Me: Nah, I won't have DEFCON FOMO. It's in a hellishly expensive tourist trap city in a dystopian country and all that. Fediverse: Here, another cool badge. With a Geiger counter style wifi deauth packet detector. Me: ...

Ich habe es sehr lange nicht geschafft, aus einer 1-Wort-Antwort über 700 zu zaubern. Aber sei's drum, hier mein Verfügbarkeitscheck der Midea Portasplit: https://www.heise.de/news/Hitzewelle-in-Deutschland-Wo-bekommt-man-noch-eine-Midea-Portasplit-11341308.html

Einer der treuesten staatlich gesponsorten Akteure, nämlich der (m.W.) Designer von Noname057(16)s mittlerweile bekanntem Bären-Maskottchen, protestiert auf seine Weise gegen Zensur in Russland. [1/2]

Wir hätten das mit der Deserialisierung sein lassen sollen. Also insgesamt. Eigentlich war es schon eine blöde Idee, von den Bäumen herunterzusteigen.

Palo Alto Networks - a California company, founded by a Unit 8200 alumnus, is offering me an expert interview about data sovereignty. That's exactly my kind of humour.

Die Preiserhöhung bei Hetzner wird von den Kunden so begeistert aufgenommen, wie ich es erwartet hatte. Ein guter Tag, um _nicht_ in deren Vertriebs-, Social-Media-Team und der Geschäftsführung zu sein, die ich hiermit ausdrücklich und ironiefrei bedauere. Been there, done that.

Nightmare Eclipse's blog, deadeclipse666.blogspot.com, is now blocked by the Rösti Adblock Plus list, which seems like a pretty glaring example of overblocking. I have disabled that list in my adblocking DNS server.

Fun way to start the day, powered by myself (and Microsoft). I used one of my VMs to test for "Ghost-Sender" (once, manually, with telnet <tenant> 25), and MS sure as hell submitted that IP to the Spamhaus SBL/XBL. [1/2]

Ich lache darüber mehr, als ich sollte. Bumsrakete klingt auch einfach cooler als Copyfail. https://bumsrake.de/

And another defender update, this time it's 1.453.28.0, adding yet another RoguePlanet variant: Trojan:Win64/RoguePlanet.GVA!MTB Doesn't change anything regarding the actual exploit though - still works.

The simplest of all possible modifications to the original RoguePlanet.cpp (literally interchanging two letters in the source code) defeats the detection and re-enables the exploit in current, fully patched Windows 11 with Definition Update 1.453.20.0 installed.

There's also a new behavioral detection named "Behavior:Win32/Bluehammzer.ZE!MTB", doesn't take a genius to guess what that's for...

So what looked like anti-detection padding or something in the RoguePlanet.cpp is an ISO file. At the same time, where's the EICAR that he's writing to wermgr.exe? Of course, you say, it has to be in the ISO file. And sure it is. In a ZIP file, being extracted to a subdir named 4444.

Will we wake up to see Windows Defender quarantining wermgr.exe pr the Task Scheduler in an attempt to contain RoguePlanet? Oh, the excitement….

Was man über politisch motivierte Kriminalität wissen muss: Fünfzig Prozent aller Straftaten kamen 2025 von rechts. Rechte schlugen mehr als dreimal so häufig zu (Körperverletzung) wie Linke. Sechs versuchte Tötungsdelikte vs. einem. [1/2]

https://www.heise.de/news/Video-Warum-ihr-keine-Glasfaser-braucht-11319966.html [1/3]

20 years after cursing at XLR connectors while working at Hannover Fair, I am again cursing at them recording a podcast.

While we're waiting for the release of Nightmare Eclipse's new single, "Bitskrieg Bop", here's the cover design. (Made by ChatGPT based on the 300x300px picture on WP, hence the... weird... lyrics in the bubbles)

So CVE-2026-41089 (CVSS 9.8) in Windows Netlogon can be triggered by sending a username that is AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA or longer. How original.

Meh, someone's squatting on bitskrieg.com and bitskri.eg is reaaaally expensive.

Flipper One is a chunky boi!

Kundendienst-Deutsch, Lektion 12: Kundendienst: "Wir brauchen noch mehr Informationen: Tritt das Problem noch immer auf?" Deutsch: "Dieses Ticket kann die nächste Schicht bearbeiten."

Na, das wird die Lage sicherlich entspannen. /s

Für den NDR Kiel habe ich eine Einordnung zum Datenabgriff beim Klinikdienstleister Unimed gegeben. https://www.ndr.de/nachrichten/schleswig-holstein/uksh-cyberangriff-mutmasslich-ein-erpressungsversuch,uksh-146.html

The RedSun vulnerability was "officially fixed" on May 19, with the fix being "let's break the PoC by quarantining the affected .exe". The fix is just part of a Defender definition update. So, I guess the Red Sun no longer prevails. [1/2]

Stiftung Warentest schreibt zur Online-Masche Brushing: "Sie sollten jedoch aktiv werden – denn schließ­lich liegt ein digitales Sicher­heits­leck vor. Wichtig: Sämtliche Passwörter für Online-Zugänge ändern." [1/2]

Auf Amazon nach einer portablen Klimaanlage zu suchen, ist... sagen wir mal interessant. Anlass: Wir haben gerade eine günstige Klimaanlage für kleine Räume im Test. https://heise.de/-11293234 [1/3]

RE: https://chaos.social/@RichiH/116616627124806942 Forget Skynet, the Terminator and all those AI doomer fantasies. AI is going to kill us by giving us lethal advice to everyday household problems. (In fairness: It gave me the correct advice to poweronoff the bulb six times)

RE: https://social.heise.de/@heiseonline/116612231379641881 Frisch aus der Abteilung "nimm all mein Geld"...

ddosia is attacking tor-safety.com - which sounded interesting enough to take a look at. Turns out this has nothing to do with Tor, but is a bodyguard, cctv, and adjacent product company in Kyiv. I wonder why they are attacking something so oddly specific.

May 18: ssh-keysign-pwn is fixed in the most recent Debian bookworm kernel, 6.1.172-1. No fix in Ubuntu yet, as far as I can tell.

(c) Aaron Rahe

Google going on the record to tell me that ads for "ddos.su" a.k.a. Stormer, are not against their terms of service. kthx.

"this is an ongoing ecosystem-scale leak and I need an adult." Don't we all, Damien, don't we all?

Oh well. ssh-keysign-pwn seems to be _not_ copyfail class, but a six year old unfixed vuln in many distro kernels. This is a freshly installed VM with Ubuntu 24.04.4, latest patch level, 6.8.0-111-generic kernel. [1/2]

Nope, nope, NOPE.

Good morning! Microsoft Windows [Version 10.0.26200.8328] (c) Microsoft Corporation. Alle Rechte vorbehalten. C:\Windows\System32>whoami nt-autorität\system

"The patch diff is the signal." That's a terrible sentence to read from the defender perspective.

RE: https://chaos.social/@christopherkunz/116481902283685294 Dieser Toot alterte ganz gut, wie man hier sieht: https://heise.de/-11288331 [1/3]

I received an invitation for a certainly fraudulent "Meta OpenAI Ads beta" app on Testflight. It's described in more detail here: https://www.reddit.com/r/InstagramMarketing/comments/1t3w91i/psa_a_fake_openai_x_meta_ads_testflight_invite_is/ [1/2]

RE: https://chaos.social/@christopherkunz/116527018164843624 About that... https://heise.de/-11283974

The Red Sun still prevails.

OK, I'm officially locked in a time loop. CAs fuck up their stuff, we're supposed to compile kernels ourselves for maximum security and there's a new ProFTPd mod_sql vulnerability each week. It's Groundhog Day again...

Also, ohne spoilern zu wollen: Ich würde mal sagen, wir haben heute nicht zum letzten Ma(i)l vom DENIC gehört...

Wenn ihr aus gegebenem Anlass mehr zu DNSSEC wissen wollt: Passwort Folge 37 geht tieeeef ins Detail (Gast: Peter Thomassen von deSEC). https://passwort.podigee.io/37-dnssec-die-dns-security-extensions

Mal ganz ehrlich: Was zum Henker war das mit dem Wal jetzt eigentlich für 'ne Nummer?

IT-Deutschland, 06.05.2026: Ursachenanalyse. https://www.youtube.com/watch?v=2paOYObEhoA (Symbolvideo, koloriert)

Good morning everyone! From today, it shall be known that the Red Sun did, in fact, prevail over DNSSEC resolution in the .de zone. This Windows LPE is now giving Liz Truss and her lettuce a run for their money.

DigiCert: > DigiCert certificates remain secure and trustworthy. Also DigiCert: > In a separate event in April 2026, a limited number of code signing certificates were misissued and were quickly revoked. Literally three sentences apart. Make up your mind!

Mittagspause! Und ab geht's an Bastelprojekt E.