ρσℓα¢ķ͌͌͌͌͌͌͌͌͌͌͌͌͌

@deviouspolack on infosec dot exchange & bsky • DFIR, threat hunting, red team • reppin’ @defcon562

[Iceman @herrmann1001]

Mind blown 🤯

Some smartphones sold in mainland China (like certain OPPO models) can read MIFARE Classic cards, crack the keys in seconds, store them, and then fully emulate the card directly on the phone.
No extra hardware. Just the phone.
Access control, transit cards, hotel keys… game over.

Huge thanks to Ian for showing me this in person. Really eye-opening how far NFC capabilities have gone in some regions.

Who else has seen this in the wild?

#NFC #MIFARE #TechSecurity​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​ #oppo

[vx-underground @vxunderground]

CVE-2026-31431 a/k/a CopyFail

> Linux LPE
> Description sounds like AI slop
> Exploit is legit
> Impacts every Linux kernel from 2017 - Now
> Proof-of-concept released
> It's Wednesday?

https://t.co/FXgjWW7lOV

[Iceman @herrmann1001]

The latest Proxmark3 release is called BREAKMEIFYOUCAN!

Not a random name.

That is the actual 3DES factory default key NXP burned into every MIFARE Ultralight C they shipped since 2008.

Somebody finally broke it properly.

The paper drops the keyspace from 2^112 down to 2^28.

Counterfeit cards fall in under 60 seconds from a single card interaction. The tooling is merged: https://t.co/2CYKrRdv22

#Proxmark3 #RFID #NFC #MifareUltralightC #NXP #OpenSource

[International Cyber Digest @IntCyberDigest]

🖥️🔥 Two inmates at an Ohio prison built a secret hacking operation from behind bars, using computers they were supposed to be recycling, they downloaded and sold porn in return for snacks, built a hacker toolkit with Kali Linux and password crackers, and created fake passes to move freely around the facility.

All from two secret computers they built from recycling scraps and hid in a ceiling...

Marion Correctional Institution in Ohio housed 2,500 inmates.. In 2014, the prison signed a deal with a recycling nonprofit called RET3 to have inmates disassemble old computers for parts.

Inmates Adam Johnston and Scott Spriggs had other plans. Instead of breaking the machines down, they rebuilt two fully functioning computers from the scraps.

Johnston hid the two PCs on plywood boards in the ceiling above a closet in a third-floor training room. He ran cables from the hidden machines directly into the prison's network switch.

To get the computers there, he loaded them onto a hygiene cart alongside soap and shampoo. He wheeled the cart 1,100 feet across the prison, past a corrections officer, through a metal detector, into an elevator, and up three floors.

Once connected, Johnston had full internet access and could remote into the hidden computers from any inmate terminal in the facility. He obtained a staff member's login credentials by shoulder surfing, watching him type his password.

That password hadn't been changed in years. The prison's systems didn't enforce password rotations, in violation of their own policy.

Using the stolen credentials, Johnston accessed DOTS, the state's offender tracking database. He browsed inmate records, searching for a young prisoner serving a long sentence whose identity he could steal.

He found Kyle Patrick. Johnston pulled Patrick's Social Security number and date of birth from the system, bypassing a security filter that was supposed to hide SSNs by simply adjusting the browser's view settings.

Johnston then applied for five credit and debit cards in Patrick's name. He texted his mother from prison using a free online messaging service and had her provide a neighbor's address across the street as the mailing address.

One card, a Visa debit from MetaBank, was approved. His mother received it in the mail, called him at the prison, and read him the card number, expiration date, and activation code over the phone.

Johnston activated the card from inside the prison using the hidden computers. Both the application and the activation were traced back to an Ohio state government IP address.

He wasn't done. Johnston had also pulled up a Bloomberg article detailing how to file fraudulent tax returns and have refunds wired to prepaid debit cards. That was his next move.

The computers were loaded with a full hacker's toolkit: Kali Linux, Wireshark, Nmap, password crackers like Cain and THC Hydra, VPN software, the Tor browser, proxy tools, and encryption software. Investigators also found articles on making homemade drugs, explosives, and fake credit cards.

Johnston used DOTS to create fake passes, giving inmates unauthorized access to restricted areas of the prison. He also downloaded pornography onto thumb drives that another inmate sold to other prisoners for commissary items.

The scheme only unraveled because the prison upgraded its web filtering software. In early July 2015, the new Websense system flagged Canterbury's credentials being used for three straight hours on a Friday, a day Canterbury didn't work.

More alerts followed on Saturday and the following Monday. IT flagged the activity to the warden. Everyone suspected an inmate was involved. Nobody called law enforcement.

The prison's IT specialist, Gene Brady, was told exactly which network port the rogue computer was plugged into. He misread the email and checked port 10 instead of port 16. It took him three days to realize his mistake.

When Brady finally traced the cable into the ceiling and found the two hidden computers on July 27, he brought two inmates along to help and had them pull the computers down, contaminating the crime scene.

He then emailed the warden: "What do you want me to do with the PCs?" The warden admitted he knew illegal activity was occurring but had no answer for why he never reported it to law enforcement.

The state highway patrol trooper assigned to investigate crimes at the prison literally shared an office with the prison's own investigator. Neither one was informed.

It wasn't until August 7, over a month after the first alert, that anyone reported the incident to the Inspector General or law enforcement. And only because an outside IT security officer told them they were required to.

After the discovery, inmates immediately began wiping other prison computers with CCleaner to destroy evidence. Investigators later found the cleaning software had been run at least 10 times in two days, while inmates still had unsupervised access.

Four inmates were transferred to separate prisons and placed in segregation with their phone access blocked. Johnston simply used another inmate's PIN to call his mother five more times anyway.

When investigators finally seized computers across the prison, they pulled 308 machines. Of those, 291 had no inventory tags. Brady had been swapping recycling-bound computers into the prison network for years without documenting any of it.

The investigation uncovered a cascade of failures: no password enforcement, no IT inventory, no crime scene protection, no reporting of illegal activity, and years of unsupervised inmate access to computers, parts, cables, and network infrastructure.

The warden resigned.

[Luke McOmie / Pyr0 @lmcomie]

CHECK IT OUT!
The main stage speakers for NaClCON have been released, and we are proud to announce that @LeeFelsenstein (Homebrew Computer Club) and @WeldPond (Chris Wysopal) will be our keynotes! Check out all of the amazing speakers via the link below. Our selected Fireside speakers will be released next. Don't miss out, get registered and book your 75% discounted room today!
https://t.co/0ikko9b1rr

#naclcon #historyofhacking #keynotes

[sshell @sshell_]

it’s so funny that every comment on this is a maximally aggressive insult and we’re just in discord laughing and having a good time watching claude brick a phone for fun.

this meme has never felt so accurate LOL

[Count Dankula @CountDankulaTV]

The Afroman Trial.

-Cops raid Afromans house for bullshit reasons.
-Steal money, break his door, fuck his house up.
-No criminality found whatsoever, no charges at all pressed on Afroman.
-Afroman spends the next 3 years making songs that make fun of all the officers involved by name, even using footage of the raid from his own CCTV cameras.
-Songs had titles like "Randy Walters is a son of a bitch" and "Lick Em Low Lisa" accusing one of the officers of being a lesbian and sleeping with the other officers wives.
-During the raid one officer looked like he was about to eat some lemon pound cake sitting on Afromans counter, Afroman made a whole album calling the officer fat.
-The cops get mad and file a lawsuit for defamation.
-Afroman turns up to court in a whole American flag suit.
-Officers performatively mald and cry while listening to the songs really trying to oversell how badly the songs upset them.
-One officer was suing because Afroman made a whole song about him saying he was fucking the officers wife. When the officer was asked if Afroman was really fucking his wife, he said "I don't know". Nuking his own case and establishing that there is a non-zero chance that Afroman might actually be fucking his wife.
-As his only witness for the trial, Afroman brought a deputies EX FUCKING WIFE.
-The jury ruled completely in favour of Afroman.

This entire thing has been a great win for free speech and absolutely fucking hilarious.

[Luke McOmie / Pyr0 @lmcomie]

Celebrating our history and networking with old school Hackers, Fireside Chats, Beach/Boardwalk, Amusement Park, Dive Bars, Pool Party, Concert/DJs, Excellent food, that is exactly what will be going down at https://t.co/Knr5xCxnkr - Get your tickets and 75% discounted rooms now!

[Cannibal 🎃 @Cannibal]

California right now

[CIX 🦾 @cixliv]

Using a mocap suit to kick yourself in the balls with a robot is a great metaphor to close out 2025.

[Dave Jones @eevblog]

IMPORTANT message for everyone using Gmail.
You have been automatically OPTED IN to allow Gmail to access all your private messages & attachments to train AI models.
You have to manually turn off Smart Features in the Setting menu in TWO locations.

Retweet so every is aware.

[Byron Wan @Byron_Wan]

In mid-Sep 2025, Anthropic detected suspicious activity that later investigation determined to be a highly sophisticated espionage campaign conducted by a threat actor assessed with high confidence to be a 🇨🇳 state-sponsored group. The attackers used AI’s “agentic” capabilities to an unprecedented degree — using AI not just as an advisor, but to execute the cyberattacks themselves.

The threat actor manipulated Anthropic’s Claude Code tool into attempting infiltration into roughly 30 global targets and succeeded in a small number of cases. The operation targeted large tech companies, financial institutions, chemical manufacturing companies, and government agencies. This is believed to be the first documented case of a large-scale cyberattack executed without substantial human intervention.

https://t.co/eFkzAfNxZs

https://t.co/SJhbUP8vJj

https://t.co/DwpuZm86hy

[ρσℓα¢ķ͌͌͌͌͌͌͌͌͌͌͌͌͌ @deviouspolack]

on a road trip and found out the state of Utah broadcasts wifi at rest stops, this is the captive portal 😂

[ρσℓα¢ķ͌͌͌͌͌͌͌͌͌͌͌͌͌ @deviouspolack]

@Cannibal i printed some twerkin' ghosts for an upcoming Halloween parteh 👻🍑

[ρσℓα¢ķ͌͌͌͌͌͌͌͌͌͌͌͌͌ @deviouspolack]

@Cannibal i keep that MF'n thing on me. strapped & ready to go 🌶️

[MG @_MG_]

If we are renaming gov entities to be more truthful… oh man do I have some ideas!

But first, I can’t get past the typography on the seal for Department of War… how is this not a crime?

[Phrack Zine @phrack]

Phrack turns 40.
The digital drop is live.
Download it. Archive it. Pass it on.
💾 https://t.co/JbEbf6xoVQ
#phrackat40 #phrack72

[Meshtastic @TheMeshtastic]

At #DEFCON33, #Meshtastic ran its biggest mesh yet—2K+ nodes, thousands of msgs & an unexpected live vulnerability demo. Lessons learned ✅ Big plans for security, identity & UX.

Full recap 👉 https://t.co/T5UB0nVeSK

#Cybersecurity #OpenSource

[chompie @chompie1337]

Tomorrow 7 PM PDT! Livestream w me and @MalwareTechBlog. We’ll look at this month’s Patch Tuesday, dissect a bindiff, and try to turn it into an exploit. I might also try to get him to solve the STILL UNSOLVED Windows Phrack CTF challenge 🤔 https://t.co/WxqFg26avP

[ρσℓα¢ķ͌͌͌͌͌͌͌͌͌͌͌͌͌ @deviouspolack]

@sshell_ @defcon

[ρσℓα¢ķ͌͌͌͌͌͌͌͌͌͌͌͌͌ @deviouspolack]

made a few new sticker designs and brought some from last year, leaving them around @defcon