Peter C

Exciting! MLS e2ee messaging with fingerprints in Bluesky bios (to prevent silent bindings) and pre-keys in PDS.

Kinda wish the key was published in the DID document though, especially if one day plc.directory will become a tlog. (Basically free KT!)

www.germnetwork.com/blog/integra...

Hackers Can Remotely Trigger the Brakes on American Trains and the Problem Has Been Ignored for Years “All of the knowledge to generate the exploit already exists on the internet. AI could even build it for you,” the researcher told 404 Media.

New from 404 Media: we spoke to the researcher who found hackers can remotely trigger brakes on American trains. Says was ignored for years, DHS confirmed. "All of the knowledge to generate the exploit already exists on the internet, AI could even build it for you." www.404media.co/hackers-can-...

Just to clear up some misinfo, a BGP hijack was not the cause of Cloudflare DNS going down today.

At 21:51 UTC, Cloudflare (AS13335) withdrew both 1.1.1.0/24 and 1.0.0.0/24 for an unknown reason.

I suspect AS4755 was always announcing 1.1.1.0/24, when CF went away, it leaked a bit (%2).

Activision pulls Call of Duty game after PC players are hacked Call of Duty: Remote Code Execution

Activision has pulled a Call of Duty game after multiple reports of PC players having their computers hacked. An old insecure version of the game was reportedly uploaded to the Microsoft Store 😬 www.theverge.com/news/702255/...

161. The Court's Disastrous Ruling in the Third-Country Removal Case The majority did not just greenlight an especially odious immigration policy without any explanation; it did so in a case in which the government defied the district court—twice—with no consequence.

Today’s unsigned, unexplained #SCOTUS ruling clearing the way for removals of migrants to third countries without any additional process is a disaster—not just on the merits, but because of the government misbehavior that it not only refuses to punish, but effectively rewards.

Me, via “One First”:

Here's something I am very excited about: Photosynthesis! 🌱☀️

A proposal to have CAs run transparency logs and make X.509 certificates out of Merkle Tree inclusion proofs.

This is similar to how CT would have worked in an ideal world, and it solves the problem of PQC sizes in logs and handshakes.

this is actually how my cursed Online brain read the post

Coinbase breach tied to bribed TaskUs support agents in India A recently disclosed data breach at Coinbase has been linked to India-based customer support representatives from outsourcing firm TaskUs, who threat actors bribed to steal data from the crypto exchange.

A recently disclosed data breach at Coinbase has been linked to India-based customer support representatives from outsourcing firm TaskUs, who threat actors bribed to steal data from the crypto exchange.

Democratizing Detection Engineering at Block: Taking Flight with Goose and Panther MCP A comprehensive overview of how Block leverages Goose and Panther MCP to democratize and accelerate security detection engineering.

Most engineers aren’t taught how to write secure code or catch threats after deploy.

Detection engineering used to be limited to experts. Now anyone can do it with prompts, Goose, and the Panther MCP server. 💪

block.github.io/goose/blog/2...

Vanta bug exposed customers' data to other customers | TechCrunch The compliance company said the customer data exposure was caused by a product change.

New, by me: Compliance startup Vanta said it's fixing a bug that exposed some customer data to other Vanta customers.

One Vanta customer told us that they were notified that some of their data was pulled out of their Vanta instance "into other customers’ instances."

Our latest investigation…

I'm often asked if I'll redo the 2019 quantum factoring estimate. Denser storage by yokes, smaller magic factories by cultivation, slimmer approx arithmetic by Chevignard et al… surely the cost is lower now?

Yes, it's lower now.

security.googleblog.com/2025/05/trac...

arxiv.org/abs/2505.15917

Probe Found Security Lapses Led to US Contractor’s Data Breach Failures in cybersecurity practices at a software company that helps federal agencies manage investigations and FOIA requests allowed two convicted hackers to delete databases, according to internal d...

SCOOP: In Feb, federal agencies "lost" many #FOIA requests but you probably had no idea. It turns out that the FOIAs disappeared due to an "insider threat attack" by 2 employees at a software company who were previously convicted of hacking into the State Dept

🧵

🎁 www.bloomberg.com/news/article...

DHI

New: Docker Hardened Images 🔐

✅ Non-root by default
✅ SLSA Level 3 compliant
✅ SBOMs, VEX, provenance — all signed
✅ Built-in to Docker Hub

👉 http://spklr.io/63323CAqR

#Docker #DevSecOps #SoftwareSupplyChain #Containers #CloudNative #DockerHardenedImages

DDoSecrets publishes 410 GB of heap dumps, hacked from TeleMessage's archive server micahflee.com/ddosecrets-p...

Time to update microcode on your Intel processors (gen >9)
new speculative prediction bug lets you capture /etc/shadow with 99% reliability. They didn't make anything like it work on AMD or ARM, yet...

comsec.ethz.ch/research/mic...

www.intel.com/content/www/...

github.com/intel/Intel-...

Despite misleading marketing, Israeli company TeleMessage, used by Trump officials, can access plaintext chat logs Despite their misleading marketing, TeleMessage, the company that makes a modified version of Signal used by senior Trump officials, can access plaintext chat logs from its customers. In this post I ...

Despite misleading marketing, Israeli company TeleMessage, used by Trump officials, can access plaintext chat logs. My findings are based on TM SGNL's source code, and they are corroborated by hacked data micahflee.com/despite-misl...

The Signal Clone the Trump Admin Uses Was Hacked TeleMessage, a company that makes a modified version of Signal that archives messages for government agencies, was hacked.

TeleMessage, the Israeli company that makes the modified Signal app used by Trump officials, was hacked. “I would say the whole process took about 15-20 minutes,” the hacker said micahflee.com/the-signal-c...

PhD Timeline xkcd.com/3081

🧵 THREAD: A federal whistleblower just dropped one of the most disturbing cybersecurity disclosures I’ve ever read.

He's saying DOGE came in, data went out, and Russians started attempting logins with new valid DOGE passwords

Media's coverage wasn't detailed enough so I dug into his testimony:

Turning the Security Flywheel

This post explores the "flywheel" concept and its application to security, demonstrating how to create self-reinforcing cycles that improve effectiveness.

www.philvenables.com/post/turning...

Safe.eth on X: "Investigation Updates and Community Call to Action" / X Investigation Updates and Community Call to Action

New details on the ByBit/Safe{Wallet} breach, and uhhh wow, some really silly blunders on the DPRK side. They still succeeded which is the most upsetting part of all of this. Let's bully some threat actor tradecraft! A🧵
x.com/safe/status/...

Security engineering should be embedded in engineering teams, doing joint engineering work.

Security engineering that operates as its own isolated team is an organizational artifact of a company’s “we’ll bolt on security later” culture.

The executive response to Copilot products consistently violating data security policies and development requirements causing escalations every release was to just stop having the escalation meetings for a while

I am not even exaggerating

On the other hand, it will be redundant to all the other actual vulnerabilities in the EOL version which have actual quantifiable severities.

Yep, basically!

I guess we're creating vulnerabilities about the potential for vulnerabilities now and classifying them as high severity 😩
www.cve.org/CVERecord?id...

Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel On November 20, 2024, Shubham Shah and I discovered a security vulnerability in Subaru’s STARLINK admin panel that gave us unrestricted access to all vehicles and customer accounts in the United State...

Outstanding write-up from @zlz.bsky.social (as always)

samcurry.net/hacking-subaru

• Enumeration
• Account takeover via vulnerable password reset feature
• 2FA bypass as it was implemented only as an UI limitation (not server-side)

First blog post of the new year and this is one I've been meaning to write up for a while which is some details on #Kubernetes API Server proxy feature and how it might be possible to use some known weaknesses in it to escalate your privileges in a cluster.

raesene.github.io/blog/2025/01...