After a short #EMFCamp induced hiatus, it's back...

First up this weekend is interesting talks from #emfcamp2026:

Threats:

* https://media.ccc.de/v/emf2026-215-1-north-korean-agent-looking-for-a-job - job hunting, .kp style

Exploitation:

* https://media.ccc.de/v/emf2026-93-1-they-forgot-what-happened-last-time - @Rairii's pokes the Redmond beast some more
* https://media.ccc.de/v/emf2026-206-1-breaking-in-to-buildings-with-boobs - a guide to social engineering the physical world

Hard hacks:

* https://media.ccc.de/v/emf2026-57-1-obd-ii-obviously-broken-design-too - getting into ODB-II
* https://savvycan.com/ - CANbus packet parser
* https://media.ccc.de/v/emf2026-56-1-lock-picking-robot - robotic approaches to locks
* https://safetyfic.com/how-to-unlock-tsa007-lock-forgot-combination/ - how to change the code on a TSA combination lock?
* https://www.amazon.co.uk/tsa-key-007-master-luggage/ - want a TSA master key?
* https://lpubelts.com/ - how hard to pick is my lock?
* https://media.ccc.de/v/emf2026-47-1-building-a-tiny-paging-network - build your own pager network with @sammachin

Crypto:

* https://media.ccc.de/v/emf2026-59-1-how-not-to-make-a-random-number-generator - return 42;
* https://en.wikipedia.org/wiki/Euclidean_algorithm - finding the common factor
* https://en.wikipedia.org/wiki/Euler%27s_factorization_method - more on common factors

Data:

* https://media.ccc.de/v/emf2026-88-1-building-a-mostly-local-mildly-judgemental-home-assistant - Mark J Cox takes us on a journey to build your own home assistant 🤖

Nerd:

* https://media.ccc.de/v/emf2026-124-1-infrastructure-review - a review of the EMF Camp 2026 infrastructure
* https://media.ccc.de/v/emf2026-230-1-an-sres-guide-to-camping-in-extreme-conditions - vanlife reliability engineering from @donna_156
* https://phones.emfcamp.org/ - the EMF phone book
* https://media.ccc.de/v/emf2026-46-1-the-orphan-source-incident - more about the 2024 orphan source incident
* https://media.ccc.de/v/emf2026-277-1-reverse-engineering-007-nightfire - updating Nightfire via reverse engineering
* https://media.ccc.de/v/emf2026-100-1-automated-game-hacking - parsing and compiling game logic

#security, #research

Genuinely having a great time reading @tara 's exploration of purpose-built business machines (in the vein of the IBM 5280): https://www.tara.sh/posts/2026/2026-07-24_cobolito400_essay/

Honestly her site is one of my favorite little blogs. There's a fully essay behind the post!

As an industry, I know we're not going back, but it's neat reflecting on how different engineers over the decades have thought about _data_ and data portability as a first-class citizen.

@floyd I did! Although apparently I'm much less anally-fixated than the author (but I do love Breakfast of Champoins) :D

[RSS] Patch In, Exploit Out: How deepsec Reconstructed the Pwn2Own Microsoft Edge Sandbox Escape

http://www.darknavy.org/blog/patch_in_exploit_out_how_deepsec_reconstructed_the_pwn2own_microsoft_edge_sandbox_escape/

Coldcard devices used predictable RNGs, and apparently this has consequences. 😂

I'm pleased to announce a new release of the #idalib #Rust bindings for @HexRaysSA IDA Pro! This release adds compatibility with latest SDK (v9.4), and a couple of bug fixes. Thanks to @raptor and @yegor for their contributions.
https://github.com/idalib-rs/idalib.git

Happy Sys Admin Appreciation Day to all to who observe it.

This made us think

Yet another attack against the Arch User Repository is underway. We are monitoring and analyzing the malware samples.

https://discourse.ifin.network/t/new-aur-attack-prompts-adoption-lock/698

#ThreatIntel #ThreatIntelligence #IFIN

anyone experienced with #outdoor high-speed #ethernet (~150m) cabling and possibly also somewhere half-way injecting solar-based PoE? is this a thing?

[RSS] LLMs won't break symmetric crypto

https://www.bfswa.blog/p/llms-wont-break-symmetric-crypto

Anthropic choosing an asshole as the logo for Claude is the most honest marketing move in recent history.

Somehow, we have ended up in a universe where companies brag about deploying multibillion dollar software systems with an objective to break decades old IT security legislation, and nobody holds their executives to account.
https://www.wired.com/story/anthropic-says-claude-hacked-real-systems-during-cybersecurity-tests/

#VMware: three critical #vulnerabilities in VMware vCenter, ESX, Workstation, and Fusion, allow attackers to bypass authentication, execute arbitrary code, or escape from a virtual machine to the host. Patches released by Broadcom - it's time to patch!
👇
https://www.bleepingcomputer.com/news/security/vmware-fixes-three-critical-flaws-allowing-auth-bypass-vm-escapes/

For the nerds in the back:

Not understanding how your program works is not an excuse for it doing the bad shit it was literally programmed to do.

@codinghorror CEOs often work for minimal wage for tax reasons around here. But even that case is much better than simply asking your billionaire friends to push literal peanuts your way along with a job contract 2 years before you run for office.

Wiz found a master key that could access every database in Azure's Cosmos DB. #cosmosescape

Whoops.

https://nitter.net/yuvalavra/status/2082864672294736324

My present to all of you: Go ahead and think a bit about why such a key even exists. Go ahead...

AI: Considerations for people who make decisions. There is enormous pressure to deploy AI, and if you believe the LinkedIn thought leadership, you'd think that if you don't get on board NOW you'll be lost forever. Meanwhile other people severely detest AI, so much so that it damages their (worthwhile) arguments against it. Below, thoughts on what to do now, and what things might best be postponed. Finally, some stimulating words on what we actually DO at the office: https://berthub.eu/articles/posts/ai-for-decision-makers/

This wonderful wallpaper and the Issue #9 cover were created by Vasyl/Joker^NAH^TRSI. Both this and other wallpapers, as well as Issue #9 which just came out, can be downloaded from Paged Out!'s website!

This feels like kindergarteners making up stories about who fell bigger with their scooters during summer break :P

https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals