@rene_mobile@infosec.exchange

🇺🇦 @rene_mobile@infosec.exchange · Jul 14, 2026

Why do US media outlets still call it the DoD when the department's own website calls itself Department of War (https://www.war.gov/) Is this trying to downplay the new agenda?

0

2

0

René Mayrhofer

🇺🇦 @rene_mobile@infosec.exchange · Jun 09, 2026

I'm leaving #Google: https://www.mayrhofer.eu.org/post/leaving-google/ While I believe that I have been able to do some good with my continuing (part-time) engagement in the Android security and privacy team since returning to Austria a couple of years ago, the deal with the US #DoW is completely misaligned with my personal ethical principles. I will, therefore, no longer be able to act as a contact point to Google-internal teams and discussions, but will continue our research on private digital identity, end-to-end secure communication and storage, network privacy, (embedded/mobile) operating system security, supply chain transparency, etc. from a purely academic point of view. Android - and in particular AOSP - will remain a research interest, so please feel free to reach out on any of those topics for potential collaborations or discussions on the academic side.

103

2

86

0

René Mayrhofer

🇺🇦 @rene_mobile@infosec.exchange · May 12, 2026

Replying to @rayk@techhub.social

@rayk@techhub.social Nobody "forced" them to release all the details and talk to lots of press about #DirtyFrag. Before the press attention, I hadn't heard about it, and I assume that's true for _many_ others as well. Yes, some party may have leaked parts of the find in some limited groups. That doesn't mean the original finder needs to accelerate the publication manyfold.... Seen from the outside, this process created attention, credit, and marketing, but certainly not more security. I try not to guess people's intentions, but judge mostly by the outcome. And that was bad.

1

0

René Mayrhofer

🇺🇦 @rene_mobile@infosec.exchange · May 10, 2026

Replying to @rayk@techhub.social

@rayk@techhub.social Leaking the bug (potentially to some limited list) is still not the same as leaking the full exploit and making a lot of noise about it. Even it the exploit can be recreated, why make it so easy for everybody to exploit it immediately? Sure, there's always lots of gray in the spectrum of coordinated disclosure. But from what I can see, they didn't seem to try very hard to help people get their systems into a safer state. The bug release page first and foremost points out how easy the exploit it and on how many distributions it works. This is showing off, and not making systems more secure. Yeah, I am not amused.

5

1

5

0

René Mayrhofer

🇺🇦 @rene_mobile@infosec.exchange · May 10, 2026

Releasing a universal #Linux #kernel #exploit with very little or even no previous time to distribute a patch through distributions is not cool. Doing it on the day before a weekend - on two weekends in a row - is just being an asshole. Looking at you, #CopyFail and #DirtyFrag.

You may think it helps your PR, that people will queue to use your cool new AI/agentic/whatever tool because you found the bug. You may think that releasing the full exploit because somebody else was even quicker with "leaking" your cool find makes it right. You're wrong. This is neither responsible nor coordinated disclosure. In security, we've tried to learn the hard lessons on keeping in-production, live systems on a global scale safer.

Yes, those bugs have existed for a long time in the kernel source. Yes, other bad actors may already have found them. But you're shining a light on it *and* giving every script kiddie in the world a working exploit to point their mass scans at. That's dangerous. There's a reason why the normal process is to reach out at least to the most widely installed distributions before releasing the bug details publicly. There's a reason why 90 days is a good default - it allows downstream percolation of patches. You can still get the credit. This way, you only create stress for admins.

[For a little relief, refer to https://www.tomshardware.com/tech-industry/cyber-security/dirty-frag-exploit-gets-root-on-most-linux-machines-since-2017-no-patches-available-no-warning-given-copy-fail-like-vulnerability-had-its-embargo-broken for a quick mitigation, because updating kernels and rebooting a fleet of hosts just takes time, weekend or not. #HugOps]

infosec.exchange

Infosec Exchange

72

7

65

0

René Mayrhofer

🇺🇦 @rene_mobile@infosec.exchange · May 03, 2026

Replying to @ilumium@eupolicy.social

@ilumium @signalapp These are all bandaids and it becomes a cat-and-mouse game with phishers. What would really help (at least for organizations of any size with an admin staff or person) is federated account management. Accounts should be linked to, e.g., an internal LDAP directory or a family group. Everybody inside this org is marked green, everybody outside is different. People from other orgs that have been marked trusted get their own indicators. Individual outside accounts should be marked trusted when the owner is personally known (that's a manual step). Random accounts, however, should be clearly marked as untrusted. Wire does a bit of that. That is, allow list trusted accounts, don't try to block list bad ones.

0

1

0

René Mayrhofer

🇺🇦 @rene_mobile@infosec.exchange · Apr 23, 2026

We have opened a job posting for a (maximum 6 years) post-doc position at JKU Linz (@jkulinz@mastodon.social) in networks and security: https://karriere.jku.at/hcm/jobexchange/showJobOfferDetail.do?jobOfferId=8a7ec1e69cf609ed019d24e15bd17c6e&j=&languageChanged=true

If you'd like to work with us on timely topics like digital identity (very much including EUDI), embedded system security (including Android), software supply chain security (fixing your future xz and trivy dependencies), and/or the related underlying methods and technologies, please feel free to reach out!

9

0

25

0

René Mayrhofer

🇺🇦 @rene_mobile@infosec.exchange · Apr 22, 2026

Replying to @gannimo@infosec.exchange

@gannimo@infosec.exchange Battery life on the AMD 13 (pre-Pro) is not good, also because of s2idle. I like the machine generally, but battery life is bugging me. Not sure of the Intel variant is any better.

1

0

René Mayrhofer

🇺🇦 @rene_mobile@infosec.exchange · Apr 17, 2026

RE: @EUCommission@ec.social-network.europa.eu

Unfortunately, this is not ready.

The current GitHub repository is a start - a (fairly expensive) prototype (https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/issues). Before any wider rollout, however, this needs to:
* stabilize in its feature set (e.g., which form of app/device attestation);
* be verified in detail by independent audits - the quick checks done by some security/privacy researchers and developers at the moment do *not* replace a systematic code audit; and
* go through interoperability testing with different age credential providers (the Python demo code is certainly not production-ready)
as a minimum bar.

Of all the different approaches being discussed right now for age assurance (see our open letter at https://csa-scientist-open-letter.org/ageverif-Feb2026), this is the least-bad from a privacy and surveillance point of view. It's one of the few directions that might be acceptable in any shape or form - *if the general political decision is to do this at all* (see the letter for counter arguments that still need to be debated). But rushing it won't help. The privacy and security aspects are nuanced, and hard to get right in apps that should be deployed on a wide variety of Hundreds of Millions of smartphones. Let's settle these important details before announcing it as a "solution".

ec.social-network.europa.eu

European Commission: "It is for parents to raise their children. Not pl…" - European Commission on M

14

1

21

0

René Mayrhofer

🇺🇦 @rene_mobile@infosec.exchange · Apr 14, 2026

New blog post on why I think that GenAI/LLM coding agents use for finding vulnerabilities and generating PoC code to demonstrate exploitability is going to be painful, but most probably a good thing in the mid term: https://www.ins.jku.at/blog/vulnerability-reports-and-llms/

(Energy consumption and other resource usage is still a problem of those types of LLMs, though!)

5

0

4

0

René Mayrhofer

🇺🇦 @rene_mobile@infosec.exchange · Apr 14, 2026

Last Saturday, I was honored and delighted to give the keynote at Grazer Linuxtage #GLT26, a large #Linux event with a lot of history (23 years and counting!) and still a dedicated team behind it.

Title: "What can we learn from Android for other embedded Linux systems security?"

Slides are available at https://pretalx.linuxtage.at/glt26/talk/J8GCHE/, talk recording at https://media.ccc.de/v/glt26-615-what-can-we-learn-from-android-for-other-embedded-linux-systems-security

15

1

10

0

René Mayrhofer

🇺🇦 @rene_mobile@infosec.exchange · Apr 03, 2026

RE: @metin@graphics.social

For anybody (still) using #LinkedIn on a regular basis (and I understand that there are reasons for it), you may want to do that with #Firefox for the moment. At least the extensions scanning seems to be done only on Chrome browsers according to https://browsergate.eu/how-it-works/, even if all the other profiling is probably browser agnostic.

I personally take this as an opportunity to ignore that platform completely for the time being. My account will remain as a defense against identity theft, but is fully dormant as of now.

20

0

16

0

René Mayrhofer

🇺🇦 @rene_mobile@infosec.exchange · Mar 24, 2026

I just learned that a new release of the decentralized, open source Android (and iOS, but that requires a centralized Apple service) key attestation library warden-supreme has landed. It explicitly supports alternative/custom roots of trust for the attestation chain now and comes with a test for @GrapheneOS@grapheneos.social keys: https://github.com/a-sit-plus/warden-supreme/blob/development/serverside/roboto/src/test/kotlin/GrapheneOsTests.kt

Nice! That's a good match to our academic research direction on digital identity (https://digidow.eu) - avoiding points of centralization for better resilience (against many types of threats). We'll most probably use this for our prototype Android apps that require or benefit from key attestation guarantees and can't/shouldn't use Play Integrity (e.g., because they only communicate over Tor hidden services with each other, and having a Warden backend included on one side is much easier than coming up with a form of mixnet proxy service for querying central instances while retaining an unlinkability guarantee).

grapheneos.social

GrapheneOS (@GrapheneOS@grapheneos.social) - GrapheneOS Mastodon

14

0

11

1

René Mayrhofer

🇺🇦 @rene_mobile@infosec.exchange · Mar 01, 2026

The democratic, liberal, dependable USA that I have known and respected for most of my adult life is dead and will not be revived even after the orange clown stops pretending to be king. It cannot, because the concept of the USA in the world outside its own borders very much depended on soft power, which requires trust. That trust is gone, completely, and probably irrevocably for at least a generation.

It saddens me deeply that all the value, all the good that this long-term stability and trust brought to the USA and the world at large is gone as well. My only hope is that others will accept the responsibility and step up to become the new center of trust in international relations. The EU has the potential for that, but not (yet?) the political will to transcend national interests and rhetoric. China has the economic and military potential, but doesn't share the liberal values (yet?). The world is going to change.

10

1

9

0

René Mayrhofer

🇺🇦 @rene_mobile@infosec.exchange · Feb 04, 2026

Replying to @webi18n@w3c.social

@webi18n@w3c.social @ Most US and UK companies: please read this!

2

0

René Mayrhofer

🇺🇦 @rene_mobile@infosec.exchange · Dec 30, 2025

Replying to @phoenix_r_d@mastodon.social

@phoenix_r_d Is it possible to get an invite to test it even if I'm not at CCC? 🙏 @airmessenger

1

0

René Mayrhofer

🇺🇦 @rene_mobile@infosec.exchange · Apr 23, 2025

Replying to @rnbwdsh@chaos.social

@rnbwdsh@chaos.social User agent strings seem to be intentionally misleading. Some examples I see: "Mozilla/5.0 (X11; U; Linux armv7l; en-GB; rv:1.9.2.3pre) Gecko/20100723 Firefox/3.6.11", "Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.99 Safari/533.4", "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/418 (KHTML, like Gecko) Safari/417.9.2", Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.134 Safari/534.16", "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b6pre) Gecko/20100903 Firefox/4.0b6pre", etc. That's part of why I am calling them out as illegal, malicious DDoS.

0

René Mayrhofer

🇺🇦 @rene_mobile@infosec.exchange · Apr 21, 2025

Replying to @gunstick@mastodon.opencloud.lu

@gunstick@mastodon.opencloud.lu I am using Quixotic right now instead of Nepenthes (because it was easier to get to run in my setup and seems quite a bit more efficient). Not sure if Anubis or Checkpoint work without Javascript support - I am trying to keep my (static) webpage completely usable without client-side code execution so far. If a site doesn't have the constraint, they will probably work very well...

1

0

René Mayrhofer

🇺🇦 @rene_mobile@infosec.exchange · Apr 21, 2025

Replying to @rene_mobile@infosec.exchange

I declare partial success with much more aggressive connection, request, and transfer rate throttling in the embedded #nginx instance that serves my static page (plus the dynamic link maze that caught the stupid "AI" scraper bots...) behind #traefik (causing the TLS termination part to be overloaded and blocking authenticated users from legitimate access). https://www.mayrhofer.eu.org/post/defenses-against-abusive-ai-scrapers/nginx-default.conf is the current rate limiting config, https://www.mayrhofer.eu.org/post/defenses-against-abusive-ai-scrapers has the explanations. Something like https://blog.lrvt.de/configuring-crowdsec-with-traefik/ will probably have to be the next level of escalation to deal with the issue on a global level.

3

0

1

0

René Mayrhofer

🇺🇦 @rene_mobile@infosec.exchange · Apr 20, 2025

I have been trying for hours to debug what I thought was a #Treafik regression causing massive CPU usage to the point that my own (very small) dockerized services I host for my family are getting slow and hard to reach.

But no, my meager virtual server is just being DDoSed by stupid #AI bots downloading pieces of my webpage over and over and over again. It looks like the steps described in https://www.mayrhofer.eu.org/post/defenses-against-abusive-ai-scrapers/ are no longer working, and I need to start looking into actual IP blocking. However, as AI fraudsters are resorting to using massive client pools for downloading, that will also become difficult.

This is new. The AI scraper bots amounting to over 90% of all traffic until a couple of weeks ago were annoying, but my services still worked. Now it has reached the level of active denial of service.

16

8

14

0

René Mayrhofer

🇺🇦 @rene_mobile@infosec.exchange · Apr 20, 2025

#Trump, #Musk, #Putin, #Netanjahu, #Erdoğan, #Orban, #LePenn, and #Kickl are #populist #fascists. There, I said it publicly.

Many more western politicians have clear fascist, illiberal tendencies, including previous #FPÖVP chancellors and current governors (Austrian #federalism does not work any more and needs to be severely limited to get back to a functioning government).

[https://www.derstandard.at/story/3000000021253/was-kickl-als-volkskanzler-bedeuten-wuerde is a good summary of some reasonable criteria for spotting #fascism, and https://www.diepresse.com/19301692/haben-wir-es-den-faschisten-zu-leicht-gemacht gives more insight into the Austrian variant. https://www.aaup.org/news/professors-are-not-enemy-fascists-are%C2%A0 gives links to the current US government fight against academia.]

The result of this toot is probably that I _really_ shouldn't be traveling to the #US, #Israel, or #Turkey with their current governments. Luckily, I still dare write such statements publicly in Austria and the wider EU. If I really have to get into political trouble, then let it be because I denounce fascism and oppose the abuse of technology to build surveillance states driven by fear. I will not fight with violence, but I can and will fight it with words.

infosec.exchange

Infosec Exchange

16

0

12

0

René Mayrhofer

🇺🇦 @rene_mobile@infosec.exchange · Jul 04, 2023

Today, two open letters from academics on the scientific arguments against the current #CSS (client side scanning) initiatives have been released:

* The first (in English, internationally coordinated) one is online at https://tinyurl.com/CSAScientistsLetter and still open for additional signatures.

* The second (in German, by #Austrian academics) one is online at https://www.ins.jku.at/chatcontrol/ and explicitly includes law experts in addition to the arguments from a security, privacy, and AI perspective.

This debate is expected to gain new steam with #Spain taking over the EU council presidency, given recently leaked statements like "Ideally, in our view, it would be desirable to legislatively prevent EU-based service providers from implementing end-to-end encryption" (https://www.wired.co.uk/article/europe-break-encryption-leaked-document-csa-law).

Please boost on any channels you deem adequate. The discussion is still open, and we have little time to bring it to a more rational level.

#csam #law #eu #privacy #dataprotection #privacy #humanrights #messenger #chat #chatcontrol #signal #whatsapp #telegram #threema #e2ee

58

4

89

0

René Mayrhofer

🇺🇦 @rene_mobile@infosec.exchange · Apr 27, 2023

Replying to @ilumium@eupolicy.social

@ilumium@eupolicy.social The Nitrokey article is wrong or at least inaccurate on many levels. Given the many other open, interesting topics for current smartphone security, this is pretty much a non-event. @nitrokey@social.nitrokey.com @Fairphone@social.weho.st @ilumium@eupolicy.social

0

1

0

René Mayrhofer 🇺🇦

Posts

Infosec Exchange

European Commission: "It is for parents to raise their children. Not pl…" - European Commission on M

GrapheneOS (@GrapheneOS@grapheneos.social) - GrapheneOS Mastodon

Infosec Exchange

Remote instance