Elektrine lite

โ† Feed

Will Dormann

wdormann@infosec.exchange

<p>I play with vulnerabilities and exploits. <br />I used to be <a href="https://twitter.com/wdormann" target="_blank" rel="nofollow noopener" translate="no"><span class="invisible">https://</span><span class="">twitter.com/wdormann</span><span class="invisible"></span></a> but Twitter has become unbearable, so here I am.</p>

Posts

  • View post

    Wow. iOS 27 sure figured out a way to require a lot more taps to get to the photo editing tools in Photos. ๐Ÿคฆโ€โ™‚๏ธ

  • View post

    File under: Will just wants to go one day without computer bugs jumping out at him. Since late 2023, an elevated (to an admin account user) Windows Terminal will say that $env:username is SYSTEM.

  • View post

    In today&#39;s episode of Will hates computers and vice-versa: Because Microsoft recognized that pretty much everybody logs into Windows as an admin user, they created a new feature called Administrator protection, which adds extra protections for those who use their computer in such a YOLO manner. The consequence of this feature being enabled on systems where you don&#39;t log in as an admin user is that an elevated process running as this admin user will have a different %USERPROFILE% value...

  • View post

    I went to a pretty intense championship yesterday. It was great.

  • View post

    Seen as an ad on my Fire TV stick. For Blade Runner. Two AI-generated guys in a car, sharing a single AI cheeseburger and a single AI french fry order. Who comes up with this, and more importantly who gives it the green light?

  • View post

    Ramdom thought / further evidence that this universe is against me: In the cycling world, clipless pedals are pedals that you clip into. I don&#39;t like this.

  • View post

    Well, I made the jump from macOS 15.8 directly to 27.0 (Golden Gate). Version 26 (Tahoe) was painful enough to my eyes that I didn&#39;t even consider it. Things I&#39;ve noticed: It looks a touch different.There&#39;s seemingly more AI shoehorned into the OS.Some of my auto-start apps no longer auto-started when I logged in. This was resolved by twiddling with settings and/or re-installing said apps.Somehow a Time Machine backup was running, yet the menu that pops up from the icon at the top...

  • View post

    RE: https://flipboard.com/@cbsnews/latest-headlines-3kai39s2z/-/a-fY6emZFXTAC7OV2eCgjWVA%3Aa%3A2476075171-%2F0 Honest question: Why do politicians basically work until they die?

  • View post

    Did you update to iOS 27? Congratulations! You&#39;ve now possibly have been re-enrolled in Apple Intelligence, because Apple knows better about what you want than you do. Starting with iOS 27, there is no top-level Apple Intelligence setting that you can turn off.If you had Apple Intelligence disabled on iOS prior to 27, the features that use Apple Intelligence will be automatically re-enabled upon upgrading to 27.If you do want to turn off an example Apple Intelligence thing in iOS 27, you c...

  • View post

    Washington Post editor: Maybe we should find a picture of Susan Collins where the fotographer&#39;s finger isn&#39;t partly covering the camera lens? Their boss: Just ship it.

  • View post

    Over at the bad place, somebody mentioned a &quot;BYOVD&quot; attack that&#39;s happening in the wild that&#39;s going to be demonstrated at Defcon. We&#39;re not in Las Vegas, because all of that nonsense is silly. So let&#39;s look at what we&#39;ve got. The Driver is on VirusTotal. It&#39;s made by MOCOMSYS &amp; DRC. Its authentihash of 2a7ed8d0be70e0667aa14e161ae1dc6b7daaeb1438b534d73b1093c0b44d78a2 is (obviously) not on the Microsoft recommended driver block rules list, but it&#39;s a...

  • View post

    So, uh, Bugtraq is back?

  • View post

    Saw The Odyssey over the weekend. Was a pretty good example of the type of epic fantasy film. Several people I invited to come along backed out saying that they were waiting to see it on IMAX. Of course I had to be the person to bring up that the closest IMAX screen is 4.5 hours away. (Look up &quot;LieMAX&quot; if you want to read about the nonsense you&#39;ve been led to believe) If you have an actual IMAX nearby, sure, go ahead and pop for it. If not, then just go see it on a normal scr...

  • View post

    I&#39;m old enough to remember when Google helped you find websites to go to. It was indeed better than HotBot, which was pretty decent. https://www.theringer.com/2026/08/04/tech/google-search-ai-internet

  • View post

    Why would a deer get into tomatoes that are very clearly planted by me, for my own consumption, before they are ripe, bite into them, and then drop them on the ground. Is it an idiot? Or just an asshole? We&#39;ll see how this goes...

  • View post

    Last&#39;s night entertainment: Puddles Pity Party and Weird Al. They were both spectacular.

  • View post

    A purple tomatillo is apparently a tomatillo with a purple sunburn.

  • View post

    Wiz found a master key that could access every database in Azure&#39;s Cosmos DB. #cosmosescape Whoops. https://nitter.net/yuvalavra/status/2082864672294736324

  • View post

    Concern #1: There apparently aren&#39;t enough dogs for WeRateDogs to not have to recycle material. Concern #2: Ronnie clearly did something to raise his score from 12 to 13. ๐Ÿค”

  • View post

    Apparently on Monday, Apple killed fG!&#39;s bug With any system that has Screen Sharing enabled, it&#39;s reported that the vulnerability can allow for remote code execution as root. Apple lists no CVE with such a description. Closest is CVE-2026-43760, which is: An app may be able to access user-sensitive data The navi_the_clown PoC appears to only retrieve files from the target system (root-only is fine).

  • View post

    Anthropic isn&#39;t even trying to hide the fact that they only know how to speak spin, with the sole intention of getting investors. The second identifies a new way to attack round-reduced AES, the most widely used symmetric cipher. A not-careful reader (or victim of the telephone game) might conclude that a new way to attack the most widely used symmetric cipher was identified. Round-reduced AES, as opposed to actual AES, isn&#39;t used in the real world. I didn&#39;t read the article beyon...

  • View post

    Lots of vul collisions in the world of AI-driven vul discovery. Chart taken from a terrible place, so no attribution.

  • View post

    iOS 26.6 is out, with fixes for 91 CVEs.

  • View post

    Claude: Once a chat has been shared, anyone with the link can view the chat snapshot. The part Claude doesn&#39;t say out loud: When you generate a link, we share the link with search engines, so basically the whole world has the link. https://www.google.com/search?q=site%3Aclaude.ai%2Fpublic%2Fartifacts

  • View post

    @ai6yr@m.ai6yr.org At some point in the future we will look back at the time when people cooked with open flame indoors with utter disbelief.

  • View post

    Today&#39;s accomplishment: Code execution as NT AUTHORITY\SYSTEM, triggered by playing a music file on Windows. Local environment configuration by a non-admin user required, so this definitely isn&#39;t RCE. Just LPE. If MSRC requires me to provide a video of the exploit, that&#39;ll force my hand to drop 0day. ๐Ÿ˜‚

  • View post

    Looks like somebody [posted an exploit for CVE-2026-50522] (patched in July)(https://gist.githubusercontent.com/testanull/0868e02d81d57d6c59a91261969f7f81/raw/4d16304047e525057d732401f718e20fa830eb0a/SharePoint%2520SE%2520p2o%2520PoC.ps1) While I can reproduce it on SharePoint Subscription Edition, I didn&#39;t get it to work on SharePoint 2016 or 2019. But I could also attribute that to me having no clue how to properly install SharePoint. Here it is tweaked to run calc.exe as the SharePoint...

  • View post

    Have you ever been on , and it decides to refresh what you see, potentially in a way that you&#39;ll never again see what you were just reading? Mastodon has got your back.

  • View post

    AI news is exhausting. Huggingface : We tried to defend ourselves, but guardrails prevented us due to &quot;cyber&quot;. So we used a Chinese model (Gee, who could have predicted this? ๐Ÿ˜‚) OpenAI: Our models are so powerful, the world isn&#39;t ready for them yet (Wink to venture capitalists and government contract makers. ๐Ÿ˜‰) I want off of this ride.

  • View post

    I&#39;ve been growing tomatoes for years, and today is the first I&#39;ve heard about the &quot;breaker stage&quot;. That is, once the blossom end of a tomato shows its first blush of color, that is the point that it should be harvested. Leaving it on the plant adds nothing to the flavor, encourages the plant to produce fewer tomatoes, and also increases the risk to the tomato on the vine. Is this common knowledge?