InfoSec / (Cyber)Security | 'Cyber all the things!' | Former DBA / Data Platform / ITOps | History | Space | Aviation | Rotterdam / Delft, NLD
Netherlands
Joined April 2011
- Tweets9.6K
- Following1.9K
- Followers491
- Likes46.4K
Jeffrey Verheul retweeted
Everyone get some rest. There is chatter that we haven't seen anything yet. Today was the appetizer. Until Valhalla. HTP ♥️♥️
Jeffrey Verheul retweeted
How it feels to be working in infosec lately 😭
🚨 BREAKING: Microsoft's October 2026 Patch Tuesday is MASSIVE!
Microsoft has fixed a record-breaking 1,411 security vulnerabilities, including 70 critical flaws and 3 zero-days, one of which is actively exploited in attacks.
🔥 317 remote code execution flaws
⚠️ 677 privilege escalation flaws
🛡️ 40 security feature bypass flaws
💻 Time to get patching!
Jeffrey Verheul retweeted
Today, our partners at the Dutch National Police announced the arrest of one of the alleged leaders of ShinyHunters, a group linked to cyberattacks in the United States, the Netherlands, and around the world.
The Dutch High-Tech Crime Unit arrested the suspect under Dutch law. That's exactly how the "best athlete" model in the new FBI Cyber Strategy is meant to work: the partner with the strongest authority and access leads.
The @FBI is grateful to everyone who has assisted us in the ShinyHunters investigation, especially the Dutch National Police and the industry partners who shared information with us.
Jeffrey Verheul retweeted
From the muddy fields of Normandy to the pages of history, Dick Winters didn’t just lead Easy Company — he distilled a lifetime of command into 10 timeless principles.
🧵 Dick Winters’ 10 Principles of leadership
Jeffrey Verheul retweeted
The fundamental problem with this "hack" is it requires three things being true.
1. An attacker must possess the device
2. An attacker must be able to unlock the cell phone
3. The cell phone must be "rooted", all additional cell phone security already bypassed
In the event all three of these conditions are true, you have far greater issues than someone modifying the PIN on your age verification app or... verify they're an adult using your stuff.
If you want to do this, for whatever reason, using this you can now reset the PIN on your age verification app arbitrarily or give yourself unlimited verifications.
Hacking the #EU #AgeVerification app in under 2 minutes.
During setup, the app asks you to create a PIN. After entry, the app *encrypts* it and saves it in the shared_prefs directory.
1. It shouldn't be encrypted at all - that's a really poor design.
2. It's not cryptographically tied to the vault which contains the identity data.
So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app.
After choosing a different PIN, the app presents credentials created under the old profile and let's the attacker present them as valid.
Other issues:
1. Rate limiting is an incrementing number in the same config file. Just reset it to 0 and keep trying.
2. "UseBiometricAuth" is a boolean, also in the same file. Set it to false and it just skips that step.
Seriously @vonderleyen - this product will be the catalyst for an enormous breach at some point. It's just a matter of time.
Jeffrey Verheul retweeted
Bypassing #EU #AgeVerification using their own infrastructure.
I've ported the Android app logic to a Chrome extension - stripping out the pesky step of handing over biometric data which they can leak... and pass verification instantly.
Step 1: Install the extension
Step 2: Register an identity (just once)
Step 3: Continue using the web as normal
The extension detects the QR code, generates a cryptographically identical payload and tells the verifier I'm over 18, which it "fully trusts".
This isn't a bug... it's a fundamental design flaw they can't solve without irrevocably tying a key to you personally; which then allows tracking/monitoring.
Of course, I could skip the enrolment process entirely and hard-code the credentials into the extension... and the verifier would never know.
Hacking the #EU #AgeVerification app in under 2 minutes.
During setup, the app asks you to create a PIN. After entry, the app *encrypts* it and saves it in the shared_prefs directory.
1. It shouldn't be encrypted at all - that's a really poor design.
2. It's not cryptographically tied to the vault which contains the identity data.
So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app.
After choosing a different PIN, the app presents credentials created under the old profile and let's the attacker present them as valid.
Other issues:
1. Rate limiting is an incrementing number in the same config file. Just reset it to 0 and keep trying.
2. "UseBiometricAuth" is a boolean, also in the same file. Set it to false and it just skips that step.
Seriously @vonderleyen - this product will be the catalyst for an enormous breach at some point. It's just a matter of time.
Jeffrey Verheul retweeted
Hacking the #EU #AgeVerification app in under 2 minutes.
During setup, the app asks you to create a PIN. After entry, the app *encrypts* it and saves it in the shared_prefs directory.
1. It shouldn't be encrypted at all - that's a really poor design.
2. It's not cryptographically tied to the vault which contains the identity data.
So, an attacker can simply remove the PinEnc/PinIV values from the shared_prefs file and restart the app.
After choosing a different PIN, the app presents credentials created under the old profile and let's the attacker present them as valid.
Other issues:
1. Rate limiting is an incrementing number in the same config file. Just reset it to 0 and keep trying.
2. "UseBiometricAuth" is a boolean, also in the same file. Set it to false and it just skips that step.
Seriously @vonderleyen - this product will be the catalyst for an enormous breach at some point. It's just a matter of time.
.@vonderleyen "The European #AgeVerification app is technically ready. It respects the highest privacy standards in the world. It's open-source, so anyone can check the code..."
I did. It didn't take long to find what looks like a serious #privacy issue.
The app goes to great lengths to protect the AV data AFTER collection (is_over_18: true is AES-GCM'd); it does so pretty well.
But, the source image used to collect that data is written to disk without encryption and not deleted correctly.
For NFC biometric data:
It pulls DG2 and writes a lossless PNG to the filesystem. It's only deleted on success. If it fails for any reason (user clicks back, scan fails & retries, app crashes etc), the full biometric image remains on the device in cache. This is protected with CE keys at the Android level, but the app makes no attempt to encrypt/protect them.
For selfie pictures:
Different scenario. These images are written to external storage in lossless PNG format, but they're never deleted. Not a cache... long-term storage. These are protected with DE keys at the Android level, but again, the app makes no attempt to encrypt/protect them.
This is akin to taking a picture of your passport/government ID using the camera app and keeping it just in case. You can encrypt data taken from it until you're blue in the face... leaving the original image on disk is crazy & unnecessary.
From a #GDPR standpoint:
Biometric data collected is special category data. If there's no lawful basis to retain it after processing, that's potentially a material breach.
youtube.com/watch?v=4VRRriyD…
Jeffrey Verheul retweeted
‼️🇪🇺 The EU's new Age Verification app was hacked with little to no effort.
When you set it up, the app asks you to create a PIN. But that PIN isn't actually tied to the identity data it's supposed to protect. An attacker can delete a couple of entries from a file on the phone, restart the app, pick a new PIN, and the app happily hands over the original user's verified identity credentials as if nothing happened.
It gets worse. The app's "too many attempts" lockout is just a counter in a text file. Reset it to 0 and keep guessing. The biometric check (face/fingerprint) is a simple on/off switch in the same file. Flip it to off and the app skips it entirely.
Jeffrey Verheul retweeted
I can finally reveal what I’ve been working on for the past year - CloudDump! It’s an app that allows you to *directly* upload all of your most important personal data into a publicly accessible database. Instead of using intermediate steps with the other apps, you can directly and effortlessly dump all of it yourself!
Jeffrey Verheul retweeted
So dark web firmware for the Flipper Zero exists and I have it. Turns out… I’ve been wrong!
Jeffrey Verheul retweeted
Rut Roh, looks like we made the news! san.com/cc/millions-of-cars-…
Jeffrey Verheul retweeted
No.
Someone took a bunch of existing leaks, threw it all together, and slapped a NEW stick on it.
16 billion passwords have been leaked from Apple, Google, Facebook, etc
It is now considered as the largest password leak in history
Readers added context they thought people might want to know
This claim appears to originate from a CyberNews article that doesn't list any sources, and which appears to include AI-written quotes.
Additionally, none of the affected companies have made a statement regarding this leak so far, which further casts doubt on its existence.
cybernews.com/security/billi…
Jeffrey Verheul retweeted
Yep now it's happening, @23andMe just filed for bankruptcy and the DNA of 15 million people will be sold to the highest bidder.
There's not many actions users can take now, but I'll add some supposed steps you could take to attempt to protect your privacy below:
Jeffrey Verheul retweeted
The world has gone mad.
🇺🇦🫡
youtu.be/G6uERvMN_jc
