cybersecurity

I wrote about coordinated scanning waves against my honeypot infrastructure

From the article:

“it appears to be siphoning images collected by a widely-used identity verification company based in Louisiana.”

Worth noting that 5 US states (e.g. Florida) have stopped issuing standard drivers licenses and effectively force their residents to obtain a “Real ID” which includes additional data -- which of course makes more sensitive data available to cybercriminals.

(edit) BTW, would be useful to have a free-world venue for posts just about data breaches. Proposal here.

I'm so sorry if this isn't in the correct posting format or what-have you, this is my first PieFed post, and I'm pretty dumb sometimes.

https://media.piefed.social/posts/Y3/1S/Y31SK8v4YHjR0xZ.png

https://media.piefed.social/posts/3J/HB/3JHBmeDDTu3wZsa.png

https://media.piefed.social/posts/hg/sm/hgsmZjHGGz1AC2J.jpg

https://media.piefed.social/posts/3z/mG/3zmGZK1sHin7IUp.jpg

I've been using a TCL Flip 3 for the last 3 or so weeks, KaiOS 3.0+ enabled. My sibling had sent me a text asking if timing belts for his Honda Goldwing were at my house. I got up from the computer, confirmed that they were, texted him back, and went back to my computer.

A few minutes later, my gmail refreshed, and I had an email about "myself" signing up for a motorcycle parts storefront email list, specifically for a Honda Goldwing. I don't own a bike. I don't have any interest in one, I don't talk about them. Why, after I've received this text message, am I getting this advertisement? The only time I've talked about said "Goldwing" was THIS correspondence. It's the second time I've even texted him on this phone. He's one of 6 contacts. All I do with this phone is call and text. I've had some other advertisement scares (some wheels, some pants, some cologne) showing up in my gmail, but I chalked it up to a crazy coincidence that I just "happened" to be talking aloud and texting about.

I stay away from social media and smart enabled devices at if all possible. I've made the effort to make my digital footprint is as small as possible, including web security, privatizing my home server, etc. The TCL Flip 3 was supposed to be one of the bigger "unshackling" moments for my digitized life. Currently getting rid of Google entities as well. This Goldwing advertisement is just too much of a coincidence for me to look away.

TLDR: Am I just being dumb, or is KaiOS scraping data from my texts?

Update: Since I've finished typing this out, I received another two emails, same advertiser.

Vulnerability-Lookup 6.1.0 is out. The highlights:

• CNA roots. The CVE Program hierarchy is now part of the platform. The assigner search accepts root: to select every CNA under a root, the vulnerability page shows the assigner's root, and a new dashboard tab lists the latest vulnerabilities of each root with per-root RSS/Atom feeds.
• CNA activity report. One page summarizing everything your local CNA/GNA did over a date range: reservations, publications, KEV entries, sightings, disclosures, comments, bundles and registrations. Charts included, Markdown export too.
• CPE Editor integration. The vulnerability page checks CPE names against the collaborative catalogue of the GCVE project (cpe.gcve.eu) and lets you propose missing vendors and products from a pre-filled form.

Also inside: sighting summaries on bundles, a Markdown export of recent vulnerabilities, the CVE Program bundle warning on flagged records, a KEV publication activity grid, frontend libraries managed with npm, and a batch of security and storage fixes.

Upgrading requires Node.js >= 18, a PostgreSQL migration and gcve >= 0.13.0. Instances that tuned kvrocks.conf should read the storage fix before restarting.

Full details on the blog: https://www.vulnerability-lookup.org/2026/09/02/vulnerability-lookup-6-1-0

Source: https://github.com/vulnerability-lookup/vulnerability-lookup

Weekly thread to discuss whatever you’re working on, big or small, at work or in your free time.

For five days in March 2026, a single stolen token let one group poison five software ecosystems including a package downloaded 95 million times a month. The attack started with a misconfigured GitHub Actions workflow, and ended with backdoored code sitting inside CI/CD pipelines around the world.

Today, two people behind this attack were arrested. TeamPCP, allegedly operated by these threat actors, started attacks in late 2025 running opportunistic cloud exploits, then pivoted in early 2026 to targeting the software supply chain itself.

Flare’s Emerging Threats Team wanted to share examples of some of the techniques that can be used to unmask one operator behind TeamPCP, using the Flare platform to trace a single alias across the accounts, credentials, and infrastructure that connected back to a real identity. There were other independent investigations on this topic, including by Brian Krebs. Below, we walk through who TeamPCP is and share the process of deanonymizing threat actors.

Title. Is the association legit? Reading through the privacy policy looks pretty typical, kind of surprised for a nonprofit they collect all that data, use Meta Pixel and Web Beacon.

Maybe the wrong place to post, but looks applicable.

Weekly thread to discuss whatever you’re working on, big or small, at work or in your free time.

Existing anonymity networks rely on routing tables, creating a structural vulnerability where metadata maps identity to destination. Under active global cyber warfare, traditional incremental architectures act as surveillance sinks.

I propose a "Dumb Pipe" architecture that eliminates routing entirely. By utilizing additive homomorphic superposition, atomic-scale synchronization, and holographic sparse projection, we construct a broadcast-only system where the provider never maintains attribution or destination mapping.

1. The Collapse of the Routing Paradigm

Traditional networks require routing tables to direct packets, turning infrastructure into a weaponized surveillance sink. In a hostile cyber environment, incremental patches fail because metadata leakage is native to directed routing. Our architecture replaces routing with a Holographic Broadcast Superposition:

• Users encode inputs locally using a private, procedurally generated sparse projection mask.
• Inputs are aggregated into a single superposition blob via homomorphic addition.
• The blob is broadcast globally.
• Users perform local, private extraction.

2. Mathematical Foundations & Error Correction

A. Sparse Local Projection

Each user (i) possesses a private input vector (x_i). They apply a sparse projection mask (P_k), derived from an ephemeral key, to create a sparse vector (s_i). These are blinded with differential privacy noise (r_i) and summed into an aggregate blob (B): B = Σ ( P_k(x_i) + r_i )

B. Resilient Erasure Handling

To combat crosstalk and packet dropouts, the system utilizes Fountain (Luby Transform) codes and Reed-Solomon interleaving. Missing shares are treated as erasures, allowing seamless reconstruction without stalling the global pipe.

3. Hardware-Backed Atomic Synchronization

True synchronization underpins the protocol. Nodes utilize Chip-Scale Atomic Clocks (CSACs) or White Rabbit PTP for nanosecond-level epoch boundaries. While full atomic integration scales with specialized hardware costs, hierarchical timing layers or regional nodes anchor precision, ensuring phase-coherent superposition and rendering jitter analysis impossible.

4. Adversarial Defenses & Modular Bootstrapping Vectors

A. Ingestion Flooding & Spam Mitigation

To prevent DoS attacks via share-flooding, aggregators implement Stake-Weighted Quality of Service (SWQoS) and Proof-of-Work (PoW) ingress filters. Malformed packets are discarded at the edge via QUIC flow control.

B. Modular Bootstrap Trust Interfaces (Multi-Vector Approach)

To bypass central directory vulnerabilities, the network supports multiple modular trust vectors depending on deployment constraints:

Vector A (Out-of-Band Physical / Self-Revoking H-TAN): Holographic TAN Manifests utilizing sequentially indexed, single-use, self-revoking seed coordinates bound to hardware contexts to instantly kill replay vectors upon consumption.

Vector B (Decoupled Ephemeral DHT): Decentralized key-rotation ledgers with short validity windows for open-access networks.

Vector C (Federated Committee Handshakes): Multi-party threshold governance for enterprise or consortium onboarding.

5. Threat Model Boundaries

This protocol assumes application-layer hygiene is managed externally:

Device Fingerprinting: Mitigated via Mullvad Browser or LibreWolf.

Transport Metadata: Mitigated via Nym mix-nets during intake upload.

6. Conclusion & Call to Action

We are no longer building for academic applause; we are coding for survival in an active digital attrition war. I explicitly invite anyone with the means, the compute, and the engineering resources to take this architecture, build it, and deploy it to save what remains of digital sovereignty.

Published as defensive prior art. Synthesizes principles from Attribute-Based Encryption, Fuzzy Extractors, and Lattice-based geometric superposition.

cross-posted from: https://scribe.disroot.org/post/10794972

Archived version

...

Three of the world's most active state-sponsored hacking programs — North Korea, Russia, and China — collectively carried out 158 documented cyberattack incidents in the first half of 2026, a 7.5% rise over the 147 recorded in the prior six months, according to the S2W TALON H1 2026 APT report published August 12 by South Korean cybersecurity intelligence firm S2W. The aggregate number, modest on its face, conceals three radically different strategic stories — and one counterintuitive finding that may be the most important for enterprise defenders: China's 17.5% decline in attributed incidents does not reflect reduced threat. It reflects a backdoor that conventional firewalls and network scanners physically cannot detect.

...

No state matched North Korea's volume. Pyongyang-linked groups were attributed 99 incidents over the six months — up 13.8% from 87 in the prior period, according to the same S2W report. South Korea absorbed 19 of those attacks, nearly double the eight recorded against the United States. Those are the headline numbers. The mechanism behind them is what should recalibrate how defenders think about social engineering.

...

Russia's 30% surge is the steepest percentage increase among all three state actors and the finding most directly relevant to enterprise organizations with European operations. Russian-linked APT groups recorded 26 incidents in H1 2026, up from 20 in the prior period.

Ukraine remained the primary target, absorbing 10 of those 26 attacks as Moscow's cyber operations continue to function as a force multiplier in the ongoing conflict. But the geographic footprint is expanding. Poland and Romania each recorded two confirmed Russian-attributed incidents — marking a systematic shift toward NATO's eastern flank that mirrors the broader hybrid warfare escalation Russia has conducted against both countries.

...

China's attribution count fell 17.5%, from 40 incidents in H2 2025 to 33 in H1 2026. That decline is not evidence of reduced threat. It is the product of a specific technical mechanism that makes Chinese APT activity structurally harder to detect than any other state actor's operations.

The mechanism is BPFDoor. The backdoor — attributed to Chinese APT cluster Red Menshen (also tracked as Earth Bluecrow and DecisiveArchitect) — operates at the Linux kernel level, embedding itself into the Berkeley Packet Filter (BPF) subsystem, a decades-old networking feature originally designed for efficient traffic analysis. BPFDoor does not open any listening ports. It does not maintain an outbound connection to a command-and-control server. It does not register as a suspicious process in standard system monitoring. It remains completely dormant, passively inspecting incoming network traffic in kernel space — below the layer where firewalls and network scanners operate — until a specially crafted "magic packet" arrives.

...

Weekly thread for any and all career, learning and general guidance questions. Thinking of taking a training or going for a cert? Wondering how to level up your career? Wondering what NOT to do? Got other questions? This is the time and place to ask!

Your bank never calls asking to "verify" anything urgent. Scammers don't need hackers, just fake urgency and a cloned website. Digital literacy isn't optional now, it's survival. #CyberSecurity #Phishing #DigitalLiteracy

Vulnerability-Lookup (https://github.com/vulnerability-lookup/vulnerability-lookup) is an open-source platform (AGPL) for fast vulnerability lookup and correlation across many sources — CVE, EUVD, GHSA, OSV, CSAF/VEX, national CERTs — with collaborative annotation, sightings and coordinated disclosure. 6.0.0 is out today; two big additions this round.

Webhook notifications

Product notifications are no longer e-mail only. A subscription can push its reports to any HTTPS endpoint — a chat channel, a SIEM, a ticketing system — instead of, or in addition to, e-mail. HTTP method, custom headers and a payload template are all configurable, so the same mechanism feeds a generic JSON collector or the specific shape Mattermost/Teams/DingTalk/Telegram expect.

Targets are held to a strict outbound policy, enforced when the form is saved and again at delivery time: HTTPS on a standard port, no redirects, delivery pinned to the validated IP, private/loopback/link-local refused (IPv6 transition addresses judged by their embedded IPv4 destination), URL-shortener and dynamic-DNS domains rejected via the MISP warning lists, and URL paths redacted from failure logs.

Local exploit hazard

An implementation of the model from arXiv:2607.24618 (https://arxiv.org/abs/2607.24618), which turns an EPSS forecast into an exploitation risk estimate that accounts for your environment — compensating controls (globally or per attack vector), KEV policy weighting, and exponential or KEV-calibrated Weibull age decay.

• POST /api/exploit-hazard — a single vulnerability instance, resolved from a vulnerability id or from explicit values.
• POST /api/exploit-hazard/batch — aggregates a whole exposed set into the aggregate daily hazard, the expected number of exploitation events over the horizon, and the Poisson probability of at least one event.

The same model drives the notifications: reports are ordered by individual hazard and annotated with EPSS score, age and horizon probability. Each subscription can localize the estimates with its own parameters, and a daily standing exposure evaluation alerts on upward threshold crossings, listing the vulnerabilities whose remediation would lower the exposure most.

There's a longer write-up on how the paper became running code in nine days: https://www.vulnerability-lookup.org/2026/08/11/local-exploit-hazard/

Also in this release

• A vulnerability credits index — credited researchers from CVE 5, OSSF and CSAF records, indexed and ranked at /credits/ with search and pivots from every advisory
• SSVC v2.0 decisions on the CVE page, extracted from every container (CNA and ADPs), normalized and attributed
• import_dump — bootstrap a fresh instance from the public NDJSON dumps (a one-time bootstrap, not a sync mechanism)
• EUVD: KEV catalog linking and a score-ordered EPSS index
• Security fixes: XSS in tag rendering, SSE stream gated on confirmed accounts, single-use activation/recovery tokens, outbound-URL policy on remote sync, and authenticated responses kept out of shared caches
• Project governance, maintainer list, roadmap and privacy documentation

Links

• Release notes: https://www.vulnerability-lookup.org/2026/08/13/vulnerability-lookup-6-0-0/
• Source: https://github.com/vulnerability-lookup/vulnerability-lookup
• Public instance operated by CIRCL: https://vulnerability.circl.lu/

Co-funded by CIRCL and by the European Union through the NGSOTI project.

🔓 Most organizations have some layer of legacy technology still running in production. Old binaries, orphaned tools, systems whose original developers and documentation are long gone. These legacy applications still increase the attack surface. AI can change what's feasible here.

One clear example: Adobe Flash. Thousands of internal dashboards, training modules, and business tools were built on it and never migrated when it was deprecated. To address this, I built an AI skill that decompiles, analyzes, and rewrites legacy Flash applications into modern HTML5 and JavaScript, without requiring the original source.

Ideal for legacy end-of-life software that's still being used, with no one left to maintain or migrate it.

#flash #claude #AI #decompile

That "poorly written email" advice for spotting phishing? Dead. AI writes flawless scam emails now. Here's what actually still works to catch them before you click.