iiinova — where your digital self keeps evolving

Arrigo Triulzi @cynicalsecurity.bsky.social · 16/09/2026

The fix is to disable the Apple Stupidity daemons with launchctl (exercise left to the reader, no not really… see Alt-text for c&p content ;P ).

UID=$(id -u)

# Disable Apple Intelligence search daemons (user session)
launchctl disable gui/$UID/com.apple.assistantd
launchctl disable gui/$UID/com.apple.assistant_service
launchctl disable gui/$UID/com.apple.assistant_cdmd
launchctl disable gui/$UID/com.apple.siriknowledged
launchctl disable gui/$UID/com.apple.siriinferenced
launchctl disable gui/$UID/com.apple.Siri.agent

# Disable system-wide AI search components (may require sudo)
sudo launchctl disable system/com.apple.contextstored
sudo launchctl disable system/com.apple.modelmanagerd

# Stop the running hybridsearchd process immediately
sudo launchctl bootout gui/$UID/com.apple.hybridsearchd 2>/dev/null || true
sudo pkill -9 hybridsearchd 2>/dev/null || true

031

Arrigo Triulzi @cynicalsecurity.bsky.social · 16/09/2026

Just to show the folly, a couple of images of Activity Monitor...

Activity Monitor output showing the following tasks writing large amounts of data:

hybridsearchd
SetStoreUpdateService
corespotlightd
storagekit

110

Arrigo Triulzi @cynicalsecurity.bsky.social · 16/09/2026

Dear #Apple, Who on Earth came up with the idea of running LLM quantisation of all my data after upgrading to #macOS 27 making it impossible to run anything which needs I/O like Parallels? The machine is floored and, after 24hrs, it is still at 7.1% of the job. Can the adults come back, please?

$plutil -extract SpotlightKnowledgeV2.embeddingGenComplete raw ~/Library/Preferences/com.apple.spotlightknowledge.plist | awk '{printf "%.1f%%\n", $1 * 100}' 7.1%$

260

Arrigo Triulzi @cynicalsecurity.bsky.social · 30/07/2026

If you use WireGuard on FreeBSD you urgently need to patch¹. And I mean urgently. __ ¹ security.freebsd.org/advisories/F...

II. Problem Description

After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step succeeded.
The driver thus silently accepted packets with an invalid Poly1305
authentication tag.

III. Impact

A remote attacker who can send UDP packets to a WireGuard endpoint, and who can guess the bounds of the receiver's replay window, can inject forged or modified transport data packets into the tunnel.

A remote attacker who can intercept WireGuard packets bound for a FreeBSD host can modify the ciphertext and authenticated data without detection by the receiver.

062

Arrigo Triulzi @cynicalsecurity.bsky.social · 24/07/2026

The lyrics of "Spirits in a Material World"¹ by The Police resonate more and more… To think it was the height of the Cold War and we thought it was bad. We had seen nothing :( __ ¹ genius.com/The-police-s...

[Verse 1]
There is no political solution
To our troubled evolution
Have no faith in constitution
There is no bloody revolution

[Chorus]
We are spirits in the material world
Are spirits in the material world
We are spirits in the material world
Are spirits in the material world

[Verse 2]
Our so-called leaders speak
With words, they try to jail you
They subjugate the meek
But it's the rhetoric of failure

[Chorus]
We are spirits in the material world
Are spirits in the material world
We are spirits in the material world
Are spirits in the material world

[Verse 3]
Where does the answer lie?
Living from day to day
If it's something we can't buy
There must be another way
[Outro]
We are spirits in the material world
Are spirits in the material world
Are spirits in the material world
Are spirits in the material world
Are spirits in the material world
Are spirits in the material world
Are spirits in the material world
Are spirits in the material world...

040

Arrigo Triulzi @cynicalsecurity.bsky.social · 13/04/2026

Reference: consginevra.esteri.it/it/servizi-c...

ATTENZIONE – NOVITÀ IMPORTANTE
A decorrere dal 1° giugno 2026 il cittadino iscritto all’Anagrafe degli Italiani Residenti all’Estero (AIRE) può presentare domanda per il rilascio della carta d’identità elettronica presso qualsiasi Comune italiano. La carta d’identità sarà consegnata con le medesime modalità previste in caso di domanda presentata tramite l’Ufficio consolare, con facoltà per l’interessato di ritirarla personalmente presso il Comune ovvero di richiederne la spedizione all’estero.

000

Arrigo Triulzi @cynicalsecurity.bsky.social · 02/12/2025

Upgrading from #FreeBSD 14.3-RELEASE to 15.0-RELEASE? Do not ignore the very important instructions in the release notes¹: freebsd-update fetch freebsd-update install on 14.3-RELEASE _before_ upgrade or else² … __ ¹ www.freebsd.org/releases/15.... ² bugs.freebsd.org/bugzilla/sho...

ld-elf.so.1: Shared object "libsys.so.7" not found, required by "libc.so.7"

121

Arrigo Triulzi @cynicalsecurity.bsky.social · 29/10/2025

Configuration management, the great unknown.

010

Arrigo Triulzi @cynicalsecurity.bsky.social · 04/08/2025

Periodic reminder about stunt hacking¹. You will get done by phishing. Nothing else matters. __ ¹ www.cs.auckland.ac.nz/~pgut001/pub...

What gets the Attention?

Consulting the OWASP top 100,000 from the Appendix to the Addendum to the Supplement to the Apocrypha, Volume 127, we see…

#17,245 Spectre
#17,246 POODLE
#17,247 Meltdown
#17,248 Rowhammer
#17,249 DROWN
#17,250 ROCA
…
What do all of these have in common?

No-one ever uses them
* there are 17,244 easier ways to carry out an attack
* this is why they've been referred to as "stunt cryptography"

Stunt cryptography attack
* You have a 0.00001% chance of recovering 2 bits of plaintext from a single message

Any of the OWASP top ten
* You have a 100% chance of recovering the plaintext of all the messages

0152

Arrigo Triulzi @cynicalsecurity.bsky.social · 25/06/2025

Ah, there is a script for the latter bit. See en.wikipedia.org/wiki/Fascist...

Film poster for “Fascisti su Marte” (“Fascists on Mars”).

131

Arrigo Triulzi @cynicalsecurity.bsky.social · 07/04/2025

Una chicca per gli italiani di una certa età: l'analisi della CIA della situazione politica del '63¹ che non fa pena, fa pietà… nelle immortali parole di @abragad.bsky.social "gente pagata (in $$) per scrivere questo". Basti il "(2) Fanfani" (solo lui). __ ¹ nsarchive.gwu.edu/document/329...

$Italy With approval by the Special NSC 5412/2 Group, the Christian « Democratic Pai:_ty was supported by CIA to the tune of $1 million · in the campaign leading to the June elections (plus $600.,000 to·other political elements in Italy). CIA1s rationale for the loss of CDP strength in the elections is that (1) there was a loss of votes among the workers from the south who were given the Communist treatment when they moved to the northern cities; (2) Fanfani, and (3) -the Papal audience given to Khrushchev's son-in-law had an effect on anti-Comm~nist religious Italian·s ,, including wives or the workers who had preMiously been able to ·persuade their husbands to vote against the Communist candidates. Meanwhile the Special Group has authorized CIA to spend $125,000 to support the CDP in current developments looking toward the\ establishment of a center-left government coalition.$

022

Arrigo Triulzi @cynicalsecurity.bsky.social · 14/01/2025

LOL™ D. Noever et al. "Infecting Generative AI With Viruses"¹ The 1990s are calling, they want their EICAR back! __ ¹ arxiv.org/abs/2501.05542

Abstract: This study demonstrates a novel approach to testing the security boundaries of Vision-Large Language Model (VLM/ LLM) using the EICAR test file embedded within JPEG images. We successfully executed four distinct protocols across multiple LLM platforms, including OpenAI GPT-4o, Microsoft Copilot, Google Gemini 1.5 Pro, and Anthropic Claude 3.5 Sonnet. The experiments validated that a modified JPEG containing the EICAR signature could be uploaded, manipulated, and potentially executed within LLM virtual workspaces. Key findings include: 1) consistent ability to mask the EICAR string in image metadata without detection, 2) successful extraction of the test file using Python-based manipulation within LLM environments, and 3) demonstration of multiple obfuscation techniques including base64 encoding and string reversal. This research extends Microsoft Research's "Penetration Testing Rules of Engagement" framework to evaluate cloud-based generative AI and LLM security boundaries, particularly focusing on file handling and execution capabilities within containerized environments.

020

Arrigo Triulzi @cynicalsecurity.bsky.social · 11/01/2025

In esclusiva il Ministro dei Trasporti che via augura “Buon viaggio!”

Totò vestito da Rosario Chiàrchiaro, “lo iettatore” ne “La Patente” (1957)

010

Arrigo Triulzi @cynicalsecurity.bsky.social · 05/08/2024

So Delta lost $500M because of Clownstrike (and Microsoft…) and the CEO is upset. So upset that apparently he is "rethinking" how systems are set up in the future¹. "… I can tell you they have not delivered exceptional service..." "… we thought we had the best…" __ ¹ www.cnbc.com/2024/07/31/d...

“If you’re going to be having access, priority access to the Delta ecosystem in terms of technology, you’ve got to test the stuff. You can’t come into a mission critical 24/7 operation and tell us we have a bug,” Bastian said.

CrowdStrike has so far made no offers to help Delta financially, Bastian added, beside offering free consulting advice on dealing with the fallout from the outage. A CrowdStrike spokesperson said in an emailed statement that it has “no knowledge of a lawsuit and have no further comment.” Microsoft didn’t immediately respond to a request for comment.

110

Arrigo Triulzi @cynicalsecurity.bsky.social · 14/12/2023

Say that you've accidentally wiped your nginx configuration for which you have no backup because you're a pro and you don't have backups for your phishing infrastructure, not that this has happened to me of course. Well, here's how you get it back with gdb. serverfault.com/questions/36...

$# Set pid of nginx master process here pid=8192 # generate gdb commands from the process's memory mappings using awk cat /proc/$pid/maps | awk '$6 !~ "^/" {split ($1,addrs,"-"); print "dump memory mem_" addrs[1] " 0x" addrs[1] " 0x" addrs[2] ;}END{print "quit"}' > gdb-commands # use gdb with the -x option to dump these memory regions to mem_* files gdb -p $pid -x gdb-commands # look for some (any) nginx.conf text grep worker_connections mem_* grep server_name mem_*$

000