Paul van Ramesdonk

DFIR | guitars | valve amps and music | Opinions are my own

[Paul van Ramesdonk @van_Ramesdonk]

@BarneySimon Wednesday - Zac Schulze Gang

[Ryan Naraine @ryanaraine]

Good lord 🤮

[Paul van Ramesdonk @van_Ramesdonk]

@infosec_fox Apologies I unplugged the internet briefly…. I need to use the vacuum cleaner and didn’t have a free plug socket. Car mats are at least clean now.

[Paul van Ramesdonk @van_Ramesdonk]

@AnotherOutlaw @BarneySimon After the Rory Gallagher festival in Ballyshannon over the weekend I am probably about 75% Irish of that 75% is 100% Guinness. Haha

[Paul van Ramesdonk @van_Ramesdonk]

Haha. Good sign. This shouldn’t only apply in then. There should be no sweet Caroline ever.

[DFIR Training @DFIRTraining]

Why are there 9,145 subscribers to a "Digital Forensics" channel that sells cracked forensic software?

One of the first questions on the stand for every #DFIR witness should be, "Have you ever used pirated, stolen, hacked, or cracked forensic software?"

[Ricardo @Ric_RTP]

Google is making $62 billion a quarter destroying the websites it NEEDS to survive.

This is literally a death spiral that ends with Google killing itself.

Let me explain what's going on...

Google added AI summaries to the top of every search result in 2024.

When you Google something now, the answer sits right there on Google's page. You never have to click anywhere. Google took the information from someone else's website, summarized it, and kept you inside Google's ecosystem.

The result: 60% of all Google searches now end without a single click to any website.

Small publishers lost 60% of their traffic in one year. Medium publishers lost 47%.

Even the biggest names in media, the New York Times, the Washington Post, Business Insider, all saw traffic fall between 22% and 55%.

The Axios CEO called it "a referral extinction event for the ad-supported web."

Google's response to all of this was to tell publishers they can "opt out" of having their content summarized. But opting out also REMOVES your description from normal search results.

So the choice Google gives you is let us steal your content for free, or become invisible on the internet.

That's extortion.

The Washington Post laid off another round of journalists this year because of it. Stereogum, one of the most respected music publications on the internet, had to BEG readers for donations.

Business Insider cut 21% of its staff. Dozens of smaller publishers have shut down entirely.

The people who actually CREATE the information Google summarizes are going bankrupt while Google posts record revenue.

But here's where this gets interesting and where everyone stops thinking:

Google's AI summaries are only as good as the content they summarize. If the publishers who write the original articles, run the original investigations, and create the original data go out of business, there is nothing left for Google to summarize.

The AI starts recycling old information, the answers get stale, the quality drops, and users start noticing that Google's summaries are increasingly wrong, outdated, or useless.

Google is essentially strip-mining the internet for short-term revenue. They are extracting all the value from content creators without paying for it, driving those creators out of business, and then wondering why the quality of their own product is declining.

This is exactly what Napster did to the music industry in the early 2000s:

Made content free, creators went broke, and quality collapsed. It took a decade to rebuild.

Google is doing the same thing to the entire internet at 100x the scale.

Rolling Stone, Variety, Deadline, The Hollywood Reporter, and Billboard are now suing Google for antitrust violations. Chegg, the education platform, lost 49% of its traffic and is suing too.

The UK's competition authority just ordered Google to let publishers opt out without being punished. The DOJ already ruled Google is an illegal monopoly.

And Google's defense in court is genuinely unbelievable.

They argue that publishers CHOOSE to let Google index their content and can leave anytime they want. That's like saying you choose to pay protection money to the mob because technically you could close your business and move to another city.

Google controls 90% of search. Leaving Google means leaving the internet.

Meanwhile Google is investing billions in custom AI chips to make these summaries cheaper at scale. Every quarter the problem gets worse.

The internet as we've known it for 25 years ran on a simple deal:

Publishers make content.
Google sends traffic.
Advertisers pay for the traffic. Everyone wins.

But Google just BROKE that deal and kept all the money.

[Florian Roth ⚡️ @cyb3rops]

Oh, wow - this is big

[International Cyber Digest @IntCyberDigest]

❗️🚨 Microsoft Edge keeps every saved password in process memory as cleartext from the moment it launches. Microsoft's responsed when reported: "by design."

All of them. Including credentials for sites you won't open this session.

Researcher @L1v1ng0ffTh3L4N tested every major Chromium browser. Edge is the only one that behaves this way.

Chrome decrypts credentials on demand, and App-Bound Encryption locks the keys to an authenticated Chrome process so other processes can't reuse them.

In Chrome, plaintext surfaces only during autofill or when a password is viewed, making memory scraping far less useful.

What makes this extra weird is that Edge still demands re-authentication before revealing those passwords in its Password Manager UI, while the same browser process already holds every one of them in plaintext.

In shared environments, this turns into a credential harvest. On a terminal server, an attacker with admin rights can read the memory of every logged-on user process. In the published PoC video, a compromised admin account lifts stored credentials from two other logged-on (and even disconnected) users with Edge running.

Microsoft's official response when notified: "by design."

The finding was disclosed April 29 at BigBiteOfTech by PaloAltoNtwks Norway, alongside a small educational tool that lets anyone verify the cleartext storage for themselves.

[Sébastien Rolland @Blindevy]

My new blog post is released. It explains in detail how applications (App Registrations, Service Principals, MI) and their permissions really work, why they can introduce several subtle paths for privilege escalation, and presents my open-source tool designed to uncover them.

[International Cyber Digest @IntCyberDigest]

‼️🇪🇺 The EU's new Age Verification app was hacked with little to no effort.

When you set it up, the app asks you to create a PIN. But that PIN isn't actually tied to the identity data it's supposed to protect. An attacker can delete a couple of entries from a file on the phone, restart the app, pick a new PIN, and the app happily hands over the original user's verified identity credentials as if nothing happened.

It gets worse. The app's "too many attempts" lockout is just a counter in a text file. Reset it to 0 and keep guessing. The biometric check (face/fingerprint) is a simple on/off switch in the same file. Flip it to off and the app skips it entirely.

[Paul van Ramesdonk @van_Ramesdonk]

@RussianPanda9xx You were short poured….they wouldn’t get away with that it in Bayern Germany. What beer were you drinking IPA? Or an unfiltered larger or wheat beer?

[Paul van Ramesdonk @van_Ramesdonk]

@BarneySimon I may just have to Ghost you @BarneySimon tsk tsk 🤪

[Alex Jay @AlexJayZA]

Another average day in a music store.
(Sound up 😉)
#ThrowbackThursday

[Paul van Ramesdonk @van_Ramesdonk]

@AlexJayZA @jacarandafm This is brilliant

[Paul van Ramesdonk @van_Ramesdonk]

@BarneySimon Marc Alex 🙌🏻

[Paul van Ramesdonk @van_Ramesdonk]

Phil Campbell RIP

[Paul van Ramesdonk @van_Ramesdonk]

@Rainmaker1973 Nancy or Ann

[Paul van Ramesdonk @van_Ramesdonk]

@AlexJayZA @jacarandafm Schnauzers are the best. Schnoodles are the cutest