← Feed

Posts

• View post

  It's always amazed me that ID.me, which you have to use in order to interact w/ the IRS online these days, has a top level domain from the country of Montenegro. Ublock Origin says they're injecting tracking links from Italy's TLD when you login at the irs.gov website. What's next? Cookies from Colombia? AI from Anguilla?

• View post

  What a surprise. "The auditor for former president Donald Trump’s media company was charged with “massive fraud” Friday by the Securities and Exchange Commission, which accused the firm of being a “sham audit mill” whose failures put investors at risk." https://www.washingtonpost.com/technology/2024/05/03/trump-media-auditor-borgers-suspended-permanently/

• View post

  Reason #2,391 why revisiting security assumptions is always a good idea. [Bimi] No cryptographic connection between VMC and DKIM key https://mailarchive.ietf.org/arch/msg/bimi/Ba3jFfJ8K6ic7qg4DzPsIsGW5UY/ My favorite part: "I guess some may consider what I just said as an unimportant or a merely theoretical issue, so I would like to illustrate it with an example. Let's take the domain entrust.com. It has a DKIM key configured at "dkim._domainkey.entrust.com&quot...

• View post

  Letting AI agents run your life is like handing the car keys to your 5-year-old. What could go wrong? I was marveling while reading this PCMag piece, which describes how to secure an agentic AI setup that essentially mimics malware: To do it's job properly, the AI agent has to be able to read private messages, store credentials, execute commands, and maintain a persistent state. How do you do that? You chase after it like you would your child. "The important thing is to make...

• View post

  The POTUS can't TACO his way out of the war he started now that the price of oil is spiking upwards, so he's loosening restrictions on Russian oil exports. Couldn't have come at a better time for his pal Putin. "Mr. Bessent later said that the United States was considering lifting more sanctions on Russian oil. And President Trump on Monday said in a news conference that his administration was “waiving certain oil-related sanctions to reduce prices.” https://ww...

• View post

  Breaking, new, by me: Iran-backed Hackers Claim Wiper Attack on Medtech Firm Stryker A hacktivist group with links to Iran's intelligence agencies is claiming responsibility for a data-wiping attack against Stryker, a global medical technology company based in Michigan. News reports out of Ireland, Stryker's largest hub outside of the United States, said the company sent home more than 5,000 workers there today. Meanwhile, a voicemail message at Stryker's main U.S. headq...

• View post

  New, by me: How AI Assistants are Moving the Security Goalposts AI-based assistants or “agents” — autonomous programs that have access to the user’s computer, files, online services and can automate virtually any task — are growing in popularity with developers and IT workers. But as so many eyebrow-raising headlines over the past few weeks have shown, these powerful and assertive new tools are rapidly shifting the security priorities for organizations, while blurring the lines between data and...

• View post

  When I saw the other journalists that were nominated, I didn't think there was a chance (e.g. ProPublica was nominated for their excellent investigative reporting uncovering the Pentagon's reliance on Chinese contractors for cloud work). I'm very flattered to be in such great company. Thank you to the Institute for Security and Technology (IST) for this award. Last night's IST gala at the National Press Club was a stroll down memory lane in many ways. Ran into pe...

• View post

  The POTUS is learning that you can't just TACO yourself out of a war that you JUST started, no matter how the market reacts. It turns out the market reacts badly to uncertainty, and the president just said he's going to keep bombing Iran for a few more weeks, maybe longer (probably if he'd said yeah we'll be wrapped up by April 20 the market would be like oh, okay cool). But it's not just everyone's savings and 401ks that are going to take a nosedi...

• View post

  Well, we're batting 0 for like 200 on observing cool astronomical phenomena lately. Total solar eclipse: Cloudy. Northern Lights appear in Virginia! Cloudy. Rare planetary conjunction happens. Cloudy. Blood Moon from a lunar eclipse. Cloudy. I'm sure when the aliens finally come park their giant death cruiser in front of our planet, it'll be cloudy then, too.

• View post

  For years we've been told that grand juries in the US are just a rubber stamp for prosecutors (i.e. that they will indict even pork-based comestibles). But increasingly what we're seeing is that grand juries are the last line of defense against an administration that is hellbent on perverting the justice system. From the NYT: "Federal prosecutors in Washington sought and failed on Tuesday to secure an indictment against six Democratic lawmakers who posted a video this f...

• View post

  Saw a few videos this morning of Iranian drones targeting US military bases and blowing shit up. I was struck by how loud and slow these things are. It's as if the loudest leafblower on the planet had wings and a propeller. This AP News story has some good detail on Iran's response to its neighbors, which indicates the majority of the many, many missiles and drones Iran sent at or near the UAE were intercepted, but that some less defended places were still hit due to the volume...

• View post

  Whoops. The data broker giant LexisNexis has suffered another data breach. LN says the data taken was no big deal. The group claiming credit for the breach claims otherwise, of course. https://www.bleepingcomputer.com/news/security/lexisnexis-confirms-data-breach-as-hackers-leak-stolen-files/ This brings back memories of previous breach stories. One of my first big scoops that made the WaPo dead tree edition's front page involved a breach at LexisNexis in 2005 that exposed >300k...

• View post

  I'm pretty sure Mastodon is the first social network I've been on that didn't immediately ask me to betray all of the people in my address book.

• View post

  @SteveBellovin@infosec.exchange Yes! Or as I like to say, you don't have to protect what you don't collect.

• View post

  New, by me: Who Is the Kimwolf Botmaster, "Dort"? In early January 2026, KrebsOnSecurity revealed how a security researcher disclosed a vulnerability that was used to build Kimwolf, the world’s largest and most disruptive botnet. Since then, the person in control of Kimwolf — who goes by the handle “Dort” — has coordinated a barrage of distributed denial-of-service (DDoS), doxing and email flooding attacks against the researcher and this author, and more recently caused a SWAT...

• View post

  Security nerds have launched a Gofundme to buy back securityfocus.com, a domain that hosted the Bugtraq site and more than 120,000 links from the National Vulnerability Database that are now dead. Whoops. "Symantec killed Bugtraq in 2020 and let the domain lapse. Now it's squatted for $175k," writes Jonathan Brossard. "The NVD has 120,000+ broken links pointing there. The security community's memory is being held hostage." https://www.gofund...

• View post

  Agentic AI-based services are the new Shadow IT. Change my mind.

• View post

  Favorite headline today (via HackerNews): Pope tells priests to use their brains, not AI, to write homilies https://www.ewtnnews.com/vatican/pope-leo-xiv-tells-priests-to-use-their-brains-not-ai-to-write-homilies

• View post

  A slick new phishing-as-a-service offering demonstrates just how easily a username+password and a one-time token can be phished. Dubbed "Starkiller," the service uses cleverly disguised links to load the target brand's real website, and then acts as a relay between the victim and the legitimate site -- forwarding the victim's username, password and multi-factor authentication code to the legitimate site and returning its responses. https://krebsonsecurity.com/2026/02/starkille...

• View post

  The WSJ reports that Google has moved to seize dozens of domains belonging to IPIDEA, a Chinese residential proxy service and the largest by far with ~10M proxies for rent. Google has also taken steps to remove hundreds of apps affiliated with the company from Android devices https://www.wsj.com/tech/google-aims-knockout-blow-at-chinese-company-linked-to-massive-cyber-weapon-3c3fdc40?st=tzboX3 Earlier this month, we broke the news about how the world's biggest botnet -- Kimwolf -- grew ver...

• View post

  We knew this was coming, but now the clock is running. From Privacy International: "Yesterday the Trump Administration announced a proposed change in policy for travellers to the U.S. It applies to the powers of data collection by the Customs and Border Police (CBP)." "If the proposed changes are adopted after the 60-day consultation, then millions of travellers to the U.S. will be forced to use a U.S. government mobile phone app, submit their social media from the last five ye...

• View post

  New, by me... Dismantling Defenses: Trump 2.0 Cyber Year In Review The Trump administration has pursued a staggering range of policy pivots this past year that threaten to weaken the nation’s ability and willingness to address a broad spectrum of technology challenges, from cybersecurity and privacy to countering disinformation, fraud and corruption. These shifts, along with the president’s efforts to restrict free speech and freedom of the press, have come at such a rapid clip that many read...

• View post

  In other depressing IoT news, iRobot, the maker of the popular Roomba vacuums, files for bankruptcy and sells itself to Chinese company. Hello cameras and mics in bajillions of homes. https://www.cbsnews.com/news/irobot-bankruptcy-irbt-roomba-app-continue-to-operate/

• View post

  The CEO of The Onion set the publication's goal for 2026 to have more subscribers than The Washington Post. At the rate the latter is going, that won't take long. "For reasons we don't like or understand, our work has become increasingly important." "Look, we're an independent company, we don't use AI to write headlines and make art, and we're one of roughly three publications who are up for the fight. Unlike other places, The Onion is quadrupling down on...

• View post

  I always wince a little when I see graphs and charts on the homepage of some news outlet, but this one was really well done and conveyed a lot of interesting and timely information in very few words. https://www.washingtonpost.com/business/2025/11/24/sp500-stock-market-tech-nvidia/

• View post

  This is pretty wild. Checkout.com got hacked by a group that claims to be Shiny Hunters again. Checkout said in blog post that it would not be extorted by criminals. "We will not pay this ransom. Instead, we are turning this attack into an investment in security for our entire industry. We will be donating the ransom amount to Carnegie Mellon University and the University of Oxford Cyber Security Center to support their research in the fight against cybercrime." Far too many victim...