Tom Van de Wiele

Offensive R&D Lead • Hacker • Advisor • Speaker
Founder Hacker Minded
|

[Tom Van de Wiele @0xtosh]

The bad guys are running LLMs on public src code and are finding bugs 24/7. The people that wrote the code or that are using the code knowingly or unknowingly for production are still busy having meetings.

[Charlie Miller @0xcharlie]

I’ve been around long enough to remember when source code/binary auditing was how bugs were found. Then there was 20 years where fuzzing was best. Now source code analysis (via LLM) is the jam again.

[Nagli @galnagli]

New "Critical" nginx RCE requires LFI as prereq and has 0 practical exploitation odds - CVEs & CVSS are the biggest slop in security and AI just keeps accelerating it

[Tom Van de Wiele @0xtosh]

New rule: if someone makes you read AI-generated slop text then you *have* to pronounce the emojis out loud.

[Nicolas Krassas @Dinosn]

How I Defeat Passkeys Nearly Every Time in Phishing Assessments https://t.co/B692Xeh552

[Tom Van de Wiele @0xtosh]

Great thread and very relatable to my past Red Team ops: Blue teams seem more interested & concerned with looking good for a test than actually improving processes. Continuous testing helps though. It’s not about the diet, it’s about the lifestyle.

[Mudge @dotMudge]

It was very tight-lipped.

Then it was “go” time.

Everyone freaked out.

Lots of people were more focused on finding out whether it was a drill/exercise or not.

Some went heads down.

[Tom Van de Wiele @0xtosh]

VPNs are the number one privacy tool in a world that is increasingly being surveilled by parties for which we as consumer have no insight and for which there is no due process. When VPNs are outlawed, only outlaws will have privacy.

[European Parliamentary Research Service @EP_EPRS]

Virtual private networks #VPN are increasingly used to bypass online age verification.

Protecting children online is a priority, with new rules being implemented requiring a minimum age for access to some services

Read👉 https://t.co/XKK8ACwgtf

#DSA @EP_Justice @FZarzalejos

[thaddeus e. grugq @thegrugq]

The only cybersecurity barrier that Mythos has lowered is the level of cybersecurity knowledge in the people talking about AI and cybersecurity.

[Bart Preneel @bpreneel1]

As predicted: someone decides that age verification is the best way to protecting children; this starts with mandatory age verification (for everyone!) and ends with banning VPNs and massive blocking. The slippery slope experts have been warning for.

[Tom Van de Wiele @0xtosh]

Someone somewhere is discussing the Hollywood rights for this

[International Cyber Digest @IntCyberDigest]

🖥️🔥 Two inmates at an Ohio prison built a secret hacking operation from behind bars, using computers they were supposed to be recycling, they downloaded and sold porn in return for snacks, built a hacker toolkit with Kali Linux and password crackers, and created fake passes to move freely around the facility.

All from two secret computers they built from recycling scraps and hid in a ceiling...

Marion Correctional Institution in Ohio housed 2,500 inmates.. In 2014, the prison signed a deal with a recycling nonprofit called RET3 to have inmates disassemble old computers for parts.

Inmates Adam Johnston and Scott Spriggs had other plans. Instead of breaking the machines down, they rebuilt two fully functioning computers from the scraps.

Johnston hid the two PCs on plywood boards in the ceiling above a closet in a third-floor training room. He ran cables from the hidden machines directly into the prison's network switch.

To get the computers there, he loaded them onto a hygiene cart alongside soap and shampoo. He wheeled the cart 1,100 feet across the prison, past a corrections officer, through a metal detector, into an elevator, and up three floors.

Once connected, Johnston had full internet access and could remote into the hidden computers from any inmate terminal in the facility. He obtained a staff member's login credentials by shoulder surfing, watching him type his password.

That password hadn't been changed in years. The prison's systems didn't enforce password rotations, in violation of their own policy.

Using the stolen credentials, Johnston accessed DOTS, the state's offender tracking database. He browsed inmate records, searching for a young prisoner serving a long sentence whose identity he could steal.

He found Kyle Patrick. Johnston pulled Patrick's Social Security number and date of birth from the system, bypassing a security filter that was supposed to hide SSNs by simply adjusting the browser's view settings.

Johnston then applied for five credit and debit cards in Patrick's name. He texted his mother from prison using a free online messaging service and had her provide a neighbor's address across the street as the mailing address.

One card, a Visa debit from MetaBank, was approved. His mother received it in the mail, called him at the prison, and read him the card number, expiration date, and activation code over the phone.

Johnston activated the card from inside the prison using the hidden computers. Both the application and the activation were traced back to an Ohio state government IP address.

He wasn't done. Johnston had also pulled up a Bloomberg article detailing how to file fraudulent tax returns and have refunds wired to prepaid debit cards. That was his next move.

The computers were loaded with a full hacker's toolkit: Kali Linux, Wireshark, Nmap, password crackers like Cain and THC Hydra, VPN software, the Tor browser, proxy tools, and encryption software. Investigators also found articles on making homemade drugs, explosives, and fake credit cards.

Johnston used DOTS to create fake passes, giving inmates unauthorized access to restricted areas of the prison. He also downloaded pornography onto thumb drives that another inmate sold to other prisoners for commissary items.

The scheme only unraveled because the prison upgraded its web filtering software. In early July 2015, the new Websense system flagged Canterbury's credentials being used for three straight hours on a Friday, a day Canterbury didn't work.

More alerts followed on Saturday and the following Monday. IT flagged the activity to the warden. Everyone suspected an inmate was involved. Nobody called law enforcement.

The prison's IT specialist, Gene Brady, was told exactly which network port the rogue computer was plugged into. He misread the email and checked port 10 instead of port 16. It took him three days to realize his mistake.

When Brady finally traced the cable into the ceiling and found the two hidden computers on July 27, he brought two inmates along to help and had them pull the computers down, contaminating the crime scene.

He then emailed the warden: "What do you want me to do with the PCs?" The warden admitted he knew illegal activity was occurring but had no answer for why he never reported it to law enforcement.

The state highway patrol trooper assigned to investigate crimes at the prison literally shared an office with the prison's own investigator. Neither one was informed.

It wasn't until August 7, over a month after the first alert, that anyone reported the incident to the Inspector General or law enforcement. And only because an outside IT security officer told them they were required to.

After the discovery, inmates immediately began wiping other prison computers with CCleaner to destroy evidence. Investigators later found the cleaning software had been run at least 10 times in two days, while inmates still had unsupervised access.

Four inmates were transferred to separate prisons and placed in segregation with their phone access blocked. Johnston simply used another inmate's PIN to call his mother five more times anyway.

When investigators finally seized computers across the prison, they pulled 308 machines. Of those, 291 had no inventory tags. Brady had been swapping recycling-bound computers into the prison network for years without documenting any of it.

The investigation uncovered a cascade of failures: no password enforcement, no IT inventory, no crime scene protection, no reporting of illegal activity, and years of unsupervised inmate access to computers, parts, cables, and network infrastructure.

The warden resigned.

[Vaishnavi @_vmlops]

OverTheWire Wargames is where Linux stops being theory and starts becoming muscle memory

One terminal. Endless lessons. Real hacking thinking

https://t.co/IwxILxg9wH

Start with Bandit

[Tom Van de Wiele @0xtosh]

Wanted to continue a project and Claude retroactively deleted the chats of a reverse engineering project I was last working on last month. That will teach me not to use cloud models with moving goal posts for security research & to stick to local models only...

[Tom Van de Wiele @0xtosh]

@corelanc0d3r @bytecodevm Nice one! 👌 Seems we had similar thoughts, as during the lockdown a few years ago I wrote a thing that instruments Bind to host what you want using TXT records + generates the fetch scripts: https://t.co/7zCkCn9Ye8

[eleven red pandas @bytecodevm]

The article shows a proof-of-concept where DOOM is stored across ~2,000 DNS TXT records and executed directly from memory. A PowerShell loader reconstructs the binary via DNS queries, illustrating how DNS can act as a covert payload delivery system.
https://t.co/HyJWYJGqgk

[Tom Van de Wiele @0xtosh]

Seems a LiDAR scan is in progress over Sjælland, Denmark. Probably to measure elevation for flood calculation if it is indeed the Danish Agency for Data Supply and Infrastructure. The LiDAR scans have an accuracy of 5-10 cm.

[Brendan Dolan-Gavitt @moyix]

I agree with folks this who say that this year will be an absolute deluge of CVEs found with AI. But I also worry that it will reveal the limits of the "we'll just fuzz out all the bugs" mindset

[Denis Laskov 🇮🇱 @it4sec]

Remote Code Execution (RCE) in Yamaha synthesizers: an exploit in MIDI files & a hidden backdoor 🎹♫💉👨🏻‍💻🎉

More details on:
LinkedIn: https://t.co/tbjClhHRqq
Substack: https://t.co/R6DLQmGZPX

[Tom Van de Wiele @0xtosh]

Let's see how long this stays up 😅

[hackaday @hackaday]

Open Source Radar Has Up To 20 KM Range https://t.co/DPXyOWCOBH

[Matthew Green @matthew_d_green]

I would liken Tor to putting on Sauron's ring. The wearer is invisible to ordinary beings, like Men, but highly visible to the Nazgûl.

[gabsmashh @gabsmashh]

a SIEM is not a dumping ground for every log your company generates.

if your strategy is “ingest everything so we don’t miss anything,” you have built a data lake instead and your analysts are going to drown in it (pun intended).

[rcegan @rcegann]

Honeypots don't need an expensive product either. Thinkst Canarytokens are largely free and can be integrated into your SIEM with webhooks in minutes.

What's even cheaper is deploying infra into your environment and setting up detection rules to see if they're ever touched. This is dead easy and looks great on pentest reports.