BrianKrebs

Independent investigative journalist. Covers cybercrime, security, privacy. Author of 'Spam Nation,' a NYT bestseller. Former Washington Post reporter, '95-'09. Signal: briankrebs.07
krebsonsecurity @ gmail .com
Linkedin: https://www.linkedin.com/in/bkrebs

Public Key

npub1rfdvtvmesnz7x7s3hjg5q2dgrup9xfh209gvj36angljrfy5edtq25t9xk

NIP-05 Address

briankrebs@infosec-exchange.mostr.pub

Profile Code

nprofile1qqsp5kk9kducf30r0ggmey2q9x5p7qjnym48j5xfgawe50ep5j2vk4spz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsupe7zn

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1rfdvtvmesnz7x7s3hjg5q2dgrup9xfh209gvj36angljrfy5edtq25t9xk

Show more details

Last Notes

2026-06-29 19:15:57 UTC

Maybe this will be needed or even useful, but to me it kind of feels like putting the cart before the horse. Full disclosure: I don't use AI agents (on purpose anyway) but probably making sure that platforms can't discriminate against one's AI agent isn't a bad idea. OTOH, is legislation for privacy, security and market fairness protections of the humans just a foregone conclusion? At this rate, my AI agent is going to have more rights than I do online soon.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/834/992/368/908/002/original/9605e665106f2454.png

2026-05-31 00:14:33 UTC

- reply

Somehow I missed this story in my research concerning Nightwing, the Virginia government contractor where the CISA contractor worked.
May 2, 2025: Raytheon, Nightwing to Pay $8.4 Million in Settlement Over Cybersecurity Failures
"The US government on Thursday announced that it has reached a settlement with Raytheon, RTX Corporation, and Nightwing Group in a lawsuit over the companies’ alleged failures to meet cybersecurity requirements for defense contractors.
Raytheon, a subsidiary of RTX Corporation (previously Raytheon Technologies Corporation), and its then-subsidiary Raytheon Cyber Solutions, Inc. (RCSI), allegedly failed to comply with cybersecurity requirements in 29 contracts and subcontracts with the Department of Defense (DoD). Nightwing is a cybersecurity and intelligence company that spun out of RTX.
According to the settlement, between 2015 and 2021, Raytheon did not implement necessary cybersecurity controls on a system used to perform work on DoD contracts. In 2015, the company landed a DHS cybersecurity contract worth $1 billion.
Raytheon and RCSI allegedly not only failed to implement a security plan for the internal development system, but also failed to ensure that it complied with other Defense Federal Acquisition Regulation Supplement (DFARS) and Federal Acquisition Regulation (FAR) requirements.
Per DFARS and FAR, contractors are required to apply basic safeguarding to systems that process or store federal contract data, and to provide adequate security for those systems, respectively."
https://www.securityweek.com/raytheon-to-pay-8-4-million-in-settlement-over-cybersecurity-failures/amp/

2026-05-30 03:02:29 UTC

One reason that Microsoft might be issuing such harshly worded language here to describe the researcher may be that, according to Nightmare Eclipse, they until recently worked as a security researcher at Microsoft.
Scroll back far enough through their Xitter account (to June 2020) and you will see they claimed CVE-2019-1385 was theirs.
On July 1, 2021, Nightmare Eclipse complained that Microsoft failed to fix one of the weaknesses they reported in CVE-2021-24084. Microsoft credits both of these flaws to the same researcher, whose LinkedIn account says they are in Germany and worked full time at Microsoft from Sept. 2022 to June 2025.
For the record, I think @nprofile…g4vn called it that this person was a former MS employee.
https://x.com/ChaoticEclipse0/with_replies

2026-05-25 14:58:04 UTC

So, I guess now that Google has officially shit the bed w/ their AI search, this is going to be my new browser start page from now on.
https://udm14.org/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/635/796/859/443/674/original/ea93a3dcba81cd37.png

2026-05-24 16:40:08 UTC

To my hearing, there is no more infectious earworm than the Coconut song by Harry Nilsson. I'm not saying a master work of art or anything, just that you will probably be humming (or just hearing) this song the rest of the day. You have been warned.
https://www.youtube.com/watch?v=TsSuueEGQSM

2026-05-23 17:05:57 UTC

I'm sort of wimpy around spiders, but I was marveling at this mama wolf spider outside our door. That is, until I realized she was carrying hundreds of copies of herself on her back that will soon invade our home (several days of heavy rain have forced a ton of creepy crawly things indoors). BUT, they will also eat lots of bugs, so..
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/624/972/637/865/985/original/9fb94d15416bc9fd.png

2026-05-23 16:26:12 UTC

- reply

Come to think of it, that could be a great AI awareness campaign. Just get 1000 different scenarios where people are demonstrably less well-off because of AI: Polluted, diverted or drained water supplies; immense air, noise and heat pollution from countless new gas powered turbines; young grads $500k in debt and watching their field of study evaporate; farmers having trouble being able to buy fertilizer; small businesses literally having trouble keeping the lights on because electricity has skyrocketed in price; and they all just look at the camera and say thanks AI.

2026-05-23 15:37:23 UTC

Feeling pretty good about stocking up on 4 of these bad boys at the end of 2024, when they could be had for ~$350 each. Now, just one of these drives costs as much as I paid for all 4. Thanks, AI!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/624/626/712/578/043/original/ecab5f1493d6854e.png

2026-05-22 17:31:51 UTC

- reply

There's a tendency for organizations to react to inadvertently exposing secrets in public code repositories by disabling the repo in question on GitHub, but then taking their time to rotate the exposed credentials. I guess the thinking is that well, maybe nobody noticed. And that's pure folly. From today's story:
"Ayrey said his company Truffle Security monitors GitHub and a number of other code platforms for exposed keys, and attempts to alert affected accounts to the sensitive data exposure(s). They can do easily on GitHub because the platform publishes a live feed which includes a record of all commits and changes to public code repositories. But he said cybercriminal actors also monitor these public feeds, and are often quick to pounce on API or SSH keys that get inadvertently published in code commits."
"In practical terms, it is likely that cybercrime groups or foreign adversaries also noticed the publication of these CISA secrets, the most egregious of which appears to have happened in late April 2025, Ayrey said.
“We monitor that firehose of data for keys, and we have tools to try to figure out whose they are,” he said. “We have evidence attackers monitor that firehose as well. Anyone monitoring GitHub events could be sitting on this information.”"

2026-05-22 16:39:14 UTC

New, by me: Lawmakers Demand Answers as CISA Tries to Contain Data Leak
"Lawmakers in both houses of Congress are demanding answers from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) after KrebsOnSecurity reported this week that a CISA contractor intentionally published AWS GovCloud keys and a vast trove of other agency secrets on a public GitHub account. The inquiry comes as CISA is still struggling to contain the breach and invalidate the leaked credentials."
From the story:
"KrebsOnSecurity has learned that more a week after CISA was first notified of the data leak by the security firm GitGuardian, the agency is still working to invalidate and replace many of the exposed keys and secrets."
"On May 20, KrebsOnSecurity heard from Dylan Ayrey, the creator of TruffleHog, an open-source tool for discovering private keys and other secrets buried in code hosted at GitHub and other public platforms. Ayrey said CISA still hadn’t invalidated an RSA private key exposed in the Private-CISA repo that granted access to a GitHub app which is owned by the CISA enterprise account and installed on the CISA-IT GitHub organization with full access to all code repositories."
https://krebsonsecurity.com/2026/05/lawmakers-demand-answers-as-cisa-tries-to-contain-data-leak/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/619/204/346/413/400/original/e1050233c912b78d.png

2026-05-22 12:33:40 UTC

If AI is truly making it easier to find security bugs in code (which it appears to be doing), then it makes sense that bug bounty programs may be far less willing to pay a lot of money for a single bug report. From El Reg:
"Finding vulns just doesn't pay like it used to. At least one bug hunter who found an open source security flaw and reported it months ago via HackerOne's backlogged Internet Bug Bounty (IBB) program finally got paid for his work - but at a drastically reduced reward rate. The security researcher found a medium-severity vulnerability that previously paid $1,843. As of Monday, HackerOne's IBB pays $297 for the same severity level. Similarly, the new IBB cash prize for a critical vulnerability is $2,257, compared to the previous $9,250 reward. High-severity bugs now fetch $1,009, while they used to earn a $4,429 payout. And low-severity bugs earn researchers $68, compared to the previous $597 reward."
Not to say that AI has somehow stopped the beg bounty madness. I seem to get more unbidden bug reports from researchers these days than ever, and half the time the bugs are fixed "in the cloud" w/out much notice or fanfare (or CVEs).
https://www.theregister.com/security/2026/05/21/hackerone-takes-an-axe-to-its-bug-bounty-rewards/5244458

2026-05-18 20:55:23 UTC

New, by me: CISA Admin Leaked AWS GovCloud Keys on GitHub
Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and that it represents one of the most egregious government data leaks in recent history.
https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/597/563/541/512/344/original/8f9a823d2ae9bc9c.png

2026-05-16 00:58:05 UTC

Arts and humanities grads at the University of Central Florida booed a commencement speaker who heralded AI as the next industrial revolution. It went over like a lead balloon:
“The rise of artificial intelligence is the next industrial revolution,” she said, addressing a sea of black caps, gowns and tassels, most of them with newly acquired degrees in creative disciplines, including film, animation and media production.
The crowd booed.
“What happened?” Caulfield stammered, looking over her shoulder, as if searching for an escape hatch. “OK, I struck a chord! May I finish? Only a few years ago, A.I. was not a factor in our lives.”
The crowd erupted in cheers.
“And now, A.I. capabilities are in the palm of our hands.” Boooooooooo."
https://www.nytimes.com/2026/05/14/style/ucf-commencement-ai-booed-gloria-caulfield.html

2026-05-12 22:15:20 UTC

I had a daydream today where I imagined an AI dystopian future where AI models are "doxing" each other by pointing out live zero-days in each others' platforms. I'm not sure this is as sci-fi as it sounds.

2026-05-12 21:55:45 UTC

ZOMG PATCH TUESDAY! As today's post explains, it's not just Microsoft increasing the volume (and pacing) of patch releases lately as a result of code audits reportedly from Anthropic's much-hyped and exclusive Glasswing AI offering. Other software giants are getting in on the act now!
https://krebsonsecurity.com/2026/05/patch-tuesday-may-2026-edition/
#patchtuesday #microsoft #anthropic

2026-05-12 20:08:04 UTC

We've come to an icky time in security when the concern about using outdated, unpatched software starts to become overshadowed by the fear of downloaded some backdoored update.

2026-05-12 00:52:02 UTC

- reply

Instructure says it paid a ransom. SMH
"STATUS UPDATE 5/11/26
We know that concerns about the potential publication of data related to this incident remain top of mind for many customers. We understand how unsettling situations like this can be, and protecting our community remains our top priority."
"With that responsibility in mind, Instructure reached an agreement with the unauthorized actor involved in this incident. As part of that agreement:"
"The data was returned to us.
We received digital confirmation of data destruction (shred logs).
We have been informed that no Instructure customers will be extorted as a result of this incident, publicly or otherwise."
'This agreement covers all impacted Instructure customers, and there is no need for individual customers to attempt to engage with the unauthorized actor.
While there is never complete certainty when dealing with cyber criminals, we believe it was important to take every step within our control to give customers additional peace of mind, to the extent possible. We continue to work with expert vendors to support our forensic analysis, further harden our environment, and conduct a comprehensive review of the data involved. We will continue to provide updates as that work progresses."
https://www.instructure.com/incident_update

2026-05-08 03:07:06 UTC

New, from me: Canvas Breach Disrupts Schools and Colleges Nationwide
"An ongoing data extortion attack targeting the widely-used education technology platform Canvas disrupted classes and coursework at school districts and universities across the United States today, after a cybercrime group defaced the service’s login page with a ransom demand that threatened to leak data from 275 million students and faculty across nearly 9,000 educational institutions."
"Canvas parent firm Instructure [NYSE:INST] responded to today's defacement attacks by disabling the platform, which is used by thousands of schools, universities and businesses to manage coursework and assignments, and to communicate with students."
Lots more here:
https://krebsonsecurity.com/2026/05/canvas-breach-disrupts-schools-colleges-nationwide/
#canvas #breach #shinyhunters #instructure
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/536/721/932/019/959/original/a4d51ec80caca497.png

2026-04-25 19:42:00 UTC

I've noticed an interesting shift lately in the Letters to the Editor I get from people who are convinced an unknown tormentor is tracking their every movement through every device they own and then some. I generally don't engage these readers, who almost universally say hello with an absolute wall of text.
But lately, these pleas have come in the form of someone's AI bot breaking down the alleged tracking in painstaking, bullet point detail. The implication is that well the AI bot forensically analyzed the situation and this is the report it produced. As if the AI couldn't be the cause or at least enabler of this person's all-consuming paranoia.

2026-04-21 14:58:12 UTC

New, by me:
'A 24-year-old British national and senior member of the cybercrime group “Scattered Spider” has pleaded guilty to wire fraud conspiracy and aggravated identity theft. Tyler Robert Buchanan admitted his role in a series of text-message phishing attacks in the summer of 2022 that allowed the group to hack into at least a dozen major technology companies and steal tens of millions of dollars worth of cryptocurrency from investors.
Buchanan’s hacker handle “Tylerb” once graced a leaderboard in the English-language criminal hacking scene that tracked the most accomplished cyber thieves. Now in U.S. custody and awaiting sentencing, the Dundee, Scotland native is facing the possibility of more than 20 years in prison."
https://krebsonsecurity.com/2026/04/scattered-spider-member-tylerb-pleads-guilty/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/443/274/546/057/735/original/159263b13544ec3c.png

2026-04-18 14:53:17 UTC

Pretty wild mural painted over the men's urinals in the restroom of a restaurant we went to last night (if they don't call it a "murinal" they should). I thought it was hilarious but I wonder how many others would have a very different reaction.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/426/263/501/524/032/original/53c98bd6beb06d22.png

2026-04-18 13:26:18 UTC

I recently misspelled the word dumbbell. Some words really do shame you when you forget their form. I still feel like a meathead.

2026-04-16 14:30:34 UTC

This apparently happened overnight in Virginia, in Annandale near where we used to live.
"Virginia Ex-Lt. Gov. Justin Fairfax Kills Wife and Self, Police Say
Mr. Fairfax, a Democrat, served as lieutenant governor from 2018 to 2022.
From NYT:
"Justin Fairfax, a former lieutenant governor of Virginia, and his wife, Cerina Fairfax, were found dead in a murder-suicide at their home in Annandale, Va., shortly after midnight on Thursday, according to the county police.
The Fairfax County police chief said that Mr. Fairfax, 47, shot his wife and then himself. Their teenage children were home at the time, the police chief said.
Mr. Fairfax, a Democrat, served as the lieutenant governor from 2018 to 2022. He was accused of sexual assault by two women in 2019, prompting calls for his resignation. Mr. Fairfax denied the allegations and finished his term. He then ran unsuccessfully for governor, losing in the primary to the former Virginia governor Terry McAuliffe in 2021.
Kevin Davis, the county police chief, said that the couple had been in an “ongoing domestic dispute surrounding a complicated or messy divorce.” Court records show that Mr. Fairfax and his wife, a dentist, were in court proceedings this year to divorce."
https://www.nytimes.com/2026/04/16/us/virginia-lt-governor-justin-fairfax-murder-wife-suicide.html

2026-04-15 15:53:58 UTC

If my attention span was any shorter today

2026-04-14 23:58:26 UTC

- reply

@nprofile…j4vx @nprofile…equ9 I had to dig up this 2008 WaPo story from Archive since WaPo nuked all my blog posts from their site. It's about @nprofile…e49m, the guy who registered donotreply.com.
https://web.archive.org/web/20110810225035/http://voices.washingtonpost.com/securityfix/2008/03/they_told_you_not_to_reply.html

2026-04-14 21:55:29 UTC

ZOMG! It's freakin Patch Tuesday again. And Microsoft has patched a staggering 167 security holes (think more people are using AI to find bugs, maybe?)
tl;dr: There's something for everyone today, like an Adobe Reader 0day that's apparently been exploited since at least November 2025; a SharePoint zero-day; and a fix for BlueHammer, and a Windows Defender bug for which there is working exploit code that no longer works if you install today's Windows updates (as per @nprofile…c808).
https://krebsonsecurity.com/2026/04/patch-tuesday-april-2026-edition/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/405/281/966/806/831/original/f61414859dc60aae.png

2026-04-14 20:17:40 UTC

So @nprofile…c808, is this CVE-2026-33825 the BlueHammer patch? https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-33825

2026-04-14 12:44:08 UTC

This discussion atop Hackernews right now about how someone bought 30 WordPress plugins and planted a backdoor in all of them has me wondering, is there a plugin that blocks plugins from being automagically updated if the plugin's ownership changes?
https://news.ycombinator.com/item?id=47755629#47756259

2026-04-10 15:35:13 UTC

- reply

@nprofile…7q73 no, plagiarism is the sincerest form of flattery :)

2026-04-10 14:33:07 UTC

Someone posted this to the Breachforums telegram channel. Not sure who the others in this image are supposed to be, but it looks like the Breachforums admin Pompompurrin in the front. While supplies last....
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/380/886/041/684/912/original/3af7b6826e9fa90d.png

2026-04-06 15:54:01 UTC

- reply

@nprofile…e09a @nprofile…dyda @nprofile…rvvx thanks. Are you talking about Shchukin? I started listening to that talk you mentioned but it's quite long and seems to concern the Finnish hacker Kivimaki. If you can tell me a time in the video to look at/listen, that would be helpful, thanks.

2026-04-06 15:40:50 UTC

New, by me: An elusive hacker who went by the handle “UNKN” and ran the early Russian ransomware groups GandCrab and REvil now has a name and a face. Authorities in Germany say 31-year-old Russian Daniil Maksimovich Shchukin headed both cybercrime gangs and helped carry out at least 130 acts of computer sabotage and extortion against victims across the country between 2019 and 2021. From the story:
UNKNOWN also gave an interview to Dmitry Smilyanets, a former malicious hacker hired by Recorded Future, wherein UNKNOWN described a rags-to-riches tale unencumbered by ethics and morals.
“As a child, I scrounged through the trash heaps and smoked cigarette butts,” UNKNOWN told Recorded Future. “I walked 10 km one way to the school. I wore the same clothes for six months. In my youth, in a communal apartment, I didn’t eat for two or even three days. Now I am a millionaire.”
https://krebsonsecurity.com/2026/04/germany-doxes-unkn-head-of-ru-ransomware-gangs-revil-gandcrab/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/358/510/805/464/240/original/052d98c5649a0d1c.png

2026-04-02 00:08:03 UTC

The POTUS' war on Iran is already bringing rationing of fuel and major disruptions in many countries, and how it's going to get a lot worse soon as the final shipments that made it thru the Strait start to arrive this week, the NYT reports. I admire (but do not share) this story's optimism of the potential for the Iran war to hasten more global adoption of renewables.
"Sri Lanka and Myanmar are rationing fuel. The Philippines has instituted four-day workweeks to conserve gasoline and electricity. Bangladesh briefly closed its universities to reserve power for homes and businesses. Across India, families and restaurants are cooking over wood fires for want of gas. Airlines are canceling flights."
"As painful as the first phase of the energy crisis set off by the war with Iran has been, what comes next will be worse. This week, the final deliveries of oil and liquefied natural gas to Asia that passed through the Strait of Hormuz before it was closed are expected to arrive. The last tanker shipments to Europe should land by mid-April. After that, many countries’ reserves of gasoline, diesel, liquid petroleum gas and natural gas will dwindle. The price of oil could soar as high as $200 a barrel if the war drags on."
Meanwhile, China -- which leads the world in battery technology production -- stands to massively gain from all this oil shock.
"As the Philippines declared a national energy emergency on March 24, car shoppers in Manila were crowding into showrooms of the Chinese carmaker BYD and purchasing E.V.s ."
Of course, here in the US we've largely said that we're just gonna keep making gas guzzlers and forget about all those pledges we made to invest in electric vehicles. Consumers in the US would be flocking to those BYD cars too if import duties didn't make them prohibitively expensive. Most of the big car makers in the US are hopelessly focused on people who don't bat an eyelash spending $60,000 (base price) for a new car or truck.
https://www.nytimes.com/2026/04/01/opinion/oil-crisis-iran-electric-solar.html

2026-04-01 18:46:36 UTC

IDK who Deb Eskew is, but I certainly glanced askew when reading this. See how many red flags you can spot. This one seems to have them all:
-unbidden attachment (which couldn't be auto-scanned for malware btw)
-no actual greeting or salutation
-a password needed to unlock the attachment
-relevant (if a bit on-the-nose) social engineering involving a podcast ostensibly focused on fraud;
-Google is clearly glancing askew here, too, but kind of tapping out on a verdict because it ultimately made it through.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/330/924/197/339/594/original/ac20ac5d112ea872.png

2026-03-23 21:19:40 UTC

Whoa, that escalated quickly. This just got sent out by the press folks at the Federal Communications Commission (FCC). The FCC says it has decided that all foreign-made consumer-grade Internet routers are henceforth prohibited from receiving FCC authorization and are therefore prohibited from being imported for use or sale in the United States.
"Update Follows Determination by Executive Branch Agencies that Consumer-Grade Routers Produced in Foreign Countries Threaten National Security
WASHINGTON, March 23, 2026—Today, the Federal Communications Commission updated its Covered List to include all consumer-grade routers produced in foreign countries. Routers are the boxes in every home that connect computers, phones, and smart devices to the internet. This followed a determination by a White House-convened Executive Branch interagency body with appropriate national security expertise that such routers “pose unacceptable risks to the national security of the United States or the safety and security of United States persons.”
"The Executive Branch determination noted that foreign-produced routers (1) introduce “a supply chain vulnerability that could disrupt the U.S. economy, critical infrastructure, and national defense” and (2) pose “a severe cybersecurity risk that could be leveraged to immediately and severely disrupt U.S. critical infrastructure and directly harm U.S. persons.”
"This action does not affect any previously-purchased consumer-grade routers. Consumers can continue to use any router they have already lawfully purchased or acquired."
"Producers of consumer-grade routers that receive Conditional Approval from DoW or DHS can continue to receive FCC equipment authorizations. Interested applicants are encouraged to submit applications to conditional-approvals@fcc.gov."
Not sure how many consumer-grade routers will be left for sale if it really is a ban on approvals for any foreign-made consumer routers like they said, and not just a bunch of already restricted Chinese makers like Huawei and ZTE.
https://www.fcc.gov/document/fcc-updates-covered-list-include-foreign-made-consumer-routers
FCC's "covered list" of "thou shalt not entities": https://www.fcc.gov/supplychain/coveredlist

2026-03-23 21:10:18 UTC

The Kimwolf botmaster Dort is currently spamming the living crap out of this Mastodon instance with messages claiming i'm a monster. Sorry @nprofile…l9z3. That's a lot of junk accounts and messages. I guess the visit he got from law enforcement didn't deter him much.

2026-03-23 17:11:18 UTC

This is a crazy, developing story. And here you thought *your* organization's patch management routines were strict: From Christopher Kunz at Heise:
"A serious security vulnerability in the Windchill and FlexPLM products prompted a nationwide police response over the weekend. At the behest of the Federal Criminal Police Office (BKA), officers from across Germany were dispatched to alert affected companies – an unprecedented move. Administrators, whose weekends were disrupted, expressed their irritation – some of whom don't even use the compromised software."
"When the editorial team received a tip late Sunday morning about a critical security vulnerability in Windchill and FlexPLM , it sounded like a routine report: A deserialization vulnerability in specialized software, even with a CVSS score of 10, doesn't cause any alarm at heise security. The situation was apparently quite different at the Federal Criminal Police Office (BKA): By that time, they had already alerted the state criminal police offices (LKA) in various federal states, which dispatched police officers to affected companies during the night. As several readers reported to us in the forum , police officers were standing outside company and private premises in the dead of night."
https://www.heise.de/news/WTF-Polizei-rueckte-Samstagnacht-wegen-Zero-Day-aus-11221345.html

2026-03-23 16:10:20 UTC

ICYMI (from the not-all-cyber-news-is-horrible dept), a cyberattack on a U.S. vehicle breathalyzer company has left drivers across the United States stranded and unable to start their vehicles. This story positively cries out for a headline-writing contest. TechCrunch reports:
"The company, Intoxalock, says on its website that it is “currently experiencing downtime” after a cyberattack on March 14. Intoxalock sells breathalyzer devices that fit into vehicle ignition switches, and is used by people who are required to provide a negative alcohol breath sample to start their car."
https://techcrunch.com/2026/03/20/cyberattack-on-vehicle-breathalyzer-company-leaves-drivers-stranded-across-the-us/

2026-03-21 01:01:34 UTC

- reply

@nprofile…3jn2 it used to be the case, but a lot of more recent IoT malware will survive a reboot just fine.

2026-03-20 00:53:34 UTC

New, breaking: Feds Disrupt IoT Botnets Behind Huge DDoS Attacks
The U.S. Justice Department joined authorities in Canada and Germany in dismantling the online infrastructure behind four highly disruptive botnets that compromised more than three million hacked Internet of Things (IoT) devices, such as routers and web cameras. The feds say the four botnets — named Aisuru, Kimwolf, JackSkid and Mossad — are responsible for a series of recent record-smashing distributed denial-of-service (DDoS) attacks capable of knocking nearly any target offline.
No word yet on which botmasters got a visit from feds, but the DOJ statement references law enforcement against against botmasters in Canada and Germany. Last month, I reported on a likely identity behind Dort, the main individual behind the Kimwolf botnet. The other suspect was a 15 y/o from Germany.
https://krebsonsecurity.com/2026/03/feds-disrupt-iot-botnets-behind-huge-ddos-attacks/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/258/762/468/524/130/original/99f730f77a43a287.png

2026-03-11 16:24:45 UTC

Breaking, new, by me: Iran-backed Hackers Claim Wiper Attack on Medtech Firm Stryker
A hacktivist group with links to Iran's intelligence agencies is claiming responsibility for a data-wiping attack against Stryker, a global medical technology company based in Michigan. News reports out of Ireland, Stryker's largest hub outside of the United States, said the company sent home more than 5,000 workers there today. Meanwhile, a voicemail message at Stryker's main U.S. headquarters says the company is currently experiencing a building emergency.
From the story:
"Wiper attacks usually involve malicious software designed to overwrite any existing data on infected devices. But a trusted source with knowledge of the attack who spoke on condition of anonymity told KrebsOnSecurity the perpetrators in this case appear to have used a Microsoft service called Microsoft Intune to issue a ‘remote wipe’ command against all connected devices."
"Intune is a cloud-based solution built for IT teams to enforce security and data compliance policies, and it provides a single, web-based administrative console to monitor and control devices regardless of location. The Intune connection is supported by this Reddit discussion on the Stryker outage, where several users who claimed to be Stryker employees said they were told to uninstall Intune urgently."
https://krebsonsecurity.com/2026/03/iran-backed-hackers-claim-wiper-attack-on-medtech-firm-stryker/
#stryker #handala #intune #wiper #cybersecurity
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/211/464/307/859/938/original/3d348cfab9495ad4.png

2026-03-10 19:42:49 UTC

We've been weaning ourselves off ordering things from Amazon, so my wife went and ordered something big from a different retailer, who was actually advertising it at a lower price than Amazon. Well, after a week of waiting for the item to ship, it suddenly just arrived. Turns out the order was fulfilled through Amazon anyway.

2026-03-09 16:43:48 UTC

New, by me: How AI Assistants are Moving the Security Goalposts
AI-based assistants or “agents” — autonomous programs that have access to the user’s computer, files, online services and can automate virtually any task — are growing in popularity with developers and IT workers. But as so many eyebrow-raising headlines over the past few weeks have shown, these powerful and assertive new tools are rapidly shifting the security priorities for organizations, while blurring the lines between data and code, trusted co-worker and insider threat, ninja hacker and novice code jockey.
Read more (and boost please!):
https://krebsonsecurity.com/2026/03/how-ai-assistants-are-moving-the-security-goalposts/
#openclaw #AI #agentic #aiagents #lethaltrifecta
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/200/212/293/707/219/original/44864d04eae0af69.png

2026-03-08 22:20:12 UTC

With the recent heavy rains around here, the spring peepers are going nuts today with the warm weather we're enjoying. I don't know why -- maybe it's because their little froggy peeps are some of the first hopeful signs of Spring -- but hearing them sing in unison this early makes me unreasonably happy.

2026-03-05 15:18:11 UTC

- reply

@nprofile…rh4q Lol yes. The Kimwolf botmaster is responsible for that. Funny what you can do with several hundred thousand bots.

2026-03-03 17:16:11 UTC

- reply

@nprofile…6vjc the small, edible kind.

2026-03-03 16:21:43 UTC

Saw a few videos this morning of Iranian drones targeting US military bases and blowing shit up. I was struck by how loud and slow these things are. It's as if the loudest leafblower on the planet had wings and a propeller.
This AP News story has some good detail on Iran's response to its neighbors, which indicates the majority of the many, many missiles and drones Iran sent at or near the UAE were intercepted, but that some less defended places were still hit due to the volume of the missile/drone volley.
"Officials in Dubai in the United Arab Emirates said Sunday that air defenses had dealt with 165 ballistic missiles, two cruise missiles and more than 540 Iranian drones over two days. While officials said they intercepted all air attacks Saturday, debris from the knocked-down weapons sparked blazes at some of Dubai’s most iconic locations."
"Some Iranian drones flew as far as a U.K. military base in Cyprus. The runway at the Royal Air Force base in Akrotiri was struck by an Iranian drone Sunday, according to U.K. officials, and sirens blared there again Monday when two more drones heading toward the base were intercepted."
"State-of-the-art U.S. and Israeli air defense assets have proven efficient in intercepting most of Iran’s ballistic missiles launched at Israel. But the attacks using large numbers of cheap drones hit some softer targets lacking the same level of protection."
https://apnews.com/article/iran-us-israel-gulf-war-drone-49c8ea76358e579447ff839485f394ac

2026-03-03 15:49:03 UTC

The POTUS is learning that you can't just TACO yourself out of a war that you JUST started, no matter how the market reacts. It turns out the market reacts badly to uncertainty, and the president just said he's going to keep bombing Iran for a few more weeks, maybe longer (probably if he'd said yeah we'll be wrapped up by April 20 the market would be like oh, okay cool). But it's not just everyone's savings and 401ks that are going to take a nosedive because of this war; a LOT of stuff that was already overpriced because of his arbitrary taxes is about to get way more expensive.

2026-03-03 15:30:39 UTC

Oh yes, the merger of HBO Max and Paramount+ will engender soooo much competition. What a load of hooey. If this doesn't turn out to be the most textbook example of enshittification, I'll eat my hat. From WaPo:
"Paramount Skydance will combine Paramount+ and HBO Max into one streaming service, David Ellison, the company’s CEO, said on a Monday call with investors.
“As we said, we do plan to put the two services together, which today gives us a little over 200 million direct-to-consumer subscribers,” Ellison said. “We think that really positions us to compete with the leaders in the space.”
https://www.washingtonpost.com/style/2026/03/02/hbo-max-paramount-streaming-service/

2026-03-03 15:22:43 UTC

Oh goodie: Daylight Savings Time again this weekend! For most of my life I've been a night person. But almost like clockwork when I turned 50, my body clock started waking me up when the sun comes up, which I resisted at first but have grown used to (it's actually my fav part of the day now). But I basically have to start going to bed an hour earlier after this Sunday because then I will be wide awake an hour earlier. I would be very happy if the US followed British Columbia's lead in permanently adopting daylight time. All this moving clocks and body clocks around is just silly in 2026.
https://www.cbc.ca/news/canada/british-columbia/b-c-adopting-year-round-daylight-time-9.7111657

2026-03-03 14:57:11 UTC

Found myself wincing while reading this story about how Ars Technica fired a reporter over fabricated quotations generated by an AI tool. What a mess. And a tough one to bounce back from. I get asked all the time how I use AI in my work, and my answer is always the same: I don't, for all the reasons I also don't delegate important research to others, plus a whole bunch of other good reasons. But I really am interested in the answer from other journalists, because I suspect I'm in the minority here.
From Futurism.com:
"In the post, Edwards said that he was sick at the time, and “while working from bed with a fever and very little sleep,” he “unintentionally made a serious journalistic error” as he attempted to use an “experimental Claude Code-based AI tool” to help him “extract relevant verbatim source material.” He said the tool wasn’t being used to generate the article, but was instead designed to “help list structured references” to put in an outline. When the tool failed to work, said Edwards, he decided to try and use ChatGPT to help him understand why.
“I should have taken a sick day because in the course of that interaction, I inadvertently ended up with a paraphrased version of Shambaugh’s words rather than his actual words,” Edwards continued. He emphasized that the “text of the article was human-written by us, and this incident was isolated and is not representative of Ars‘ editorial standards. None of our articles are AI-generated, it is against company policy and we have always respected that.”
https://futurism.com/artificial-intelligence/ars-technica-fires-reporter-ai-quotes

2026-03-03 13:29:12 UTC

Well, we're batting 0 for like 200 on observing cool astronomical phenomena lately.
Total solar eclipse: Cloudy.
Northern Lights appear in Virginia! Cloudy.
Rare planetary conjunction happens. Cloudy.
Blood Moon from a lunar eclipse. Cloudy.
I'm sure when the aliens finally come park their giant death cruiser in front of our planet, it'll be cloudy then, too.

2026-03-02 16:11:09 UTC

- reply

@nprofile…l9z3 just search messages for krebson. reporting them all would take quite some time.

2026-03-02 16:05:44 UTC

Someone has registered a ton of new accounts and is spamming with messages saying I'm a pedophile. Sorry @nprofile…l9z3

2026-03-02 15:04:16 UTC

One of my early roles at WaPo was as an editorial aide in the Editorial section, where part of my job involved reading all the Letters to the Editor and separating the crazies from those might possibly have a salient point to make.
30 years later (gulp), I am still getting plenty of Letters to the Editor, but they are not what they used to be. Time was, they were mostly people convinced their lives were being turned upside down and inside out by nebulous hackers, the govt, their ex, etc. Back in WaPo days, the common thread from the crazies was that their tormentors were using radio signals or somesuch to track and harass them.
These days, however, the "they're all after me" pleas are getting drowned out by inquiries from people who have clearly delved too deep down the AI chatbot rabbit hole. To the point where they're trying to convince everyone that nefarious, AI-based actors are harassing them, or that benevolent sentient beings reside within.
The thing is, the sentient being claim aside, it is actually stupid easy with today's hot new agentic AI toys for people to make their worst nightmares come true -- including having all their stuff taken over by a machine that most definitely does not have their best interests at heart.

2026-03-02 13:40:51 UTC

New, by me: Who Is the Kimwolf Botmaster, "Dort"?
In early January 2026, KrebsOnSecurity revealed how a security researcher disclosed a vulnerability that was used to build Kimwolf, the world’s largest and most disruptive botnet. Since then, the person in control of Kimwolf — who goes by the handle “Dort” — has coordinated a barrage of distributed denial-of-service (DDoS), doxing and email flooding attacks against the researcher and this author, and more recently caused a SWAT team to be sent to the researcher’s home. This post examines what is knowable about Dort based on public information.
https://krebsonsecurity.com/2026/02/who-is-the-kimwolf-botmaster-dort/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/159/859/092/244/058/original/a53e5b0c509e0d8a.png

2026-03-02 13:35:06 UTC

- reply

@nprofile…3qha I get these requests constantly. I used to respond to all that I could but these days I get a wall of AI-written questions before I even agree to help.

2026-02-25 20:19:36 UTC

- reply

I'd argue that very few companies have any real appreciation for how many of their employees are already feeding API keys and other stuff into fairly new and questionable agentic AI tools or platforms. So many companies are like, oh we're taking a wait-and-see approach to adopting AI. Meanwhile, half their dev team is doing critical development work on shared servers that have no authentication or limited (no 2fa) auth.

2026-02-25 20:04:25 UTC

Agentic AI-based services are the new Shadow IT. Change my mind.

2026-02-21 14:04:45 UTC

- reply

The CEO of Persona responded to this post, saying they wanted to clarify about the identity verification process. They said:
"The only subprocessors (8) used are: AWS, Confluent, DBT, ElasticSearch, GCP, MongoDB, Sigma Computing, and Snowflake
All biometric personal data is deleted immediately after processing.
All other personal data processed is automatically deleted within 30 days. Data is retained during this period to help users troubleshoot.
No personal data processed is used for AI/model training. Data is explicitly used to confirm your identity.
The subprocessors used do NOT include Anthropic, Groqcloud, or OpenAI. The referenced subprocessor list is the superset of subprocessors used across all customers which is unfortunately misleading - we are updating our documentation to make this clearer going forward (thank you for helping us realize this). Our customers select which products are used which determines which subprocessors are used."

2026-02-20 17:48:03 UTC

- reply

Sorry. VM=Virtual Machine, like Parallels, VMWare or VirtualBox, which let you load another operating system as a guest OS and run it on top of your host OS. The nice thing about a VM is that you can configure it how you like, save a snapshot, and then revert to that snapshot when you're ready to shut down.

2026-02-20 17:25:07 UTC

Was just browsing the Internet in a VM with script-blockers turned off for a bit, and half the sites were like "IT PUTS THE DATA IN THE BASKET OR IT GETS THE HOSE AGAIN!" with multiple videos, dozens of ads and and 99 pieces of third-party Javascript loading in the background. The amount of advertiser profiling and data sharing that goes on when you visit these noisy sites with a mobile device is even higher and more invasive, which might explain why I do most of my web browsing inside a VM (but with script blockers turned on).

2026-02-20 13:28:48 UTC

If you're on LinkedIn and are thinking about verifying your account with them, maybe read this first. It walks through LinkedIn's privacy disclosure to identify 17 companies that may receive and process the data you submit, including name, passport photo, selfie, facial geometry, NFC data chip, national ID #, DoB, email, phone number, address, IP address, device type, MAC address, language, geolocation etc. Unsurprisingly, it seems the biggest recipients are US-based AI companies.
https://thelocalstack.eu/posts/linkedin-identity-verification-privacy/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/103/178/327/243/236/original/e6bc02dc19c54552.png

2026-02-11 18:19:27 UTC

Thank goodness the Federal Aviation Administration is still able to do its job and be the adult in the room. For now, anyway. How long until the Cheetoh in Chief starts grounding planes in blue states for the rebuke?
From CBS News:
"The unexpected but brief airspace closure in the Texas border city of El Paso stemmed from disagreements between the Federal Aviation Administration and Pentagon officials over drone-related tests, multiple sources close to the matter told CBS News. "
"The Pentagon had undertaken extensive planning on the use of military technology near Fort Bliss, a military base that abuts the El Paso International Airport, to practice taking down drones."
"Two sources identified the technology as a high-energy laser."
"Meetings were scheduled over safety impacts, but Pentagon officials wanted to test the technology sooner, stating that U.S. Code 130i requirements governing the protection of certain facilities from unmanned aircraft had been met."
"FAA Administrator Bryan Bedford on Tuesday night decided to close the airspace — without alerting White House, Pentagon or Homeland Security officials, sources said."
https://www.cbsnews.com/news/airspace-closure-followed-spat-over-drone-related-tests-and-party-balloon-shoot-down-sources-say/

2026-02-10 22:28:17 UTC

Yes, Windows (ab)users it's your favorite time of the month once again (ducks). Microsoft today released updates to fix more than 50 security holes in its Windows operating systems and other software, including patches for a whopping six "zero-day" vulnerabilities that attackers are already exploiting in the wild.
https://krebsonsecurity.com/2026/02/patch-tuesday-february-2026-edition/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/048/686/678/525/034/original/a72d44121d2b8d0e.png

2026-02-09 21:18:26 UTC

One of the more terrifying realities about the prospect of starting your own business in the US is that you quickly learn you are on your own when it comes to finding affordable healthcare. You might even make enough that you don't qualify for any plan that doesn't cost <$30k a year, w/ high deductibles.
I know I've mentioned this before here, but it bears repeating because it came up in a conversation the other day where the small biz owner had no idea. Namely, that depending on where you live, you may qualify for a fairly inexpensive and decent healthcare plan for you and your family just by taking a class at a local university or community college. NB: It may only require a non-degree (non-credit) course. Anyway, something to investigate if you're looking for a way to reduce your healthcare costs.

2026-02-09 19:49:18 UTC

ICYMI, from Reuters:
"Democratic Senator Maria Cantwell on Tuesday said Verizon and AT&T are blocking release of key documents about an alleged massive Chinese spying operation that infiltrated U.S. telecommunications networks known as Salt Typhoon and wants their CEOs to appear before Congress to answer questions."
"Cantwell asked both companies to turn over security assessments conducted by Alphabet cybersecurity unit Mandiant. She said Mandiant refused to provide the requested network security assessments, apparently at the direction of AT&T and Verizon."
"In some cases, hackers are alleged to have intercepted conversations, including between prominent U.S. politicians and government officials. Several lawmakers have described them as the worst telecom hacks in U.S. history."
"Cantwell said Salt Typhoon allowed the Chinese government to "geolocate millions of individuals" and "record phone calls at will," and that the incident targeted almost every American."
https://www.reuters.com/business/media-telecom/senator-says-att-verizon-blocking-release-salt-typhoon-security-assessment-2026-02-03/

2026-02-06 21:10:40 UTC

The Extorter in Chief is at it again. Per the NYT:
"The Trump administration has sought to pressure Senator Chuck Schumer, Democrat of New York and the minority leader, to help name New York’s Penn Station and Washington Dulles International Airport after President Trump in exchange for releasing billions of dollars he has frozen for a rail tunnel under the Hudson River."
Top administration officials have told Mr. Schumer in recent weeks that the money would be released if he agreed to name the facilities in Mr. Trump’s honor, according to four people familiar with the private conversations. The people spoke on the condition of anonymity because they were not authorized to reveal the private discussions."
https://www.nytimes.com/live/2026/02/06/us/trump-news#section-918963069

2026-02-06 20:15:34 UTC

- reply

@nprofile…206n Do I really look that much older?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/025/518/466/927/080/original/7f4e2759b2a292f4.png

2026-02-06 18:40:33 UTC

I've really been enjoying Dana Milbank's dispatches from the Va. countryside lately. This one is about how the effort to "save the honeybees" -- which has been on the whole enormously beneficial -- has largely helped the honeybees massively crowd out native species, particularly the bumblebees. We have several people keeping honeybees near where we live, and we've absolutely noticed the honeybees crowding out other native species (of which there ~4,000). Milbank writes of the bumblebees:
"Once widespread throughout eastern North America, it has disappeared from 87 percent of its historic range. Now it exists only in pockets, such as in the Upper Midwest and in the mountains between Virginia and West Virginia."
"If you are in it for the pollinators, try some of the better (and easier) suggestions I’ve listed below from the experts. The bumblebees, sweat bees, mason bees, miner bees, leafcutters and other native bees, most of them solitary, ground-nesting and docile, need your help. Honeybees do not."
https://www.washingtonpost.com/climate-environment/2026/02/06/how-to-save-the-bees-honeybees-dying/
https://archive.ph/GyeS5

2026-02-06 16:32:57 UTC

When I saw the other journalists that were nominated, I didn't think there was a chance (e.g. ProPublica was nominated for their excellent investigative reporting uncovering the Pentagon's reliance on Chinese contractors for cloud work). I'm very flattered to be in such great company. Thank you to the Institute for Security and Technology (IST) for this award.
Last night's IST gala at the National Press Club was a stroll down memory lane in many ways. Ran into people I haven't seen in person for ages, and most of them have been involved in shaping cybersecurity policy for 25+ years.
It was also bittersweet because I spent a lot of time at the Press Club as a reporter at The Washington Post, and I'm still livid about the insanity of the 300 or so WaPo journalists who lots their jobs this week.
I'm particularly mystified by the decimation of the Post's Metro staff; despite its stature as a top source of national and international news, The Washington Post has always maintained a strong focus on what's going on in the DC area. When they merged washingtonpost.com with the dead tree edition in 2009 and eliminated my job, the mantra of the company was they wanted to be THE source of news about what's happening in the Nation's Capital, and how policy being made in DC affects the rest of the world. Here's part of what I told the audience last night:
"I horrified this week to see The Washington Post lay off 300 of its 800 remaining journalists -- the third major staff reduction in as many years. A lot of the cuts are deeply affecting the foreign and local metro staff; it's easy to forget the Watergate scandal started as a metro story. Probably we need several hundred more reporters digging into what this administration is doing, because Watergate frankly can't hold a candle to it all."
"I'm hoping all of the post-Posties will land in a better place soon, but I also hope they can keep doing their important work regardless of where it comes from. And I will continue to advocate for, support and encourage anyone who wants to go the independent route. I think journalism is going to be just fine for now, but I'm not sure I share the same view about many traditional news organizations. I hear from a lot of reporters considering the going out on their own worry about not having a big publication name to automatically open doors for them, or watch their backs legally, and those are certainly big adjustments of going solo. But you know what makes all that worth it? When you're breaking news that forces important people to answer hard questions, and the gatekeepers go, wait, who are you with again?"
https://www.linkedin.com/feed/update/urn:li:activity:7425373027145752577/?commentUrn=urn%3Ali%3Acomment%3A(activity%3A7425373027145752577%2C7425575747831947264)&dashCommentUrn=urn%3Ali%3Afsd_comment%3A(7425575747831947264%2Curn%3Ali%3Aactivity%3A7425373027145752577)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/024/623/073/463/045/original/df6c07ec86e63501.png

2026-02-02 00:37:25 UTC

So, rather than watch the rest of the performers bow out of gigs, he's just going to close it down for construction? Can't wait to see what he does with the place. From WaPo:
"Trump plans to close Kennedy Center for about two years, starting in July
Under the proposal, the Kennedy Center could close on July 4, coinciding with America’s 250th anniversary."
“I have determined that The Trump Kennedy Center, if temporarily closed for Construction, Revitalization, and Complete Rebuilding, can be, without question, the finest Performing Arts Facility of its kind, anywhere in the World,” Trump wrote in a post on Truth Social. “In other words, if we don’t close, the quality of Construction will not be nearly as good, and the time to completion, because of interruptions with Audiences from the many Events using the Facility, will be much longer. The temporary closure will produce a much faster and higher quality result!”
https://www.washingtonpost.com/style/2026/02/01/kennedy-center-trump-closure-construction/

2026-02-01 18:01:38 UTC

According to the Epstein files, he had a "personal hacker" working for him. The FBI document says Epstein's personal hacker was an "Italian citizen born in Calabria who developed zero-day exploits and offensive cyber tools and sold the tools to governments."
https://www.justice.gov/epstein/files/DataSet%2010/EFTA01683874.pdf
"[Redacted] sold a zero-day to Hebollah. [Redacted] was known as the first person to hack and find vulnerabilities in Blackberries and iOS. He was known for finding Firefox vulnerabilities. [Redacted] former company was acquired by CrowdStrike in fall of 2017 and was currently a vice president there."
"S//NF= was very good at finding vulnerabilities was friends with "old school" European hackers. "Received a trunk of cash from Hezbollah when was in Italy; drove the money to Switzerland and deposited it in another ba [redacted]. [redacted] owned a theater company in California and he used the theater company to launder his zeroday money
"Made six figures from the sale of his zero-days. He sold his tools to United Kingdom GCHQ and provided training to the organization. He also sold his zero-days to a Central African government, as well as Hezbollah for political reasons. The Italian Government asked for help, but [redacted] declined because he felt the Government was incompetent. Calabria was mob-controlled an did not have much loyalty for his birth country.
"[Redacted] sold his exploits to the United States and United Kingdom, but he would not sell to Asian countries because he a is racist. He was also anti-Semitic. [Redacted] was terrified of Russia, however, and would never travel there. He lived in Dubai at one time, and was acquainted with the [redacted] lived in Oman as well. He may have an Iranian and Israeli passport, in addition to his Vatican City passport"
Looks likely the top commenter here is correct about "Epstein's hacker":
https://www.reddit.com/r/cybersecurity/comments/1qsi6ds/informant_told_fbi_that_jeffrey_epstein_had_a/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/996/648/309/425/145/original/e25504a41a65f78a.png

2026-01-30 16:52:35 UTC

Finally got around to learning the song "Breathe" by Pink Floyd on the piano. The chord sequences are just dripping with chill. This song reminds me of Zepplin's "Rain Song," in that I could listen to it and play it for hours on end. Pink Floyd recorded this song with a guitar mostly doing the chords. It sounds amazing with the keyboard filling in, especially with some funky preset like 70s funk.
Breathe:
https://www.youtube.com/watch?v=jcz0YxYl6Ac&list=RDjcz0YxYl6Ac&start_radio=1
Quick and dirty tutorial on the chords (you can mess around within the chord in the right hand for a melody):
https://www.youtube.com/watch?v=apQRi_B5miE

2026-01-27 21:17:37 UTC

Letting AI agents run your life is like handing the car keys to your 5-year-old. What could go wrong?
I was marveling while reading this PCMag piece, which describes how to secure an agentic AI setup that essentially mimics malware: To do it's job properly, the AI agent has to be able to read private messages, store credentials, execute commands, and maintain a persistent state. How do you do that? You chase after it like you would your child.
"The important thing is to make sure you limit "who can talk to your bot, where the bot is allowed to act, [and] what the bot can touch" on your device, the bot's support documentation says."
https://www.pcmag.com/news/clawdbot-moltbot-hot-new-ai-agent-creator-warns-of-spicy-security-risks?test_uuid=04IpBmWGZleS0I0J3epvMrC&test_variant=A

2026-01-27 19:24:58 UTC

Ten feet of sledding in our plastic sled told me that to continue down meant almost certain manglement or death. The entire hill is a thick, glistening layer of frozen rain and sleet on top of snow, where breaking through requires some serious force. So I ditched the sled and slid down the hill in my snowpants. As I feared, stopping was terrifying, difficult and somewhat painful. Worse, took about 10 seconds to go down, and about 10 minutes to go back up. 2/10 for the smooth ride till the violent end.

2026-01-26 17:10:54 UTC

We knew this was coming, but now the clock is running. From Privacy International:
"Yesterday the Trump Administration announced a proposed change in policy for travellers to the U.S. It applies to the powers of data collection by the Customs and Border Police (CBP)."
"If the proposed changes are adopted after the 60-day consultation, then millions of travellers to the U.S. will be forced to use a U.S. government mobile phone app, submit their social media from the last five years and email addresses used in the last ten years, including of family members. They’re also proposing the collection of DNA."
PI linked to and summarized a Federal Register entry describing the proposed requirements:
-All visitors must submit ‘their social media from the last 5 years’
-ESTA (Electronic System for Travel Authorization) applications will include ‘high value data fields’, ‘when feasible’
‘telephone numbers used in the last five years’
-‘email addresses used in the last ten years’
-‘family number telephone numbers (sic) used in the last five years’
-biometrics – face, fingerprint, DNA, and iris
-business telephone numbers used in the last five years
-business email addresses used in the last ten years.
https://www.privacyinternational.org/news-analysis/5713/trump-administration-wants-your-dna-and-social-media
The Federal Register entry says comments are encouraged and
must be submitted (no later than
February 9, 2026) to be assured of
consideration
Federal Register entry: https://www.govinfo.gov/content/pkg/FR-2025-12-10/pdf/2025-22461.pdf

2026-01-26 14:15:28 UTC

Had way more fun that I should have watching doggo try to do her business this morning. Blew off the driveway yesterday, only to have about 2.5 inches of sleet freeze on top of a light layer of snow. Hard enough to for a 170 lb person walk on without leaving a footprint. She got to the side yard and started sliding backwards all the way down the hill, all while frantically trying to gain her footing. She's fine, but poor thing was really scared while I was on the ground laughing my ass off.

2026-01-23 16:50:05 UTC

- reply

Also, any continued IMAP support that doesn't make it easy to incorporate 2FA or other things really doesn't help.

2026-01-23 16:34:24 UTC

- reply

The world would be a better and safer place if legacy ISPs stopped giving away email accounts. None of them want to be in the email business, and probably 95 percent of these accounts have horrible passwords, no MFA, and they get taken over constantly by cybercriminals and used for bad stuff.

2026-01-23 16:28:04 UTC

- reply

I'd heard that Comcast was getting ready to issue a report on how it's been dealing with the massive number of Aisuru/Kimwolf botnet infections on their network. Also, Kimwolf piggybacked on IPIDEA's proxy network, and data from Synthient shows Comcast's email service (imap.comcast.net) was the most-requested domain of IPIDEA users (these are credential-stuffing attacks).
Glad I didn't wait for their report. It's basically a recap of everything we know so far, but narry a word about how it's affecting their customers. Instead, the blog post uses the old "we ran the malware in a lab and here's what we saw" approach to admiring the problem.
https://corporate.comcast.com/press/releases/localhost-as-an-attack-multiplier-resproxy-co-infection-and-lateral-expansion
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/945/344/780/125/499/original/3bcc659d52e9e255.png

2026-01-20 23:34:53 UTC

Politico writes: "Two members of Elon Musk’s DOGE team working at the Social Security Administration were secretly in touch with an advocacy group seeking to “overturn election results in certain states,” and one signed an agreement that may have involved using Social Security data to match state voter rolls, the Justice Department revealed in newly disclosed court papers."
"Elizabeth Shapiro, a top Justice Department official, said SSA referred both DOGE employees for potential violations of the Hatch Act, which bars government employees from using their official positions for political purposes.
"Shapiro’s previously unreported disclosure, dated Friday, came as part of a list of “corrections” to testimony by top SSA officials during last year’s legal battles over DOGE’s access to Social Security data. They revealed that DOGE team members shared data on unapproved “third-party” servers and may have accessed private information that had been ruled off-limits by a court at the time."
Kind of makes you wonder about the rest of the departments where DOGE had access.
https://www.politico.com/news/2026/01/20/trump-musk-doge-social-security-00737245?cid=apn

2026-01-20 20:30:33 UTC

- reply

Called it: Via CNN...Inside plans to rebuild the ‘top-secret’ bunker beneath the White House East Wing
https://archive.is/e4wzc#selection-2133.7-2133.93

2026-01-20 18:43:10 UTC

- reply

@nprofile…6vjc Thanks! I'm stealing all your tags. I always forget to include them.

2026-01-20 18:37:49 UTC

New, from me: The Kimwolf Botnet is Lurking in Corporate, Govt. Networks
A new Internet-of-Things botnet called Kimwolf has spread to more than 2 million devices, forcing infected systems to participate in massive distributed denial-of-service (DDoS) attacks and to relay other malicious and abusive Internet traffic. Kimwolf’s ability to scan the local networks of compromised systems for other IoT devices to infect makes it a sobering threat to organizations, and new research reveals Kimwolf is surprisingly prevalent in government and corporate networks.
https://krebsonsecurity.com/2026/01/kimwolf-botnet-lurking-in-corporate-govt-networks/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/928/869/864/827/654/original/0d9f831201e3d70d.png

2026-01-18 17:04:10 UTC

Continue, or "try it now" a popup from Gmail now asks, offering to compose your next message with Gemini. I guess the tiny "x" is the "fuck no" button?
#darkpatterns
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/917/175/923/211/616/original/143ba6c295735300.png

2026-01-14 01:01:40 UTC

Can you believe it's been a month already, Windows (ab)users? Yes, that's right, it's Patch Tuesday, or depending on when you're reading this Reboot Wednesday!
Microsoft today issued patches to plug at least 113 security holes in its various Windows operating systems and supported software. Eight of the vulnerabilities earned Microsoft’s most-dire “critical” rating, and the company warns that attackers are already exploiting one of the bugs fixed today.
https://krebsonsecurity.com/2026/01/patch-tuesday-january-2026-edition/
#patchtuesday
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/890/745/657/416/739/original/475f31791edb80de.png

2026-01-10 19:23:30 UTC

- reply

OMG! Someone made a rap about the Kimwolf botmasters. And it's actually good.
This is fire: https://soundcloud.com/alphafire69/dort-is-cooked-the-kimwolf-downfall?si=2d5ae31cbaba46f3b55471b3f1e3f187&utm_source=clipboard&utm_medium=text&utm_campaign=social_sharing

2026-01-08 23:44:41 UTC

New, by me:
Our first story of 2026 revealed how a destructive new botnet called Kimwolf has infected more than two million devices by mass-compromising a vast number of unofficial Android TV streaming boxes. Today, we’ll dig through digital clues left behind by the hackers, network operators and services that appear to have benefitted from Kimwolf’s spread.
https://krebsonsecurity.com/2026/01/who-benefited-from-the-aisuru-and-kimwolf-botnets/
For part one in this series, check out:
https://krebsonsecurity.com/2026/01/the-kimwolf-botnet-is-stalking-your-local-network/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/862/126/029/526/354/original/06dd57aadbcb77d0.png

2026-01-06 22:29:32 UTC

- reply

@nprofile…3jd4 Wait, so is what you pasted the initial version of this list from Teramind AI?
https://www.linkedin.com/feed/update/urn:li:activity:7414342585353371650/

2026-01-06 19:11:40 UTC

- reply

@nprofile…3jd4 I don't even know where to start here. wow

2026-01-03 17:29:06 UTC

- reply

the NYT, cont'd: Pressed by reporters on who would be running Venezuela, Trump points to his advisers standing behind him and says that for a “period of time” the “people that are standing right behind me, we’re going to be running it.”
Some of the advisers standing behind him include Defense Secretary Pete Hegseth, Secretary of State Marco Rubio and General Dan Caine, the chairman of the Joint Chiefs. Trump said the United States would be a part of an unspecified “group” running Venezuela without providing details.

2026-01-03 17:28:00 UTC

- reply

NYT: "President Trump said the United States would “run” Venezuela “until such time that we can do a safe, proper and judicious transition,” following the U.S. military operation that captured the country’s president, Nicolás Maduro, and his wife."
"Mr. Trump offered few details about how the United States would oversee Venezuela, saying only that “a group” would do so. It was not clear whether that would involve an occupying military force, but Mr. Trump said he was not afraid of “boots on the ground.”
https://www.nytimes.com/live/2026/01/03/world/trump-united-states-strikes-venezuela

2026-01-03 16:32:51 UTC

- reply

My favorite line: "Now he should spend the rest of his life in a humane American prison."
Hahahahahahahh. Yeah, nobody does prisons like the US. More humans than humanes is our motto.

2026-01-03 16:21:00 UTC

- reply

Also, in what universe is the US invading Venezuela a test of our military and intelligence prowess?

2026-01-03 16:12:12 UTC

- reply

Statements that upon reading in a newspaper story I would assume were written by the White House or the military itself:
"Details are still emerging, but what happened in Caracas was a clear reminder that America’s military and intelligence capabilities are second to none."
"What are Iranian leaders thinking now as they consider how to respond to widespread anti-government protests? Are the communists in Cuba sleeping well?"

2026-01-03 16:08:47 UTC

This is disheartening. WaPo editorial board goes full cheerleader for Trump's invasion of Venezuela. https://archive.ph/5iVFN

2025-12-23 18:40:33 UTC

- reply

@nprofile…xqk3 Okay. Everyone here is such an expert. Can't wait for next year.

2025-12-23 14:41:15 UTC

When an entire class of technology states on the packaging that it was made in China but intended "for overseas use only," this should really give you pause before plugging it into your network.
You will find this verbiage on a lot of Android TV streaming boxes for sale at the major retailers. There's a very good reason the country that makes this crap doesn't want it on their own networks. My advice: If you have one of these Android streaming boxes on your network or get one as a gift, toss it in the trash. I'll have a lot more about this in the New Year, but these things are responsible for building out a botnet that currently has ~2M devices and is growing rapidly. https://blog.xlab.qianxin.com/kimwolf-botnet-en/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/769/390/783/483/982/original/bc84b9308c7e6db3.png

2025-12-19 20:49:11 UTC

- reply

"near-obsessed obsession" indeed
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/748/197/028/225/571/original/11d18d8323f998c9.png