Ian Campbell 🏴

New post up if you want to read one of the cooler things I’ve seen in DNS https://dti.domaintools.com/securitysnacks/it-always-comes-back-to-dns-iranian-vpn-over-dns-activity-in-the-2026-conflict

Heard a great quote the other day that I think we should amplify: "Windows is the Flock camera of operating systems."

the rm -rf's will continue until morale improves

RE: https://mastodon.social/@violetblue/117277215709060410 if you find yourself saying something like "no politics in my hacking blog" i want you to stop think REAL hard about what you just said and if you STILL don't understand what was incorrect about it, please for everyone's sake go sell shoes or something. hacking is political. technology is political. always has been. and always will be.

RE: https://mastodon.social/@Sarahp/117010326592463918 this isn't to report AI slop this is to help tune their model.

Exhausting, demoralizing, generally bad day. Please send good memes.

Kinda glad this nor'easter isn't snow

RE: https://infosec.exchange/@kcarruthers/117277224142241619 wait why would an irish band sympathize with the palestinia- *hand to earpiece* ohhhhhhhhhhhhhhhhhhh.

The more I use it and the more I learn about it, almost every LLM use case in enterprises does one thing well: it signals exactly where the company that’s deployed it is intent on underspending.

They should put out a sequel to the Shaft series called “Shaftermath.” Bonus points if it involves elevator engineering. Thank you, thank you, I’ll be here all well.

@krypt3ia@infosec.exchange Oh I agree!

RE: https://cyberplace.social/@GossiTheDog/117009205530767591 hey it's almost like, once again, adblocking is a critical security measure

*pokes head up from conference-land, gasping for air* so...i miss anything good out in the world, or more of the same?

@spiegelmama@infosec.exchange The wording is a pretty transparent appeal to AI opponents, but it's not in order to reduce AI content. It's utilizing volunteer bias to get those most opposed to share how they detect (or think they detect) AI prose in order to make it less detectable. In short, fuck em.

@briankrebs@infosec.exchange I would love to see the raw body of the scam email to see if there was any attempt at prompt injection, or if it was literally just Gemini falling for a basic scam email.

@hacks4pancakes@infosec.exchange fuuuuuuuuuuuuuuuuuuck. no lies detected.

RE: https://techhub.social/@Techmeme/117308800902835850 They're not sending their best...

@nyanbinary@infosec.exchange yeah but then i have to shovel it

Eeeeenteresting. https://www.bellingcat.com/news/2026/09/19/christy-kinahans-uae-residence-visa-cancelled/

@AAKL@infosec.exchange I admire your optimism (non-sarcastically)

i hate this fucking timeline. integrity and vigilance are apparently for chumps.

RE: https://mastodon.social/@hrbrmstr/117031467694127984 Gonna be a hot one in Vegas, unsurprisingly. An important reminder: certain medications, including and especially some antidepressants (SNRIs and some SSRIs) increase your heat sensitivity deeply. Some also increase your alcohol sensitivity deeply. Please take care.

Palworld update: I kinda started counterfeiting gold coins. This caused the cops to raid my base. I had forgotten to log out and just left it running, but luckily my base is ringed with a series of .50 caliber machine guns crewed by witches as well as several dinosaurs wielding rocket launchers. And that’s Palworld.

add to that: ssokeyportal[.]com - first seen 25 or so minutes ago.

Cyber defense is adversarial. Swagger for every block, strut like you own it for every detection, dance for every threat uncovered. Don’t let attackers have all the fun. We are the adversaries. Defend and hunt like you damn well mean it. Happy hacker summer camp, friends.

I reckon they can skip most of the diagnostic battery for autism on this one

@paco@infosec.exchange oh no

Hugging Face wasn’t the only target of OpenAI’s uncontrolled/unsupervised agent https://www.reuters.com/business/openais-rogue-agent-compromised-an-account-second-tech-firm-sources-say-2026-07-28/

Me, elsewhere: “I long for the NorseCorp days now. Back when it was artisanal, hand-crafted cyber grift, rather than AI slop irresponsibly rushed to market.”

RE: https://infosec.exchange/@metacurity/117031178228141971 lol okay Partnered Health

@zackwhittaker@mastodon.social what do you think Grok is doing? I'm guessing popping iCloud accounts for nudes.

RE: https://ioc.exchange/@abuse_ch/117009056997384855 QUIT ABUSING THE ABUSE SERVICE! c'mon people. having been on the receiving end of similar, y'all gotta realize just how finite the resources are to keep something like this rolling, and how hard it is to secure more while still serving the community.

RE: https://infosec.exchange/@psylo/117003011519421493 My paid sub to Psylo continues to help me sleep at night

@zackwhittaker@mastodon.social can't wait until it happens to a defense contractor

@freediverx@mastodon.social @psylo@infosec.exchange Psylo's a @mysk@mastodon.social project - they've made more substantial contributions to iOS privacy, over the course of years, than anyone else I can think of

Think I’ll propose an “east coast early riser” track for hacker summer camp next year. Prospective agenda: 0300 - Coffee (Dunkin’s) 0330 - Welcome 0335 - Keynote - Why the Red Sox Are Better Even When They’re Worse 0336 - More Coffee (still Dunk’s) 0337 - Leaving each other alone until the coffee takes hold 0400 - Lightning Talks, Boston Format (mid-word r letters may not be fully pronounced) 0500 - Break for… you guessed it… coffee. 0530 - Expert Panel - Boston Bluntness or Autistic Bluntness or Both? Saying What We Think as a Superpower 0615 - Lightning Talks II - Airing of Grievances 0730 - Locknote - Per My Last Email, Guy 0800 - Coffee.

@xorhex@infosec.exchange @mysk@mastodon.social @freediverx@mastodon.social @psylo@infosec.exchange i'm awful at chess. only winning move for me is not to play. ;)

thinking about blackhat/defcon, and some year i want my org to sponsor a quiet reading party. maybe low-key waitstaff taking care of drinks and snacks, and handing out warm washcloths. "no eye contact chill rager; unless someone's wearing a green sign they get left alone to rest" back in my meditation days, at the retreat center the folks on silent retreats would wear a big button that said "in loving silence" i wonder what the hacker equiv would be

RE: https://infosec.exchange/@da_667/117009614714601301 WELL THAT'S A RELIEF IT'S A GOOD THING A MASTER KEY HAS NEVER BEEN ABUSED ACROSS MICROSOFT ENVIRONMENTS BEFORE PERHAPS THEY WILL LEARN FROM THIS SINGULAR UNIQUE EXPERIENCE

@krypt3ia@infosec.exchange her who?

@cR0w@infosec.exchange honestly? it's a good thing you didn't come to Vegas. ai psychosis as far as the eye could see, drowning out people doing the Actual Work.

@ADHDruid@infosec.exchange @da_667@infosec.exchange @cR0w@infosec.exchange @krypt3ia@infosec.exchange oh da and I have compared notes on Rimworld already. It’s where I let the worst version of myself out to play, and da seems to do the same thing.

@davidfetter@kolektiva.social david we've had the discussion previously about what you should do if you don't like things i'm talking about: go elsewhere. i'm too tired to humor you today.

@winterknight1337@infosec.exchange @da_667@infosec.exchange gotta admit i don't know this reference off the top of my head

@krypt3ia@infosec.exchange shrug i'm a fan. think she does good work, from a unique and important perspective.

RE: https://infosec.exchange/@BleepingComputer/117077078527523059 Now - these things can happen of course - but there is not one single detail as to *how* it happened or how they've changed process to avoid it happening again. This is confirmation bias for me, sure, but whaddaya wanna bet AI was involved? https://blog.mozilla.org/security/2026/08/10/updated-gpg-key-for-signing-firefox-and-thunderbird-releases/

Oh this is a good one. Physical letters being mailed out by a threat actor pretending to be the IRS, trying to get folks to "declare" their cryptocurrency holdings in a fake portal that auths to and drains the wallets. https://www.coinbase.com/blog/consumer-protection-tuesday-fake-irs-scam

@cR0w@infosec.exchange literally came up in a pew pew map conversation