Elektrine
EN
Log in Register
Paige Chat Timeline Communities Gallery Videos Email DNS VPN Uptime Kairo
Back to Timeline
Remote

dragosr

@dragosr@chaos.social
mastodon 4.5.15
  • Open on chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense.
Host of CanSecWest, and PacSec.
Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF.
VA7MOV

3089 Followers
1789 Following
28 Posts
Joined April 29, 2022
Organizer:
CanSecWest, PACSEC
Nexus:
https://secwest.net

Posts

Open post
dragosr
dragosr @dragosr@chaos.social · Jul 31, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social
WireGuard powers some of the world’s fastest VPN services. The VPN technology behind services like Tailscale now goes where UDP cannot: WireguardTCP delivers familiar configuration, kernel-native performance, outbound NAT traversal, seamless roaming, with impressive throughput, latency, and CPU load improvements over UDP. https://wireguardtcp.net/ Two years in development, testing, and performance tuning, finally released and robust. We beat TCP Meltdown, and the surprise, less latency than UDP.
17
2
15
0
Open post
dragosr
dragosr @dragosr@chaos.social · Jun 23, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social

Don't see these that often, malicious server, no auth, no interaction, RCE in ssh.

CVE-2026-55200 — libssh2 pre-auth heap OOB write, server supplied length runs past heap allocation

Because the trigger sits in the transport layer ahead of full server authentication, network-position attacks (DNS hijack, ARP/BGP, a malicious forward proxy) can deliver the packet even where the client pins host keys, assuming the early-KEX reachability holds.

https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc

https://www.linkedin.com/posts/dragosruiu_dont-see-these-that-often-malicious-server-share-7475281823900622848-TiIO/

21
3
30
0
Open post
dragosr
dragosr @dragosr@chaos.social · Jun 12, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social

x86 emulator in CSS

https://github.com/rebane2001/x86CSS

5
0
4
0
Open post
dragosr
dragosr @dragosr@chaos.social · Jun 11, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social

This kind of hurt my eyes and my brain, and reinforced my opinion that FreeBSD is a softer target amongst OS platforms. It is pretty funny though, and definitely gets some style points for a vulnerability disclosure.

https://bumsrake.de

3
1
1
0
Open post
dragosr
dragosr @dragosr@chaos.social · Jun 10, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social

It's over petrofuel industry, solar has the high ground.

@robert.ferry@medium.com

3
0
1
1
Open post
dragosr
dragosr @dragosr@chaos.social · Jun 10, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social

The Anthropic Fable-5 safety classifiers seem to be written by the OpenAI marketing department.

Pretty much anything I talk to LLMs about gets downgraded.
Nerfed into useless. Worst model release ever?

2
0
1
0
Open post
dragosr
dragosr @dragosr@chaos.social · May 31, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social

When you leave all the mitigations on, crank up the inference settings to maximum, and run the exploit benchmark to see how close the PoCs can get.

3
0
0
0
Open post
dragosr
dragosr @dragosr@chaos.social · May 28, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social

The thought processes of AI native kids: 9-year old gets a DOCX file from school laptop, wants to read it, doesn't have M365. His first impulse is to use GPT to write a python script to convert it to TXT so he can use VSCode, instead of asking for Word license or searching for converter.

When AI is the path of least resistance.

9
2
5
0
Open post
dragosr
dragosr @dragosr@chaos.social · May 26, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social

🚨 CVE-2026-48710 ("BadHost"): one character in a Host header bypasses path-based auth across most of the internet's Python AI stack.

In Starlette → FastAPI → vLLM, LiteLLM, TGI, MCP servers, agent harnesses. Found by X41 during a vLLM audit.

Patch shipped after 4 months quietly as CVSS 6.5 scoped as a "web framework problem"; but discoverers say critical.

https://secwest.net/starlette

Fix: Starlette 1.0.1.
Scanner: https://badhost.org
Semgrep+CodeQL: https://github.com/x41sec/poc/tree/master/starlette-host-header

Hat Tip: @marver@mastodon.social

3
0
5
0
Open post
dragosr
dragosr @dragosr@chaos.social · May 11, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social

Raelize had Claude Code reproduce an ESP32 Secure Boot V1 bypass via voltage glitching. AI wrote all software: ChipWhisperer Husky control, RK6006 voltage sweeps, PicoScope verification, boot ROM reversing via sub-agent, plus a live dashboard built while glitching. 20k shots, 12.2% bypass rate, 57%+ at two voltage peaks. Two evenings, no human code. Workflow compression is the story.

https://raelize.com/blog/ai-fi-giving-claude-code-glitch-skills-for-bypassing-secure-boot/

3
0
0
0
Open post
dragosr
dragosr @dragosr@chaos.social · May 08, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social

"Dirty Frag" status update on the clickbait overhype: ESP half (CVE-2026-43284) now patched: mainline f4c50a4034e6, stable backports in 7.0.5 / 6.18.28 / 6.12.87 / 6.6.138 / 6.1.171 / 5.15.205 / 5.10.255. RxRPC half (CVE-2026-43500) still unpatched upstream. AWS now adds ipcomp4/ipcomp6 to the blacklist alongside esp4/esp6/rxrpc, adjacent xfrm code paths, defense in depth or a hint more is coming. AlmaLinux and CloudLinux shipped both fixes. Ubuntu, Debian, RHEL, Amazon still mitigation only.

2
0
3
0
Open post
dragosr
dragosr @dragosr@chaos.social · May 02, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social

My retort for anyone who insists LLMs are just "spicy autocorrect" and can't reason:

Sure, and you're just spicy electrochemistry. If it walks like reasoning, and proves theorems like reasoning, maybe we need to stop calling it a duck shaped Markov chain.

3
1
1
0
Open post
dragosr
dragosr @dragosr@chaos.social · May 02, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social
Replying to @satmd@brettvormkopf.de
@satmd I actually think the simple solution is just to do a fleet wide delete of the .ko until you can patch. Nuke it from orbit style. Might not break much. :-) But your point is a good one I'll go edit the writeup to mentions all this.
0
1
0
0
Open post
dragosr
dragosr @dragosr@chaos.social · May 02, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social
Replying to @dragosr@chaos.social
@satmd The attack surface of "anyone in group x can load a module" where capabilities can be inherited is worse than just a simple sudo gate IMHO. But I'm just an old fashioned Unix grump. :-)
0
1
0
0
Open post
dragosr
dragosr @dragosr@chaos.social · May 02, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social
Replying to @satmd@brettvormkopf.de
@satmd AFAiK in modern systems it's actually bound to CAP_SYS_MODULE not root, but likely effectively yes, and that's been getting locked down progressively over history. Unsure of all distro timelines. Non-root syscalls / executions can succeed if they have that. (And they're been locking to signed modules at some point in time.) The kernel autoload has always been an endrun to that, even now. I've seen some hella old kernels in embedded systems, not sure of real risk.
0
1
0
0
Open post
dragosr
dragosr @dragosr@chaos.social · May 01, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social

Copy Fail (CVE-2026-31431):
The modprobe.d + rmmod recipe is inadequate. Both populations equally vulnerable; the fix differs.

RHEL/Alma/Rocky/Oracle: compiled in — need initcall_blacklist + reboot.

Ubuntu/Debian: auto-loads on AF_ALG bind — block via modprobe.d install /bin/false.

aarch64, Alpine/busybox: PoC fails. Still vulnerable.

Local root + K8s container escape. Page cache attack; FIM blind.

Mitigation: https://secwest.net/copyfail-mitigation

10
6
12
0
Open post
dragosr
dragosr @dragosr@chaos.social · Apr 17, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social
Replying to @lritter@mastodon.gamedev.place
@lritter@mastodon.gamedev.place Most of the time you can fix a lot just by deleting text. there is a lot of needless fluff in LLM output, they always love to use three adjective when one will suffice, etc... Problem is most people mistake the ornament language for good style. They don't recognize how much weaker it makes their communication I swear reading EB White's Elements of Style should be mandatory yearly for anyone that uses the internet.
2
1
0
0
Open post
dragosr
dragosr @dragosr@chaos.social · Apr 17, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social
Replying to @lritter@mastodon.gamedev.place
@lritter@mastodon.gamedev.place thing is, it's easy to get llms to write better if you spend a few minutes on it, take the output and an use a few prompts and you can clean it up with LLMs too. Or just edit more. Claude even has writing styles you can load now, so there isn't much excuse.
0
1
0
0
Open post
dragosr
dragosr @dragosr@chaos.social · Apr 17, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social
Replying to @lritter@mastodon.gamedev.place
@lritter@mastodon.gamedev.place Agreed, I can smell it a mile away these days: -the omnipresent tricolons, -anaphora emphasis, -the Not X - Y substitution frames, -the now cliche constructs, -and parallelism overload. But at least they had the sense to edit out the omnipresent em dash interjections that Claude loves so much. LLM default style writing output is a little like fingernails on chalkboard now. That aside still interesting commentary.
1
2
0
0
Open post
dragosr
dragosr @dragosr@chaos.social · Apr 16, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social

Interesting critical analysis of IPv8 Draft...

https://shitwolfymakes.substack.com/p/we-need-to-talk-about-the-ipv8-draft

We Need to Talk About the IPv8 Draft
shitwolfymakes.substack.com

We Need to Talk About the IPv8 Draft

The Good, The Bad, and the Heinous

63
27
66
4
Open post
dragosr
dragosr @dragosr@chaos.social · Apr 11, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social
Replying to @wdormann@infosec.exchange
@wdormann I do think it lowers the bar, the original was faily complex to build, this makes it accessible with less effort. II haven't checked if the MS defender signatures catch this one.
0
0
1
0
Open post
dragosr
dragosr @dragosr@chaos.social · Apr 10, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social
Replying to @wdormann@infosec.exchange
@wdormann have you seen SNEK release ?
0
2
1
0
Open post
dragosr
dragosr @dragosr@chaos.social · Mar 31, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social
Replying to @dragosr@chaos.social
LOL, ported to Python already. https://github.com/instructkr/clawd-code
7
1
4
0
Open post
dragosr
dragosr @dragosr@chaos.social · Mar 31, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social
Boosted by CM Harrington @octothorpe@mastodon.online
Anthropic inadvertently made Claude Code open source.  Chaofan Shou discovered that the published npm package for Claude Code included a .map file referencing the full, unobfuscated TypeScript source — downloadable as a zip from Anthropic's R2 storage bucket.  https://github.com/nirholas/claude-code The internet is furiously pulling it apart and analyzing it, at LLM speed.
39
6
44
2
Open post
dragosr
dragosr @dragosr@chaos.social · Mar 29, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social

A walkthrough on patching Dell UEFI firmware at the SPI flash level to disable pre-boot DMA protection — bypassing the BIOS password entirely. The interesting part: the UEFI UI still reports the setting as enabled, and TPM measured boot doesn't detect the NVRAM change, so BitLocker unlocks normally. The patch also persists through official Dell BIOS updates. From there it's DMAReaper to kill IOMMU + PCILeech for a SYSTEM shell. Significant measured boot policy gap. https://www.mdsec.co.uk/2026/03/disabling-security-features-in-a-locked-bios/

16
0
14
0
Open post
dragosr
dragosr @dragosr@chaos.social · Mar 17, 2026
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social

Your UEFI firmware can inject a PE binary into Windows on every boot via WPBT (Windows Platform Binary Table). smss.exe extracts it to disk and runs it as SYSTEM. OEMs use this to survive OS reinstalls. Attackers use it the same way.

One registry key tells Windows to ignore the table entirely:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v DisableWpbtExecution /d 1 /t REG_DWORD /f

Won't stop real firmware implants, but kills a whole class of cheap persistence for free.

65
5
39
1
Open post
dragosr
dragosr @dragosr@chaos.social · May 13, 2025
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social

Time to update microcode on your Intel processors (gen >9)...

New speculative prediction bug lets you capture /etc/shadow with 99% reliability. They didn't make anything like it work on AMD or ARM... yet...

https://comsec.ethz.ch/research/microarch/branch-privilege-injection/

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01247.html

https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20250512

23
0
26
0
Open post
dragosr
dragosr @dragosr@chaos.social · Mar 21, 2025
dragosr
@dragosr@chaos.social

Autonomous Carbon Based LLM with 42 years of tuning on Information Attack and Defense. Host of CanSecWest, and PacSec. Do security audits, code, IR, LLM, red team consulting. Specialize in Firmware, and RF. VA7MOV

chaos.social

How to inject/spoof positional _audio_ mic arrays remotely using _lasers_.

CanSecWest2025_newtype Presentation:

Cross-Medium Injection: Exploiting Laser Signals to Manipulate Voice-Controlled IoT Devices

Hetian Shi, Tsinghua University

So that positional mic array in your Tesla can be spoofed with lasers to hear "Unlock the Car" and the positional audio microphone array system will think the command is coming from inside the car.

April 24/25 in Vancouver.
https://secwest.net

16
0
11
0

Remote instance

chaos.social
Open on original server

Media

313k7r1n3
Elektrine

Tor hidden service

elekhj7afj4qnrr4yd3bkzslsyo5jgfxw3orgjkhlcxifueodybyiiad.onion

Platform

  • Email
  • Chat
  • Timeline
  • Communities
  • VPN
  • DNS

Company

  • About
  • Contact
  • FAQ

Legal

  • Terms of Service
  • Privacy Policy
  • Warrant Canary
  • Lite (no JS)
  • VPN Policy
  • Source code

Support

  • support@elektrine.com
  • Report Security Issue
Mail client setup IMAP mail.elektrine.com:993 POP3 mail.elektrine.com:995 SMTP mail.elektrine.com:465
© 2026 Elektrine. All rights reserved. Server: 05:47:05 UTC