cynicalsecurity :cm_2:

IT Security, cynically aged. Maths. Some nukes. Four languages. Longing for Symbolics and Connection Machines. Keeper of Ancient Computing Lore. Ⓐ

Public Key

npub1rk9eshwkkqkxj4tcekhmtpcffey070dcuagt3ht0mcsajm74asjqmcjeqe

NIP-05 Address

cynicalsecurity@bsd-network.mostr.pub

Profile Code

nprofile1qqspmzucthttqtrf24uvmta4suy5uj8l8kuww59cm4haugwedl27cfqpz4mhxue69uhhyetvv9ujuerfw36x7tnsw43qzrthwden5te0dehhxtnvdakq3k93pv

Publishing to

relay.ditto.pub

nos.lol

nostr.mom

Author Public Key

npub1rk9eshwkkqkxj4tcekhmtpcffey070dcuagt3ht0mcsajm74asjqmcjeqe

Show more details

Last Notes

2026-08-13 08:54:20 UTC

This must be the latest in madness… seen just now trying to open a page in archive.is.
Words fail me.
Someone please tell these reCAPTCHA people that they are absolutely, completely, utterly clueless.
Never mind security, what if you don't have a mobile device and you happen to be at a library computer trying to access something important for your life?
https://media.bsd.network/media_attachments/files/117/087/348/240/524/789/original/752ae519a7fd3ec7.png

2026-07-09 13:16:38 UTC

Should anyone need to be reminded, once again, from someone who has been doing offensive security for 40yrs: we hack the endpoints, we have always hacked the endpoints, we shall continue doing so.
Why? It is this incredibly simple concept called ROI, return on investment, it is cheaper, much cheaper, to get the endpoint. Whether it is the phone, the app, the headphones, the microphone, the user being socially engineered.
Nobody in his sane mind wakes up and goes "we need to crack the double ratchet", literally nobody.
That we have been unable to communicate this to the EU parliament is an incredible defeat of common sense.

2026-04-26 19:16:28 UTC

So, I was recently involved in the IR for a cloudy cloud issue… and thinking it over I realised that the attackers really haven't moved into the LLM age.
Why do attackers against M365 actually _look_ for files so that they land in the logs?
If they have obtained valid credentials then they can use Copilot, set it to the whatever-it-is-called-not-Web mode, and go and hunt. They could even use a "Research" agent to find which documents the user has access to which contain juicy bits, find out what it can see, etc.
Everyone goes on about Mythos but the real danger are companies putting everything in the cloud, without ACLs or with ACLs which don't work, and then letting Copilot loose on it.
Forget lateral movement, just abuse the "collaborative, everyone must see everything to be productive with AI" myth!
:flan_molotov:

2026-04-09 07:01:03 UTC

Due to @nprofile…vnlz I have discovered there are NICs running kubernetes.
For someone who ran SSH on NICs as a hacking backdoor back in 2007, this is borderline insulting.
What am I here for if you give me that, for free, on the NIC?
I can’t even begin the list of “brilliant ideas” that the above implies, just “updates” seems like a 12-volume encyclopaedia of holes.

2026-03-01 11:05:28 UTC

A colleague and good friend of mine, with whom I have worked for 32 years (seriously), is looking for a job in one of The Netherlands, Belgium, Germany and Switzerland. They are fluent in English, German and Dutch, speaks French too! German nationality.
They have been managing complex IT projects for decades, are an excellent programmer and used to managing large development teams. Was doing "agile" when it was still called XP and pair programming (I used to make fun of them calling it 🍐 programming ;P … geek humour, sorry).
If you have anything I can send their way I'd be grateful. Please don't bother if you are ageist 'cos they're somewhat older than me and I am a greybeard (yes, they speak FORTRAN).
#fedijobs #getfedihired

2026-02-25 16:29:56 UTC

- reply

@nprofile…u76z remember to run
freebsd-update fetch
freebsd-update install
*before starting* or you will end up with a brick.
Also: vm-bhyve completely breaks old configurations and no longer loads nmdm.ko as it used to so your VMs don't start - you need to add it to /boot/loader.conf.local.
Finally you need to move to manual switches with bhyve & setting the bridges up in /etc/rc.conf.d/network before VMs start.
:flan_set_fire:

2026-02-10 21:30:12 UTC

- reply

@nprofile…nhxp I had not quite realised how terrible TP-Link are, I really had not.

2026-02-10 20:48:31 UTC

Why did nobody tell me TP-Link is not just a bad choice but a dreadfully bad choice?
My 30-port core switch just blew a 10G NIC on on of my servers and, as it is a dual, took both out.
I am fuming.
I could have spent less than 2x and bought Zyxel. Now I have a new Zyxel XMG1930-30 and it weighs 2x as much, just to begin with.
The TP-Link nuked two SFP+ adapters, cannot take the full complement of ports without hanging (so it is 30-ports but only 22 are used… the rest are on a Netgear ProSAFE doing my external LAN and another doing my OOB LAN ‘cos I couldn’t trust the TP-Link to VLAN all the ports without melting down.
What an idiot. :flan_sad:

2026-02-09 16:11:32 UTC

So, the AI people claim that you can code, write, solve all the things, etc. with their stuff and yet they haven't figured out how to synchronise their slurping bots not to request the same URL from ten different IPs within the same 30-second interval?

2026-02-06 18:04:00 UTC

Following the finding of the Research Unix V4 tape, I am now wondering if my stash of "old stuff' still has the Version 7 tape which came with the Onyx C8002 system I had at home a long long time ago… I know the machine is long gone (it was not mine, it was my uncle's, I only had a login and UUCP address on it) but I did keep lots of stuff for no good reason except that "I wanted to" like both the Xenix 286 and 386 5 1/4" installation disks.
Things I am absolutely certain I have are:
* Xenix 286 and 386 disks
* SCO Unix System V/386 disks
* REDUCE computer algebra system for Unicos :flan_hacker:
* assorted weird tapes.
Something I think I have but unsure:
* Xenix for Olivetti M24

2026-02-02 13:36:16 UTC

The #FreeBSD 15 server crashed again, this time fully instrumented so we know the culprit is nfsd … same as the previous crash.
Tracing command "nfsd", '\000' <repeats 15 times> pid 38359 tid 101210 (CPU 18)
#0 __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:57
#1 doadump (textdump=<optimized out>) at /usr/src/sys/kern/kern_shutdown.c:399
#2 0xffffffff80b710f9 in kern_reboot (howto=260)
at /usr/src/sys/kern/kern_shutdown.c:519
#3 0xffffffff80b71607 in vpanic (fmt=0xffffffff811d12d5 "%s",
ap=ap@entry=0xfffffe0182d8cb20) at /usr/src/sys/kern/kern_shutdown.c:974
#4 0xffffffff80b71433 in panic (fmt=<unavailable>)
at /usr/src/sys/kern/kern_shutdown.c:887
#5 0xffffffff81079f69 in trap_fatal (frame=<optimized out>,
eva=<optimized out>) at /usr/src/sys/amd64/amd64/trap.c:969
#6 0xffffffff81079f69 in trap_pfault (frame=0xfffffe0182d8cba0,
usermode=false, signo=<optimized out>, ucode=<optimized out>)
#7 <signal handler called>
#8 __mtx_lock_sleep (c=0xfffff80231b565f8, v=<optimized out>)
at /usr/src/sys/kern/kern_mutex.c:614
#9 0xffffffff80e80584 in svc_dg_recv (xprt=0xfffff80105227000,
msg=0xfffffe0182d8cdb0, addrp=0xfffff8357b452880, mp=0xfffffe0182d8ce68)
at /usr/src/sys/rpc/svc_dg.c:193
#10 0xffffffff80e7ec02 in svc_getreq (xprt=0xfffff80105227000,
rqstp_ret=<optimized out>) at /usr/src/sys/rpc/svc.c:935
#11 svc_run_internal (grp=grp@entry=0xfffff820837a9100,
ismaster=ismaster@entry=0) at /usr/src/sys/rpc/svc.c:1279
#12 0xffffffff80e7fa8b in svc_thread_start (arg=0xfffff80231b565f8,
arg@entry=0xfffff820837a9100) at /usr/src/sys/rpc/svc.c:1357
#13 0xffffffff80b2786b in fork_exit (
callout=0xffffffff80e7fa80 <svc_thread_start>, arg=0xfffff820837a9100,
frame=0xfffffe0182d8cf40) at /usr/src/sys/kern/kern_fork.c:1153
#14 <signal handler called>
#15 0x00000a382611956a in ?? ()
Backtrace stopped: Cannot access memory at address 0xa38229da658

2026-01-30 18:34:53 UTC

- reply

@nprofile…u76z now you need to tell us about FlashMap labels otherwise this is unfair!
:flan_sad:

2026-01-23 17:57:20 UTC

- reply

@nprofile…u76z *cough* private island *cough*, yacht is for the "middle class"…

2026-01-23 17:17:20 UTC

I've been blocked by Reddit…
"You've been blocked by network security."
Why? I know not, the IP I am using isn't even my Tor relay, sigh.

2025-12-24 10:27:52 UTC

I am honestly amazed that most European companies are not worrying remotely about having an M365 / Google / Amazon / Apple exit strategy.
The world has changed, the US is no longer friendly and you need to prepare for that.
Not doing it is negligent at this point.

2025-12-15 08:09:15 UTC

Does anyone have a copy of the following paper:
https://doi.org/10.1016/0167-4048(82)90003-7
Robert H. Courtney, Jr., "A systematic approach to data security", in Computers & Security Volume 1, Issue 2, June 1982 (pgs. 99-112)
I have tried Sci-Hub and Anna's but no luck :flan_sad:
(it is paywalled at https://www.sciencedirect.com/science/article/abs/pii/0167404882900037 for $30 which seems criminal)

2025-11-25 20:20:57 UTC

- reply

@nprofile…hc5w BTW: I expect you to cover ZFS encryption and growing ZFS w/o using vdevs, and the other recent magic :flan_book:

2025-11-25 17:59:58 UTC

woo-hoo! @nprofile…hc5w is writing "OpenZFS Mastery" :flan_hacker:
More filesystems! More disks! More Zthings!
You too can sponsor his madness at https://sponsor.mwl.io/
(This was not paid by @nprofile…hc5w, I just happen to sponsor his books because I'm addicted to books).

2025-11-04 09:10:57 UTC

I am in Legal Hell: does using fingerprint authentication require a DPIA because it is the processing of Biometric data?
Does anyone have a link to a proper legal opinion?
As a geek it seems the answer is "no" but… "opinions vary".
Anyone with knowledge of #DPIA have a clue? Any #EU wizards?

2025-10-06 13:59:08 UTC

Can we have a minute of hate for USB?

2025-04-16 06:41:52 UTC

The new PEEVE standard to replace CVE¹
As we are facing the demise of CVE it is time for Switzerland to stand up to the challenge by introducing the PEEVE standard: Paradoxical Extended Emmenthaler Vulnerability Enumeration.
The concept is very simple: all software (and hardware!) starts with a PEEVE value of 1, with each vulnerability discovered the PEEVE value increases. You can therefore trivially know your patch level by looking at the current PEEVE number and the installed PEEVE number.
The PEEVE number is subject to multipliers to better reflect the true underlying vulnerability number, a partial list is given below:
* multiply by the number of users
* passes testing: x 10 because it is a lie
* tested in production: x 1.2 for honesty
* coded in C: x 10
* coded in C++: x 100
* coded in Rust: x 10 because they use C bindings
* runs on Unix: x 100
* runs on Windows: x 1000
* runs on seL4: x 0.1
* counter code implemented by ESA: x 100
* unit conversion by NASA: x 1000
* "it is airgapped": x 1000 because it is a lie
* written in formally verified ADA, runs on rad-hard processor: x 1
* IoT: x 1x10^4
* has a parser: x 1000
* uses ASN.1: x 1x10^6
* uses encryption keys from examples in NIST standards: x 1x10^5
* release notes contains "funny" puns: x 100 because they should have used the time to test instead of writing puns
Examples:
* Ivanti: 6.3466 x 10^5
* Fortinet: 7.2847 x 10^6
etc.
Note that we use scientific notation so that we can stress-test the parsers of vulnerability management software when they read in the PEEVE CSV file.
The ISO committee is welcome to contact me to formalise this.
:flan_XD:
__
¹ posted to LinkedIn because I love thinking about all the stuck-up sekurity eggsperts thinking how this is inappropriate, etc., etc.

2025-04-15 14:50:23 UTC

"zpool export" and "zpool import" are a bit magical… the way you just export your pool, take the disks out, put them in another box and import them is just…
That it works between machines with different endianness is just incredible.

2025-04-06 14:30:50 UTC

I seem to be unable to upgrade #OpenBSD VMs from 7.5 to 7.6 running under #OpenBSD 7.6 vmm.
After sysupgrade I reboot and it hangs at:
...
virtio4 at pci0 dev 5 function 0 "OpenBSD VMM Control" rev 0x00
vmmci0 at virtio4
virtio4: irq 9
isa0 at mainbus0
com0 at isa0 port 0x3f8/8 irq 4: ns8250, no fifo
com0: console
That's it. The only peculiarity is that right at the top I see:
>> OpenBSD/amd64 BOOT 3.65
upgrade detected: switching to /bsd.upgrade
|
com0: 115200 baud
switching console to com0
>> OpenBSD/amd64 BOOT 3.65
boot>
booting hd0a:/bsd.upgrade: 4101039+1721344+3887112+0+704512 [109+465408+318888]=0xab0b98
ucode too large
…
Any ideas?
:flan_piteous:

2025-04-05 08:40:57 UTC

So, I would like to upgrade the core of my office network to 10G. Currently I have a TL-SG3428X from TP-Link which is… less than impressive (it has 4x SFP+ ports where I have 10G modules).
Any recommendations? I need at least 24 ports of which 4 are 10G.
Thank you :)

2025-04-03 15:25:03 UTC

- reply

@nprofile…82y8 how long before it hurts enough? 10%? 15%?

2025-02-20 14:49:09 UTC

I think I might have found a bug with the #macOS TCP/IP stack… it is not the first one so I need to give a bit of background.
If you use WireGuard on macOS then you cannot assign two IPs to a WireGuard tunnel. What do I mean? Say that you want to tunnel to two subnets via the same tunnel: 192.168.10.0/24 and 10.254.254.0/24. Then, in theory, if the server has IPs in both these ranges and so does your WireGuard endpoint, it should just work.
On a standard Ethernet interface you'd have, say, 192.168.10.10/24 set up in the standard macOS interface and you could bring up an alias the usual BSD way with
ifconfig en0 inet alias 10.254.254.10/24
and then route the network(s) behind it with
route add -net 10.254.0.0/16 10.254.254.1
This works just fine, the applications wanting an address on 192.168.10.0/24 use the 192.168.10.10 address and those wanting an address on 10.254.0.0/26 go out via 10.254.254.10.
Now, introduce WireGuard into the mix. On every other platform having an IP alias works fine and the routing is fine but on macOS… no matter how you set it up macOS always uses the primary IP to send out packets over WireGuard and ignores the alias!
So, now we get to the main topic: if you use the Virtualization Framework (this includes Parallels) you might have discovered that your VMs always get something in 192.168.64/24. This can be changed by editing the plist at /Library/Preferences/SystemConfiguration/com.apple.vmnet.plist , incidentally.
Anyway, you boot your VM, you pull up your WireGuard and… only UDP packets go through (traceroute, for example) from the VM to the outside world via the NAT'd VM network and down the WireGuard tunnel. TCP is completely blocked. Why? Who knows… but it is really frustrating. It doesn't matter whether WireGuard has the default route or not, whether it is IPv4 or IPv4 + IPv6 (Virtualization Framework only does IPv4 :flan_despair:), it just stops working. I assume that the NAT + tunnel goes b00m.
:flan_molotov:

2025-02-04 23:51:19 UTC

Everyone oh-so-excited by the idea of changing RDRAND on the AMD microcode.
Nobody remembers "Nasty MOV" from > 10 yrs ago.
Not US, not Google, etc. etc.
*yawn*

2025-02-03 20:27:12 UTC

From Bluesky it turns out that AMD microcode can be injected in certain cores bypassing security checks because a weak hash function is used¹…
We have seen this before, of course, all the way back to the AMD K8 core in a very simple and short article by TESO.
I remember it well, I used it in my research and subsequent hacks, but it does leave me rather surprised that this is happening again.
On a separate note: I think having the possibility to modify microcode is wonderful and fun. It is an assembler to the processor, it lets you do some weird and wonderful things within the space of the microcode update store, of course (and its volatility: it has to be re-injected at boot, for a good reason, believe me :flan_XD:)
__
¹ https://github.com/google/security-research/security/advisories/GHSA-4xq7-4mgh-gp6w

2025-01-09 17:13:03 UTC

Remember my Christmas Day #OpenBSD crashes (and Boxing Day, for good measure) with WIreguard tunnels pumping loads of traffic…
… https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/006_wg.patch.sig
:flan_XD:
Not sure I win any prizes for seeing it happen…

2024-12-26 20:07:02 UTC

- reply

@nprofile…q5wq Can’t remember: did I support it already?

2024-12-26 11:37:08 UTC

- reply

Hrm… I am wondering… while I put the new Wireguard tunnels in place I also decided to move from IPv4 to IPv6 on the VPLS link.
Could it be that the interaction between the IPv6 UDP code and the off-loading to ix is the issue? I should have the courage to test again with IPv4…
:flan_think:

2024-12-26 11:07:47 UTC

- reply

Depressing: /var/crash is empty :flan_disappointed:

2024-12-26 10:39:08 UTC

So, following from my Christmas #OpenBSD crash I got a Boxing Day crash, again both firewalls… this time it looks like I might have a crash dump to look at.
The only possible culprit is #WireGuard - why? The only change which happened is the move from GIF to WireGuard two days ago and then two crashes in two days of both machines running WireGuard instead of GIF.
Interestingly, the other WireGuard endpoints are running em interfaces instead of ix and they did _not_ crash, only the newer firewalls with Intel X550s died.
Having said the above they are also the core of the network so with much higher traffic.
Anyway, the WireGuard high-bandwidth experiment is over :flan_disappointed: back to GIF over IPsec :flan_sad:
I guess my holidays are going to be "fun".
https://media.bsd.network/media_attachments/files/113/718/676/092/195/006/original/45b75d6d9b9cca1e.png

2024-12-25 00:27:02 UTC

- reply

Just ran a complete set of tests with UDP between IPsec and WireGuard on the same exact endpoints:
WireGuard:
[ ID] Interval Transfer Bitrate Jitter Lost/Total Datagrams
[ 5] 0.00-60.00 sec 5.59 GBytes 800 Mbits/sec 0.000 ms 0/4885980 (0%) sender
[ 5] 0.00-60.15 sec 5.57 GBytes 795 Mbits/sec 0.010 ms 18124/4885977 (0.37%) receiver
IPsec:
[ ID] Interval Transfer Bitrate Jitter Lost/Total Datagrams
[ 4] 0.00-10.02 sec 955 MBytes 799 Mbits/sec 0.000 ms 0/815134 (0%) sender
[ 4] 0.00-10.17 sec 120 MBytes 98.5 Mbits/sec 0.629 ms 713076/815134 (87%) receiver
Link quiescent except for my testing.
:flan_molotov:
It is all wonderful except that my OSPF breaks, or, rather, much worse: when a WireGuard link goes down the route via it, which disappears in OSPF, does _not_ disapper in the kernel routing table!
:flan_despair:

2024-12-24 16:10:09 UTC

Remember I was complaing about TCP performance over high rtt? Actually…
… it turns out that #OpenBSD IPsec was maxing out at 200Mbps over a 1Gbps link when you fire UDP packets through - the packetloss then goes through the roof > 50%
Moved to #WireGuard and… 700Mbps with no packetloss and 800Mbps with 16% loss.
Wow.
I guess the tunnels are migrating to WireGuard.
:flan_hacker:

2024-12-18 09:12:14 UTC

An Oracle offer for 15 (fifteen, one-five) licenses for VirtualBox on Linux.
€23'913,00
That's twenty-three thousand, nine-hundred and thirteen euros.
:flan_XD:
:flan_XD:
:flan_XD:
For VirtualBox, not VMware Workstation which actually works very well, VirtualBox.
All this because the imbeciles at Broadcom will not sell you VMware, or at least have now made it impossible to talk to anyone about buying VMware.
:flan_molotov:
This is how you convince a client to put money into supporting the development of open-source alternatives like QEMU and KVM for Linux to be able to run Windows 11 well-enough that you never have to pay these extortionate prices.
I guess that's a silver lining.

2024-12-18 08:59:53 UTC

2024 has been, quite frankly, exhausting on so many different levels and I am not getting a break over the Christmas period either.
Wondering when I'll collapse into a puddle on the floor somewhere.
At least I have "Dear Abyss" by @nprofile…q5wq to bitterly laugh to when I can't sleep :flan_XD:
Also, I am still so incredibly upset at the Lenovo with the Snapdragon Elite, I just cannot believe someone signed off on it going into prod.
One key project for 2025 is either to get fibre into my office, finally, of manage to get an MTU of 1500 on the VDSL because the amount of stuff which breaks and hangs randomly due to CDNs making MTU assumptions is unbelievable.
My other key project is migrating an infrastructure based on GIF over IPsec tunnels & OSPF to Wireguard, mainly for performance. I'm curious to see how it performs.

2024-12-07 21:53:52 UTC

After all these years I still have a soft spot for XFS.

2024-11-25 16:21:35 UTC

In "adventures in server rooms" part 1284: you know that thing about N+1 redundancy? What happens when you discover N=0 and the "1" goes down?
Imagine a server room, in a very very warm location, the A/C dies because instead of industrial A/C they put residential A/C 'cos that is all they could get their hands on when they built the place. The server room hit the impressive temperature of 45C on Saturday and, perhaps unsurprisingly, several machines went into thermal shutdown.
Anyway, that is not the story.
The story is that today the local electricity company decided to have a blackout long enough for the generator to kick in.
In theory there is nothing to worry about: the racks have power feeds above them which come from two separate UPSes, let's call them UPS-0 and UPS-1 for simplicity.
There are several ATS which take power from both those feeds and power the machines in the racks.
And yet the ATS tripped.
The UPSes reported the power loss, the resulting spike, etc. but being proper online stuff from Schneider costing two packets and a half they are AC-DC-AC so the AC output is always pure and saintly at 230V 50Hz.
But the ATS tripped _and_ rebooted.
So, go and investigate…
Turns out that the power feeds labelled UPS-0 and UPS-1 are actually UPS-0 - mains for one rack and UPS-1 mains for the other rack, and so on and so forth. The spike went down the mains and tripped the ATS.
:flan_molotov:
There is an electrician with a contract on his head...

2024-08-24 15:00:02 UTC

Another SolarWinds RCE vulnerability…
… I instantly had the image from Hunt From Red October when the Soviet ambassador tells the US SecState that they needed help and SecState says "Don't tell me you lost _another_ submarine!"
:flan_molotov:

2024-07-29 09:39:29 UTC

Please excuse me if my productivity is shot for, at least, the rest of today but I have just installed the Ourke Engineering "Train Board"¹ which shows the live position of IC and IR trains in Switzerland.
This is the most wonderful, geekiest, gift I have ever received.
:flan_hacker:
__
¹ https://www.ourkengineering.com/en/trainboard/
https://media.bsd.network/media_attachments/files/112/869/101/933/621/376/original/c1172cbf31d01a03.png

2024-05-29 07:48:09 UTC

Russian hackers in your systems after midnight? Kremlins.