BrianKrebs

Independent investigative journalist. Covers cybercrime, security, privacy. Author of 'Spam Nation,' a NYT bestseller. Former Washington Post reporter, '95-'09. Signal: briankrebs.07
krebsonsecurity @ gmail .com
Linkedin: https://www.linkedin.com/in/bkrebs

Public Key

npub1rfdvtvmesnz7x7s3hjg5q2dgrup9xfh209gvj36angljrfy5edtq25t9xk

NIP-05 Address

briankrebs@infosec-exchange.mostr.pub

Profile Code

nprofile1qqsp5kk9kducf30r0ggmey2q9x5p7qjnym48j5xfgawe50ep5j2vk4spz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsupe7zn

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1rfdvtvmesnz7x7s3hjg5q2dgrup9xfh209gvj36angljrfy5edtq25t9xk

Show more details

Last Notes

2026-04-02 00:08:03 UTC

The POTUS' war on Iran is already bringing rationing of fuel and major disruptions in many countries, and how it's going to get a lot worse soon as the final shipments that made it thru the Strait start to arrive this week, the NYT reports. I admire (but do not share) this story's optimism of the potential for the Iran war to hasten more global adoption of renewables.
"Sri Lanka and Myanmar are rationing fuel. The Philippines has instituted four-day workweeks to conserve gasoline and electricity. Bangladesh briefly closed its universities to reserve power for homes and businesses. Across India, families and restaurants are cooking over wood fires for want of gas. Airlines are canceling flights."
"As painful as the first phase of the energy crisis set off by the war with Iran has been, what comes next will be worse. This week, the final deliveries of oil and liquefied natural gas to Asia that passed through the Strait of Hormuz before it was closed are expected to arrive. The last tanker shipments to Europe should land by mid-April. After that, many countries’ reserves of gasoline, diesel, liquid petroleum gas and natural gas will dwindle. The price of oil could soar as high as $200 a barrel if the war drags on."
Meanwhile, China -- which leads the world in battery technology production -- stands to massively gain from all this oil shock.
"As the Philippines declared a national energy emergency on March 24, car shoppers in Manila were crowding into showrooms of the Chinese carmaker BYD and purchasing E.V.s ."
Of course, here in the US we've largely said that we're just gonna keep making gas guzzlers and forget about all those pledges we made to invest in electric vehicles. Consumers in the US would be flocking to those BYD cars too if import duties didn't make them prohibitively expensive. Most of the big car makers in the US are hopelessly focused on people who don't bat an eyelash spending $60,000 (base price) for a new car or truck.
https://www.nytimes.com/2026/04/01/opinion/oil-crisis-iran-electric-solar.html

2026-03-23 21:19:40 UTC

Whoa, that escalated quickly. This just got sent out by the press folks at the Federal Communications Commission (FCC). The FCC says it has decided that all foreign-made consumer-grade Internet routers are henceforth prohibited from receiving FCC authorization and are therefore prohibited from being imported for use or sale in the United States.
"Update Follows Determination by Executive Branch Agencies that Consumer-Grade Routers Produced in Foreign Countries Threaten National Security
WASHINGTON, March 23, 2026—Today, the Federal Communications Commission updated its Covered List to include all consumer-grade routers produced in foreign countries. Routers are the boxes in every home that connect computers, phones, and smart devices to the internet. This followed a determination by a White House-convened Executive Branch interagency body with appropriate national security expertise that such routers “pose unacceptable risks to the national security of the United States or the safety and security of United States persons.”
"The Executive Branch determination noted that foreign-produced routers (1) introduce “a supply chain vulnerability that could disrupt the U.S. economy, critical infrastructure, and national defense” and (2) pose “a severe cybersecurity risk that could be leveraged to immediately and severely disrupt U.S. critical infrastructure and directly harm U.S. persons.”
"This action does not affect any previously-purchased consumer-grade routers. Consumers can continue to use any router they have already lawfully purchased or acquired."
"Producers of consumer-grade routers that receive Conditional Approval from DoW or DHS can continue to receive FCC equipment authorizations. Interested applicants are encouraged to submit applications to conditional-approvals@fcc.gov."
Not sure how many consumer-grade routers will be left for sale if it really is a ban on approvals for any foreign-made consumer routers like they said, and not just a bunch of already restricted Chinese makers like Huawei and ZTE.
https://www.fcc.gov/document/fcc-updates-covered-list-include-foreign-made-consumer-routers
FCC's "covered list" of "thou shalt not entities": https://www.fcc.gov/supplychain/coveredlist

2026-03-23 21:10:18 UTC

The Kimwolf botmaster Dort is currently spamming the living crap out of this Mastodon instance with messages claiming i'm a monster. Sorry @nprofile…l9z3. That's a lot of junk accounts and messages. I guess the visit he got from law enforcement didn't deter him much.

2026-03-23 17:11:18 UTC

This is a crazy, developing story. And here you thought *your* organization's patch management routines were strict: From Christopher Kunz at Heise:
"A serious security vulnerability in the Windchill and FlexPLM products prompted a nationwide police response over the weekend. At the behest of the Federal Criminal Police Office (BKA), officers from across Germany were dispatched to alert affected companies – an unprecedented move. Administrators, whose weekends were disrupted, expressed their irritation – some of whom don't even use the compromised software."
"When the editorial team received a tip late Sunday morning about a critical security vulnerability in Windchill and FlexPLM , it sounded like a routine report: A deserialization vulnerability in specialized software, even with a CVSS score of 10, doesn't cause any alarm at heise security. The situation was apparently quite different at the Federal Criminal Police Office (BKA): By that time, they had already alerted the state criminal police offices (LKA) in various federal states, which dispatched police officers to affected companies during the night. As several readers reported to us in the forum , police officers were standing outside company and private premises in the dead of night."
https://www.heise.de/news/WTF-Polizei-rueckte-Samstagnacht-wegen-Zero-Day-aus-11221345.html

2026-03-23 16:10:20 UTC

ICYMI (from the not-all-cyber-news-is-horrible dept), a cyberattack on a U.S. vehicle breathalyzer company has left drivers across the United States stranded and unable to start their vehicles. This story positively cries out for a headline-writing contest. TechCrunch reports:
"The company, Intoxalock, says on its website that it is “currently experiencing downtime” after a cyberattack on March 14. Intoxalock sells breathalyzer devices that fit into vehicle ignition switches, and is used by people who are required to provide a negative alcohol breath sample to start their car."
https://techcrunch.com/2026/03/20/cyberattack-on-vehicle-breathalyzer-company-leaves-drivers-stranded-across-the-us/

2026-03-10 19:42:49 UTC

We've been weaning ourselves off ordering things from Amazon, so my wife went and ordered something big from a different retailer, who was actually advertising it at a lower price than Amazon. Well, after a week of waiting for the item to ship, it suddenly just arrived. Turns out the order was fulfilled through Amazon anyway.

2026-03-09 16:43:48 UTC

New, by me: How AI Assistants are Moving the Security Goalposts
AI-based assistants or “agents” — autonomous programs that have access to the user’s computer, files, online services and can automate virtually any task — are growing in popularity with developers and IT workers. But as so many eyebrow-raising headlines over the past few weeks have shown, these powerful and assertive new tools are rapidly shifting the security priorities for organizations, while blurring the lines between data and code, trusted co-worker and insider threat, ninja hacker and novice code jockey.
Read more (and boost please!):
https://krebsonsecurity.com/2026/03/how-ai-assistants-are-moving-the-security-goalposts/
#openclaw #AI #agentic #aiagents #lethaltrifecta
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/200/212/293/707/219/original/44864d04eae0af69.png

2026-03-05 15:18:11 UTC

- reply

@nprofile…rh4q Lol yes. The Kimwolf botmaster is responsible for that. Funny what you can do with several hundred thousand bots.

2026-03-03 15:49:03 UTC

The POTUS is learning that you can't just TACO yourself out of a war that you JUST started, no matter how the market reacts. It turns out the market reacts badly to uncertainty, and the president just said he's going to keep bombing Iran for a few more weeks, maybe longer (probably if he'd said yeah we'll be wrapped up by April 20 the market would be like oh, okay cool). But it's not just everyone's savings and 401ks that are going to take a nosedive because of this war; a LOT of stuff that was already overpriced because of his arbitrary taxes is about to get way more expensive.

2026-03-03 15:30:39 UTC

Oh yes, the merger of HBO Max and Paramount+ will engender soooo much competition. What a load of hooey. If this doesn't turn out to be the most textbook example of enshittification, I'll eat my hat. From WaPo:
"Paramount Skydance will combine Paramount+ and HBO Max into one streaming service, David Ellison, the company’s CEO, said on a Monday call with investors.
“As we said, we do plan to put the two services together, which today gives us a little over 200 million direct-to-consumer subscribers,” Ellison said. “We think that really positions us to compete with the leaders in the space.”
https://www.washingtonpost.com/style/2026/03/02/hbo-max-paramount-streaming-service/

2026-03-03 15:22:43 UTC

Oh goodie: Daylight Savings Time again this weekend! For most of my life I've been a night person. But almost like clockwork when I turned 50, my body clock started waking me up when the sun comes up, which I resisted at first but have grown used to (it's actually my fav part of the day now). But I basically have to start going to bed an hour earlier after this Sunday because then I will be wide awake an hour earlier. I would be very happy if the US followed British Columbia's lead in permanently adopting daylight time. All this moving clocks and body clocks around is just silly in 2026.
https://www.cbc.ca/news/canada/british-columbia/b-c-adopting-year-round-daylight-time-9.7111657

2026-03-03 14:57:11 UTC

Found myself wincing while reading this story about how Ars Technica fired a reporter over fabricated quotations generated by an AI tool. What a mess. And a tough one to bounce back from. I get asked all the time how I use AI in my work, and my answer is always the same: I don't, for all the reasons I also don't delegate important research to others, plus a whole bunch of other good reasons. But I really am interested in the answer from other journalists, because I suspect I'm in the minority here.
From Futurism.com:
"In the post, Edwards said that he was sick at the time, and “while working from bed with a fever and very little sleep,” he “unintentionally made a serious journalistic error” as he attempted to use an “experimental Claude Code-based AI tool” to help him “extract relevant verbatim source material.” He said the tool wasn’t being used to generate the article, but was instead designed to “help list structured references” to put in an outline. When the tool failed to work, said Edwards, he decided to try and use ChatGPT to help him understand why.
“I should have taken a sick day because in the course of that interaction, I inadvertently ended up with a paraphrased version of Shambaugh’s words rather than his actual words,” Edwards continued. He emphasized that the “text of the article was human-written by us, and this incident was isolated and is not representative of Ars‘ editorial standards. None of our articles are AI-generated, it is against company policy and we have always respected that.”
https://futurism.com/artificial-intelligence/ars-technica-fires-reporter-ai-quotes

2026-03-02 16:11:09 UTC

- reply

@nprofile…l9z3 just search messages for krebson. reporting them all would take quite some time.

2026-03-02 16:05:44 UTC

Someone has registered a ton of new accounts and is spamming with messages saying I'm a pedophile. Sorry @nprofile…l9z3

2026-03-02 13:35:06 UTC

- reply

@nprofile…3qha I get these requests constantly. I used to respond to all that I could but these days I get a wall of AI-written questions before I even agree to help.

2026-02-25 20:19:36 UTC

- reply

I'd argue that very few companies have any real appreciation for how many of their employees are already feeding API keys and other stuff into fairly new and questionable agentic AI tools or platforms. So many companies are like, oh we're taking a wait-and-see approach to adopting AI. Meanwhile, half their dev team is doing critical development work on shared servers that have no authentication or limited (no 2fa) auth.

2026-02-25 20:04:25 UTC

Agentic AI-based services are the new Shadow IT. Change my mind.

2026-02-21 14:04:45 UTC

- reply

The CEO of Persona responded to this post, saying they wanted to clarify about the identity verification process. They said:
"The only subprocessors (8) used are: AWS, Confluent, DBT, ElasticSearch, GCP, MongoDB, Sigma Computing, and Snowflake
All biometric personal data is deleted immediately after processing.
All other personal data processed is automatically deleted within 30 days. Data is retained during this period to help users troubleshoot.
No personal data processed is used for AI/model training. Data is explicitly used to confirm your identity.
The subprocessors used do NOT include Anthropic, Groqcloud, or OpenAI. The referenced subprocessor list is the superset of subprocessors used across all customers which is unfortunately misleading - we are updating our documentation to make this clearer going forward (thank you for helping us realize this). Our customers select which products are used which determines which subprocessors are used."

2026-02-20 17:48:03 UTC

- reply

Sorry. VM=Virtual Machine, like Parallels, VMWare or VirtualBox, which let you load another operating system as a guest OS and run it on top of your host OS. The nice thing about a VM is that you can configure it how you like, save a snapshot, and then revert to that snapshot when you're ready to shut down.

2026-02-20 17:25:07 UTC

Was just browsing the Internet in a VM with script-blockers turned off for a bit, and half the sites were like "IT PUTS THE DATA IN THE BASKET OR IT GETS THE HOSE AGAIN!" with multiple videos, dozens of ads and and 99 pieces of third-party Javascript loading in the background. The amount of advertiser profiling and data sharing that goes on when you visit these noisy sites with a mobile device is even higher and more invasive, which might explain why I do most of my web browsing inside a VM (but with script blockers turned on).

2026-02-20 13:28:48 UTC

If you're on LinkedIn and are thinking about verifying your account with them, maybe read this first. It walks through LinkedIn's privacy disclosure to identify 17 companies that may receive and process the data you submit, including name, passport photo, selfie, facial geometry, NFC data chip, national ID #, DoB, email, phone number, address, IP address, device type, MAC address, language, geolocation etc. Unsurprisingly, it seems the biggest recipients are US-based AI companies.
https://thelocalstack.eu/posts/linkedin-identity-verification-privacy/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/103/178/327/243/236/original/e6bc02dc19c54552.png

2026-02-11 18:19:27 UTC

Thank goodness the Federal Aviation Administration is still able to do its job and be the adult in the room. For now, anyway. How long until the Cheetoh in Chief starts grounding planes in blue states for the rebuke?
From CBS News:
"The unexpected but brief airspace closure in the Texas border city of El Paso stemmed from disagreements between the Federal Aviation Administration and Pentagon officials over drone-related tests, multiple sources close to the matter told CBS News. "
"The Pentagon had undertaken extensive planning on the use of military technology near Fort Bliss, a military base that abuts the El Paso International Airport, to practice taking down drones."
"Two sources identified the technology as a high-energy laser."
"Meetings were scheduled over safety impacts, but Pentagon officials wanted to test the technology sooner, stating that U.S. Code 130i requirements governing the protection of certain facilities from unmanned aircraft had been met."
"FAA Administrator Bryan Bedford on Tuesday night decided to close the airspace — without alerting White House, Pentagon or Homeland Security officials, sources said."
https://www.cbsnews.com/news/airspace-closure-followed-spat-over-drone-related-tests-and-party-balloon-shoot-down-sources-say/

2026-02-10 22:28:17 UTC

Yes, Windows (ab)users it's your favorite time of the month once again (ducks). Microsoft today released updates to fix more than 50 security holes in its Windows operating systems and other software, including patches for a whopping six "zero-day" vulnerabilities that attackers are already exploiting in the wild.
https://krebsonsecurity.com/2026/02/patch-tuesday-february-2026-edition/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/048/686/678/525/034/original/a72d44121d2b8d0e.png

2026-02-09 21:18:26 UTC

One of the more terrifying realities about the prospect of starting your own business in the US is that you quickly learn you are on your own when it comes to finding affordable healthcare. You might even make enough that you don't qualify for any plan that doesn't cost <$30k a year, w/ high deductibles.
I know I've mentioned this before here, but it bears repeating because it came up in a conversation the other day where the small biz owner had no idea. Namely, that depending on where you live, you may qualify for a fairly inexpensive and decent healthcare plan for you and your family just by taking a class at a local university or community college. NB: It may only require a non-degree (non-credit) course. Anyway, something to investigate if you're looking for a way to reduce your healthcare costs.

2026-02-09 19:49:18 UTC

ICYMI, from Reuters:
"Democratic Senator Maria Cantwell on Tuesday said Verizon and AT&T are blocking release of key documents about an alleged massive Chinese spying operation that infiltrated U.S. telecommunications networks known as Salt Typhoon and wants their CEOs to appear before Congress to answer questions."
"Cantwell asked both companies to turn over security assessments conducted by Alphabet cybersecurity unit Mandiant. She said Mandiant refused to provide the requested network security assessments, apparently at the direction of AT&T and Verizon."
"In some cases, hackers are alleged to have intercepted conversations, including between prominent U.S. politicians and government officials. Several lawmakers have described them as the worst telecom hacks in U.S. history."
"Cantwell said Salt Typhoon allowed the Chinese government to "geolocate millions of individuals" and "record phone calls at will," and that the incident targeted almost every American."
https://www.reuters.com/business/media-telecom/senator-says-att-verizon-blocking-release-salt-typhoon-security-assessment-2026-02-03/

2026-02-06 20:15:34 UTC

- reply

@nprofile…206n Do I really look that much older?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/025/518/466/927/080/original/7f4e2759b2a292f4.png

2026-02-06 16:32:57 UTC

When I saw the other journalists that were nominated, I didn't think there was a chance (e.g. ProPublica was nominated for their excellent investigative reporting uncovering the Pentagon's reliance on Chinese contractors for cloud work). I'm very flattered to be in such great company. Thank you to the Institute for Security and Technology (IST) for this award.
Last night's IST gala at the National Press Club was a stroll down memory lane in many ways. Ran into people I haven't seen in person for ages, and most of them have been involved in shaping cybersecurity policy for 25+ years.
It was also bittersweet because I spent a lot of time at the Press Club as a reporter at The Washington Post, and I'm still livid about the insanity of the 300 or so WaPo journalists who lots their jobs this week.
I'm particularly mystified by the decimation of the Post's Metro staff; despite its stature as a top source of national and international news, The Washington Post has always maintained a strong focus on what's going on in the DC area. When they merged washingtonpost.com with the dead tree edition in 2009 and eliminated my job, the mantra of the company was they wanted to be THE source of news about what's happening in the Nation's Capital, and how policy being made in DC affects the rest of the world. Here's part of what I told the audience last night:
"I horrified this week to see The Washington Post lay off 300 of its 800 remaining journalists -- the third major staff reduction in as many years. A lot of the cuts are deeply affecting the foreign and local metro staff; it's easy to forget the Watergate scandal started as a metro story. Probably we need several hundred more reporters digging into what this administration is doing, because Watergate frankly can't hold a candle to it all."
"I'm hoping all of the post-Posties will land in a better place soon, but I also hope they can keep doing their important work regardless of where it comes from. And I will continue to advocate for, support and encourage anyone who wants to go the independent route. I think journalism is going to be just fine for now, but I'm not sure I share the same view about many traditional news organizations. I hear from a lot of reporters considering the going out on their own worry about not having a big publication name to automatically open doors for them, or watch their backs legally, and those are certainly big adjustments of going solo. But you know what makes all that worth it? When you're breaking news that forces important people to answer hard questions, and the gatekeepers go, wait, who are you with again?"
https://www.linkedin.com/feed/update/urn:li:activity:7425373027145752577/?commentUrn=urn%3Ali%3Acomment%3A(activity%3A7425373027145752577%2C7425575747831947264)&dashCommentUrn=urn%3Ali%3Afsd_comment%3A(7425575747831947264%2Curn%3Ali%3Aactivity%3A7425373027145752577)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/024/623/073/463/045/original/df6c07ec86e63501.png

2026-02-02 00:37:25 UTC

So, rather than watch the rest of the performers bow out of gigs, he's just going to close it down for construction? Can't wait to see what he does with the place. From WaPo:
"Trump plans to close Kennedy Center for about two years, starting in July
Under the proposal, the Kennedy Center could close on July 4, coinciding with America’s 250th anniversary."
“I have determined that The Trump Kennedy Center, if temporarily closed for Construction, Revitalization, and Complete Rebuilding, can be, without question, the finest Performing Arts Facility of its kind, anywhere in the World,” Trump wrote in a post on Truth Social. “In other words, if we don’t close, the quality of Construction will not be nearly as good, and the time to completion, because of interruptions with Audiences from the many Events using the Facility, will be much longer. The temporary closure will produce a much faster and higher quality result!”
https://www.washingtonpost.com/style/2026/02/01/kennedy-center-trump-closure-construction/

2026-02-01 18:01:38 UTC

According to the Epstein files, he had a "personal hacker" working for him. The FBI document says Epstein's personal hacker was an "Italian citizen born in Calabria who developed zero-day exploits and offensive cyber tools and sold the tools to governments."
https://www.justice.gov/epstein/files/DataSet%2010/EFTA01683874.pdf
"[Redacted] sold a zero-day to Hebollah. [Redacted] was known as the first person to hack and find vulnerabilities in Blackberries and iOS. He was known for finding Firefox vulnerabilities. [Redacted] former company was acquired by CrowdStrike in fall of 2017 and was currently a vice president there."
"S//NF= was very good at finding vulnerabilities was friends with "old school" European hackers. "Received a trunk of cash from Hezbollah when was in Italy; drove the money to Switzerland and deposited it in another ba [redacted]. [redacted] owned a theater company in California and he used the theater company to launder his zeroday money
"Made six figures from the sale of his zero-days. He sold his tools to United Kingdom GCHQ and provided training to the organization. He also sold his zero-days to a Central African government, as well as Hezbollah for political reasons. The Italian Government asked for help, but [redacted] declined because he felt the Government was incompetent. Calabria was mob-controlled an did not have much loyalty for his birth country.
"[Redacted] sold his exploits to the United States and United Kingdom, but he would not sell to Asian countries because he a is racist. He was also anti-Semitic. [Redacted] was terrified of Russia, however, and would never travel there. He lived in Dubai at one time, and was acquainted with the [redacted] lived in Oman as well. He may have an Iranian and Israeli passport, in addition to his Vatican City passport"
Looks likely the top commenter here is correct about "Epstein's hacker":
https://www.reddit.com/r/cybersecurity/comments/1qsi6ds/informant_told_fbi_that_jeffrey_epstein_had_a/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/996/648/309/425/145/original/e25504a41a65f78a.png

2026-01-30 16:52:35 UTC

Finally got around to learning the song "Breathe" by Pink Floyd on the piano. The chord sequences are just dripping with chill. This song reminds me of Zepplin's "Rain Song," in that I could listen to it and play it for hours on end. Pink Floyd recorded this song with a guitar mostly doing the chords. It sounds amazing with the keyboard filling in, especially with some funky preset like 70s funk.
Breathe:
https://www.youtube.com/watch?v=jcz0YxYl6Ac&list=RDjcz0YxYl6Ac&start_radio=1
Quick and dirty tutorial on the chords (you can mess around within the chord in the right hand for a melody):
https://www.youtube.com/watch?v=apQRi_B5miE

2026-01-27 21:17:37 UTC

Letting AI agents run your life is like handing the car keys to your 5-year-old. What could go wrong?
I was marveling while reading this PCMag piece, which describes how to secure an agentic AI setup that essentially mimics malware: To do it's job properly, the AI agent has to be able to read private messages, store credentials, execute commands, and maintain a persistent state. How do you do that? You chase after it like you would your child.
"The important thing is to make sure you limit "who can talk to your bot, where the bot is allowed to act, [and] what the bot can touch" on your device, the bot's support documentation says."
https://www.pcmag.com/news/clawdbot-moltbot-hot-new-ai-agent-creator-warns-of-spicy-security-risks?test_uuid=04IpBmWGZleS0I0J3epvMrC&test_variant=A

2026-01-27 19:24:58 UTC

Ten feet of sledding in our plastic sled told me that to continue down meant almost certain manglement or death. The entire hill is a thick, glistening layer of frozen rain and sleet on top of snow, where breaking through requires some serious force. So I ditched the sled and slid down the hill in my snowpants. As I feared, stopping was terrifying, difficult and somewhat painful. Worse, took about 10 seconds to go down, and about 10 minutes to go back up. 2/10 for the smooth ride till the violent end.

2026-01-26 17:10:54 UTC

We knew this was coming, but now the clock is running. From Privacy International:
"Yesterday the Trump Administration announced a proposed change in policy for travellers to the U.S. It applies to the powers of data collection by the Customs and Border Police (CBP)."
"If the proposed changes are adopted after the 60-day consultation, then millions of travellers to the U.S. will be forced to use a U.S. government mobile phone app, submit their social media from the last five years and email addresses used in the last ten years, including of family members. They’re also proposing the collection of DNA."
PI linked to and summarized a Federal Register entry describing the proposed requirements:
-All visitors must submit ‘their social media from the last 5 years’
-ESTA (Electronic System for Travel Authorization) applications will include ‘high value data fields’, ‘when feasible’
‘telephone numbers used in the last five years’
-‘email addresses used in the last ten years’
-‘family number telephone numbers (sic) used in the last five years’
-biometrics – face, fingerprint, DNA, and iris
-business telephone numbers used in the last five years
-business email addresses used in the last ten years.
https://www.privacyinternational.org/news-analysis/5713/trump-administration-wants-your-dna-and-social-media
The Federal Register entry says comments are encouraged and
must be submitted (no later than
February 9, 2026) to be assured of
consideration
Federal Register entry: https://www.govinfo.gov/content/pkg/FR-2025-12-10/pdf/2025-22461.pdf

2026-01-26 14:15:28 UTC

Had way more fun that I should have watching doggo try to do her business this morning. Blew off the driveway yesterday, only to have about 2.5 inches of sleet freeze on top of a light layer of snow. Hard enough to for a 170 lb person walk on without leaving a footprint. She got to the side yard and started sliding backwards all the way down the hill, all while frantically trying to gain her footing. She's fine, but poor thing was really scared while I was on the ground laughing my ass off.

2026-01-23 16:34:24 UTC

- reply

The world would be a better and safer place if legacy ISPs stopped giving away email accounts. None of them want to be in the email business, and probably 95 percent of these accounts have horrible passwords, no MFA, and they get taken over constantly by cybercriminals and used for bad stuff.

2026-01-23 16:28:04 UTC

- reply

I'd heard that Comcast was getting ready to issue a report on how it's been dealing with the massive number of Aisuru/Kimwolf botnet infections on their network. Also, Kimwolf piggybacked on IPIDEA's proxy network, and data from Synthient shows Comcast's email service (imap.comcast.net) was the most-requested domain of IPIDEA users (these are credential-stuffing attacks).
Glad I didn't wait for their report. It's basically a recap of everything we know so far, but narry a word about how it's affecting their customers. Instead, the blog post uses the old "we ran the malware in a lab and here's what we saw" approach to admiring the problem.
https://corporate.comcast.com/press/releases/localhost-as-an-attack-multiplier-resproxy-co-infection-and-lateral-expansion
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/945/344/780/125/499/original/3bcc659d52e9e255.png

2026-01-20 18:43:10 UTC

- reply

@nprofile…6vjc Thanks! I'm stealing all your tags. I always forget to include them.

2026-01-20 18:37:49 UTC

New, from me: The Kimwolf Botnet is Lurking in Corporate, Govt. Networks
A new Internet-of-Things botnet called Kimwolf has spread to more than 2 million devices, forcing infected systems to participate in massive distributed denial-of-service (DDoS) attacks and to relay other malicious and abusive Internet traffic. Kimwolf’s ability to scan the local networks of compromised systems for other IoT devices to infect makes it a sobering threat to organizations, and new research reveals Kimwolf is surprisingly prevalent in government and corporate networks.
https://krebsonsecurity.com/2026/01/kimwolf-botnet-lurking-in-corporate-govt-networks/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/928/869/864/827/654/original/0d9f831201e3d70d.png

2026-01-14 01:01:40 UTC

Can you believe it's been a month already, Windows (ab)users? Yes, that's right, it's Patch Tuesday, or depending on when you're reading this Reboot Wednesday!
Microsoft today issued patches to plug at least 113 security holes in its various Windows operating systems and supported software. Eight of the vulnerabilities earned Microsoft’s most-dire “critical” rating, and the company warns that attackers are already exploiting one of the bugs fixed today.
https://krebsonsecurity.com/2026/01/patch-tuesday-january-2026-edition/
#patchtuesday
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/890/745/657/416/739/original/475f31791edb80de.png

2026-01-10 19:23:30 UTC

- reply

OMG! Someone made a rap about the Kimwolf botmasters. And it's actually good.
This is fire: https://soundcloud.com/alphafire69/dort-is-cooked-the-kimwolf-downfall?si=2d5ae31cbaba46f3b55471b3f1e3f187&utm_source=clipboard&utm_medium=text&utm_campaign=social_sharing

2026-01-06 22:29:32 UTC

- reply

@nprofile…3jd4 Wait, so is what you pasted the initial version of this list from Teramind AI?
https://www.linkedin.com/feed/update/urn:li:activity:7414342585353371650/

2025-12-23 18:40:33 UTC

- reply

@nprofile…xqk3 Okay. Everyone here is such an expert. Can't wait for next year.

2025-12-23 14:41:15 UTC

When an entire class of technology states on the packaging that it was made in China but intended "for overseas use only," this should really give you pause before plugging it into your network.
You will find this verbiage on a lot of Android TV streaming boxes for sale at the major retailers. There's a very good reason the country that makes this crap doesn't want it on their own networks. My advice: If you have one of these Android streaming boxes on your network or get one as a gift, toss it in the trash. I'll have a lot more about this in the New Year, but these things are responsible for building out a botnet that currently has ~2M devices and is growing rapidly. https://blog.xlab.qianxin.com/kimwolf-botnet-en/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/769/390/783/483/982/original/bc84b9308c7e6db3.png

2025-12-19 20:49:11 UTC

- reply

"near-obsessed obsession" indeed
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/748/197/028/225/571/original/11d18d8323f998c9.png

2025-12-19 15:19:57 UTC

New, by me...
Dismantling Defenses: Trump 2.0 Cyber Year In Review
The Trump administration has pursued a staggering range of policy pivots this past year that threaten to weaken the nation’s ability and willingness to address a broad spectrum of technology challenges, from cybersecurity and privacy to countering disinformation, fraud and corruption. These shifts, along with the president’s efforts to restrict free speech and freedom of the press, have come at such a rapid clip that many readers probably aren’t even aware of them all.
https://krebsonsecurity.com/2025/12/dismantling-defenses-trump-2-0-cyber-year-in-review/

2025-12-16 16:42:16 UTC

Read this upsetting story at the BBC today about scam groups that are using terminally ill children to raise money then stiffing the parents of the funds. The story says the scam was tied to an org called Chance Letikva (chanceletikva.org) but stops short of figuring out who's responsible.
https://www.bbc.com/news/articles/ckgz318y8elo
I spent about 10 seconds looking at the passive DNS for this domain, and found some interesting leads. Passive DNS shows it references the email address davidm@yeahdim.co.il. That email address is tied to multiple website registrations for a person in Israel by the name of David Margaliot, and also Shoshana Margaliot.
A search on this name in Domaintools finds the name David Margaliot tied to at least 25 domains, including ezri.org.il, which is a very odd site that features a huge image of a young child who is apparently in the hospital holding a gift wrapped box with a teddy bear. The site asks for donations but has a strange mission statement: Ezri Association promotes life-saving innovation through a surveillance drone project for emergency response teams, the establishment of an international medical knowledge database, along with other technological initiatives".
I'll probably continue the rest of this in a follow-up story.

2025-12-12 18:44:02 UTC

- reply

I guess these geniuses missed the first memo. Time to post this at the source (LinkedIn)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/708/068/284/022/214/original/bf9e188922e2b851.png

2025-12-12 13:55:42 UTC

I'm going to keep calling out companies that offer to pay me to repost stuff on my site. Especially the AI-backed ones, which seem unusually aggressive in this PR tactic. Who knows, maybe they'll stop sending them to me at least (not holding my breath).
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/706/933/866/999/225/original/2a075b51bce5313f.png

2025-12-12 01:16:17 UTC

- reply

A very kind and thoughtful person took me up on the idea and sent me this. It warms my revenge heart.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/703/945/978/502/386/original/5ac84385e6b3cbac.png

2025-12-11 17:26:10 UTC

- reply

I'm told that ordinarily you are blocked from seeing the login page if you're "outside" the DoW network, but that anyone can get past this by using Google VPN (e.g. the one built into a Pixel phone). I don't have either of these and am wondering if someone can verify? Thanks in advance.

2025-12-11 16:14:03 UTC

Pete Hegseth is urging members of the military to embrace GenAI.mil, a "secure generative AI platform for every member of the Department of War." I'm sure this will be fine.
"I expect every member of the Department to log in, learn it, and incorporate it into your workflows immediately. AI should be in your battle rhythm every single day. It should be your teammate. By mastering this tool, we will outpace our adversaries. The power is now in your hands."
I wonder who came up with their logo, which looks like a worm invading the Pentagon.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/701/807/309/719/661/original/3ca553a68c6baf33.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/701/816/131/134/999/original/7f3cf1e2e25110a3.png

2025-12-08 16:30:53 UTC

Guess I buried the lede on this Oct 10 story, which broke the news about a record 29+ Tbps DDoS from the Aisuru IoT botnet.
https://krebsonsecurity.com/2025/10/ddos-botnet-aisuru-blankets-us-isps-in-record-ddos/
Because tons of sites are writing about this latest quarterly report from Cloudflare is if this is somehow news.
https://blog.cloudflare.com/ddos-threat-report-2025-q3/
To my mind, the real news is that we're way past 30 Tbps capability with this botnet, and we're safely moving into a territory (terrortory?) where only Cloudflare can handle these attacks. This is problematic on a multitude of levels, and it's probably worth restating that much of the DDoS for hire industry still hides behind CF. And apparently 68 percent of phishing sites, if these stats are credible.
https://blog.sicuranext.com/68-of-phishing-websites-are-protected-by-cloudflare/

2025-12-08 14:06:56 UTC

via Hackernews. It really is comical the lengths to which companies will go to avoid being contacted by their customers.
What the fuck is a ‘fuck off contact page?’
"A “fuck off contact page” is what a company throws together when they actually don’t want anyone to contact them at all. They are usually found on the websites of million or billion dollar companies, likely Software-as-a-service (SaaS) companies that are trying to reduce the amount of money they spend on support by carefully hiding the real support channels behind login walls. These companies tend to offer multiple tiers of support, with enterprise customers having a customer success manager who they can call on this ancient device we call phones, whereas the lower-paying customers may have to wrangle various in-app ticket mechanisms. If you solve your own problem by reading the knowledge base, then this is a win for the company. They don’t want to hear from you, they want you to fuck off."
https://www.nicchan.me/blog/the-f-off-contact-page/

2025-12-08 12:56:35 UTC

How did I hit the German wall so quickly today in my feed? Get posting, y'all!

2025-12-08 12:38:25 UTC

Ah, that's a shame. Can't wait to learn more about this. Probably worth pointing out that a lot of high-end sports cars can be similarly bricked (think Lambos) if cut off from anti-theft systems.
https://www.autoblog.com/news/all-of-russias-porsches-were-bricked-by-a-mysterious-satellite-outage
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/683/979/044/520/256/original/00a2f508aad192fb.png

2025-12-06 16:39:26 UTC

Just heard from a fraud examiner that some asshat using my name and likeness is running around defrauding elderly people. The person who alerted me to this said the fraudsters are actually picking up these poor folks and driving them to credit union branches to withdraw cash. According to Constella Intelligence, the phone number listed here is tied a Facebook account for someone who appears to reside in the Chicago area.
Exactly how stupid do you have to be to use my identity for something like this??
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/673/571/654/686/283/original/ed370b46b76f8540.png

2025-12-04 23:19:12 UTC

New, by me: SMS Phishers Pivot to Points, Taxes, Fake Retailers
China-based phishing groups blamed for non-stop scam SMS messages about a supposed wayward package or unpaid toll fee are promoting a new offering, just in time for the holiday shopping season: Phishing kits for mass-creating fake but convincing e-commerce websites that convert customer payment card data into mobile wallets from Apple and Google. Experts say these same phishing groups also are now using SMS lures that promise unclaimed tax refunds and mobile rewards points.
https://krebsonsecurity.com/2025/12/sms-phishers-pivot-to-points-taxes-fake-retailers/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/663/843/066/018/411/original/d0b3da55754ed46a.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/663/850/459/577/852/original/efdde57cf5c0f402.png

2025-11-26 15:17:17 UTC

Eat your heart out, Enron
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/616/653/967/633/107/original/366119ab7da5c27d.png

2025-11-20 23:14:18 UTC

- reply

To my mind, the biggest story of the year that hasn't been gotten yet is WTF happened with all this data? The assumption is that Musk and X have it, which may be true. But who else?

2025-11-20 22:39:24 UTC

- reply

One aspect of this I can't stop thinking about is the example and precedent set by this administration when Musk took over and started joining all these federal databases that had previously been kept secret for about 100+ reasons over time.
Kind of secondary to those alarming developments was the fact that all of the safeguards we put in place to ensure Security 101 things like "need to know access" and audibility were just tossed out the window, and really haven't been observed by this administration since. It's as if the entirety of what they teach you in Security 101, 201, 301, etc, is just a suggestion.
Also, where THE FUCK did this data go? Who has it? How can anyone be sure who does? Is it still being used? How will it be used going forward?

2025-11-20 19:10:01 UTC

- reply

@nprofile…9mvk greed, most likely. also, regulation bad.

2025-11-20 18:45:14 UTC

- reply

Welp, they rolled back the proposed changes put in place after the extent of the Salt Typhoon debacle became widely known (shocker). Sen. Mark Warner (D-Va.) is just stating the obvious here:
“The Salt Typhoon intrusion made clear that existing voluntary measures alone have not been sufficient to prevent sophisticated, state-sponsored actors from gaining long-term, covert access to critical networks. While collaboration with industry is essential, it must be paired with clear, enforceable expectations that reflect the scale of the threat."
"I am concerned that abandoning an enforceable, standards-based approach in favor of undefined ‘flexible’ solutions leaves us without a credible plan to address the gaps exposed by Salt Typhoon, including basic failures like credential reuse and the absence of multi-factor authentication for highly privileged accounts."

2025-11-20 15:56:21 UTC

The Federal Communications Commission (FCC) is slated to vote today on a proposal to scrap cyber rules that the FCC began adopting during the Biden administration.
"The commission first declared that the 1994 Communications Assistance for Law Enforcement Act (CALEA) “affirmatively requires telecommunications carriers to secure their networks from unlawful access or interception of communications,” and then it proposed specific requirements that telecoms should have to meet."
https://www.cybersecuritydive.com/news/fcc-telecom-regulation-reversal-cantwell-letter/805906/
https://www.fcc.gov/November2025
Pay no mind to the fact that the FBI recently warned the public away from sharing sensitive information over the public telephone networks because they are all so completely owned by state-sponsored hackers China that they should not be trusted.
Also, try to ignore the fact that CALEA data is exactly what the Chinese hackers succeeded in gaining access to, including call and text message metadata.
We need 10x more oversight of ISPs and telephony providers, not less. What's clear is that what we've been doing to encourage telcos to care more about security is not working at all, but it's for damn sure they're not going to do it on their own.

2025-11-19 15:17:12 UTC

8 billion followers, huh? Seems legit, lol. Who TF is Todd?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/577/018/570/281/157/original/46a9547c6d88d607.png

2025-11-18 19:11:01 UTC

The top story right now is somewhat triggering. From the NYT: Hosting Crown Prince Mohammed bin Salman, President Trump brushed off the murder of a journalist by Saudi agents, saying, “Things happen.” Fighter jets and investment deals are on the leaders’ agenda today.
https://www.nytimes.com/live/2025/11/18/world/trump-saudi-crown-prince-visit
From WaPo: The president said he did not hold Mohammed bin Salman responsible for the 2018 murder of Post columnist Jamal Khashoggi, despite a U.S. intelligence report assessing the opposite.
https://www.washingtonpost.com/world/2025/11/18/saudi-prince-trump-visit-white-house/

2025-11-13 19:44:37 UTC

- reply

Distabulated? Tic-Tac-Tab? Tabicide?

2025-11-13 19:38:50 UTC

Is there a term for the inverse productivity achieved when you have so many tabs open that you can no longer see any favicons? If not, I'm going to spend some CPU cycles coining one. I feel like I hit this pivotal point almost daily, even though I'm working on many screens at once. The problem is I'm usually squirreling on so many things at once I neglect to close tabs. p.s. long ass German words don't count sorry.

2025-11-13 14:52:43 UTC

People like to complain about holiday decorations creeping into public spaces earlier and earlier each year. It's true: I did speaking gig in Nashville at the end October and they were already festooning the place with holiday wreaths and ribbons. But my big Grinch gripe is that the stupid end-of-year cybersecurity predictions emails from PR flaks start coming earlier each year. It's not even Thanksgiving yet and they've already started. Bah humbug!

2025-11-10 15:45:43 UTC

- reply

@nprofile…6zuf @nprofile…scce So the claim is that it will all be anonymized data is complete bollocks. Just like the mobile ad companies say oh this mobile location data is anonymized, and then you have this enormously profitable industry of brokers who are piecing all the marketing industry data points together to build detailed profiles on people.

2025-11-09 23:14:00 UTC

Anyone know what to do with 20 lbs of green tomatoes? I guess we can still broil them and turn them into green salsa. We're supposed to get a freeze overnight soon, and so furiously picked the unripe fruit. But now I'm looking at this pile thinking, this is nuts.

2025-11-09 20:41:05 UTC

They had me at the headline: AI isn’t replacing jobs. AI spending is
"From Amazon to General Motors to Booz Allen Hamilton, layoffs are being announced and blamed on AI. Amazon said it would cut 14,000 corporate jobs. United Parcel Service (UPS) said it had reduced its management workforce by about 14,000 positions over the past 22 months. And Target said it would cut 1,800 corporate roles. Some academic economists have also chimed in: The St. Louis Federal Reserve found a (weak) correlation between theoretical AI exposure and actual AI adoption in 12 occupational categories."
"Yet we remain skeptical of the claim that AI is responsible for these layoffs. A recent MIT Media Lab study found that 95% of generative AI pilot business projects were failing. Another survey by Atlassian concluded that 96% of businesses “have not seen dramatic improvements in organizational efficiency, innovation, or work quality.” Still another study found that 40% of the business people surveyed have received “AI slop” at work in the last month and that it takes nearly two hours, on average, to fix each instance of slop. In addition, they “no longer trust their AI-enabled peers, find them less creative, and find them less intelligent or capable.”
https://www.fastcompany.com/91435192/chatgpt-llm-openai-jobs-amazon

2025-11-08 23:44:36 UTC

- reply

@nprofile…scce I really got into this game for a few weeks, but then I was like this is boring having to dock all the time and get new assignments. Maybe I just need to go rogue or something?

2025-11-06 18:38:04 UTC

Meta, Meta, Meta. So Meta. This Reuters report is 🔥
"Meta is earning a fortune on a deluge of fraudulent ads, documents show"
"Meta projected 10% of its 2024 revenue would come from ads for scams and banned goods, documents seen by Reuters show. And the social media giant internally estimates that its platforms show users 15 billion scam ads a day. Among its responses to suspected rogue marketers: charging them a premium for ads – and issuing reports on ’Scammiest Scammers.’
https://www.reuters.com/investigations/meta-is-earning-fortune-deluge-fraudulent-ads-documents-show-2025-11-06/?utm_source=substack&utm_medium=email

2025-11-05 18:32:08 UTC

The term "personal firewall" might for some conjure quaint memories of using stuff like Zone Alarm. But I suspect this term will be resurrected in the not-too-distant future to describe pricey wearable technology designed to project a stealth mode that can confuse ubiquitous AI-based security and surveillance systems.

2025-11-04 15:34:25 UTC

Enjoyed reading The Atlantic's take on the highly incestuous and circular investments that are powering AI companies as they scrape and scrounge for more data centers. Or, why all this AI investment promises to be a lose/lose for everyone but the super rich. Tranches. Packaging and repackaging risky data center debt into financial instruments that people can buy or sell. Does any of this sound remotely familiar?
"Boom and bust can feel like two sides of the same coin: Consider also that if AI companies deliver on their massive investments, it would likely mean producing a technology so capable and revolutionary that it wipes out countless jobs and sends an unprecedented shock wave through the global economy before humans have time to adapt. (Perhaps we will be unable to adapt at all.) If they fail, there will likely be unprecedented financial turmoil as well."
https://www.theatlantic.com/technology/2025/10/data-centers-ai-crash/684765/

2025-11-04 12:24:33 UTC

It's my fediversary! Three years ago today I said goodbye to several hundred thousand followers at the nazi bar and joined this community. No regrets! Thanks for making me want to stick around :)

2025-11-03 19:52:54 UTC

In two recent public speaking engagements, I made a comparison between the obesity epidemic in various pockets of the globe and AI. Several people came up afterwards and said that was the best analogy they'd heard, so maybe it's worth repeating here. Also, I feel like this one will hold up a while.
What I said was some recent CDC figures show that something like 55 percent of the average American diet comes from processed or highly processed "foods," and the numbers are even higher for kids. In a similar way, so much of what AI produces is akin to highly processed data: Its myriad origins are murky at best, you often don't feel great after using it a while, and if you are exposed to it too much it might just freaking kill you.

2025-10-31 13:49:49 UTC

ICYMI, Joe Menn had a good scoop this week about how the US govt is getting set to ban TP-Link devices from being sold in the United States. If that happens, a whole lot of small businesses will probably need to find new networking gear. I have never trusted TP-Link devices and have repeatedly warned readers away from them. They have a history of flooding the market with massively underpriced hardware, and this is a market where generally speaking the cheapest means the most hackable. Here's one reply I sent to a reader in 2023 who inquired about finding what appeared to be an undocumented cloud login page.
https://www.msn.com/en-us/news/politics/u-s-agencies-back-banning-top-selling-home-routers-on-security-grounds/ar-AA1Pubbt
"Thanks for your readership and the nice note. I was posting on Mastodon yesterday about your very brand of router!
https://infosec.exchange/@briankrebs/110588154233185809
"I realize that NYT and others constantly recommend TPLink b/c of the features vs price point, but I would stay away from this brand, and any that force you to register "in the cloud" before you can use them as local networking devices. You do not want your router to do anything except when you tell it do so, and to my mind all this cloud business being attached to network storage and local network things is troubling."
"If you are at all confident around computers, I'd recommend getting something like a high-end ASUS router and then installing an open source firmware on it, like Tomato or something. Because the default software that is on most routers is complete garbage, and often turns on a lot of stuff you really don't want turned on, or has other stupid default settings. If updating your new $160 router w/ third party firmware that could brick it if you screw it up is too much, then just stick with a Netgear router and make sure you check for firmware updates periodically."

2025-10-29 02:55:40 UTC

New, by me: Aisuru Botnet Shifts from DDoS to Residential Proxies
Aisuru, the botnet responsible for a series of record-smashing distributed denial-of-service (DDoS) attacks this year, recently was overhauled to support a more low-key, lucrative and sustainable business: Renting hundreds of thousands of infected Internet of Things (IoT) devices to proxy services that help cybercriminals anonymize their traffic. Experts says a glut of proxies from Aisuru and other sources is fueling large-scale data harvesting efforts tied to various artificial intelligence (AI) projects, helping content scrapers evade detection by routing their traffic through residential connections that appear to be regular Internet users.
I included a section at the end mentioning that the latest Aisuru botnet code apparently tells infected systems to check in at the host fuckbriankrebs[.]com. When I heard this, I wondered what its use might be other than to just say what the domain says. But we also noticed the domain was unregistered....
Happily, the domain name was deftly snatched up last week by Philippe Caturegli, “chief hacking officer” for the security intelligence company Seralys.
Caturegli enabled a passive DNS server on that domain and within a few hours received more than 700,000 requests for unique subdomains on fuckbriankrebs[.]com.
But even with that visibility into Aisuru, it is difficult to use this domain check-in feature to measure its true size, Brundage said. After all, he said, the systems that are phoning home to the domain are only a small portion of the overall botnet.
“The bots are hardcoded to just spam lookups on the subdomains,” he said. “So anytime an infection occurs or it runs in the background, it will do one of those DNS queries.”
Read more:
https://krebsonsecurity.com/2025/10/aisuru-botnet-shifts-from-ddos-to-residential-proxies/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/455/194/816/388/927/original/798cd81824da7cb5.png

2025-10-25 17:11:08 UTC

So...taxpayers are paying Don Jr. to build his own army of killer drones for Dad? Isn't there an entire Star Wars movie about how this is a bad idea? From the Financial Times:
"A little-known drone company backed by Donald Trump Jr has won its largest contract from the Pentagon, as the US government expands its procurement of the drones."
"Florida-based Unusual Machines, in which Trump Jr has held a $4mn stake, said the US army had contracted it to manufacture 3,500 drone motors, alongside various other drone parts."
"The company added the army indicated it planned to order an additional 20,000 components from Unusual Machines next year."
https://archive.is/FUwKa#selection-1931.0-1939.122

2025-10-25 14:18:57 UTC

It's difficult to gauge how much self-help books have actually helped me over the years, but I will say I rarely get discouraged. Was journaling today (ahem, why does this message editor think journaling is not a word?) and realized that by the time I was about 15, I'd read or listened to all of the following books/series of self-help titles that either my dad or my salesperson brother had bought over the years, including:
Every single thing Tony Robbins uttered or wrote
At least three books by Wayne Dyer (but probably more)
Stephen Covey's 7 Habits of Highly Effective People
Dale Carnegie's How to Win Friends and Influence People (I hated this book)
The Power of Positive Thinking by Norman Vincent Peale
A lot of books from Thomas Merton
The last "self-help" book I read was The Power of Now, by Eckhart Tolle. Actually, I've read or listened to that book now several times, and would recommend it to anyone.

2025-10-23 18:27:27 UTC

Ah, the value of being part of a social network that is decentralized...from Techdirt's Karl Bode:
"Last week, Indiana University administrators fired the school newspaper’s (Indiana Daily Student) advisor and ordered students to stop printing the paper."
"The student journalists say that University administrators didn’t like the student paper’s decision to increasingly criticize University President Pamela Whitten’s decision to coddle the authoritarian Trump administration, or, at best, remain silent as the Trump administration and state leaders take direct aim at free expression, the First Amendment, and any curriculum teaching about race or gender discrimination."
"Enter students at the Purdue student paper, The Exponent, who stepped up and traveled two hours from West Lafayette to Bloomington to help Indiana University students deliver a physical paper to local students anyway:"
“We have the benefit of being fully independent of the university. We own our own press,” said Kyle Charters, publisher and news adviser for the Exponent. “We were more than willing, with our extra freedom being an independent student organization, to help out.”
“Both our publications have had their run-ins with their respective universities this summer and fall,“ Charters said. “While we’re pretty significant rivals — and while I might not be rooting for their football team tomorrow — we do have something in common, and we’re happy to have that camaraderie.“
https://www.techdirt.com/2025/10/23/student-journalists-at-indiana-university-and-purdue-show-more-integrity-solidarity-and-backbone-than-many-in-the-mainstream-press/

2025-10-22 18:08:30 UTC

Largest study of its kind shows AI assistants misrepresent news content 45% of the time – regardless of language or territory. An intensive international study was coordinated by the European Broadcasting Union (EBU) and led by the BBC.
https://www.bbc.co.uk/mediacentre/2025/new-ebu-research-ai-assistants-news-content
Not at all shocking. We all know about fake news. But what about fake news that isn't made for human consumption, but rather for digestion solely by LLMs, and designed to influence how they represent the news to others? Newsguard had a report about just such a Russia-based network earlier this year.
https://www.newsguardrealitycheck.com/p/a-well-funded-moscow-based-global

2025-10-20 20:26:45 UTC

I'm only just getting my feet wet after vacay, but I've gathered that there's a big Amazon #cloutage today? IDK if that's a word, but if not it is now :)

2025-10-16 20:41:06 UTC

Here's a little light vandalism/protest that is bound to catch on, given the prevalence of "no smoking" signs everywhere in public places. Was at the airport the other day and noticed someone had taken a black Sharpie and covered over the "smo" part.

2025-10-10 20:46:21 UTC

Trump, given an excuse to do what he's wanted to do ever since he got mad and fired my brother from another mother. Per the NY Post:
WASHINGTON — The Cybersecurity and Infrastructure Security Agency (CISA) is among the offices being permanently downsized as a result of the ongoing partial government shutdown, The Post has learned.
The RIFs (reductions in force), which started Friday, will fire some of CISA’s 2,540 employees as well as thousands more within the federal bureaucracy — after President Trump repeatedly threatened to target offices cherished by Democrats if the party’s senators refused to reopen the government.
In an indication of the possible scale of the RIF, CISA had planned to keep just 889 employees on duty during a shutdown while furloughing 65% of its workforce.
https://nypost.com/2025/10/10/us-news/cybersecurity-agency-that-clashed-with-trump-one-of-the-first-hit-with-federal-firings-due-to-shutdown/

2025-10-08 17:48:51 UTC

I've been trying to get the cybercrime journalist @nprofile…le0h to abandon their seat at the Nazi Bar, or at least to also post here. So please join me in giving them a follow and a friendly hello.

2025-10-02 16:33:35 UTC

- reply

@nprofile…kqm8 @nprofile…5lc3 I haven't seen anyone else mention this, but the posts from the Crimson Collective were signed "Miku", which is a nickname used by Thalha Jubair, the 19 y/o in the UK I wrote about last week who was charged in a ton of Scattered Spider ransom activity https://krebsonsecurity.com/2025/09/feds-tie-scattered-spider-duo-to-115m-in-ransoms/

2025-09-30 22:09:29 UTC

From Bloomberg (doesn't appear to be a paywall story)
AI Data Centers Are Sending Power Bills Soaring
Wholesale electricity costs as much as 267% more than it did five years ago in areas near data centers. That’s being passed on to customers.
"Data centers are proliferating in Virginia and a blind man in Baltimore is suddenly contending with sharply higher power bills."
"The Maryland city is well over an hour’s drive from the northern Virginia region known as Data Center Alley. But Kevin Stanley, a 57-year-old who survives on disability payments, says his energy bills are about 80% higher than they were about three years ago. “They’re going up and up,” he said. “You wonder, ‘What is your breaking point?’”
"It’s an increasingly dramatic ripple effect of the AI boom as energy-hungry data centers send power costs to records in much of the US, pulling everyday households into paying for the digital economy."
https://www.bloomberg.com/graphics/2025-ai-data-centers-electricity-prices/

2025-09-30 20:32:08 UTC

The CEO of Cloudflare just reminded me that the he tried to hire me as Employee #6 many years ago. I don't think he quite framed it that way at the time. Anyway, I joking asked him who Employee #6 was. His reply? "Someone worth over $100M." o_0

2025-09-30 20:23:33 UTC

- reply

@nprofile…crp9 god I love the Queen memes. This one's my fav
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/295/105/704/325/966/original/88bf8ac8ce6c6d04.png

2025-09-30 19:45:59 UTC

Been thinking a lot lately about how many fresh college grads are probably going to wind up joining the cybercrime community thanks to AI's impact to entry-level jobs, particularly in IT. We've spent years telling everyone we had this huge shortage of qualified IT workers, and that those pursue a career in cyber have a promising future. Whoops.
And then I was tagged in this LinkedIn post, which seems to agree.
Financial Times recently had a good video story on how AI is affecting the job market
https://www.youtube.com/watch?v=IeTFpsuCor8
NPR's Planet Money on which jobs are least threatened by AI
https://www.wbur.org/hereandnow/2025/09/30/jobs-ai
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/294/962/274/038/838/original/713d436c930233f7.png

2025-09-13 14:30:19 UTC

The Great Firewall of China has apparently experienced a great data spill. > 500gb of source code, work logs and internal communication records were leaked. Some light reading for the weekend /s
https://gfw.report/blog/geedge_and_mesa_leak/en/

2025-09-12 14:45:42 UTC

Obviously, these people don't read my posts here
Dear Brian,
I'm reaching out I believe you'd be the perfect person to review our new AI-powered cloud security and compliance software, <nope>

2025-09-11 12:59:20 UTC

This is so fucked up. Thanks to the heads up from @nprofile…kzkp (do we have quote posts yet??).
https://yle.fi/a/74-20182048
As I've said after each time the hapless Finnish justice system lets the notorious criminal hacker Julius Kivimaki off with a slap on the wrist, he'll just keep harming people. Because this guy still has zero remorse for his crimes, whether we're talking about his extortion of thousands of people over their psychotherapy patient notes, or any of his other many exploits.
Just this week, Hulu debuted a 4-part documentary on Kivimaki's ignominious career. I offered some perspectives on Julius in that series as well:
https://www.hulu.com/series/most-wanted-teen-hacker-9c894205-bcde-413c-9b53-1e3bbe99112e

2025-09-10 19:29:07 UTC

I'd pay for a high-quality handmade sketch (a good one, not some stick figures) that depicts what I desperately want to ask AI to devise just because I like the idea of asking it to imagine its own demise: I'm picturing a scene where the data centers have been overgrown with dangling vines and weeds creeping out of server cabinets, which have long ago been stripped for scarce parts in the battle against the machines. I'd settle for a more gently apocalyptic theme as well.

2025-09-10 16:35:00 UTC

Jimmy Kimmel has been must-watch over the past few days. Total 🔥 monologues. Also, Spinal Tap!
https://www.youtube.com/watch?v=YTRXOW4Mm0w
https://www.youtube.com/watch?v=BuEwkh24tYI

2025-09-10 14:41:37 UTC

Democracy in the US is under serious threat by a deranged orange comestible, but you wouldn't see any signs of that from watching the absolutely delusional stock market, which seems to only care about AI stocks continuing to lift the entire market thanks to their outsized value in it and all the wealth tied up in some fairly shaky but critical assumptions.
In other news, Financial Times reports just now that Oracle's market value jumped $200B thanks to a surge in AI investment, taking Larry Ellison's worth to that of Elon Musk.

2025-09-10 14:37:09 UTC

- reply

@nprofile…hetj exactly. why not just say this account doesn't exist anymore, or just doesn't exist. or terminated. TMI

2025-09-10 14:20:06 UTC

I've never before seen this particular 550 error in response to an email that was sent to me by a reader. Proton seems to be dunking on their own user here.
"550 5.6.0 Message rejected due to potential violation of our ToS by the recipient"