Jeffrey Verheul

InfoSec / (Cyber)Security | 'Cyber all the things!' |
Former DBA / Data Platform / ITOps |
History | Space | Aviation |
Rotterdam / Delft, NLD

[Jeffrey Verheul @DevJef]

Sounds familiar 😂

[Victor Gevers @0xDUDE]

Today someone asked me what my role is at @GDI_FDN
After I explained what we do he told that I look/sound like Gilfoyle (@MartinStarr) of Silicon Valley. So I found a clip and edited it so it would fit my narrative. But you should watch all the episodes on #SiliconValleyHBO :-)

[lcamtuf @lcamtuf]

I would like to congratulate the organizers of the 2026 Cybersecurity Awareness Month for putting together a truly spectacular event

[BlackRoomSec @blackroomsec]

Everyone get some rest. There is chatter that we haven't seen anything yet. Today was the appetizer. Until Valhalla. HTP ♥️♥️

[INFOSEC F0X 🔥 @infosec_fox]

How it feels to be working in infosec lately 😭

[FBI Cyber Branch @FBICyberBranch]

Today, our partners at the Dutch National Police announced the arrest of one of the alleged leaders of ShinyHunters, a group linked to cyberattacks in the United States, the Netherlands, and around the world.

The Dutch High-Tech Crime Unit arrested the suspect under Dutch law. That's exactly how the "best athlete" model in the new FBI Cyber Strategy is meant to work: the partner with the strongest authority and access leads.

The @FBI is grateful to everyone who has assisted us in the ShinyHunters investigation, especially the Dutch National Police and the industry partners who shared information with us.

[J&L Historical @Jason_R_Burt]

From the muddy fields of Normandy to the pages of history, Dick Winters didn’t just lead Easy Company — he distilled a lifetime of command into 10 timeless principles.

🧵 Dick Winters’ 10 Principles of leadership

[vx-underground @vxunderground]

The fundamental problem with this "hack" is it requires three things being true.

1. An attacker must possess the device
2. An attacker must be able to unlock the cell phone
3. The cell phone must be "rooted", all additional cell phone security already bypassed

In the event all three of these conditions are true, you have far greater issues than someone modifying the PIN on your age verification app or... verify they're an adult using your stuff.

If you want to do this, for whatever reason, using this you can now reset the PIN on your age verification app arbitrarily or give yourself unlimited verifications.

[Paul Moore - Security Consultant  @Paul_Reviews]

Bypassing #EU #AgeVerification using their own infrastructure.

I've ported the Android app logic to a Chrome extension - stripping out the pesky step of handing over biometric data which they can leak... and pass verification instantly.

Step 1: Install the extension
Step 2: Register an identity (just once)
Step 3: Continue using the web as normal

The extension detects the QR code, generates a cryptographically identical payload and tells the verifier I'm over 18, which it "fully trusts".

This isn't a bug... it's a fundamental design flaw they can't solve without irrevocably tying a key to you personally; which then allows tracking/monitoring.

Of course, I could skip the enrolment process entirely and hard-code the credentials into the extension... and the verifier would never know.

[Paul Moore - Security Consultant  @Paul_Reviews]

Hacking the #EU #AgeVerification app in under 2 minutes.

During setup, the app asks you to create a PIN. After entry, the app *encrypts* it and saves it in the shared_prefs directory.

1. It shouldn't be encrypted at all - that's a really poor design.
2. It's not cryptographically tied to the vault which contains the identity data.

So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app.

After choosing a different PIN, the app presents credentials created under the old profile and let's the attacker present them as valid.

Other issues:
1. Rate limiting is an incrementing number in the same config file. Just reset it to 0 and keep trying.
2. "UseBiometricAuth" is a boolean, also in the same file. Set it to false and it just skips that step.

Seriously @vonderleyen - this product will be the catalyst for an enormous breach at some point. It's just a matter of time.

[International Cyber Digest @IntCyberDigest]

‼️🇪🇺 The EU's new Age Verification app was hacked with little to no effort.

When you set it up, the app asks you to create a PIN. But that PIN isn't actually tied to the identity data it's supposed to protect. An attacker can delete a couple of entries from a file on the phone, restart the app, pick a new PIN, and the app happily hands over the original user's verified identity credentials as if nothing happened.

It gets worse. The app's "too many attempts" lockout is just a counter in a text file. Reset it to 0 and keep guessing. The biometric check (face/fingerprint) is a simple on/off switch in the same file. Flip it to off and the app skips it entirely.

[@mikko @mikko]

In security, when you do your job perfectly, nothing happens. And people don't see when nothing happens.

[Hack The Planet 💾 @HackedPlanet]

Happy Zero Cool Day! https://t.co/UrU81wJocz

[vx-underground @vxunderground]

https://t.co/tDpKMg1qmk

[Bojan Tunguz @tunguz]

I can finally reveal what I’ve been working on for the past year - CloudDump! It’s an app that allows you to *directly* upload all of your most important personal data into a publicly accessible database. Instead of using intermediate steps with the other apps, you can directly and effortlessly dump all of it yourself!

[Talking Sasquach @TalkingSasquach]

So dark web firmware for the Flipper Zero exists and I have it. Turns out… I’ve been wrong!

[Talking Sasquach @TalkingSasquach]

Rut Roh, looks like we made the news! https://t.co/RqJb1Qb0G3

[vx-underground @vxunderground]

No.

Someone took a bunch of existing leaks, threw it all together, and slapped a NEW stick on it.

[Rachel Tobac @RachelTobac]

Yep now it's happening, @23andMe just filed for bankruptcy and the DNA of 15 million people will be sold to the highest bidder.
There's not many actions users can take now, but I'll add some supposed steps you could take to attempt to protect your privacy below:

[🦆 SchizoDuckie 🦆 @SchizoDuckie]

The world has gone mad.
🇺🇦🫡
https://t.co/noo9KkQWdz

[mRr3b00t @UK_Daniel_Card]

https://t.co/uDClBBH1DA is awesome! that is all! carry on cybering! :)