Hiç kimse

[Hiç kimse @electrocode]

In this world of crime, there are no longer any rules.

[Zoe @zoecyber001]

If an attacker parks outside your building with a $1,500 software-defined radio, a 5G smartphone will still drop its connection, connect to a fake 1991-era GSM tower, and hand over its permanent hardware identity in cleartext.

Every modern baseband modem still carries legacy 2G silicon for backward compatibility, and that 2G stack has no way to verify if a cell tower is real.

1. The architectural flaw: One-way tower trust

In 4G (LTE) and 5G, mobile networks enforce mutual authentication after the initial attach.

When your phone connects to an LTE tower, the network sends a random cryptographic challenge (RAND) alongside an Authentication Token (AUTN). Inside your SIM card, a secure processor checks that token against a 128-bit secret root key (K) burned in at the factory. If the tower cannot prove it shares that key with your carrier, the baseband drops the connection before any voice or text data flows.

In 2G (GSM), that check only runs in one direction.

When GSM was standardized in 1991, commercial software-defined radios did not exist. The protocol was built so the tower authenticates the SIM card to stop billing fraud, while the SIM card never authenticates the tower.

A 2G baseband processor will connect to any transmitter broadcasting a valid Mobile Country Code and a stronger signal (RXLev) than the surrounding towers.

2. How rogue base stations force the downgrade

Because a rogue tower cannot forge a 4G cryptographic signature, it forces the phone's baseband to abandon 4G and 5G entirely.

An attacker using an Ettus USRP B210 and a 10-watt RF power amplifier triggers this fallback in two ways:

* Selective RF jamming: The radio floods local 4G and 5G downlink frequencies with noise while leaving a 2G GSM frequency clean. When the phone loses its LTE signal, the baseband's cell reselection state machine scans all supported bands and locks onto the attacker's clean 2G beacon.
* Protocol downgrade injection: The attacker broadcasts a rogue LTE signal just long enough to catch the phone's tracking area update, then replies with an unauthenticated Tracking Area Update Reject (EMM Cause #7: EPS services not allowed) or an RRCConnectionRelease redirecting the modem straight to a 2G frequency.

The baseband assumes you walked into a dead zone and switches to 2G in about 10 seconds without prompting the user.

3. Identity theft, A5/0, and the SMS relay catch

Once the phone camps on the rogue 2G station, the attacker sends a standard Identity Request packet. The phone replies in cleartext with its 15-digit International Mobile Subscriber Identity (IMSI) and its hardware IMEI.

Next comes encryption. Normal 2G traffic uses the 64-bit A5/1 stream cipher, which can already be cracked in seconds using 2TB Kraken rainbow tables. Worse, the 3GPP specification (TS 44.018) requires every phone to obey a Ciphering Mode Command set to A5/0 (null cipher).

When the rogue tower sends A5/0, the phone turns off air-interface encryption completely. Any outgoing SMS or call from the victim's phone travels to the attacker's laptop as unencrypted GSM 7-bit bytes.

To intercept incoming two-factor SMS codes from a bank, the attacker has to go one step further. Because a rogue SDR in a car is not wired into your real carrier's core network, the bank's SMS won't route to the attacker's laptop automatically. Either the attacker uses a second radio to relay your phone's handshake back to the real carrier's 2G tower and cracks the A5/1 downlink key, or they simply jam 4G so your phone drops onto the real carrier's 2G tower and passively crack the A5/1 air traffic in Wireshark.

4. The modern defense: Cutting legacy silicon

You cannot patch a 1991 radio handshake without breaking backward compatibility, so OS vendors finally gave users a kill switch for the baseband:

* Android 12+ 2G kill switch: Android added the setAllowedNetworkTypesForReason API to the Radio Interface Layer (RIL). Turning off "Allow 2G" instructs the modem firmware to disable its GSM stack at the silicon level. If 4G is jammed, the phone stays in "No Service" instead of dropping to 2G.
* Android 14 & 15 null-cipher locks: Android 14 added a modem toggle to reject A5/0 null-cipher connections outright on supported hardware, and Android 15 added live system alerts whenever a tower requests an unencrypted connection or cleartext IMSI.
* iOS Lockdown Mode: Turning on Lockdown Mode disables the 2G baseband stack on iPhones.
* 5G Standalone (5G SA) SUCI: Even on 4G LTE, a phone still sends its IMSI in cleartext during the very first attach request before encryption starts. Pure 5G Standalone fixes this last gap: the SIM card uses ECIES public-key cryptography to encrypt your IMSI into a Subscription Concealed Identifier (SUCI) before a single packet leaves the antenna.

[Hiç kimse @electrocode]

Greetings from the depths of the darkness, and crazy hacks! ❤️‍🔥❤️‍🔥❤️‍🔥

[Hiç kimse @electrocode]

Bence Türkiye finansal açıdan riskleri öngörüp olası küresel internet kesikliği olduğu an kendi kaynakları ile sorunların üstesinden gelebilecek yapıyı organize edip tedbir almalı.

[The Hormuz Letter @HormuzLetter]

BREAKING: Iran has drawn up detailed plans to attack the 7 major undersea Internet cables in the Gulf as soon as the US and Israel attack it again, per two senior Iranian officials to Reuters.

Iran says it would aim to prevent repairs after any attack to prolong the disruption to communications and internet connections.

"If Iran is attacked, there will be no more red lines, from undersea cables to military bases, including covert ones." The official warned US not to "play with fire," saying Iran has full access to the cables and could easily destroy them.

More than 99% of international data traffic travels through undersea cables. Iran warned this month that US-linked data centres and AI facilities across the Gulf will also be targeted.

[Hiç kimse @electrocode]

@emrahsaritas @GarantiBBVA Diyelimki birileri sahte imza ile paranızı çekmeye gidiyor ve çekiyor üstüne çektikten sonra dolandırıcıları bulamayıp bununla bağlantılı kişiler diyorsunuz, bu işlemi yapan kişiler yakalandı mı ? Neden kesin kanıt olmadan itham ediyorsunuz maksadınız nedir, Diye sordular mı hiç?

[National Crime Agency (NCA) @NCA_UK]

Five men who were part of a gang who circumvented border checks by hiding people in lorries to transport them to France were found guilty of people smuggling, following an investigation by the NCA.

Read the full story ➡️ https://t.co/KHeRE1drzk

[The Insider @InsiderEng]

Uninvited guest: How a GRU spy connected to state hackers broke into the African Union’s diplomatic residence in Ethiopia

A video version of @Dobrokhotov and @michaeldweiss’ latest investigation.

[Hiç kimse @electrocode]

🔥🔥🔥

[NSA/CSS @NSAGov]

Cisco Systems are used worldwide within infrastructure networks and include various password protection types. Brush up on Cisco password best practices to learn which types to use and avoid to better secure NSS and DIB networks against malicious actors. https://t.co/heqT9KtleU
#CybersecurityAwarenessMonth

[The Hacker News @TheHackersNews]

🚨 Hackers breached enterprise firewalls and VPNs worldwide in a campaign linked to k0t.

Over 70,000 exposed credentials identified.

Fortinet and Palo Alto devices targeted. Persistent access established. Data exfiltrated.

Inside the attack chain and suspected ransomware links: https://t.co/j7v6zQ4ZTj

[International Cyber Digest @IntCyberDigest]

‼️ Palo Alto firewall VMs and Citrix NetScaler run without ASLR, a basic memory defence, Kevin Beaumont says.

He warns that makes the PHP2Shell flaws trivial to exploit through internet-facing management interfaces.

Neither has a patch out. Citrix promises one on 27 October.

[Watcher.Guru @WatcherGuru]

JUST IN: 🇦🇪 UAE-led operation tracks over $39 billion in fraudulent funds and crypto assets, leading to more than 960 arrests.

[International Cyber Digest @IntCyberDigest]

❗️ A Miami crypto broker has been arrested and charged with conspiring to launder drug money for a Russian network.

The DEA says a leaked ledger lists 37 deals worth ~$1.5M under his alias.

His Telegram bio advertised "EXCHANGE USDT 🇺🇸 MIAMI", complete with business hours.

[Robert Morton @Robert4787]

Two CIA agents end up dead in Mexico, and now a former top law enforcement official faces treason charges. Here's the frightening part: when cartel money corrupts people on the inside, American spies may not know who's protecting them and who's setting them up. #CIA #Espionage #NationalSecurity

https://t.co/JUhsXORTfK

[CTI Updates @CTI__Updates]

the Patched hacking forum has been offline for an entire month. They have finally released a statement as to why.

"On September 23, a Russian drone strike on telecommunications facilities in Ukraine damaged the data center hosting our servers. We later learned that the data center holding our backups had also been damaged. Our servers and backups were with two separate hosting providers, but the attack did not affect just one provider; several hosting companies in the region were impacted.

We kept backups in three places: two separate physical devices and one cloud storage service. According to our providers, the drives are in good condition and are waiting in the queue to be copied. Thousands of drives are being recovered, which is why the process has taken so long."

[Hiç kimse @electrocode]

Gecenin sorusu; Matematiksel olarak veya savaş vb anormal sebepler nedeniyle Dünya'da tüm ülkelerin ekonomisinin çökeceğini teknik olarak bilseydin ne yapardın ?

[Coin Bureau @coinbureau]

BREAKING: Asia’s stock market wiped out nearly $1,000,000,000,000 across six major markets today.

Everyone's calling it a "Black Thursday."

[Ron Masas @RonMasas]

Liked PHP2Shell? You’re gonna love Node2Shell.

We reproduced CVE-2026-111497 as pre-auth RCE. On a vulnerable Node.js runtime, app.use(express.json()) is enough to expose your server to code execution through a single Brotli request. Patch your systems now!

https://t.co/NLluyUopEi

[Narcodiario @narcodiario]

500.000 euros en efectivo, armas y #cocaína . Cae la red corrupta de ESTIBADORES que colaba droga por el puerto de #Algeciras
https://t.co/485OyvsE2t

[V12 @v12sec]

V12 found 25 vulnerabilities in the x402 protocol.

Critical findings included:
- Requests approved without any payment
- Maliciously high requests being paid by default
- Session takeover from relayed login signatures

Here's how. 🧵