VessOnSecurity

Anti-virus, malware and infosec expert, crypto amateur, privacy advocate and general annoyance.

PGP keyID: 0x365697c632dd98d9

Public Key

npub1gxa39sc7wtpmatdx9rkplkplaquyug2vfhk23dl54slsnmuzf45sh7tun6

NIP-05 Address

bontchev_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsyrwcjcv089sa74knz3mqlmql7swzwy9xymm9gkl62c0cfa7py66gpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds0tggat

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1gxa39sc7wtpmatdx9rkplkplaquyug2vfhk23dl54slsnmuzf45sh7tun6

Show more details

Last Notes

2026-05-14 15:57:40 UTC

Posting a picture of a real Monet painting and saying it's AI-generated. Watch the anti-AI bros pile up in the comments...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/573/749/490/228/120/original/31d6b349f181d58c.png

2026-05-13 15:48:35 UTC

- reply

What would happen? Most likely this:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/568/051/749/156/685/original/c7aace40209373ca.png

2026-05-05 23:07:43 UTC

- reply

Yes

2026-05-05 15:14:19 UTC

This. 👇
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/522/618/474/406/103/original/eed2638c6e1db457.png

2026-05-04 07:29:53 UTC

...then they came for the VPNs...
No, not in China, Russia, or Iran - in the USA. Coming soon to a country or a state near you. Because, "think of the children".
"Utah first state to hold websites liable for users who mask their location with VPNs — law goes into effect, designed to prevent bypassing age checks":
https://www.tomshardware.com/software/vpn/utah-becomes-first-us-state-to-target-vpn-use-with-age-verification-law

2026-04-30 13:03:54 UTC

Not sure if this is real but it sure is funny.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/493/794/064/433/898/original/10fff1555f91931b.png

2026-04-27 05:39:05 UTC

ClownStrike strikes again.
"Critical bug in CrowdStrike LogScale let attackers access files":
https://securityaffairs.com/191343/hacking/critical-bug-in-crowdstrike-logscale-let-attackers-access-files.html

2026-04-14 15:12:17 UTC

- reply

I use such a plugin for the browser (it monitors the ownership changes of the other plugins), but I don't use WordPress, so I don't know. The browser plugin is called "Under New Management".

2026-04-14 05:56:04 UTC

Getting e-mail to work shouldn't be rocket science...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/401/514/469/995/600/original/0bf357fb2ace26e6.png

2026-04-13 06:42:40 UTC

Code reviewing.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/396/035/782/689/072/original/87fbcc10ee8900e0.png

2026-04-12 17:16:58 UTC

- reply

Well, it does make a certain kind of sense. The Strait isn't really "blocked" - it has been converted into a toll booth. Traffic hasn't stopped completely but the only ones who are allowed through are Chinese ships (and those of a handful of other countries), and the only one who profits is Iran for collecting $2 mil per ship. Trump can't force Iran to free the Strait for all traffic, so he's doing what he can - cutting off Iran's profits and the oil to a country unfriendly to the USA.
Of course, it is stupid and will backfire in unpredictable ways, plunging the world further into a crisis - but it's certainly a logical plan any 6-year old could come up with.

2026-04-09 07:19:30 UTC

I am old enough to remember the Vietnam war, the mandatory draft in the USA, and Americans fleeing their own country in order to avoid it. Well, guess what.
"Automatic registration for military draft to be implemented by December":
https://www.stripes.com/theaters/us/2026-04-07/automatic-registration-military-draft-21306855.html

2026-04-02 05:48:55 UTC

- reply

The oil shock will look like a walk in the park when the food shock hits. The closing of the straight of Hormuz has interrupted the flow of fertilizer precisely at a time when they are needed. Even if the war ends a few months from now with a total victory over Iran, it will be too late to plant what needs planting today. A global famine is coming.

2026-03-31 05:53:25 UTC

Abusing the old meme...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/322/232/116/039/619/original/a80b0be1f860d727.png

2026-03-27 06:30:22 UTC

"Southwest is charging plus-size passengers a 'fat tax' at the airport":
https://www.sfgate.com/travel/article/southwest-charging-fat-tax-22094860.php
While I can see how it does make sense, isn't it a form of discrimination?

2026-03-24 18:35:59 UTC

- reply

I have the impression that you needed some kind of permission/acknowledgement before starting to record a Teams meeting?

2026-03-24 06:46:15 UTC

Regarding that WW3 everyone's been talking about...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/282/803/503/163/105/original/02e00d5712d6b400.png

2026-03-23 15:31:07 UTC

- reply

The more energy (of any kind) a country has, the better off it is. Germany's energy production is declining. And this is not the result of external factors (e.g., natural disasters or war) - it is the result of Germany's own idiotic policies. Thus - deindustrialization, the society getting poorer. Economic suicide.

2026-03-23 05:50:27 UTC

Somebody made Doom run from DNS records... 🤣
https://blog.rice.is/post/doom-over-dns/

2026-03-22 06:46:53 UTC

This is a hilarious commentary on the US/Israeli war with Iran:
"God is a comedian":
https://no01.substack.com/p/march-19-21-god-is-a-comedian

2026-03-21 08:08:18 UTC

These are real Facebook groups that exist:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/266/139/323/176/063/original/135381dc6262bbb7.png

2026-03-16 05:55:03 UTC

The picture of a nation committing economic suicide:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/237/303/688/090/510/original/b93d5fb651a9748d.png

2026-03-11 18:19:27 UTC

- reply

Your screenshot is from mobile, mine is from desktop. That's why I supposed that the two may be offering different kinds of access.

2026-03-11 15:20:50 UTC

- reply

At least for Twitter, this is not true. Yeah, the page exhorts you to create an account - but it *does* show the post. At least on desktop; maybe it's different on mobile.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/211/216/029/601/971/original/5b89e45d206b31e5.png

2026-03-10 10:51:39 UTC

The universal truths of software development.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/204/495/960/001/298/original/c8db3082974dec30.png

2026-03-10 06:12:16 UTC

Trump's efficiency.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/203/397/730/989/747/original/9401cef57ca01368.png

2026-03-05 09:11:32 UTC

- reply

Do we really know who hit the school? Was it the USA because the AI hallucinated a target, or was it Israel because they don't give a fuck?

2026-03-03 16:16:54 UTC

- reply

Do you really *want* to see an alien death cruiser parked in front of our plant, though?

2026-03-03 06:58:05 UTC

Slots machine vs vibe colding.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/163/941/607/849/863/original/bc4039be753b9f80.png

2026-02-28 07:23:46 UTC

- reply

OpenAI strikes a deal with the Pentagon.
https://www.nbcnews.com/tech/tech-news/trump-bans-anthropic-government-use-rcna261055

2026-02-17 15:44:38 UTC

Economics in one lesson.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/086/739/861/915/067/original/cfb9f2511df0d7cc.png

2026-02-16 06:09:29 UTC

I asked an AI (Claude) a question about the old MS-DOS viruses, because I had forgotten the information (it couldn't find it, either, probably because it doesn't exist) and at one point it went "according to the anti-virus researcher Vesselin Bontchev...".
I couldn't resist and told it "I *am* Vesselin Bontchev". To which it replied "Oh, it's an honor to meet you!". 🤣 🤣 🤣

2026-02-07 07:56:23 UTC

- reply

Maybe it's not AI that's remarkably good at finding vulnerabilities; maybe it's we who're remarkably bad at writing vulnerability-free code...

2026-02-01 18:14:37 UTC

- reply

Vincenzo Iozzo.

2026-01-25 15:41:52 UTC

Script to remove the AI and other shit from Firefox, Chrome, and Edge via policies:
https://justthebrowser.com/

2026-01-12 10:12:30 UTC

Home prices in my country for the past two decades. Tell me again how the anticipation of the introduction of the euro doesn't lead to inflation?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/881/590/293/991/862/original/b2f86d3c47499b8e.png

2026-01-11 18:29:12 UTC

- reply

Time to finally finish your thesis, Tay.

2026-01-09 05:54:00 UTC

- reply

I run an ADB honeypot. Is there anything I can do to help you in your research of this issue? Any particular artifacts to look for?

2026-01-07 07:28:05 UTC

Well, I didn't have this on my 2026 Bingo card...
"‘Stop sending butt plugs to Bahrain’: Toronto sex store receives letters from U.S. Department of War":
https://www.ctvnews.ca/toronto/article/stop-sending-butt-plugs-to-bahrain-toronto-sex-store-receives-letters-from-us-department-of-war/

2026-01-04 16:50:10 UTC

- reply

I don't see how threatening his wife gives the US any leverage against Venezuela. Most Venezuelans are probably happy to be rid of both Maduro and his wife (although just probably would rather that this didn't involve a military invasion).

2026-01-04 12:22:22 UTC

My MongoDB honeypot is now open source:
https://gitlab.com/bontchev/mongopot
Visualization (not included in the repo):
https://pandora.nlcv.bas.bg/grafana/d/EysKAV4Dz/mongopot

2026-01-03 18:58:29 UTC

- reply

Ah, yes, because the USA had such a great experience running Iraq...

2026-01-03 12:58:03 UTC

- reply

Imagine the outcry if Russia did that to Zelensky...

2026-01-01 07:37:02 UTC

"New York teachers stunned to learn some students can’t read time on old clocks after phone ban comes into play":
https://www.independent.co.uk/news/world/americas/new-york-phone-ban-clock-time-b2891919.html

2025-12-27 21:50:42 UTC

- reply

None here. (If I understand correctly, using the exploit would generate many connections and nothing else.) Not even authentication attempts. Just a few IPs running commands (buildinfo, listDatabases, ismaster, etc.) without prior authentication.
They seem to be looking for databases exposed to the Internet and not protected in any way? Unless something's wrong with the honeypot...

2025-12-27 10:09:11 UTC

Not related to the latest MongoDB vulnerability (since it doesn't require authentication), but does anyone know of a good MongoDB honeypot? You know, one that masquerades as a real MongoDB database server and logs the login attempts while returning a "bad credentials" error? (It clearly won't be able to log the passwords because of SCRAM but anything else would be useful.)
All I could find was a logging proxy to a real MongoDB server or a MongoDB server running in a Docker image - but I don't want that.

2025-12-26 16:30:38 UTC

"What if Bitcoin was one big mining company?":
https://no01.substack.com/p/what-if-bitcoin-was-one-big-mining
You'd be insane buying its shares.

2025-12-25 12:11:22 UTC

- reply

Yes

2025-12-25 06:46:35 UTC

Privacy settings are important.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/778/859/376/260/441/original/d6e69560864693ca.png

2025-12-18 19:49:04 UTC

"Bavarian pensioner lays trap to catch phone fraudster who was out for his gold":
https://www.theguardian.com/world/2025/dec/18/german-pensioner-lays-trap-catch-fraudsters-after-gold

2025-12-16 16:13:30 UTC

- reply

Oh, for God's fucking sake, the overly-indebted governments are so desperate to hunt down every possible cent of income that they're willing to tax robots...

2025-12-16 16:10:16 UTC

- reply

Well, before they were serving ads. Same difference.

2025-12-11 18:50:26 UTC

- reply

"Artificial intelligence and natural stupidity"

2025-12-10 10:17:03 UTC

- reply

Indicators that your machine has been infected with a virus:
- The computer slows down.
- The computer beeps.
- The OS doesn't load.
- The BIOS logo changes. (WTF?!)
- The computer freezes, has BSODs, etc.
(I thought these were indicators that you're infected with CrowdStrike.)

2025-12-10 10:14:56 UTC

- reply

- A virus can infect only with the help of the user (I can argue this one for hours).
- MBR-infecting viruses are very widespread and very hard to remove.
- Macro viruses infect templates. (Well, they did 3 decades ago.)
- A logic bomb is a kind of virus.
- Ransomware is a kind of virus.

2025-12-10 10:13:05 UTC

- reply

Indicators of a Trojan infection:
- Your DVD drive opens and closes by itself.
- Your screen blinks or the picture turns upside down.
- The wallpaper changes.
- Your printer starts printing.
- Your screensaver changes.
- The sound level of your computer keeps changing up and down.
- Your mouse buttons swap.
- The Windows Start button disappears.
- The Windows taskbar auto hides.
- The keyboard and mouse hang.
Oh, good, now that we know all the symptoms we can determine for sure if we have a Trojan horse on our machine or not.

2025-12-10 10:09:41 UTC

- reply

- Attackers can enter your computer/phone via Bluetooth.
- Attackers hide behind 13-14 chained proxies.
- Attackers turn your computer into an FTP server for illicit goods.
- The purpose of a rootkit is to let the attacker execute everything as root.

2025-12-10 10:08:03 UTC

- reply

- If you click a link sent to you by the attacker, your machine will be immediately infected.
- Like many others, the lector is confusing multi-factor authentication with two-step verification.
- Always scan the files that you have received via e-mail. (Nevermind that AV does this on-access.)
- Never use public WiFis because the attacker can intercept and MiTM your traffic. Oldie but goldie.
- Malware runs automatically from USB drives when these are inserted.

2025-12-10 10:05:05 UTC

I'm attending an on-line lecture on "cyber hygiene". The lector is some old guy who used to be in the military and now works for an infosec company. You wouldn't believe the "useful" stuff I learned there. 👇

2025-12-08 08:14:21 UTC

- reply

Obviously, since we still have directory traversal and SQL injection vulnerabilities in 2025.

2025-12-06 07:22:58 UTC

The FIFA Peace Prize is a prestigious prize rarely awarded to people who have stopped conflicts between opposing soccer teams, right?

2025-11-27 07:58:31 UTC

- reply

No but I have strategies and tools I wish I didn't (have to).

2025-11-24 20:09:54 UTC

- reply

I don't know which brand it is, but there *is* some brand of Android TV that exposes the adb interface directly to the Internet. In practice, this means that just by knowing the IP address of the device, you can log into it from anywhere in the world - and log in as root and no password!
There is, of course, a worm/botnet that exploits this. I'm tracking these attacks with my ADB honeypot:
https://pandora.nlcv.bas.bg/grafana/d/6Fh36QEmk/adbhoneypot?orgId=1

2025-11-21 12:15:51 UTC

- reply

Trust me, you don't want to date me.

2025-11-20 22:54:13 UTC

- reply

Siri actually had funny responses to the command "Open the pod bay doors" but Apple later removed them.
https://www.youtube.com/watch?v=YAjhDx4yoAA

2025-11-16 15:32:19 UTC

- reply

Well, can you blame him? He was an expert in collecting underage girls - not in cybersecurity...

2025-11-14 05:59:16 UTC

- reply

We (F-PROT) had something similar, minus the telemetry.
The reason for them was to speed up the scanning process. They were short and fast and easy to check. Signature not present - just don't bother scanning any further. Signature present - that by itself doesn't warrant a report but triggers our other, more precise but slower malware identification algorithms.
I don't know what Microsoft is using these for but this might be the idea behind them too.

2025-11-12 20:26:37 UTC

- reply

I don't think that it works any more; 94.74.164.136 seems to have been nuked.

2025-11-06 10:58:13 UTC

- reply

You "scanned the internet". Lucky you. I couldn't get permission to scan even my own organization. 😢

2025-11-04 13:47:19 UTC

- reply

Ahh, the good old times when men were real men and laser printers were real printers.

2025-11-01 15:21:57 UTC

The cybersecurity awareness month is over. You may resume using your dog's name as your password. Just make sure to use a different dog for each account and also use a dog manager.

2025-10-27 06:55:35 UTC

- reply

Q: Why is inflation low but the prices keep going up?
A: Because nobody checks the CPI at the grocery store.

2025-10-25 04:52:51 UTC

- reply

Sending information to yourself that will disappear after a while? I already have that; it's called "memory".

2025-10-21 17:46:57 UTC

- reply

When I was there (late '90s), I remember visiting lake Mývatn, which I was told meant "Mosquito lake". The damn insects weren't biting but there were thick clouds of them and you literally couldn't breathe (they got into your nose and mouth) unless you were wearing a special face net, like those the beekeepers use.

2025-10-20 21:14:43 UTC

- reply

There was. It lasted only a few hours. But a bunch of companies, web sites, games, and other services got screwed up while it lasted.
It's always DNS.

2025-10-17 13:21:20 UTC

- reply

Heroin?! In this economy?!

2025-10-14 19:48:17 UTC

"US gov't admits F-35 is a failure":
https://responsiblestatecraft.org/f-35-failure/

2025-10-13 11:04:31 UTC

You think the US government buying a stake in Intel was nationalization/socialism?
How about the Dutch government taking the *whole* of Nexperia (for nothing, apparently)?
"Dutch government takes control of Chinese-owned chipmaker Nexperia in ‘exceptional’ move":
https://lite.cnn.com/2025/10/13/tech/dutch-government-china-nexperia-chipmaker-intl

2025-10-08 16:17:38 UTC

- reply

SCR? Ah, yes, this is an old attack. Those are EXE files internally. They are supposed to be the programs that are run when the screen saver function is activated - but in practice, you can run one at any time just by double-clicking on it. It's a perfectly normal executable; it's just that many people wouldn't expect one to reside in a file that doesn't have an EXE extension.
(Well, in fact many people wouldn't see the extension at all, because by default Windows doesn't display them.)

2025-10-08 04:45:20 UTC

- reply

Ah, what is a Windows screenshot file?

2025-09-30 20:11:05 UTC

- reply

The also need one mf who knows how people work, because none of the above four is any of that.

2025-09-21 19:53:54 UTC

- reply

It will be very hard to keep it non-violent. Don't forget that nearly half the country voted for him and is very happy with what he's doing. There are likely to be counter-protests and the two sides are likely to clash, resulting in violence.
As an aside, remember that a revolution has *never* succeeded if at least part of the armed forces (police, military) haven't joined the revolutionaries. There doesn't have to be an armed clash - but at least the silent support of the armed forces is needed.

2025-09-21 19:45:12 UTC

- reply

Sometimes it is not obvious that an article is paywalled. E.g., if you click on it from Google News, you get to read it - but if you pass the URL to somebody else and they click that, they'll hit a paywall. Or the site will let you read a couple of articles for free but then you'll hit a paywall (even if you try to read the articles you've read before).
There are browser add-ons that warn you about paywalled links but, more importantly, this extension:
https://chromewebstore.google.com/detail/remove-paywalls/ghkdkllgoehcklnpajjjmfoaokabfdfm
lets you bypass the paywall (if possible) by going to an archived copy of the page you're looking at. There's probably an equivalent add-on for Firefox.

2025-09-20 19:08:24 UTC

- reply

You got off easy. They were planning to make these vaccines available only with prescription - but that proposal got voted down.

2025-09-16 14:41:55 UTC

- reply

Fortunately, virtually nobody uses CrowdStrike, right? Right?

2025-09-13 06:21:40 UTC

- reply

I wonder how big the ransom was...

2025-09-12 21:39:05 UTC

- reply

That's generally the case every time there is a large congregation of people competing for a limited resource.

2025-09-12 21:37:35 UTC

- reply

A narcissist is someone loves himself. A sociopath is someone who hates society. While a narcissist is so much occupied with himself that he's often indifferent or even hostile to society, that's not necessarily the case. Similarly, a sociopath who hates society does not necessarily love himself; he might be hating himself too.

2025-09-12 15:16:42 UTC

- reply

I think you should accept and write a review along the lines of "Not on the blockchain, 1 out of 10 stars".

2025-09-12 11:38:05 UTC

- reply

I think I watched a couple of episodes of this thing. (I guess it is the same series because it was about him and you were in it.)
What a very strange person... Most other former criminals that I've seen express remorse (real or fake) about what they did, or at least about themselves for doing something stupid and getting caught. This one was like "yeah, I did that thing, no big shit". As if he was saying that some people have pet dogs, he swats people, that sort of stuff.
I wouldn't even call him "evil". For me, an evil person is someone who knows that they're doing bad things and enjoys it. This guy seems utterly incapable of realizing what is bad. A psychopath, I guess? Severe lack of empathy and understanding of social norms - not even enough to reject them because he disagrees with them.
The society needs to be protected from people like him. That doesn't necessarily mean keeping him in jail - it means keeping him doing stuff he would find enjoyable while being physically incapable of harming others.
He needs medical help - but I doubt that he can be helped and am pretty sure that he wouldn't seek such help anyway.

2025-09-12 06:49:55 UTC

The intelligence is definitely artificial. As in fake.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/189/989/430/739/155/original/fec1a5c3aebbe43a.jpg

2025-09-10 05:45:39 UTC

- reply

There's always 0patch.com and massgrave.dev.

2025-09-05 06:13:11 UTC

"WiFi signals can measure heart rate—no wearables needed":
https://news.ucsc.edu/2025/09/pulse-fi-wifi-heart-rate/

2025-09-04 16:20:29 UTC

- reply

By law, in Russia every car must have a dashboard camera. I wonder if... ah, nevermind.

2025-09-03 17:20:23 UTC

- reply

Well, it's hardly surprising, given that even DEFCON was duped by AI slop.

2025-09-02 16:39:02 UTC

- reply

It lasted only 35 seconds?! Uhm, that's shorter than the time the user needs to decide "hmm, the page isn't loading for some reason; let me click the Refresh button".

2025-09-02 16:32:24 UTC

- reply

"Block apps with dangerous permissions"? This will fail, according to some research a colleague of mine did more than a decade ago.
Basically, Permission1+Permission2 might be considered a dangerous combination and an app requesting them might be blocked - but you just release 2 apps, each using only one of the permissions, and when both apps are installed on the same device, they cooperate to do the malicious thing. Don't have a paper to point to (it was a lecture at an anti-virus workshop) but you get the idea. Works against iOS, too.

2025-08-28 10:36:56 UTC

- reply

Yay, only 8 in Bulgaria, most of them belonging to foreign companies, 3 of them in the same company. A1 is a telecom; these are probably residential IPs - but maybe somebody ought to call the US bank and the German insurance company here and tell them that they have a little bit of a problem...
88.203.128.230,Bulgaria,Sofia,A1 Bulgaria EAD
195.191.94.244,Bulgaria,,Bulgarian-American Credit Bank JSC
92.247.124.120,Bulgaria,Sofia,Ultracom Ltd.
213.169.55.20,Bulgaria,,A1 Bulgaria EAD
91.216.174.52,Bulgaria,,ZAD Allianz Bulgaria AD
91.216.174.42,Bulgaria,,ZAD Allianz Bulgaria AD
91.216.174.53,Bulgaria,,ZAD Allianz Bulgaria AD
213.169.55.31,Bulgaria,,A1 Bulgaria EAD

2025-08-28 06:33:49 UTC

- reply

Yay! Somebody has finally found a way to use a chatbot for something profitable.

2025-08-27 19:56:57 UTC

- reply

There are two ways AI can surpass humanity:
1) AI's intelligence increases exponentially.
2) Humanity's intelligence decreases exponentially.