Today is a sad day, we should have been at our yearly favorite @hotelhacker 😢 no 2026 edition unfortunately.
RonnyTNL
- 138 Followers
- 330 Following
- 113 Posts
Rocks the Guitar | Likes Metal | Plays with TCP/IP | Security paranoid | Something with (digital) Privacy | @ronnytnl.bsky.social | @RonnyTNL
yeah right ¯\_(ツ)_/¯
I'd say burn it with fire what say you @wdormann
https://www.theregister.com/2025/09/23/sonicwall_rootkitbooting_firmware_update/
Hi @Apple
What's up with this, my phone is on 18.7 and I can't update my watch because there is iOS 26 pending or so? ¯\_(ツ)_/¯
/cc @wdormann
Why is #NoName57 sending out new DDoS Targets? Not so down at all @GossiTheDog ?
A bot witha.name (@[email protected])
New configuration detected for DDosia. Hosts: * www.regione.basilicata.it * servizicdm.comune.milano.it * www.karriere-polizei-bw.de * www.comune.antey-st-andre.ao.it * bmds.bund.de * www.regione.marche.it * www.rvr.ruhr * www.bkms-system.com * www.bundespolizei.de * www.bochum.de * www.remscheid.de * www.comune.taranto.it * www.gladbeck.de * www.duesseldorf.de * www.comune.aymavilles.ao.it * www.oberhausen.de * www.regione.molise.it * www.municipio.re.it * polizei.sachsen-anhalt.de *
Goed nieuws, Eva is gevonden door de Politie en is OK!
Sinds 5-5-2025 's nachts vermist: Eva, 16 jr. Eva is vertrokken in verwarde toestand (weggelopen) en voor het laatst gezien in Maarsbergen. Eva heeft dringend medicatie nodig! Indien u Eva ziet neem dan contact op met politie Heuvelrug 0900 8844.
Graag delen!!!
You had ONE JOB!
Did they fire the QA team?
Code quality seems to be spiraling downwards lately
Mr. BitternessEdit for those looking for the TL;DR version of this thread:
There are 3 flaws related to vulnerable driver blocking / WDAC:
1) If HVCI is off, then WDAC blocks via file signer that have a FileAttrib qualifier (e.g. all by-signer entries in the MS vulnerable driver blocklist) will not be blocked
2) The driver block list that's pushed to endpoints is not the same list as the public driver blocklist. The on-endpoint blocklist is missing numerous hashes.
3) HVCI systems do not obey the FilePath qualifier for WDAC rules
MSRC has indicated that they don't consider any of these issues to be vulnerabilities, so they will not fix.
----- Original thread as follows -----
I recently deleted a thread here as my tests were not valid. What was wrong? The driver I was using as an example of "blocked via signer" was indeed in the Microsoft recommended driver block rules list for TWO YEARS (It's present in a March 2023 version of the list). Given that the blocklist is updated on Windows endpoints "1-2 times per year", this should be present in the blocklist on a Win11 machine in 2025, right? Get real. It's bugs all the way down. No, I haven't (yet?) investigated which drivers are in the official list online, but are missing on Windows endpoints. But the fact that the first viable-for-testing driver that I chose was NOT in the list on endpoints... let's just say that this isn't a good sniff test.
Anyway, the problem that came to my attention on the Bad Place was that a user complained that that a driver that was expected to be blocked was being allowed to run if HVCI ("Memory integrity") wasn't enabled. This can't be right, can it?
Yes, it's true. The drivers listed in the Microsoft recommended driver block rules list by way of their signing certificate do NOT result in the driver being blocked (via WDAC). So just as a test, I created my own WDAC block list (with App Control Wizard and applying it with ApplyWDAC) for an arbitrary driver.
Let's compare 3 drivers that should be blocked, on a system with HVCI off, and on a system with HVCI on.
- Blocked via Authentihash in the MS vulnerable driver blocklist
- Blocked via Signer Cert in the MS vulnerable driver blocklist
- Blocked via Signer Cert via WDAC manually
If you do not have HVCI enabled, you are likely missing driver blocks that you are supposed to be getting.
@SueNeu
The inability to run extensions (like uMatrix or uBlock Origin) is what's making me abandon Chrome.
While the DuckDuckGo browser is apparently Chromium-based, the Chrome extension store seems to not allow it.
Is there a DuckDuckGo extension store?
Kali LinuxWe are excited to announce the release of Kali Linux 2024.3, available for download and update now!
This release has been focused on multiple transitions, such as GCC 14, glibc 2.40, and Python 3.12. Please check out the blog post for full details.
Kali Linux 2024.3 Release (Multiple transitions) | Kali Linux Blog
With summer coming to an end, so are package migrations, and Kali 2024.3 can now be released. You can now start downloading or upgrading if you have an existing Kali installation. The summary of the changelog since the 2024.2 release from June is: Qualcomm NetHunter Pro Devices - Qualcomm Snapdragon SDM845 SoC now supported New Tools - 11x new tools in your arsenal Our focus has been on a lot of behind the scenes updates and optimizations since the last release.