB-C PD battery pack.
I'm pretty sure that what happened here was:
Quick charge for a bit
Paused charging while I was sleeping
Finished charging
The battery pack used the phone's power to top off itself. (The phone wasn't even on at this time)
😂
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/331/325/809/678/352/original/115f353b060ee839.jpeg

2025-04-06 14:44:49 UTC

- reply

@nprofile…kxpq
Honest question:
What would lead somebody to install the disgrasya Python package?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/291/550/968/696/447/original/bd574169bb9f2d08.png

2025-03-31 17:47:07 UTC

Time to update your fruit.
https://support.apple.com/en-us/100100
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/258/294/037/861/046/original/803a242ba200e932.png

2025-03-28 22:51:57 UTC

- reply

I mean, bypassnro.cmd just does:
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE /v BypassNRO /t REG_DWORD /d 1 /f
So what Microsoft is saying is that they want to make it more work to install Windows without a Microsoft Account? 🤔

2025-03-28 22:43:50 UTC

Upcoming Windows 11 builds won't have the ability to to install without internet connectivity and a Microsoft Account.
https://blogs.windows.com/windows-insider/2025/03/28/announcing-windows-11-insider-preview-build-26200-5516-dev-channel/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/242/473/836/170/826/original/22c23d2f9c70561d.jpeg

2025-03-28 20:01:12 UTC

From the Bad Site, and I have to share:
I have a tip for everyone with imposter syndrome: Just browse linkedin for a few minutes, and it will go away 🤣🤣

2025-03-19 17:06:07 UTC

From the world of "CVE has poorly designed rules that are poorly enforced":
https://www.bleepingcomputer.com/news/security/whatsapp-patched-zero-day-flaw-used-in-paragon-spyware-attacks/
WhatsApp had a zero-click 0day exploited ITW, but they didn't bother with CVE assignment because they didn't have to.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/190/190/109/262/148/original/edef377c75f75544.jpeg

2025-03-19 12:07:57 UTC

- reply

@nprofile…8nj8 @nprofile…5lc3
I've got a better one:
Windows hides file extensions by default. Unlike the LNK thing, this one actually gets people to do things like double-clicking on things like foo.pdf.exe, thinking it's a PDF.
Surely this deserves media hype and an ID, as it's much more impactful than ZDI-CAN-25373. 🤔

2025-03-19 11:37:12 UTC

- reply

@nprofile…8nj8 @nprofile…5lc3
The fact that it doesn't warrant a CVE should be a red flag enough to indicate that it's made up. BUT the story going around has got all of the buzzwords that the media foams at the mouth about, so...
But seriously, though. How many times have you looked at a LNK target using the Windows GUI to use as a factor in the decision making process of deciding whether or not to double-click on it? 😂

2025-03-02 00:59:57 UTC

- reply

@nprofile…kxpq @nprofile…zgwf
Your article states:
These vulnerabilities have been patched by both Paragon Software, and vulnerable BioNTdrv.sys versions blocked by Microsoft's Vulnerable Driver Blocklist.
Now is perhaps a good time to consider that any system with HVCI off will NOT get this driver blocked via the Microsoft's Vulnerable Driver Blocklist. The vulnerable drivers are in the blocklist via signer certificate, which is broken in Windows when HVCI is off. (And blocking by Authentihash is broken if HVCI is on)
https://infosec.exchange/@wdormann/114080056706240573

2025-02-25 20:22:25 UTC

Me to a major vendor, in a PGP-encrypted email (their request):
. Here's an animated GIF showing exploitation of the vul. Please let me know how I can get a large file to you so I can get the PoC to you.
Vendor: Please send us a GIF and the PoC.
Me: I already sent the GIF. Are you saying you didn't get it? Also, please tell me how to get a large file to you.
Vendor: We have not received the GIF. Please send us a PoC.
Me:
I fully understand why people go the full disclosure route.

2025-02-25 05:10:01 UTC

- reply

@nprofile…naem
https://youtu.be/4VrLQXR7mKU

2025-02-20 14:47:30 UTC

New Parallels "victim"-assisted LPE 0day dropped due to ZDI not playing well with the reporter:
https://jhftss.github.io/Parallels-0-day/
I've confirmed that it works fine on Intel. Though ARM may require some retooling (if it's vulnerable)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/036/745/663/904/990/original/98f64e0b1af7c9e3.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/036/747/498/163/949/original/bd984dfb71bd10d3.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/036/748/503/128/337/original/8027ebd1e0ec2c9f.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/036/749/473/545/477/original/ae8719faefacf150.png

2025-02-20 05:44:34 UTC

Sometimes I google man pages.
And sometimes those man pages make me chuckle.
https://linux.die.net/man/1/lshw
And then I realize that those online man pages might be really old.
(This bug in the man page was fixed 15 years ago)
I gotta get out more.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/034/620/893/184/180/original/0d6d59c154399169.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/034/621/844/932/557/original/50d427a41c0dd3cd.png

2025-02-17 17:09:54 UTC

- reply

Since the guy running the US government is already blocking Signal on his stupid website, how much longer will it be before we need to enable the Censorship Circumvention option to connect to Signal on the network level? 🤔
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/020/330/427/714/031/original/6c88bbc0dd2762e4.png

2025-02-17 16:55:04 UTC

Twitter is blocking Signal links.
Rumor has it that the reason is that Signal is being used by federal workers to blow the whistle on DOGE.
Obviously I cannot confirm the rationale, but I can (and have) confirm that such links are indeed being blocked on Twitter.
https://www.disruptionist.com/p/elon-musks-x-blocks-links-to-signal

2025-02-12 14:25:50 UTC

How long before Trump realizes that he's clearly not the center of attention anymore?
Even Musk's toddler prop/human-shield is probably getting more attention than the president. I'm pretty sure that narcissists don't like this?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/991/361/486/205/500/original/47f6a234e19f1140.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/991/367/727/729/927/original/ee5b735f66b61739.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/991/380/219/446/356/original/18bf2fda654da735.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/991/389/290/480/700/original/669136460b619f1e.png

2025-02-11 15:16:27 UTC

- reply

The list of calendar entries that Google chose to remove from their calendar:
• Pride Month
• Black History Month
• Holocaust Remembrance Day
• Jewish Heritage
• Hispanic Heritage
• Indigenous People Month
HOLOCAUST. REMEMBRANCE. DAY.
😱

2025-02-11 13:23:48 UTC

Apparently Google is just shitty.
No duress signal or anything here. Just trying to fit in by being shitty. 🤦‍♂️
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/985/463/264/780/429/original/b5c3f2f8f9c3e6d9.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/985/463/273/252/625/original/039574402452eda9.jpeg

2025-02-10 20:37:19 UTC

People who updated to iOS 18.3.1 today:
Did you see a "Welcome" screen on reboot, and subsequently also an Apple Intelligence screen that automatically turns it on?
Out of my two iPhone devices (on two different Apple accounts), both of them got the multiple-language welcome screen. The one that was new enough to support Apple Intelligence also got the Apple Intelligence screen, which turned it on.
Out of my two iPhone-owning coworkers who responded, NEITHER of them got the welcome screen.
What say ye, iPhone owners? Did you get the welcome screen and Apple Intelligence re-enabling screen?
I struggle to think of what might cause a different upgrade workflow across these devices...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/981/506/176/629/119/original/6d00295302107a2a.jpg

2024-03-12 04:12:30 UTC

I get that MSRC often flip-flops on what is and what is not a security boundary for some things (e.g. admin to kernel).
But when a non-admin user can reproducibly get SYSTEM privileges and MSRC says that "no security boundary is being broken here", it really makes you wonder.
🤔
https://github.com/Wh04m1001/GamingServiceEoP
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/080/763/980/580/086/original/b8857c4294e58528.png