Tim (Wadhwa-)Brown

Thank you for calling The Void. All our operators are cursed right now but please hold the line and leave your scream after the tone.

Also:

• https://infosec.exchange/@timb_machine/116914235375705991
• https://infosec.exchange/@timb_machine/115567791797424014

(not exactly a fan...)

Interesting Git repos of the week:

Strategy:

• https://github.com/mr-r3b00t/ai_usage_mitre_analysis - AI abuse through an ATT&CK lens with @UK_Daniel_Card@infosec.exchange 🤖

Detection:

• https://github.com/citizenlab/bluecoat-investigations investigating Blue Coat device breaches with @citizenlab@mastodon.social
• https://github.com/andreicscs/HoneyWire - F/OSS deception

Bugs:

• https://github.com/sgkdev/ipv6_frag_escape - another Linux LPE

Exploitation:

• https://github.com/x86byte/Obfusk8 - obfuscation library
• https://github.com/bee-san/RustScan - a port scanner in Rust
• https://github.com/t0thkr1s/gpp-decrypt - dumping GPP cpassword
• https://github.com/kernelstub/Nox - attack surface management in Go
• https://github.com/JVBotelho/skewrun - abusing time in AD
• https://github.com/db0109/AI-Red-Team-Scripts-And-Checklist - tips and tricks for red teaming AI 🤖
• https://github.com/jonaslykkegaard9-ops/m - remapping Windows memory

Hard hacks:

• https://github.com/pinkflawd/MIPSReverseEngineeringWorkshop - @pinkflawd@mastodon.social's MIPS training

Nerd:

• https://github.com/ripienaar/free-for-dev - free hosting for developers 🤖
• https://github.com/dockur/macos - OS X in Docker

#code, #security.#research

Interesting links of the week:

Strategy:

• https://ecs-org.eu/policy/nis2-directive-transposition-tracker/ - following along at home with NIS2 enactment
• https://mr-r3b00t.github.io/org_cyber_attack_sim/ - what does it really feel life to defend, @UK_Daniel_Card@infosec.exchange has built a sim to find out

Standards:

• https://www.w3.org/TR/security-disclosure/ - @w3c@w3c.social weighs in on disclosure

Threats:

• https://anuragbhatia.com/post/2026/06/telegram-bgp-hijack-and-blackholing/ - some reporting on a BGP hijack of Telegram

Detection:

• https://www.huntress.com/blog/ldap-active-directory-detection-part-six - more from @huntress@infosec.exchange on LDAP detection
• https://tradecraftgarden.org/ - from the people that brought you Cobalt Strike
• https://nesbitt.io/2026/06/26/incident-report-cve-2026-lgtm.html - incident satire from @andrewnez@mastodon.social
• https://blog.sentry.security/log-curation-101/ - a subject after my own heart, useful logs...
• https://www.deathcon.wales/ - here be dragons

Bugs:

• https://askar.so/blogs/chaining-isc-dhcp-server-features-for-unauthenticated-root-remote-code-execution/ - poppin' DHCP
• https://pop.argus-systems.ai/advisory/adv-040.html - OpenBSD is too open 🤖

Data:

• https://intheweights.com/ - which models are you in? 🤖

Nerd:

• https://fediverse.info/explore/people - people of the Fediverse
• https://fedidb.com/welcome - find your perfect Fediverse platform

#security, #research

Interesting Git repos of the week:

Detection:

• https://github.com/hasamba/DFIR-Companion - incident support 🤖
• https://github.com/GyulyVGC/sniffnet - that packer smells kinda funny 👃

Bugs:

• https://github.com/0xHossam/UnCanny - the bullying of NTLM must stop!
• https://github.com/prdgmshift/usbliter8 - A12/A14 SecureROM exploit
• https://github.com/rub-softsec/onelogon - stealing AD creds via Netlogon
• https://github.com/bikini/exploitarium - fresh bugs today

Exploitation:

• https://github.com/MazX0p/LACUNA-Chain - build your own stack and profit
• https://github.com/Shac0x/Wonka - like picking LSASS's wallet for tickets
• https://github.com/netinvent/windows_tools - there's a snake coming through the window
• https://github.com/mitre/grid-watch - MITRE's CTID lab for OT 🤖

Hard hacks:

• https://github.com/datalocaltmp/Peepo - @datalocaltmp@infosec.exchange's primitive attacks on watchOS 🤖
• https://github.com/hacefresko/forticrack_v8 - unpack that Fortinet firmware

Data:

• https://github.com/idaholab/raven - tools for risk modeling

Development:

• https://github.com/uellenberg/Insert - you wanna write self modifying code? how about a language where it's a first class feature?

Nerd:

• https://github.com/maestro-os/maestro - a Linux-like kernel in Rust

#security, #research, #code

For all the AI hype, I'm absolutely fascinated to see more bug content that focusses on the mass of internal, commercial, compiled code that runs businesses. Most of the disclosures thus far appear to be for open source, where we should assume the models know the code, have seen the bug reports and have access to the patches but that's really not the reality of "interesting" enterprise software.

Interesting links of the week:

Strategy:

* https://cset.georgetown.edu/article/chinas-pla-challenges-and-competitions/ - analysing .cn PLA strategy
* https://ccdcoe.org/news/2026/locked-shields-2026-united-the-power-of-41-nations-to-defend-cyberspace/ - Locked Shield 2026 reporting
* https://www.homeaffairs.gov.au/about-us/our-portfolios/cyber-security/cyber-incident-review-board - post-incident review is necessary, ya galah
* https://dukesecurity.ai/incidents - SEC disclosed incidents
* https://www.theguardian.com/world/2026/may/07/revealed-russia-top-secret-spy-school-hacking-western-electoral-interference - how .ru trains their spies on fiddling with elections
* https://arxiv.org/abs/2509.00462 - AI, stealing all the jobs
* https://arxiv.org/abs/2604.01637 - but first they need job specs
* https://www.ncsc.gov.uk/guidance/guidance-on-digital-forensics-protective-monitoring - NCSC guidance on DFIR and protective monitoring
* https://blog.mozilla.org/en/privacy-security/ai-security-zero-day-vulnerabilities/ - thought piece from Mozilla on Mythos
* https://www.aisi.gov.uk/blog/our-evaluation-of-openais-gpt-5-5-cyber-capabilities - UK AI Security Institute review of GPT 5.5
* https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/ - behind the Mythos curtain with Mozilla
* https://uktl.org.uk/news-events/uktl-ncsc-and-ericsson-strengthen-the-security-of-uk-mobile-networks/ - improving UK telco security

Threats:

* https://www.trendmicro.com/en_us/research/26/d/inside-shadow-earth-053.html - Trend write up on .cn attacks in Asia
* https://www.rtl-sdr.com/student-arrested-in-taiwan-for-using-sdr-and-handheld-radios-to-halt-four-high-speed-trains-with-tetra-hack/comment-page-221/ - TETRA abuse in the wild
* https://home.s2grupo.es/hubfs/Informe%20LAB52-%20EasterBunny_Complete.pdf - new reporting on APT29
* https://i.blackhat.com/Asia-26/Presentations/AS26-Ishimaru-Tropic-Trooper-Reloaded-REV01.pdf - reporting on Tropic Trooper from BlackHat Asia 2026
* https://www.catonetworks.com/blog/global-campaign-discovered-with-modbus-plcs-targeted/ - attacks on CNI intensify

Detection:

* https://righteousit.com/2026/03/27/linux-forensic-scenario/ - @hal_pomeranz@infosec.exchange's Linux investigation (there are a number of follow on posts)

Bugs:

* https://retr0.zip/blog/cve-2026-31431-copy-fail.html - more on copy.fail
* https://seclists.org/oss-sec/2026/q2/332 - winning a race with Rust
* https://aisle.com/blog/aisle-discovers-cve-2026-42511-a-21-year-old-freebsd-remote-command-execution-vulnerability#the-vulnerability - more on the FreeBSD dhclient whoopsie
* https://copy.golf/ - copy.fail.golf
* https://visit.suspect.network/reversing-adventures/inadvertent-injections - accidentally injecting shells

Exploitation:

* https://fuzzinglabs.com/exploring-nvidia-linux-drivers-internals-basics-ioctls/ - exploring NVIDIA's LKM attack surface
* https://www.blackhillsinfosec.com/the-p-in-pam-is-for-persistence-linux-persistence-technique/ - @blackhillsinfosec@infosec.exchange discuss persisting in PAM
* https://www.group-ib.com/blog/pluggable-authentication-module/ - why PAM matters
* https://blog.trailofbits.com/2026/05/05/c/c-checklist-challenges-solved/ - solutions to @trailofbits@infosec.exchange's C challenges
* https://ipurple.team/2026/05/04/cross-session-activation/ - cross session lateral moment in Windows with @netbiosX@infosec.exchange
* https://heyitsas.im/posts/drinking-llms/ - bug hunting the Linux kernel with LLMs
* https://www.incendium.rocks/posts/Fuzzing-MS-RPC-structures-and-monitoring/ - fuzzing Microsoft RPC

Hard hacks:

* https://labs.taszk.io/articles/post/tapocalypse/ - TP-Link whoppers
* https://tantosec.com/blog/2026/04/route-to-root-in-4g-industrial-router/ - hacking a 4G router

Hardening:

* https://jan.wildeboer.net/2026/05/PSA-CopyFail-CVE-2026-31431/ - @jwildeboer@social.wildeboer.net's approach to beating copy.fail
* https://www.secwest.net/copyfail-mitigation - more on copy.fail mitigations

Nerd:

* https://tekin.co.uk/2025/09/the-ruby-community-has-a-dhh-problem - be mindful of who you mix with
* https://di.day/en - declare your independence

#security, #research

Interesting Git repos of the week:

Strategy:

* https://github.com/center-for-threat-informed-defense/attack-flow - mapping ATT&CK flows

Detection:

* https://github.com/timb-machine-mirrors/ddamenova-IRQL.md - KQL for IR
* https://github.com/ridgelinecyberdefence/vanguard - Go toolkit for IR
* https://github.com/SharonBrizinov/Holy-Grail-PCAP - new food for Packet Monkey
* https://github.com/Nextron-Labs/surface-watch - @cyb3rops@infosec.exchange's code to keep an eye on the front door
* https://github.com/keydet89/RegRipper3.0 - @keydet89@infosec.exchange's seminal IR toolkit in Perl

Bugs:

* https://github.com/V4bel/dirtyfrag - more Linux sadness

Exploitation:

* https://github.com/azqzazq1/SunnyDayBPF - imagine that, a kernel that lies
* https://github.com/BlackSnufkin/LitterBox - red teamer's sandbox
* https://github.com/L1v1ng0ffTh3L4N/EdgeSavedPasswordsDumper - dump Edge passwords from memory
* https://github.com/her3ticAVI/PAMSkeletonKey - a skeleton key for PAM
* https://github.com/segmentati0nf4ult/linux-pam-backdoor - an earlier version of the same code
* https://github.com/Kudaes/Puzzle - abusing Windows minifilters
* https://github.com/diemoeve/oxide - a new C2 framework
* https://github.com/TwoSevenOneT/DefenderWrite - enumerate AV whitelisted executables for LPE with @TwoSevenOneT@infosec.exchange

Hardening:

* https://github.com/wgnet/wg.copyfail.patch - a nice little eBPF patch for copy.fail
* https://github.com/atgreen/block-copyfail - another eBPF approach to copy.fail from @atgreen@hachyderm.io 🤖

#security, #research, #code

Citations are nice. Thank you anon.

Long old week but 5 happy customers, two commuting to renewals makes it all worthwhile. I shall sleep well tonight.

Provided genuine and nuanced feedback on AI slop on AI slop. Comments all deleted and article published. That'll teach me to spend time making suggestions to improve an article.

Stumbled into a channel where everyone is replacing themselves with their AI pets and well, if you're the kind that needs an agent to do anything then no wonder you're having trouble installing an agent...

The statement "lies, lies and statistics" could have been written by an AI, and now thanks to LLM, it will be.

Congratulations to Canonical on poor life choices:

https://seclists.org/oss-sec/2026/q2/332

#threatintel, #non-GNUcoreutils