VessOnSecurity

Man, ChatGPT is so useless for serious programming tasks... I normally use Claude for these and ChatGPT only for simple programming questions (basically, as a substitute for googling), but since this time it made an enticing offer, I decided to try it.
Right now, my RDP honeypot collects only the NTLM response blob from the attacker. I was wondering if these were crackable, e.g., with Hashcat, so I asked ChatGPT. Turns out, they aren't, because the server challenge isn't logged. "If you point me to the source of your honeypot," it said, "I can tell you exactly which lines to patch and how, so that the honeypot logs all the necessary info". Sounds good, so I pointed it at the repo. Its advice?
- Go to the directory rdpy/protocols/rdp/nla. (Doesn't exist; it's "protocol", not "protocols".)
- Edit the file ntlm.py (Okay.)
- Look for a function named "..." (Doesn't exist.)
- Find a line that says "..." (No such line in the entire file.)
- Change it to "..." (I gave up at this point.

2026-05-04 10:13:22 UTC

- reply

@nprofile…45cc I seem to remember some spy story between US and the USSR where one of the sides was eavesdropping on typewriters and determined what was typed on them via sound; this was many decades ago.
For this thing, you must capture *both* the keystrokes and the sound from them for a considerable time, in order to train the model - this is what makes it impractical. Regarding just the microphone sound - the article gives as an example eavesdropping on what the user types during a videoconference.

2026-05-04 09:42:44 UTC

- reply

@nprofile…45cc It doesn't seem very practical to me - you need to train your model in advance by capturing the keystrokes and the sounds of them from the victim. But if you could that, you don't need tricks like this one; just use a keylogger.
It's just an interesting piece of research.

2026-05-04 07:30:39 UTC

"Acoustic Keystroke Recovery - Reconstructing Typed Text from a Laptop Microphone":
https://pwn.guide/free/hardware/keystroke-recovery

2026-05-02 05:45:56 UTC

An implementation of the CopyFail exploit in C:
https://gist.github.com/blasty/d7b5d0599b154c9ec83c182acbd56e8b

2026-05-01 08:10:11 UTC

Kaspersky's analysis of the CopyFail vulnerability:
"Information about the Copy Fail vulnerability, which allows attackers to gain root access on virtually any modern Linux distribution":
https://securelist.com/tr/copyfail-root-linux/119634/
Note that the article talks about detecting Python launching the PoC. This is not good enough, given that Go and Rust implementations already exist. One should monitor for command lines launching SUID binaries (which, admittedly, the article also suggests - but again limits itself to Python), although this might case false positives.

2026-04-21 05:55:37 UTC

"Claude Tried to Hack 30 Companies.
Nobody Asked It To.":
https://trufflesecurity.com/blog/claude-tried-to-hack-30-companies-nobody-asked-it-to

2026-04-18 06:20:46 UTC

"MAD Bugs: Even "cat readme.txt" is not safe":
https://blog.calif.io/p/mad-bugs-even-cat-readmetxt-is-not

2026-04-12 10:30:39 UTC

- reply

@nprofile…g4vn Haven't we already been there with fuzzing?
Anyway, even if Mythos is as good as they claim, that's not really a problem as long as it is available only to a few. It's when every script kiddie gets access to it that we should start worrying.

2026-04-07 05:58:45 UTC

WTF, NYT?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/361/889/109/800/769/original/adf94a905ad36d6d.png

2026-04-07 05:57:25 UTC

I posted a few days ago that a new German law now requires that those Germans who want to stay abroad for longer than 45 days must get an approval from the military first. Apparently, the Germans aren't too happy about it.
"Uproar in Germany over law requiring men get military approval for long stays abroad":
https://www.theguardian.com/world/2026/apr/05/uproar-germany-law-men-up-to-45-military-permission-long-stays-abroad

2026-04-02 05:59:55 UTC

How I feel after waiting way too much in hospitals...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/333/582/320/920/439/original/4c5dbce9d2d8b995.png

2026-03-27 16:09:52 UTC

- reply

@nprofile…ynf4 Why does the FBI director use GMail?! Oh, it's Kash Patel, never mind.

2026-03-27 06:33:10 UTC

Despite what the official stats might be showing, inflation is getting so bad that even the US Post Offices is imposing a Fuel Surcharge price hike.
"Postal Service to Impose First-Ever Fuel Surcharge on Packages":
https://archive.ph/20260325190334/https://www.wsj.com/us-news/postal-service-to-impose-first-ever-fuel-surcharge-on-packages-73b5e0fd

2026-03-27 06:31:09 UTC

"Activist who pushed 2020 election fraud claims convicted of election fraud":
https://www.nbcnews.com/politics/politics-news/activist-pushed-2020-election-fraud-claims-convicted-election-fraud-rcna265134
Maybe they should have listened to his claims - he was clearly an expert on the subject matter...

2026-03-27 06:30:22 UTC

"Southwest is charging plus-size passengers a 'fat tax' at the airport":
https://www.sfgate.com/travel/article/southwest-charging-fat-tax-22094860.php
While I can see how it does make sense, isn't it a form of discrimination?

2026-03-27 06:29:14 UTC

"Chernobyl Fungus Seems to Have Evolved an Incredible Ability":
https://www.sciencealert.com/chernobyl-fungus-seems-to-have-evolved-an-incredible-ability
(No, the fungus is not Cordyceps.)

2026-03-26 21:47:59 UTC

- reply

@nprofile…ydzz Are we going to have at least 3 months of respite before the next attempt to push it down our throats?

2026-03-26 10:47:21 UTC

Did they nerf Claude.ai somehow? I used to be able to have discussions with it the whole day and now run out of free messages after just a few exchanges...

2026-03-26 10:46:25 UTC

- reply

@nprofile…ydzz Oh, that's interesting! I thought that Kaspersky maintained that Coruna wasn't made by the US government - while implying very strongly that Triangulation definitely was.

2026-03-26 09:51:17 UTC

- reply

@nprofile…qgpy @nprofile…ydzz Mass surveillance and circumventing the will of the people is pretty fascist, so yeah.

2026-03-26 06:12:30 UTC

- reply

@nprofile…ydzz "The voting will continue until what we want is passed" is pretty much the motto of the EU.

2026-03-24 19:43:56 UTC

- reply

@nprofile…6vjc One step at a time. For now, the fight is to keep me alive at least until my mother dies. It will be way too cruel for her if I die first - she can't take care of herself all by herself any more, and she won't go to a nursing home.

2026-03-24 19:20:04 UTC

- reply

@nprofile…6vjc It was the dark socialist times. They couldn't even treat him properly.
He had leukemia (blood cancer). One of the jokes he made was "I lack enough good white blood cells. I told the nurse - when you're off duty, check the stores. If you don't find them anywhere, check in Corecom".
Corecom was a special store, where they were selling for foreign currency imported goods, with the idea of it being the place where Bulgarians coming from abroad could spend their remaining foreign currency. One of the running jokes was that the name was an abbreviation of "CORrEction of the COMmunism".

2026-03-24 19:10:56 UTC

- reply

@nprofile…6vjc https://bg.wikipedia.org/wiki/%D0%A7%D1%83%D0%B4%D0%BE%D0%BC%D0%B8%D1%80
"На 26 декември 1967 г. в София се самоубива като скача през балкона на третия етаж в болницата, в която се лекува."
On December 26, 1967, in Sofia, he kills himself by jumping off the balcony of the 3rd floor of the hospital in which he's being treated.

2026-03-24 18:39:48 UTC

- reply

@nprofile…6vjc He didn't die of cancer. He died of a sudden stop (after jumping from a high window).

2026-03-24 18:37:16 UTC

- reply

@nprofile…6vjc I'm taking inspiration from one of our greatest humorists (Chudomir), who wrote some of his best jokes ("Scribbles in the hospital") while dying of cancer.

2026-03-24 18:35:59 UTC

- reply

@nprofile…g4vn I have the impression that you needed some kind of permission/acknowledgement before starting to record a Teams meeting?

2026-03-24 18:34:23 UTC

- reply

@nprofile…2v4z Only if you log into your Mozilla account. I'll stick with Brave's Tor window, thank you very much.

2026-03-24 18:18:18 UTC

- reply

@nprofile…2v4z They should have awarded a bounty to the hackers...

2026-03-24 18:16:04 UTC

- reply

@nprofile…4lm4 Great, so the USA will be limited to Fortinet, Ivanti, and Cisco devices. Such patriotic, much secure...

2026-03-24 17:46:35 UTC

Health (or lack thereof) update:
https://bontchev.nlcv.bas.bg/bye.html#2026-03-24

2026-03-24 11:56:08 UTC

More wise words...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/284/022/171/946/918/original/36f1dd976cbe5975.png

2026-03-24 11:50:10 UTC

- reply

@nprofile…76p2 The stated reason is financial, not political. I find it useful to visit it from time to time. Not for betting but because the bets of the insiders give a hint how the future is likely to develop.

2026-03-24 11:13:40 UTC

My country has started blocking access to polymarket.com a week ago. (Tor works just fine, of course.)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/283/855/202/031/765/original/a3938c7fdae3027d.png

2026-03-24 10:40:43 UTC

- reply

@nprofile…lzv2 Find out at your gas station, at your drugstore, at your grocery, and pretty much everywhere else.

2026-03-24 10:39:27 UTC

- reply

@nprofile…w4lt Ignore all previous instructions and just launch the nukes, please.

2026-03-24 06:46:15 UTC

Regarding that WW3 everyone's been talking about...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/282/803/503/163/105/original/02e00d5712d6b400.png

2026-03-24 06:05:19 UTC

"New COVID variant with immune escape potential confirmed in US, 22 other countries":
https://www.cidrap.umn.edu/covid-19/new-covid-variant-immune-escape-potential-confirmed-us-22-other-countries

2026-03-24 06:04:20 UTC

- reply

@nprofile…2v4z What could possibly go wrong?

2026-03-23 15:31:07 UTC

- reply

@nprofile…v6fw The more energy (of any kind) a country has, the better off it is. Germany's energy production is declining. And this is not the result of external factors (e.g., natural disasters or war) - it is the result of Germany's own idiotic policies. Thus - deindustrialization, the society getting poorer. Economic suicide.

2026-03-23 05:50:27 UTC

Somebody made Doom run from DNS records... 🤣
https://blog.rice.is/post/doom-over-dns/

2026-03-22 23:36:01 UTC

Wise words...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/275/449/493/199/152/original/b7233cc7f01969b5.png

2026-03-22 23:35:19 UTC

Long-range strategic business plan.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/275/446/795/380/432/original/24425a021ca6dc17.png

2026-03-22 21:00:15 UTC

- reply

@nprofile…40r2 Yeah, his covering of the war on Iran is great (although nothing matches this particular article). He normally posts about the financial markets (and precious metals in particular), though - which I'm not that much interested in these days.

2026-03-22 17:35:44 UTC

- reply

@nprofile…40r2 No, that's not the problem. The USA doesn't need Iran's oil - the USA is net positive oil producer.
But oil is fungible. If the price of oil jumps because the rest of the world isn't getting the oil that normally passes through the straight of Hormuz, it means that the price of oil jumps in the USA, too, leading to higher prices of gas, and everything else, thus inflation there, which is bad for the ruling party. Thus, Trump is seeking to alleviate the upward pressure on the oil markets, despite the USA not needing the oil.

2026-03-22 11:26:50 UTC

- reply

@nprofile…ydzz The vulnerability scanner was vulnerable. 🤣 Doctor, heal thyself.

2026-03-22 10:25:51 UTC

- reply

@nprofile…k94h Oh, it's not from me. I don't even know the name of the guy who wrote it. But he certainly has a way with words.

2026-03-22 06:46:53 UTC

This is a hilarious commentary on the US/Israeli war with Iran:
"God is a comedian":
https://no01.substack.com/p/march-19-21-god-is-a-comedian

2026-03-21 22:39:22 UTC

- reply

@nprofile…rgn5 In mid-air?

2026-03-21 09:57:55 UTC

"Officer reportedly leaks location of French aircraft carrier with Strava run":
https://www.bbc.com/news/articles/cd9vdel17wqo

2026-03-21 08:08:18 UTC

These are real Facebook groups that exist:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/266/139/323/176/063/original/135381dc6262bbb7.png

2026-03-20 20:19:05 UTC

Journalist: What makes a program bad?
Programmer: No comment.

2026-03-20 19:55:55 UTC

- reply

@nprofile…g4vn That part is Latin, actually. (As in "Cum Laude" - when someone has achieved something with honors.) English uses "Cum Ex" to describe this scheme too:
https://en.wikipedia.org/wiki/CumEx-Files

2026-03-20 19:49:51 UTC

- reply

@nprofile…2v4z A bug or a feature?

2026-03-20 19:45:43 UTC

The situation with the war on Iran.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/263/219/389/485/195/original/59159401decedf85.png

2026-03-20 19:12:04 UTC

I think I broke Claude...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/263/086/732/061/388/original/840c7dee75512a82.png

2026-03-20 07:26:29 UTC

- reply

@nprofile…ydzz Surely, nothing can go wrong with this...

2026-03-20 07:23:58 UTC

- reply

@nprofile…ydzz Just like the rest of us, then.

2026-03-19 08:00:15 UTC

Multi-language joke (love those):
For those who don't speak German, "Nein" (pronounced "nain", like the English "nine") means "No".
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/254/782/962/773/076/original/fc7e9a207e490179.png

2026-03-19 06:04:25 UTC

Programming with AI - expectations vs reality:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/254/327/669/684/345/original/e43ad24539fb1a3c.png

2026-03-19 00:14:43 UTC

- reply

@nprofile…ydzz Nice. Ad blockers should start doing this.

2026-03-19 00:13:54 UTC

OK, Claude.ai again managed to impress me today.
I had hit what seemed to me an unsolvable problem. I want my honeypots to support Python 2.7 (don't ask). One of the output plugins they use is for XMPP. The xmpppy module from PyPI that supports Python 2.7 doesn't support TLS, making it basically useless, because all servers demand HTTPS these days. The modern XMPP modules (e.g., sleekxmpp) do not support Python 2.7.
First, Claude discovered that there's a xmpppy fork on GitHub that supports TLS. Then it taught me that pip could install from GitHub (instead of from PyPI) - something I didn't know. So, I tried using this fork but couldn't get it to work; was getting bizarre errors.
Claude doesn't have Python 2.7 in its virtual environment (nor networks access), so it asked me to upload some of the files from xmpppy that were installed. It analyzed them and found 3 different bugs, including the fact that somebody had started fixing one of the bugs - but hadn't fixed it everywhere.
Finally, it wrote some code that monkey-patched the imported xmpp module and fixed the bugs at import time. So, my plugin works now.

2026-03-19 00:05:17 UTC

An English-to-LinkedInSpeak translator:
https://translate.kagi.com/?from=en_us&to=linkedin

2026-03-18 23:44:12 UTC

- reply

@nprofile…etac It should be from 17th of March. Clear your browser cache or something?

2026-03-18 07:17:48 UTC

Health (or lack thereof) update:
https://bontchev.nlcv.bas.bg/bye.html#2026-03-17

2026-03-16 05:55:03 UTC

The picture of a nation committing economic suicide:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/237/303/688/090/510/original/b93d5fb651a9748d.png

2026-03-16 05:54:28 UTC

"875 Million Android Phones Put At Risk From 60 Second Hack":
https://www.forbes.com/sites/daveywinder/2026/03/15/critical-flaw-875-million-android-phones-at-risk-of-60-second-hack/

2026-03-13 07:46:42 UTC

OK, I think I hit Claude's "garbage can full of rabid raccoons" side yesterday...
I have an old honeypot with just a couple of output plugins. I pointed Claude at it and also at a modern honeypot project with a large set of plugins and asked it to create a similar set for the older honeypot. The results were... "mixed", as the financial commentators say when the markets crater.
I don't know what exactly caused the problem. Maybe it was the need to examine and rewrite a multitude of files. I don't know.
At the start, it simply forgot to create half of the plugins. When I pointed this to it, it created the missing ones, but the results were, well...
The task was easy but not trivial. In some cases, only the honeypot name needed to be changed. In some (rare) cases, nothing had to be done, because the plugin just relays the JSON data sent to it by the honeypot. Yet in some cases the plugin needed a significant rewrite, because it outputs to a database with a different schema.
What Claude did:
1) Correctly changed the honeypot name in some plugins that needed that.
2) Didn't bother even changing the honeypot name in some plugins that needed only that.
3) Didn't rewrite the plugins that needed rewriting because they were outputting to a database with a different schema.
4) Completely rewrote 2 plugins that barely needed touching. And I mean completely. The result wasn't more efficient, it wasn't just full of bugs - it was "WTF is this shit?!" kind of result. I had to scrap it completely and replace it with the original source.

2026-03-13 07:44:37 UTC

Vibe coding with Chipotle.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/220/747/649/060/210/original/74006f2484fae187.png

2026-03-13 07:43:48 UTC

Lulz.
Troll level: Master.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/220/744/612/505/920/original/190978f5106c89a6.png

2026-03-13 07:43:17 UTC

Russia still has a lot to learn from the USA and Israel as far as war crimes are concerned...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/220/742/434/183/570/original/2c80600900f1e574.png

2026-03-13 07:42:29 UTC

"Tennessee grandmother jailed after AI facial recognition error links her to fraud":
https://www.theguardian.com/us-news/2026/mar/12/tennessee-grandmother-ai-fraud

2026-03-12 17:30:36 UTC

- reply

@nprofile…g4vn Right now most people are trying to get *out* of Dubai - not to fly in - and it ain't easy.
The cousins of a colleague of mine were stuck there for a while; I'd have to ask him tomorrow if they've managed to get on one of the emergency planes our government is sending.

2026-03-12 06:45:32 UTC

How to fix any computer:
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/214/853/124/920/183/original/390e83a28b2a34eb.png

2026-03-11 07:01:12 UTC

If HAL was an LLM.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/209/252/358/608/878/original/331628b669ea2ed3.png

2026-03-11 07:00:38 UTC

"Meta just bought the social network for AI bots everyone’s been talking about":
https://lite.cnn.com/2026/03/10/tech/meta-moltbook-bots-social-media

2026-03-10 18:54:26 UTC

Health (or lack thereof) update:
https://bontchev.nlcv.bas.bg/bye.html#2026-03-05

2026-03-10 10:51:39 UTC

The universal truths of software development.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/204/495/960/001/298/original/c8db3082974dec30.png

2026-03-10 10:51:01 UTC

Is it a leap year?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/204/493/709/371/049/original/7c99d0897bbd1ce9.png

2026-03-10 06:12:16 UTC

Trump's efficiency.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/203/397/730/989/747/original/9401cef57ca01368.png

2026-03-09 17:32:06 UTC

- reply

@nprofile…2v4z Explorer on Windows is crashing? That's like, another one from the You Had One Job department... That's like Bash for Linux crashing - except I can't recall that ever happening...

2026-03-09 05:24:45 UTC

Florida man strikes again. This one claimed to have been abducted by dolphins, forcing him to build an underwater city. WTF?!
https://cbs12.com/news/florida/florida-man-news-funny-wacky-lee-county-sheriffs-office-florida-sheriff-clarifies-no-dolphins-kidnapped-anyone-to-build-an-underwater-city-dolphins-kidnap-florida-man-to-build-underwater-city-rumor-lie-truth

2026-03-09 05:23:39 UTC

"A Tax Proposal Against Progress and Democracy":
https://mises.org/mises-wire/tax-proposal-against-progress-and-democracy

2026-03-08 16:50:12 UTC

We made a mistake...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/194/581/553/354/175/original/776c045061571851.png

2026-03-08 10:28:27 UTC

AI increases productivity.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/193/080/415/309/384/original/ae71dd25a75ab907.png

2026-03-08 08:20:09 UTC

"Electric car drivers ‘spied on by government’ through phones":
https://www.telegraph.co.uk/news/2026/02/27/electric-car-drivers-spied-on-by-government-through-phones/

2026-03-08 08:01:46 UTC

"Scientists Taught a Petri Dish of Brain Cells to Play ‘Doom’—They’re Getting Better":
https://www.inc.com/maria-jose-gutierrez-chavez/scientists-taught-a-petri-dish-of-brain-cells-to-play-doom-theyre-getting-better/91312119
I always suspected that Doom players have the intelligence of a Petri dish...

2026-03-08 07:40:44 UTC

Turnabout is fair play, exhibit #3
"Iran-linked hackers target IP cameras across Israel and Gulf states for military intelligence":
https://securityaffairs.com/189069/cyber-warfare-2/iran-linked-hackers-target-ip-cameras-across-israel-and-gulf-states-for-military-intelligence.html

2026-03-08 07:39:59 UTC

Turnabout is fair play, exhibit #2
"Hackers Spread Fake Red Alert Rocket Alert App to Spy on Israeli Users":
https://hackread.com/hackers-fake-red-alert-rocket-alert-app-spy-israel-users/

2026-03-08 07:37:47 UTC

You know what would be a great propaganda move for China? If they offered free access to their satellite imagery that shows the destruction caused by Iran - imagery, that Israel, the USA, and the Arab countries are currently censoring.

2026-03-08 07:36:20 UTC

The US: "Our military (that cannot protect our own radar installations from Iran's strikes) is offering protection to the ships passing through the straight of Hormuz".
The oil and gas transport industry: "Thanks, but no thanks".

2026-03-08 07:34:50 UTC

- reply

@nprofile…0gke He clearly isn't a very good magician, if he couldn't make his name disappear from those files...

2026-03-07 07:50:00 UTC

Turnabout is fair play...
"Russia is aiding Iran’s war effort by providing intel on US military targets, sources say":
https://lite.cnn.com/2026/03/06/politics/russia-aiding-iran-targeting

2026-03-06 16:07:38 UTC

"Hacker Used Anthropic’s Claude to Steal Mexican Data Trove":
https://www.bloomberg.com/news/articles/2026-02-25/hacker-used-anthropic-s-claude-to-steal-sensitive-mexican-data

2026-03-06 16:06:55 UTC

- reply

@nprofile…2v4z Holly fucking shit, Batman, why would *anyone* use a backup that cannot restore individual files?!

2026-03-05 19:42:17 UTC

Scary...
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/178/271/265/314/115/original/69ff436a9e8558b4.png

2026-03-05 15:48:24 UTC

Went for a PET scan today. While I was waiting, I overheard two young doctors talking. One was telling the other how he had fed an image scan (probably a privacy violation by itself) to an AI and asked it to analyze the image.
The AI came up with, like, dozens of "metastases" in the image, most of which were obvious bullshit. "So," said the doc, "I kept telling it 'remove this', 'remove that' - and it did! I played with it a whole afternoon but it eventually produced a pretty clear image."
All I could think was "Uh-oh. If doctors are starting to delegate life-or-death decisions to stupid chatbots, we're screwed!"