Threat Hunting, Android, Hacking, Rust, Old Hacker

Somewhere over the rainbow 🌈
Joined October 2009
Toto retweeted
Galaxy S26 Ultra: untrusted_app → root. Introducing "Infinity Core": 6 vulns in the Linux kernel's core subsystems. Their impact spans Linux server LPE, container escape, and Android LPE. Details: github.com/V4bel/InfinityCor…
18
104
6
838
51,957
Samsung: libimagecodec.quram.so Heap Buffer Overflow in DNG Uncompressed Tile Decoding (QuramDngReadImage::readUncompressed) project-zero.issues.chromium…
5
44
5,289
Toto retweeted
Gliff will give you access to all your remote Omarchy boxes from a single app with tabs per server that streams over SSH using GPU acceleration. Incredibly useful! Will be part of RS 4.5 🤘 github.com/omacom/gliff
120
94
17
2,116
90,542
The Phrack 73 prophile of @halvarflake A must-read from one of the legends of vulnerability research. archives.phrack.org/dl/73/ha…
3
74
2
298
19,330
Toto retweeted
I've never worked on WhatsApp before, so I thought it'd be interesting to poke it with a stick! I wrote an article about my attempt to uncover WhatsApp's CVE-2026-23866: numb3rs.re/posts/cve-2026-23… This is my first article on mobile VR, let me know what you think!
3
54
2
254
19,781
Your weekend reading assignment has arrived early. A first taste of the upcoming, still-under-wraps Phrack 73: “THE PROXY THAT MADE NO SENSE” by @mikko. archives.phrack.org/dl/73/th…
2
56
3
162
31,267
New issues of @phrack have arrived just in time for the conference!!
14
130
5,743
Sneak peek 👀 👀 👀 👀 Coming soon from your friends at Phrack!
4
42
2
213
7,732
Toto retweeted
Today we published WeWorm, the first zero-click worm to spread through WeChat calls across iOS and Android. We call you on WeChat and, without you answering or doing anything, take over your account within seconds. Then we use your phone to call your friends. Story and demos: calif.io/research/weworm
10
99
18
390
95,258
FalconFlank : Crowdstrike Falcon 0day LPE is now public github.com/MSNightmare/Falco…
90
501
78
2,904
366,676
10 years ago, I sent an initial version of #Landlock: lore.kernel.org/all/14721211… The design evolved significantly from the initial RFC to extend seccomp, through this eBPF version, to the final one in 2021 simplified and tailored for unprivileged sandboxing: landlock.io
1
1
14
1,094
/e/ is a highly problematic fork of LineageOS very poor privacy and atrocious security. People would be far better off using standard LineageOS one of the better supported devices. An iPhone is far more private and drastically more secure than Murena products. /e/ lacks crucial standard privacy and security patches. It has many months and even years of delays to provide those. Nearly all the devices they support lack most Linux kernel, driver and firmware updates. They don't keep up with those for any devices. They don't keep up with Android, Chromium or Linux security updates anywhere either. Many severe patched privacy and security vulnerabilities are left wide open for months and even years with /e/. They heavily mislead their users about what's patched and how long they take to ship it. /e/ also doesn't provide important standard privacy or security protections. It lags years behind on providing the current generation protections and disables many of the most important ones. An operating system failing to protect against known privacy weaknesses does not have reasonable privacy. /e/ includes their own privacy invasive services and sends user data to third parties. They spent years sending user speech data to OpenAI without obtaining consent and falsely claimed the data was anonymized when challenged over it. Despite how it's marketed, it includes many Google services with privileged integration into the OS. They have their own privacy invasive services including user tracking with unique identifiers in their update client. Their own supposed privacy features are incredibly flawed and do not provide what they claim. A small list of blocked domains omitting everything used for useful functionality does not stop tracking by apps or services. It leaves the most privacy invasive behavior of apps and services intact and is trivially bypassed in multiple ways even for what it does cover. Apps and services only need to use the same domains for functionality as tracking to avoid it which is already largely what they do. Apps and services also already widely deploy bypasses for this naive domain-based filtering even for domains dedicated to tracking. /e/ would have you believe that a DNS blocklist is a game changing approach. There are better implementations including RethinkDNS available for use elsewhere. More information: community.e.foundation/t/voi… codeberg.org/divested-mobile… eylenburg.github.io/android_… discuss.grapheneos.org/d/241… /e/ and their for-profit company Murena have repeatedly pushed anti-privacy talking points from authoritarians claiming devices with strong privacy and security are for criminals and pedophiles. Here are 2 examples where Gaël Duval says that himself about privacy/security hardened devices in general: xitter.cf/GrapheneOS/status/2040… clubic.com/actualite-604786-… /e/ and Murena many of the same anti-privacy talking points as France's current government and national law enforcement. They've aligned themselves with authoritarians in the country where they're based instead of opposing it. There are dozens of examples where they falsely claim GrapheneOS are mainly useful to criminals and mainly used by criminals. That's more extreme than the claims by France's national law enforcement cracking down on secure devices. They've gone so far to align themselves with anti-privacy authoritarians that they're ahead of them. Murena is a for-profit company with the founders and owners of it being the same people who run /e/. /e/ includes for-profit paid Murena services and is built for Murena to sell devices with it. Despite being made for profit, /e/ receives millions of euros in government funding from governments which have spent years cracking down on legitimate privacy products: > The European Union has subsidized us to the tune of several million for this project. projets-libres.org/en/podcas… /e/ makes it far easier to remotely take over devices, violate user privacy from apps and bypass encryption to extract all the data from a device. These are exactly the kinds of devices authoritarians opposed to privacy and security want people to be using. These devices are much less private and drastically less secure than iPhones but are duping people into paying them for it with false marketing. They're regressing privacy and security instead of advancing it.
Gaël Duval is the founder and president of the /e/ foundation along with the CEO of Murena. Duval and his organizations have consistently taken a stance against protecting users from exploits. In this video, he once again claims protecting against exploits is for only useful pedophiles and spies. Translation to English: > There's the attack surface, on that front we're not security specialists here, so I couldn't answer you precisely, but from the discussions I've had, it seems that everything we do reduces attack surface. However, we don't have a "hardened security" approach, we aren't developing a phone for pedo(censored) so they can evade justice. So there aren't difficult things to check if the memory is corrupted, really hardened security stuff that could clearly be useful for executives, in the secret service, or whatever. That's not our goal, our goal is to start from an observation: today our personal data is constantly being plundered and that wouldn't be legal in real life with the mail or the telephone, we want to change that. So we are making you a product that changes that by default for anyone. Transcription in French: > Il y a la surface d'attaque, là pour le coup on est pas des spécialistes de la sécurité, donc je ne pourrais pas te répondre avec précision, mais des discussions que j'ai eu, il semblerait que tout ce qu'on fait, ça réduit la surface d'attaque. Donc oui, probablement ça aide. Par contre, on a pas une approche "sécurité durcie", on développe pas un téléphone pour les pédo(bip) pour qu'ils puissent échapper à la justice. Donc il y a pas des trucs pas possibles pour voir si la mémoire est pas corrompue, des trucs de sécu vraiment durcis qui pourraient être utiles clairement pour des dirigeants, dans les services secrets ou que sais-je. C'est pas notre but, notre but c'est de partir d'un constat, aujourd'hui nos données personnelles sont pillées en permanence et ça serait pas légal dans la vraie vie avec le courrier ou le téléphone, on veut changer ça. Donc on vous fait un produit qui change ça par défaut pour n'importe quelle personne.
1
10
82
3,781
Doing Machine Learning on binary code? We've just open-sourced pcode_graph, a Python library that extracts semantic graphs from binaries to make training Graph Neural Networks easier. Samuel Hangouët introduces it here: blog.quarkslab.com/from-p-co… #GNN #ML #Python #OpenSource
22
67
3,961
Microsoft has failed to properly patch RoguePlanet (CVE-2026-50656), ShieldBreak, a PoC that demonstrates a full bypass to the previous patch is now public. github.com/MSNightmare/Shiel… The PoC works with the latest August 2026 patch
35
338
31
1,756
206,443
Still on my way back from #defcon! Thx to allow me to present ismyphonepwned.com/ and to talk about how it is possible to check quickly a mobile phone for compromission, and to see amazing hackers. Such a great and unique conference! Cc @bertolis24
1
4
183
5 minutes ago, @karpathy just dropped karpathy/jobs! he scraped every job in the US economy (342 occupations from BLS), scored each one's AI exposure 0-10 using an LLM, and visualized it as a treemap. if your whole job happens on a screen you're cooked. average score across all jobs is 5.3/10. software devs: 8-9. roofers: 0-1. medical transcriptionists: 10/10 💀 karpathy.ai/jobs
934
1,701
449
11,933
3,588,962
[1/2] I've designed and coded this funky hacktro for PHRACK magazine Call For Papers! Check out the video version here (remember keep the volume up): youtu.be/Vg6VqqNslDA #phrack #hacktro #pouet
6
7
1
30
6,670