MrBill // wardrive every day //

Dislike cyber__ terms | @HardHatBrigade | Perpetual Newb | Meyers-Briggs: IDGAF | !Serious Account | ex-Payphone Purveyor | on infosec exchange | views my own

[MrBill // wardrive every day // @SecureThisNow]

A comprehensive look at cryptocurrencies and NFTs, and how it's mostly a scam. 💯

[Dan Olson @FoldableHuman]

Line Goes Up - The Problem With NFTs

https://t.co/cnkdlnZTYL

[@HardHatBrigade @hardhatbrigade]

We are still wrapping up a summary and will be drawing a winner of the WiFi Shuriken by the end of the week, so stay tuned. Thanks!

[NSA Cyber @NSACyber]

Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.

[goldtooth.exe @0xGoldTooth]

Claude Code found spyware on my sister’s phone. It had been tracking her for 11 weeks…

She asked me to check her phone. Someone always seemed to know where she was and she couldn’t figure out how

I plugged it into Claude Code and asked what’s running that she never installed. It walked every app, including the hidden ones, and flagged one disguised as “System Service”, no icon, not on any store

It had been there 11 weeks, logging her location every 2 minutes. Claude pulled the details on whoever was running it:

reports to → +1 (415) *** **72
carrier → T-Mobile US
device id → IMEI 35 ********** 47
last ping it sent → 40.7**, -73.9** · 2 min ago

We saved everything the app had recorded and passed it to the people who do this professionally. Then Claude shut it down and wiped it off her phone

The full step-by-step is below, takes 5 minutes. Save it so you don't lose it, and send it to anyone who might need it

[solst/ICE of Astarte @IceSolst]

I don’t understand? How

[vx-underground @vxunderground]

> be @malwrhunterteam
> on a legendary run on social media
> find silly website
> estrosa-dot-it
> website for italian cosmetics
> legit website, used by the pasta people
> notice something silly on website
> /js/analytics/assets/js/group.html
> look inside
> group.html checks browser agent
> detects iOS version
> loads different files depending on iOS version
> loads 49554fde7424c31c.js
> 49*.js doing lots of crazy stuff
> layers of obfuscation and pointer arithmetic
> lolwtf
> look inside
> exact match of Coruna EK
> Coruna Exploit Kit
> Coruna originally used by US government
> rumored to be made by US contractor
> rumored US contractor illegally sold to kremlin
> UNC6353 (kremlin) found using Coruna in 2025

Chat, someone is swinging the legendary goop around. It is Coruna, the state-sponsored iOS exploit kit. All this requires is your Apple device to visit a website and (assuming you're running the targeted iOS version) you're cooked.

Although, from my initial bonking of it, it appears this delivers two different payloads depending on the iOS version. Unfortunately, I know almost nothing about iOS exploitation and iOS malware, so I have no idea what I'm doing. I encouraged my peers and colleagues to review it. It is good goop.

I've archived the payloads from the compromised domain. The shared link is below.

pic unrelated

[Abraxas3d (in the lab) @abraxas3d]

Really good amateur radio news!

https://t.co/CRroQCpEMk

Successful EVE2026 attempt.

Please follow @radiotelescoop for more information, details, and updates. Congratulations!

@OpenResearchIns helped with communications theory, link budgets, and protocol support.

[colonel panic @_colonel_panic]

10 bux off any assembled device in the https://t.co/X7fC06Baqx store until Halloween.

[Yohan @yohaniddawela]

A 10-year-old satellite built for daylight imaging just started seeing Earth after dark.

ESA switched Sentinel-2A on at night in December 2025. It was a test, not a normal mission mode. Sentinel-2’s multispectral imager usually relies on reflected sunlight, so the instrument is normally switched off when the satellite passes over the dark side of Earth.

This time, ESA left it running.

The targets were carefully chosen: gas flares, bright lights, wildfires, fishing activity and marine activity. The campaign covered selected locations during one full Sentinel-2A cycle, with Level-1B data collected in specialist modes.

The results were better than expected.

Sentinel-2A captured gas flares from oil production in the Middle East. That was the easier part, because flares are bright enough to stand out clearly at night.

Then it picked up subtler signals: a wildfire in India, fishing boats off South Korea, gas flares in Iraq and Qatar, and city lights.

That’s the interesting part. Sentinel-2A launched in 2015 to observe land, coasts, forests, farms and water in daylight. It carries a 13-band multispectral imager, has a 290 km-wide swath, and became one of the core workhorses of Copernicus, Europe’s Earth observation programme.

Now it’s the older sibling.

Sentinel-2B launched in 2017. Sentinel-2C launched in 2024 to take over from Sentinel-2A. Sentinel-2D is still to come. With the newer satellites handling the main operational mission, ESA is using Sentinel-2A’s remaining time in orbit to test ideas for Sentinel-2 Next Generation.

Night imaging is one of those ideas.

The next generation mission is being designed to deliver higher resolution imagery and to image some parts of the planet when the Sun is down. Sentinel-2A is helping ESA work out which signals are useful enough, strong enough and technically realistic enough to build into that future mission.

Gas flares could support emissions monitoring.

Fishing boat lights could help track marine activity, including poorly monitored fishing.

Wildfires could be easier to detect in some night scenes because the background is darker.

City lights could reveal urban expansion, infrastructure growth, electrification, disaster recovery and conflict impacts.

For researchers, the spatial detail is the real prize. Most nighttime lights work relies on sensors such as DMSP, VIIRS and Black Marble. Those datasets are incredibly useful, but they’re much coarser than Sentinel-2.

Sentinel-2 can get down to 10 to 60 metre resolution depending on the band. That opens the door to seeing night activity at the scale of ports, road corridors, settlement edges, mine sites, flare stacks, fishing clusters and fire lines.

There are constraints. This doesn’t turn Sentinel-2 into a full-time night lights mission. Energy use matters. Calibration matters. Signal strength matters. Target selection matters. Processing Level-1B nighttime data also takes specialist care.

But the direction is clear: the old boundary between “daylight optical imagery” and “nighttime activity monitoring” is starting to move.

The data is also opening up. The December 2025 campaign was first limited to expert users through the Copernicus Data Space Ecosystem.

In May 2026, ESA said a consolidated nighttime dataset from the campaign would be made public to all users, expected by the end of Q2 2026... I'm looking forward to this...

[@HardHatBrigade @hardhatbrigade]

Files are still processing, and we may need a day or two to get the final numbers, so be patient!
And BIG THANKS again to you all for joining in the community event. ❤️
#HHB24Wigle #AllTheWifi

[@HardHatBrigade @hardhatbrigade]

That's a wrap!
It will take some time for the queue to clear, so hopefully by tomorrow we will have all the data calculated.
Thanks again to @wiglenet and everyone who participated!
Stay tuned for final scoring and the drawing.
#HHB24Wigle #AllTheWiFi

[@HardHatBrigade @hardhatbrigade]

2 Hours to get everything uploaded!
#HHB24Wigle #AllTheWiFi

[@HardHatBrigade @hardhatbrigade]

@f4r__ @wiglenet We all wait for the queue
We are all equal to the queue
We serve the queue
😁

[@HardHatBrigade @hardhatbrigade]

As we head into the last 4 hours, shout-out to @wiglenet for supporting this and our hobby! Thank them when you see them, buy their merch, and continue to support with good clean uploads!
https://t.co/4xVRH3BLwG
Also: GET YOUR UPLOADS IN BEFORE TIME IS UP! 😁

[@HardHatBrigade @hardhatbrigade]

Seeing some movement on the board and new and old friends joining . ❤️
The queue is chugging along and backing up as expected, so upload when you can!
8 more hours to go!
#HHB24Wigle #AllTheWiFi

[Matt Johansen @mattjay]

🚨 Confirmed. OpenCode hacked. Keys stolen.

Telling customers to revoke.

[Dustin (BusySignal-KE2EFX) @DustinFinn]

@St3v3Wiederrich This is all WiFi RX only.
It’s build for WarDrive and mapping WiFi APs to @wiglenet and this years @hardhatbrigade 24hr WarDrive.

Antenna combiners / LNA / for reduced antennas needed. Lots of similar builds on https://t.co/hhGf9iskDG

[@HardHatBrigade @hardhatbrigade]

The queue is backed up but with 12 hours left the numbers continue to roll in!
Hope everything is going smooth for everyone. Don't forget to take breaks and be safe out there!
#HHB24Wigle #AllTheWiFi

[sudox @kmcnam1]

ROFLLLLL this is painful...

[@HardHatBrigade @hardhatbrigade]

Just over 8 hours in and the numbers are coming in. Reminder that it may take time for the queue to catch up so be patient! Also do not forget to get those uploads in before the cutoff time!!!

[International Cyber Digest @IntCyberDigest]

🚨 BREAKING: A Broadcom Wi-Fi bug lets anyone in range run code on routers without the password.

Quentin Kaiser showed it on Proximus, Orange Belgium and VOO routers and estimates ~1.5M in Belgium are exposed, none patched.

The bug dates to 2010. Broadcom won't assign a CVE.