I am so tired of all of the long blog posts of the form ‘I like the idea of magical AI things and I don’t understand why {some product with an integrated bullshit generator} doesn’t just do {thing that is either impossible without using something totally different to any current GenAI approaches or is possible but would be laughably easy to attack and would be worse than useless} and then it would be so much more useful!’

These machines are not magic. They are not thinking, they are not reasoning. They will generate token streams that have high probability based on their training data of following the input (prompts plus any other tokens you stream them). That’s it. This can be useful. They can quite quickly produce not-totally-wrong translations, for example, because their training sets include a load of things in two languages. They can produce code that solves minor variations on problems that have been solved hundreds of times before. There are probably other useful things (ethics of large-scale copyright infringement during training and ludicrous energy use aside).

The thing that really annoys me is that there are a load of more useful things that both rule-based and machine-learning systems could do and don’t. I’d love to have something that would suggest Sieve rules based on how I’ve manually filed email, for example. This is simple statistical correlation. It’s not even that hard. I haven’t seen a system that has done it. Yet people keep trying to use LLMs for live filtering instead (which is a terrible idea because avoiding prompt injection is almost impossible).

as is tradition, I just published my commentary on this year's Verizon Data Breach Investigations Report (aka #DBIR): https://kellyshortridge.com/blog/posts/shortridge-makes-sense-of-verizon-dbir-2025/

In the post, I include the following sections covering what I felt were the most notable insights and facets in the report:

🌍 So, what?

💃 Espionage: fast fashion or couture?

👻 APTs go BWAA-haha >:3

💸 How do the money crimes generate money?

🤖 Attackers are still not really using GenAI

👩‍🍳 If you can’t make your own 0day, store-bought creds are fine

🔓 #Security was the real supply chain threat all along

🍄 Things Rot Apart

🕵‍ Scooby Doo's Spooky Kooky Corporate IT Caper

🌈 At least some things are improving somewhere

Go forth and enjoy my commentary, and then make sure to find me at #RSAC to tell me what you loved or hated Tuesday 14:30 at the @fastlydevs booth (where you'll also get a free copy of my book ✨)

thanks @alexcpsec for the early copy <3

Trailing dot in Cygwin filenames https://openwall.com/lists/oss-security/2025/04/25/5
"foo" and "foo." are equivalent in DOS. This carried forward into contemporary Windows cmd.exe, explorer.exe (File Explorer), the usual file access APIs. But Cygwin actually creates a file with the dot.

A phrase I've been repeating a lot on vendor calls, regarding prevention vs. detection:

I want to win; I don't just want to know why we lost.

lol, more reason to hate Synology if you needed some - they threatened to sue Linus Sebastian if he *mentioned* a hack to put Synology OS onto other hardware https://www.youtube.com/watch?v=H1COU0ZpLQU

Parser Differentials have become pretty much my favorite bug class over the last years.

I am absolutely honored to get the chance to present on this topic at OffensiveCon in a few weeks.

https://www.offensivecon.org/speakers/2025/joernchen.html

Let's get this #nakeddiefriday started, people!

The guest of today is one TMS70C42A by TI. It is a 8-bit MCU carrying 4KB of ROM and 256B of RAM, with three timers and a UART.

This particular die was bit by gremlins, and a small part of it is missing; nothing crucial though. Let's have a walk around. 🧵

SiPron page: https://siliconpr0n.org/archive/doku.php?id=infosecdj:ti:tms70c42a

#electronics #reverseengineering #microscopy

With bluesky (mostly) going down for a few hours today, I got to wondering about how decentralized the fediverse really is in terms of where its servers are hosted. I grabbed a server list from fedidb, with network information coming from ipinfo.io .

[EDIT: I did a better analysis on a dataset of 10x as many servers, see https://discuss.systems/@ricci/114400324446169152 ]

These stats are by the number of *servers* not the number of *users* (maybe I'll run those stats later).

fedidb currently tracks 2,650 servers of various types (Mastodon, pixelfed, lemmy, misskey, peertube, etc)

The fediverse is most vulnerable to disruptions at CloudFlare: 24% of Fediverse servers are behind it. Also note that this means that I don't have real data on where this 24% are located or hosted, since CloudFlare obscures this by design.

Beyond CloudFlare, the fediverse is not too concentrated on any one network. The most popular host, Hertzner, only hosts 14% of fediverse servers, and it falls off fast from there.

Here are the top networks where fediverse servers are hosted:

504 Cloudflare, Inc.
356 Hetzner Online GmbH
130 DigitalOcean, LLC
114 OVH SAS
56 netcup GmbH
55 Amazon.com, Inc.
55 Akamai Connected Cloud
36 Contabo GmbH
33 SAKURA Internet Inc.
32 The Constant Company, LLC
31 Xserver Inc.
28 SCALEWAY S.A.S.
24 Google LLC
23 Oracle Corporation
16 GMO Internet Group, Inc.
14 IONOS SE
14 FranTech Solutions
11 Hostinger International Limited
10 Nubes, LLC

Half of fediverse servers are on networks that host 50 or fewer servers - that's pretty good for resiliency.

There is even more diversity when it comes to BGP prefixes, which is good for resiliency: for example, the cloud providers that have multiple availability zones will generally have them on different prefixes, so this gets closer to giving us a picture of the specific bits of infrastructure the fediverse relies on.

The top BGP prefixes:

55 104.21.48.0/20
50 104.21.16.0/20
48 104.21.64.0/20
41 104.21.32.0/20
41 104.21.0.0/20
38 104.21.80.0/20
32 172.67.128.0/20
31 172.67.144.0/20
28 172.67.208.0/20
28 162.43.0.0/17
27 104.26.0.0/20
26 172.67.192.0/20
26 172.67.176.0/20
23 172.67.160.0/20
19 116.203.0.0/16
17 172.67.64.0/20
17 159.69.0.0/16
16 65.109.0.0/16
14 88.99.0.0/16
14 49.13.0.0/16
13 78.46.0.0/15
13 167.235.0.0/16
13 138.201.0.0/16
11 95.217.0.0/16
11 95.216.0.0/16
11 49.12.0.0/16
11 135.181.0.0/16
10 37.27.0.0/16
10 157.90.0.0/16

75% of fediverse servers are behind BGP prefixes that host 10 or fewer servers, meaning that the fediverse is *very* resilient to large network outages.

Top countries where fediverse servers are hosted:

871 United States
439 Germany
156 France
148 Japan
75 Finland
57 Canada
49 Netherlands
38 United Kingdom
26 Switzerland
26 South Korea
21 Spain
19 Sweden
18 Austria
17 Australia
15 Russia
12 Czech Republic
10 Singapore
10 Italy

And finally, a map of the locations of fediverse servers:
https://ipinfo.io/tools/map/91960023-e8c6-4bee-9b07-721f2c8febab

📅 Mark your calendars!

https://www.hexacon.fr/

Remember the "You wouldn't steal a car" PSA? Turns out they pirated both the font AND the music. Exhibits:

font info: https://fontsinuse.com/uses/67480/piracy-it-s-a-crime-psa

pirated font embedded in this PDF: https://web.archive.org/web/20051223202935/http://www.piracyisacrime.com:80/press/pdfs/150605_8PP_brochure.pdf

and about the music: https://www.theransomnote.com/music/news/antipiracy-advert-music-was-stolen/

EDIT: more context re the composer, music, and royalties; the story is ofc more nuanced and apparently debunked: https://torrentfreak.com/sorry-the-you-wouldnt-steal-a-car-anti-piracy-ad-wasnt-pirated-170625/

#piracy #fonts #irony #hipocrisy #design #music #hashtag #download

🐣 CRACKME RESULTS are OUT! 💥

Congrats to rt_saber for being so quick.

Kudos to all those who hammered CloudFlare hard.

https://github.com/phrackzine/crackme/blob/main/easter-2025/teaser-challenge-solution.md

Another header bypass, this time a Citrix NetScaler nasty:

https://attackerkb.com/topics/7zebEgmGLs/cve-2024-6235

#threatintel, #netscaler

A few quick notes on the Erlang OTP SSHd RCE (CVE-2025-32433):

1. Cisco confirmed that ConfD and NSO products are affected (ports 830, 2022, and 2024 versus 22)

2. Signatures looking for clear-text channel open and exec calls will miss exploits that deliver the same payloads after the key exchange.

3. If you find a machine in your environment and can't disable the service, running the exploit with the payload `ssh:stop().` will shut down the SSH service temporarily.

https://www.runzero.com/blog/erlang-otp-ssh/