francoatmega

Bugs are my own

[Sahil @sahilypatel]

legendary hacker news comments that aged like milk

[francoatmega @francoatmega]

@giovannibassi Pra mim foi bem easy a aprovação, agora tô com medo é de banirem minha conta kkk

[francoatmega @francoatmega]

Fazendo uns testes com REA, primeira vez usando 😁😁😁

[francoatmega @francoatmega]

@ryHanson Great job! Those vulns were discovered with LLM assisted VR?

[Phrack Zine @phrack]

30 years ago today, Phrack 49 published Aleph One’s “Smashing the Stack for Fun and Profit”.

A legendary paper that inspired generations of hackers and helped shape modern exploit development.

Still an essential reading.

https://t.co/qAQ5CWgNj0

Phrack 73 is coming soon!

[francoatmega @francoatmega]

@AndreLajst Eae @jonesmanoel_PE vai aceitar?

[Gabe @fishjar]

安全界至今公认最精妙的零点击漏洞利用链，莫过于 NSO Group 针对 iMessage 发起的 FORCEDENTRY，被 Google Project Zero 评价为他们见过的最复杂的漏洞利用之一。

最离谱的地方，是黑客竟然在一个图片解码器里造出了一台虚拟计算机。

攻击从一条无需用户点击的 iMessage 开始。

附件看起来是 .gif 图片，实际上却是嵌入了 JBIG2 数据的恶意 PDF。

当时 iOS 的图片处理流程会通过 ImageIO 识别文件真实格式，结果这份伪装的 GIF 被送进 CoreGraphics 的 PDF 解码器，触发 JBIG2 解析中的整数溢出，最终获得越界内存读写能力。

JBIG2 原本是上世纪为扫描文档设计的黑白图像压缩标准，支持通过 AND、OR、XOR、XNOR 等逻辑运算组合图像。

攻击者利用这一特性，构造了超过 70,000 条 JBIG2 段命令，硬是在图片解码过程中搭建出一台拥有寄存器、64 位加法器和比较器的虚拟计算机。

它甚至能够搜索内存地址、执行算术运算，为下一阶段的沙箱逃逸做好准备。

而真正的沙箱逃逸，又利用了 Apple 的 NSExpression 反序列化与求值机制。

整个过程不需要用户点击附件，也没有依靠传统的机器码注入或 ROP 链来完成初始攻击。

最可怕的不是图片解码器存在内存漏洞，而是攻击者把原本只用于处理黑白像素的逻辑运算，变成了一台能够执行复杂计算的机器。

这也解释了为什么 FORCEDENTRY 至今仍是零点击漏洞研究中的经典案例。

Google Project Zero 技术复盘：
https://t.co/vBM0IO4jGz

[Ricardo Albuquerque @ralbuque]

"sshole" (CVE-2026-123158): OpenSSH anterior à 10.6p2 em Linux com musl (Alpine) sem PAM permite login em contas sem senha. Exploração começou em menos de 9h após a divulgação. Usa sshd em imagens Alpine? Atualize para 10.6p2.

https://t.co/1FLIgpBD7Y

[francoatmega @francoatmega]

@unclebobmartin I have the same feeling, but I still want to do the old way, learn the Language just in case I don’t have agents available, or to keep me pushing forward to learn something. But to be language specialist I think don’t make sense anymore, unless you’re onde of the language creator

[francoatmega @francoatmega]

@FlavioBolsonaro “Chega de frescura e mimimi, vão ficar chorando até quando?”

Jair Bolsonaro

[francoatmega @francoatmega]

Assim, perdi um pouco o tesão de programar depois das IAs generativas, mas o ganho de produtividade nem se compara, já automatizei tanta coisa com o Claude for Chrome e com os schedules…

#mopaz

[francoatmega @francoatmega]

A ideologia acima de qualquer senso de raciocínio 🤡

[JUAUM @jjuaumsccp]

“Ah, o Irã mata LGBTs. É verdade, enforca pessoas gays, lésbicas, mas existem boates, bares e tal em Teerã, por exemplo.”

- Manoel, Jones

[francoatmega @francoatmega]

@republiqueBRA Que criemos um projeto para criminalizar o comunismo igual na Polônia 🙌🏻

[francoatmega @francoatmega]

@AndreLajst Não esperava menos vindo de um comunista declarado em busca da revolução brasileira, que fique claro as palavras do dito cujo: “Eu defendo todas as formas de resistência do povo palestino” ou seja mesmo que isso inclua estupros a mulheres.

[francoatmega @francoatmega]

@FelipeTadewald Manteu

[Michael Koczwara @MichalKoczwara]

Fake recruiters, fake interviews, malicious coding tasks. DPRK has been doing this for years.

What exactly was “highly sophisticated” about that?

You say you blocked 57 suspected DPRK-linked attempts. You clearly knew the threat very well, yet a developer still ran a malicious interview assignment on a work laptop 🙈

Your developers, security teams, and everyone with access to sensitive systems should know how DPRK operates, recognize these tactics, and build security around that threat.

This has been publicly documented for years 🤦

1. Unit 42 — Hacking Employers and Seeking Employment
https://t.co/zVnlfgi2Af

2. Unit 42 — DPRK Threat Actors Lure Tech Industry Job Seekers
https://t.co/In4QJyOz4E

3. Securonix — Analysis of DEV#POPPER
https://t.co/h0nlKZBspM

4. Securonix — DEV#POPPER Research Update
https://t.co/6I6nP9wk5L

5. Datadog — Tenacious Pungsan
https://t.co/RqMWWgcwam

6. SentinelOne — macOS FlexibleFerret
https://t.co/IrqmXPmX9y

7. SentinelOne — Contagious Interview: Plans and Operations
https://t.co/TYPZKnjeeh

8. ESET — DeceptiveDevelopment Targets Freelance Developers
https://t.co/TDFW1gOdVi

9. ESET — From Primitive Crypto Theft to Sophisticated AI-Based Deception
https://t.co/hP4cd7SWFD

10. Sekoia — From Contagious to ClickFake Interview
https://t.co/Ie4xYq7bo1

11. Silent Push — Contagious Interview Front Companies
https://t.co/iAxg3554L7

12. Socket — 35 New Malicious npm Packages
https://t.co/rFmyCQ760N

13. Socket — Contagious Interview Spreads Across Five Ecosystems
https://t.co/dxrueQs9I4

14. Cisco Talos — Famous Chollima Deploying PylangGhost
https://t.co/jEghwB9gxp

15. Fireblocks — Disrupting a Recruiting Impersonation Scam
https://t.co/p6BywzFt1t

16. Kudelski Security — How DPRK’s Contagious Interview Campaign Targets Developers
https://t.co/0lKEfWqGWt

17. Microsoft — Malware Delivered Through Fake Developer Job Interviews
https://t.co/Z4dzadWhUi

18. Microsoft — Dissecting Sapphire Sleet’s macOS Intrusion
https://t.co/rKAWNO7pfM

19. FBI — North Korea Aggressively Targeting the Crypto Industry
https://t.co/nnBDXkXDyE

20. Joint Government Advisory — WaterPlum / Contagious Interview
https://t.co/4VEV3aaBit

[Proton @ProtonPrivacy]

Hey everyone, we have heard your concerns about Proton’s AI strategy and culture and after internal discussions, we want to share a few things with you.

First, Proton does not install tracking software on employees' laptops to measure how much AI-generated code they produce. This rumor stemmed from a misunderstanding about how MDM software works, and it's not true.

Second, our use of AI will never be at the expense of security. In the past year, contrary to what has been alleged, additional layers of security review have been added to meet the threat posed by hostile AIs scanning Proton's open-source code for vulnerabilities. Our code is open source, and its security remains open for all to verify.

We want to prove this to you, so in the interest of transparency, we will lift the hood on how we use AI internally at Proton. This includes publicly releasing and open sourcing several of the internal tools that we use, including more advanced versions of Lumo with greater capabilities, which have never been made available outside of the company.

We will also publish how code reviews and security reviews at Proton are done, and detail our AI policies, including where AI is permitted, and where it is not, and our rationale. Instead of just being able to see the final open-source code that we produce to verify security, you will also be able to assess how that code was produced.

Lastly, we are not re-interviewing our staff about AI usage, and there are no job losses due to AI re-interviews.

You can hold us to these commitments. We're aware that we haven't lived up to the high standard you ought to hold us to, and for that we can only apologize, we are sorry.

[Heni Ozi Cukier @hoc111]

O MAIOR ROUBO DA HISTÓRIA

Ontem, hackers norte-coreanos invadiram a maior corretora de criptomoedas do mundo, a Binance, e roubaram mais de US$ 6 bilhões!

A ditadura de Kim tem um largo histórico de roubos como esse. O recorde anterior também pertencia aos hackers do país.

Essa atividade é uma das principais fontes de receita norte-coreana e boa parte desse dinheiro deve ser destinado pro arsenal nuclear do país.

[Cleide @TentoniCleide]

Fanatismo!