イヴラド

Typical Thursday

Gosh, the orange site is full throttle on ECDSA conspiracy

It’s not the NTLM, it’s admins who did not disabled it in their networks ages ago.

Funny enough, when generating ECDSA curves NSA did not use a fancy true RNG: www.anthropic.com/research/ecd...

Forging 1024-bit RSA signatures in nearly SNFS time Hand over your HSM for some time, and we can forge signatures for its key. Arbitrary signatures. Forever. github.com/ucsd-hacc/NS...

I've got a lot of work to do today but I'm getting absolutely nerdsniped by the new Flock dataset. You can download it here. It's all of the Android partitions extracted from a Flock device ddosecrets.org/article/floc...

As scientists investigate the deadly floods that swept through Nepal and Tibet, online posts baselessly claim the disaster was caused by a Chinese dam collapse. We reviewed forensic evidence and spoke to five experts to break down the sequence of events behind the devastation 🧵

“Fix the Wayback Machine!” We’ve heard you. The Wayback Machine has been dealing with waves of high-volume automated traffic. Mark Graham, director of the Wayback Machine, explains what’s happening and what we’re doing about it. ➡️ blog.archive.org/2026/09/15/a...

Cybercriminals hacking into Berlin federal state network reads as a silly joke but it’s not: www.heise.de/en/news/Berl... Even funnier, the attackers exfiltrated almost 6 terabytes of data. It should have taken days if not weeks, and nobody noticed.

Australian police say they have arrested two people involved in the TeamPCP hacks, which hit GitHub, OpenAI and others. Brian Krebs has the full back story with one of the hackers, and it's one hell of a read. I audibly gasped at least twice.

I turned up to be passkeys hater, lol. And I remember, how fascinated I was with U2F and early FIDO implementations. The future looked so bright! )

Eclipse day! ☀️ Today's total solar eclipse is visible from Greenland, Iceland, northeastern Portugal and Spain. Most of the rest of Europe, northern North America and western Africa will witness a partial solar eclipse. More info: www.esa.int/Science_Expl... #EuropeanSolarEclipse

Somehow I seem to have 10Gbps internet at home with GUA IPv6 prefix delegated via DHCP-PD, and I did not have to do anything extraordinary for that. It’s rather surprising how … normal this is. It just works. What annoys me now, is how unstable Matter over Thread is.

Web Design trends in 1995 – Apple – Adobe – Pizza Hut – Netscape #WebDesignHistory

I feel attacked #booksky

A few people have asked me recently about how OpenSSH sshd implements privilege separation after the changes of the last couple of years, such as splitting sshd into multiple binaries. I finally got around to writing it up - please take a look if you're curious. github.com/openssh/open...

You won’t believe it, but Rob Joyce Enigma Talk is somehow 10 years old: youtu.be/bDJb8WOJYdA It was quite impactful.

I’ve never seen anything more accurate. #PCC #ChaosCentral

A Citizen Lab investigation found evidence that Russian authorities used Cellebrite’s forensic technology to access the iPhone of activist and former political prisoner Andrey Pivovarov. ⚠️🔽 citizenlab.ca/research/rus...

New at this.weekinsecurity.com: I analyzed America's top companies (aka Fortune 100) and found dozens don't have any easy way to report security flaws. Of the companies that *do* have vulnerability disclosure policies, half don't actually pay for bug submissions. My blog breaks down the data:

“Zen and the art of risk acceptance” is a book I should write

The auditors were not happy that the risk assessment report was a PDF rendered from a set of Markdown and CSV files prepared by scripts, and not Excel. They were also not happy that the list of accounts was a YAML file from the Ansible repo and not a screenshot of an Active Directory snap-in.

Mission success for the most powerful Ariane 6 yet. ✅ Flight #VA269 launched 36 Amazon Leo satellites using upgraded boosters carrying 14 tonnes more propellant each. A new record for Europe’s heaviest payload in a single launch. 🔗 esa.int/Enabling_Sup... @transport.esa.int

A world-class education is now completely free — MIT has opened its entire vault of more than 2,500 courses to the public online. source: Massachusetts Institute of Technology. (2026). About Us: MIT OpenCourseWare. MIT Open Learning. 😊

Nara, Japan. Photography by Rajeev’s Red Carpet on Flickr

I liked this talk abou the IPv6-mostly networks as a transition path to the IPv6-only future: ripe92.ripe.net/programme/me... I agree we (as the industry) tried a multiple transition mechanisms and NAT64 seems to be the only working approach.

🚨🚨 Huge breaking news from Brussels: Hungary has lifted its two-year-long veto on Ukraine's EU accession. Ukraine and Moldova will soon be able to open the first cluster of the accession process. The saga is over.

Pegasus relies on *online* exploitation, eg, via Messages, WhatsApp or Safari. The problem with online exploitation is that with the device being online it (at least, in theory) could send a signal to home base. For example, it could send a minified crash reports that would be sufficient …

Here is a look at all the special security features that Apple, Google, and WhatsApp offer to protect you from spyware all in one place. We looked at what these features do, and how to turn them on. We highly recommend them for anyone who's worried about government spyware.

A monumental modern art kimono designed by the legendary avant-garde Japanese artist Taro Okamoto (1911–1996). Displayed at the prestigious KIMONO: Fashioning Identities special exhibition held at the Tokyo National Museum Heiseikan in 2020

Exclusive: Fast16 malware has raised questions about what it was designed to do. Researchers at Symantec finally confirm it was subverting software used to simulate nuclear weapons explosions. Nuclear experts also tell me Iran was the likely target and explain how it impacted nuclear weapons tests