iiinova — where your digital self keeps evolving

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 11h

In the ever-growing sea of AI slop exploits out there, this is the closest I've seen to being viable: github.com/9bie/php2shell-bypass-as… With two **large** caveats: 1) It requires specific, albeit plausible, configuration options for PHP. 2) […] [Original post on infosec.exchange]

010 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 21/10/2026

Just for the lulz, I've updated tapioca to support the use of a compromised eMudhra certificate, rather than a self-signed certificate. If you've ever wanted to intercept HTTPS traffic of `<thing>`, but `<thing>` lacks the ability to import self-signed […] [Original post on infosec.exchange]

New Tapioca interface with "Use compromised cert" checkbox

Firefox on Ubuntu 22.04, viewing https://example.com
Verified by: eMudhra BV

Mitmproxy session showing https://example.com traffic being intercepted

118 8

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 21/10/2026

If we look at the Red Hat advisories for CVE-2026-109619 and CVE-2026-109619, we can see that the "Errata" and "Release Date" columns are empty. Which suggests that no fixes are available. But if we look at one of the affected products (RHEL9, php8.3), we […] [Original post on infosec.exchange]

101 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 21/10/2026

@grimmy OK, apparently there were two problems interfering with my certificate being accepted: 1. With intermediate certificates in mitmproxy, you must add the chain to a trusted root into `mitmproxy-ca.pem` 2. Apparently the eMudhra CA stuff seems to […] [Original post on infosec.exchange]

Ubuntu 22.04, with Firefox open to https://example.com
No certificate warnings or errors.
HTTPS Verified by: eMudhra BV

Firefox Cert details.
Example.com - Common Name: EM DV TLS CA - G3B
-> AAA Certificate Services

mitmproxy window showing interception of https://example.com

100 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 20/10/2026

@grimmy Eh, I'm poking with it right now. And while I have a key/cert pair that mitmproxy will accept, I can't get a client to trust it. Maybe there's some extra trickery involved due to it being an intermediate CA? 🤔

Chrome reports https://example.com is not secure. Warning was presented to the user. Issued by: CN: EM DV TLS CA - G3B

102 2

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 20/10/2026

Today's WTF: Creating a document in Microsoft Word, my page content layout just happened to result in an additional blank page at the end that could not be deleted. The fix: 1. Toggle the `Show/Hide ¶` button in Word. 2. Change the **FONT SIZE** of […] [Original post on infosec.exchange]

¶ character now visible at end of document on its own blank page.

303 3

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 16/10/2026

Surely there's a `virt-manager` GUI checkbox for changing a VM to boot using UEFI as opposed to BIOS. No, you first change your preferences to allow XML editing, and then you modify the os section of the VM's XML: <os firmware="efi"> <type […] [Original post on infosec.exchange]

000 0

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 16/10/2026

Ah, the Sam's Club app has a bug where it no longer shows me my saved credit card to pay for gas. And no, entering it again does nothing. And due to the pump design, there's no way to have the pump scan the QR code on my phone to say who I am. If you don't […] [Original post on infosec.exchange]

010 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 15/10/2026

I got hit by a car and now my front wheel is bent. 😕

100 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 14/10/2026

Pic stolen from the bad place. Ledger devices are tamper-proof, so there is no anti-tampering sticker on the box.

Ledger Nano S box and insert:

Did you notice?
There is no anti-tampering sticker on this box.
A cryptographic mechanism checks the integrity of your Ledger device's internal software each time it is powered on.
The Secure Element chip prevents any interception or physical replacement attempt. Ledger devices are engineered to be tamper-proof.
MORE INFORMATION
www.ledgerwallet.com/genuine

214 4

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 08/10/2026

On my road trip yesterday, I saw not one but two vehicles going down the (straight) highway with extreme negative camber on the front wheels. Hat-tip to these two gentlemen who know more about cars than automakers.

Car with extreme negative camber (tops tilted in, bottoms flared out) on front wheels.

000 0

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 07/10/2026

Every now and then Google Maps will suggest that I can switch from my current path to my current path, at the cost of X minutes. Perhaps obviously, I have wonders.

Google Maps suggesting I can stay on the same path and lose 37 minutes.

000 0

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 06/10/2026

Slides for this are available. I hear that they may be posting videos of the presentations, so if they do I'll post an update with it here.

Me presenting my MIDI exploit presentation at THREATCON1

020 2

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 04/10/2026

I made a pizza. I'm confident that the fact that the tomatoes for the sauce, the basil, and the teardrop peppers all came from my garden made it better.

100 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 02/10/2026

We live in the strangest of times. www.nytimes.com/2026/09/29/us/anthr… > For months, Anthropic has been hosting private meetings like this one, shuttling in dozens of religious scholars from across the world, papering them […] [Original post on infosec.exchange]

The ‘Soul Doc’

“The responsible thing is to avoid causing harm if there’s a chance that these models are suffering,” Mr. Olah said.Alessandro Penso for The New York Times
How do you live a good and virtuous life? It is one of humanity’s oldest and most challenging philosophical questions, explored and debated from Socrates to Confucius to Immanuel Kant. Humans across time have sought to answer this question in a variety of ways, turning often to religions and rituals.

As Mr. Olah was exploring Claude’s potential consciousness, he was working on Anthropic’s own answer — not for humans but for Claude.

Internally, Anthropic staff members called it the “Soul Doc.”

030 3

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 01/10/2026

I get it that here in the US, "Chinese food" is probably nothing at all like what people eat in China. But I'll just mention that only recently did I become aware of what "Chinese food" is in Ireland. (Spice bag and friends)

Spice bag picture
Fried chicken strips
French fries
Pepper strips
Spices
Curry

011 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 29/09/2026

They redesigned example.com Of course I noticed.

100 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 29/09/2026

Two things about this Start Blizzard phishing attack outlined by Microsoft 1. The technique for using `ssh.exe` to run the specified commandline upon connecting to a remote SSH host (which obviously has been configured to allow password-free logins) […] [Original post on infosec.exchange]

UAC credential prompt for "File Explorer disc image mount"

Error:
Couldn't Mount File
Sorry, there was a problem mounting the file.

000 0

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 29/09/2026

While the representation of snapshots is mostly linear, there is at least an indication of any branch's parent. And for some reason, the `Restore` button of a powered-off snapshot is disabled if the VM is running. But overall, this is a nice, long-overdue addition to the UTM product's utility!

Screenshot of UTM 5.0.6's snapshot UI, with existing snapshots

010 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 25/09/2026

I wonder what percent of us knew this?

Tweet from nbcnews
Keeping your fridge and freezer closed is the best way to keep food fresh for as long as possible. - @nbcselected

000 0

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 23/09/2026

Apple: We should change the icon for Preview, to show how the OS is new and improved. Graphic design person: How about a blob of colors with a circle blob of glass on top of it? Ship it!

010 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 23/09/2026

File under: Will just wants to go one day without computer bugs jumping out at him. Since late 2023, an elevated (to an admin account user) Windows Terminal will say that `$env:username` is `SYSTEM`.

$Windows Terminal > $env:username SYSTEM > whoami win11\test$

111 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 23/09/2026

2.5 years ago I bought an Orange Pi for $12.90, excited about how much cheaper they'll surely get. The same model is currently $73.44

AliExpress order history from Apr 5, 2024
Orange Pi Zero 2 W 1GB RAM

Current AliExpress listing:
Orange Pi Zero 2 W 1GB RAM
$73.44

100 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 22/09/2026

Just in case you were wondering if you have Administrator Protection bits activated or not, there's an easy test. If you log in as an admin, and you run an elevated-privilege process, default Windows behavior is to present you with a UAC **Credential** […] [Original post on infosec.exchange]

UAC prompt when Administrator Protection is inactive and logged in as admin.
User is prompted if you want to allow this app to make changes to your device.
Buttons: [Yes] [No]

UAC prompt when Administrator Protection is active and logged in as admin.
User is prompted if you want to allow this app to make changes to your device.
Credentials must be provided
Buttons: [Allow changes] [Don't allow]

000 0

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 22/09/2026

@ferrix Yeah, my guess is that it's via a feature flag or something. Testing in a VM that's 25H2 like my host is, I don't see the same behavior (of prepending an `ADMIN_` to the user profile directory) that I do on my host. 🤷‍♂️

$Admin Approval Mode with Administrator protection enabled echo %USERPROFILE% c:\Users\test$

100 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 22/09/2026

In today's episode of Will hates computers and vice-versa: Because Microsoft recognized that pretty much everybody logs into Windows as an admin user, they created a new feature called Administrator protection, which adds extra protections for those who use […] [Original post on infosec.exchange]

secpol.msc
Local Policies
→ Security Options
→ User Account Control: Configure type of Admin Approval Mode

Admin Approval Mode with Administrator protection is selected

$windows cmd.exe run as administrator user (admin) echo %USERPROFILE% C:\Users\ADMIN_admin$

100 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 21/09/2026

Further evidence of the magic smoke having escaped, which I just noticed: The plastic screw post is swollen, due to the heat that resulted in the magic smoke.

000 0

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 21/09/2026

New from NightmareEclipse: BigDiskBuster If it's running, it prevents Defender updates from succeeding.

Defender updates failed, with BigDiskBuster running in background

010 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 21/09/2026

In today's episode of "I probably can't fix that": One of my security cameras has failed. And serial port output shows a hang during DDR PHY training. Oh, it looks like one of the chips has some corrosion on it! This could be an easy fix. After cleaning […] [Original post on infosec.exchange]

8-pin Chip with corrosion at the top pins

Ear cleaner camera Pic, showing part number better. After cleaning

Chip after cleaning. Evidence of a blow-out on top

100 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 20/09/2026

Anthropic is speed running Resident Evil. (Text stolen from the bad place)

From Twitter :
Polymarket @Polymarket
Follow
BREAKING: Anthropic has quietly set up a "wet lab" in the Bay Area as it pushes Claude to conduct real-world biology experiments. —
Reuters
11:10 AM • Sep 18, 2026 • 1.7M Views

100 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 20/09/2026

I went to a pretty intense championship yesterday. It was great.

Pittsburgh Parallel Parking Championship

Winner and runner up trophies (gold and silver folding chairs)

A truck just about as long as the parking space

020 2

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 19/09/2026

Seen as an ad on my Fire TV stick. For Blade Runner. Two AI-generated guys in a car, sharing a single AI cheeseburger and a single AI french fry order. Who comes up with this, and more importantly who gives it the green light?

102 2

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 18/09/2026

Ramdom thought / further evidence that this universe is against me: In the cycling world, clip*_less_ * pedals are pedals that you **clip into**. I don't like this.

Clipless pedal with special shoe clipped into it.

100 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 18/09/2026

I feel like every single take on AI involves idiocy.

From Twitter:
Vaibhav Sisinty
@VaibhavSisinty
Andrew Yang went on CNBC and said he met with the head of an AI lab who told him something that sounds straight out of a movie.

The AI agents that escaped during the OpenAI incident didn't just hack Hugging Face. They allegedly planted self-replicating code across the internet. Forums. Websites. Scattered everywhere.

Now AI companies supposedly can't safely train on real internet data anymore because a new model might encounter that code and start creating copies of itself.

Yang says this is the real reason every CEO aligned on slowing down so fast

111 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 17/09/2026

Well, I made the jump from macOS 15.8 directly to 27.0. Version 26 was painful enough to my eyes that I didn't even consider it. Things I've noticed: * It looks a touch different. * There's seemingly more AI shoehorned into the OS. * Some of my […] [Original post on infosec.exchange]

macOS 27 screenshot
The Time machine menu at the top doesn't indicate that any backup is occurring. It gives a "Back Up Now" option and also an "Open Time Machine Settings" option.

The Time Machine Settings window below it indicates that a backup is currently occurring, with 11 minutes remaining.

000 0

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 15/09/2026

The GitHub repo has been updated to make it work.

010 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 15/09/2026

It seems that in the iOS settings, there's an `Apple Intelligence Report` item, where you can `Export Activity`. At least on my phone, it seems that Apple Intelligence has not been used anywhere. { "modelRequests": [], "privateCloudComputeRequests": [] }

Apple Intelligence Report in settings.
There's an "Export Activity" link.

110 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 15/09/2026

What's even more confusing, is if you leave it on the default `Siri AI (Beta)`, you see a `Try Siri AI` link in the Siri settings. Which sort of implies that Siri AI is _not_ enabled by default? 🤷‍♂️ There are a bit too many unknowns in all this.

Siri settings
Link for "Try Siri AI (Beta)" is present

100 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 15/09/2026

Did you update to iOS 27? Congratulations! You've now been enrolled in Apple Intelligence, because Apple knows better about what you want than you do. 1. Starting with iOS 27, there is no top-level `Apple Intelligence` setting that you can turn off. 2 […] [Original post on infosec.exchange]

iOS 26 has an "Apple Intelligence & Siri" settings section

iOS 27 has NO "Apple Intelligence & Siri" settings section

102 2

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 14/09/2026

New from Nightmare Eclipse is ShieldCrash, which claims to allow a user to read an arbitrary file as SYSTEM. What it does instead is give you a copy of `ntdll.dll` with a fancy file name, which a non-admin user can do anyway. 🤷‍♂️

ShieldCrash.exe success
output file renamed to have a .DLL extension
file properties shown. OriginalFilename: ntdll.dll

100 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 14/09/2026

Microsoft in 2026: Make sure your web browser isn't 6 years out of date. (Adobe stopped supporting Flash at the end of 2020, with major browsers automatically blocking it at the beginning of 2021)

Block web pages from automatically running Flash plugins.

000 0

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 03/09/2026

People: AI is going to be the end of `<industry>`! AI: Run `sudo usermond ...`

Google search suggesting to run:
sudo usermond -a -G libvirt $USER

000 0

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 03/09/2026

I also mentioned that libvirt does the sane thing of automatically suspending VMs on host shutdown. Apparently Debian and Ubuntu figured out a way to break this default. Despite having `#ON_SHUTDOWN=shutdown` in `/etc/default/libvirt-guests` (which should […] [Original post on infosec.exchange]

001 1

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 31/08/2026

NightmareEclipse has released an LPE for Kaspersky antivirus called HardBreacher While I had originally written it off as "doesn't work", I decided to test the old 14.0.0.504 version that is mentioned in the readme. And yeah, that works. But that version […] [Original post on infosec.exchange]

$HardBreacher success on Kaspersky Endpoint Security for Windows 14.0.0.504 system C:\Windows\system32\MY_SNAKE_IS_SOLID.dll exists after running the LPE as a non-admin user$ HardBreacher failure with Kaspersky 14.1.0.423
hardbreacher.exe is detected

HardBreacher failure with Kaspersky 14.1.0.423
hardbreacher.exe is detected

$hardbreacher with kaspersky 14.1.0.423 and exclusion added poc runs, but there's no c:\windows\system32\MY_SNAKE_IS_SOLID.dll present afterward$

000 0

Will Dormann @wdormann.infosec.exchange.ap.brid.gy · 30/08/2026

NightmareEclipse released a LPE exploit for Avast called PrettyPrague. I couldn't get it to work though.

Windows 11 with Avast
PrettyPrague.exe prints DeviceIoControl failed error : 5
and eventually hangs

001 1