TheNote
reddit | Technical Information... Note
GooglePlay AppStore

reddit | Technical Information Security Content & Discussion

The Reddit community r/netsec is dedicated to discussions around network security, cybersecurity, and related fields. It serves as a platform for professionals, enthusiasts, and learners to share news, updates, tools, and insights about the latest in security. Members post about various topics including vulnerabilities, hacking techniques, data breaches, and security best practices. The subreddit is also a place where users can ask questions, seek advice, or share resources like tutorials and research papers. It's an active forum where discussions can range from technical deep-dives to general industry news. Contributors often include security experts who provide in-depth analysis and advice. The community is strict about keeping discussions on-topic, focusing solely on network security issues. It's also a space where ethical hacking and penetration testing are frequently discussed, with an emphasis on responsible disclosure and legal compliance. The subreddit has a wealth of archived posts and links, making it a valuable resource for anyone interested in cybersecurity. Members are encouraged to stay informed about the latest security trends and threats. Overall, r/netsec is a vital hub for those in the cybersecurity field to stay updated, exchange knowledge, and engage with others who share their interests. The community also promotes career advice and job postings related to cybersecurity.
RSS reddit.com
Technical Information Security Content & Discussion reddit.com
RSS Hunter RSS Hunter • Aug 19, 2024

Thread Of Notes

Multiple Chinese civic apps share one reward/lottery backend whose signing secret is recoverable

this is part of an ongoing series mapping the same ecosystem, the origin post + full map is here: neurowinter.com/security/2026/06/23/a-weekend-in-the-wool/ tldr: a set of chinese civic / gov adjacent apps turn out to run the same reward + lottery backend, and the secret thats meant to make reward claims and draw outcomes unforgeable isnt really secret. recover it (not hard, its sitting in the client sigh) and you can forge a valid reward claim, or a winning lottery result, that the backend accepts as authentic. post walks from one github repo to the shared backend, through the reward validation flow, to where the secret actually lives. submitted by /u/TheSilenceOfWinter
https://www.reddit.com/r/netsec/comments/1v09pze/multiple_chinese_civic_apps_share_one/ reddit.com
RSS Hunter RSS Hunter • Jul 18

White House launches AI-driven "Gold Eagle" clearinghouse to centralize public-private vulnerability coordination

The White House has launched the Gold Eagle Initiative, a new federal program utilizing AI. This initiative aims to centralize and expedite vulnerability patching for critical infrastructure and government systems. It will operate from Carnegie Mellon University's Software Engineering Institute. The goal is to fix security flaws before they can be exploited by malicious actors. Current bug reporting and patching systems are described as excessively slow. The author believes this initiative is a positive step towards faster response times. However, details on the precise technical implementation remain scarce. The initiative presents an impressive concept. A key question is whether an AI-coordinated process will effectively scale response times. Alternatively, it might lead to increased noise and triage fatigue for cybersecurity teams.
https://www.reddit.com/r/netsec/comments/1uzllm1/white_house_launches_aidriven_gold_eagle/ reddit.com
RSS Hunter RSS Hunter • Jul 18

[$13337] Confused Deputy: Google IdP Universal Account Takeover via Device Code Flow Hijacking

RFC 8628's device authorization grant lets a TV or CLI "poll" for login on a second screen. On Google's implementation, the entire session was transferable across browsers, the authorization server never checked that the client_id and scope in the consent URL matched the ones the device_code was issued for, and prompt=none turned the whole thing into a one-click, invisible account takeover. submitted by /u/swinglr
https://www.reddit.com/r/netsec/comments/1uy44c4/13337_confused_deputy_google_idp_universal/ reddit.com
RSS Hunter RSS Hunter • Jul 16

AI Agent for reconaissasion

A new AI-powered reconnaissance agent has been released and is now publicly available with limited free credits. Users can register at the provided link to try out the tool. To get started, users need to create a target by entering information and selecting "Environment: Lab." The target will initially be in a "Pending" state, requiring users to click "Verify." After verification, users can navigate to the Recon page, select their target, and initiate a reconnaissance scan. It is recommended to run reconnaissance on one target at a time due to the MVP release's infrastructure limitations. Organizations that do not perform at least one reconnaissance scan will be automatically removed from the system. The developer is seeking community feedback on this new tool. This agent aims to provide users with an efficient way to conduct reconnaissance. The current setup is designed for individual use rather than large-scale operations. Users should note the automatic cleanup policy for inactive accounts. This release marks an initial step for the reconnaissance agent.
https://www.reddit.com/r/netsec/comments/1uxvs4u/ai_agent_for_reconaissasion/ reddit.com
RSS Hunter RSS Hunter • Jul 16

Enhancing IIoT Security Using Digital Twins in Industry

The AI research centre at Torrens University Australia has helped produce a review of 110 studies on digital twins and IIoT security. What were the main takeaways? They have found that DTs are shifting away from passive monitoring to being a part of the defence architecture. One of the biggest weak points they found was in legacy sensors with low bandwidth. In these situations, there is a lag before the digital twin reflects a real-world change, and that lag is where attacks tend to slip in. Would be interested to hear your thoughts! Has anyone here dealt with that sync-gap problem on older hardware? submitted by /u/TorrensUni
https://www.reddit.com/r/netsec/comments/1uvzmuz/enhancing_iiot_security_using_digital_twins_in/ reddit.com
RSS Hunter RSS Hunter • Jul 14

AXON Body camera 3 of 4 hardware reverse cracking output video！

Recently, I saw someone selling a well-known second-hand market in China. Except for some functions that need to be connected to networking, the 4th generation is used normally. However, because AXON is not in the Chinese market, most of them purchase the activated version from eBay and then reverse. Will such a problem lead to the body camera video of some American enterprises and some unpublished videos of the police will be leaked. Then he sells these body3 and 4th generations at prices ranging from 1,000 dollars and about 1,500 US dollars respectively, and gives a unique software to read and delete it. The question is whether it is feasible or not, but it is not fake to see the real shot. submitted by /u/Thomas980130
https://www.reddit.com/r/netsec/comments/1uvtu8l/axon_body_camera_3_of_4_hardware_reverse_cracking/ reddit.com
RSS Hunter RSS Hunter • Jul 14

ExporTheft: 11 "AI Chat Exporter" Chrome extensions upload full chat content on PDF export, while the store listing says "No uploads to external servers"

Family of 11 same-codebase extensions (ChatGPT/Claude/Gemini/etc), ~5.5k users on the main one. Sold as local-only: the store listing says "No uploads to external servers," "Everything processed locally," "No tracking or telemetry." Observed in the tested version: PDF export POSTs the full conversation to the developer's Cloud Run backend. A local renderer is bundled but only runs as a fallback. Markdown/Text/JSON exports beacon title + source URL to /api/usage. The title is derived from your first message, so it can contain chat content. Every request carries an X-Client-ID in chrome.storage.sync, so it follows you across machines. Detection + full writeup: https://malext.io/reports/ExporTheft/ submitted by /u/Huge-Skirt-6990
https://www.reddit.com/r/netsec/comments/1uvrnbg/exportheft_11_ai_chat_exporter_chrome_extensions/ reddit.com
RSS Hunter RSS Hunter • Jul 13

CET-Compliant Callstack Spoofing via Thread Pool & Enum Callback Trampolining (Rust PoC)

I wrote this after spending an unreasonable amount of time making CET-compliant callstack spoofing work end-to-end on hardware with Intel CET enabled. The technique combines three primitives: thread pool execution for a clean stack base, enum callback trampolining for a real signed mid-stack frame, and indirect syscalls. The actual contribution is the CET compliance mechanism: a jmp-based context switch combined with direct shadow stack pointer reconciliation via RDSSPQ/INCSSPQ, without touching unwind metadata. Different approach from BYOUD. Implemented in Rust with inline assembly. submitted by /u/_MrTiz
https://www.reddit.com/r/netsec/comments/1uvnbim/cetcompliant_callstack_spoofing_via_thread_pool/ reddit.com
RSS Hunter RSS Hunter • Jul 13

CVE-2026-47291: Windows Critical Unauthenticated Remote Code Execution in HTTP.sys

A critical severity vulnerability has been discovered in the Windows HTTP protocol stack, also known as HTTP.sys, with a CVSS score of 9.8. This vulnerability allows for unauthenticated remote code execution via an integer overflow, which can have a high impact on the system. The HTTP.sys processes incoming HTTP requests in kernel mode, making it possible for an unauthenticated attacker to execute arbitrary code with system privileges. The mechanics of this bug have been thoroughly mapped out, including the assembly-level modifications, affected functions, and execution path. The details of the bug, including WinDbg reproduction details, are available in an attached link. This level of detail is now more readily available, unlike in the past when users had to wait to understand the changes made on Patch Tuesday. The platform that hosts this information tracks and analyzes the Windows patch ecosystem, providing real-time structural breakdowns. This makes it a useful resource for identifying similar kernel-level differentials and understanding the changes made to the system. The analysis of the HTTP.sys vulnerability is just one example of the type of information available on this platform. Overall, this vulnerability highlights the importance of keeping systems up to date with the latest patches to prevent exploitation by attackers.
https://www.reddit.com/r/netsec/comments/1uuh80d/cve202647291_windows_critical_unauthenticated/ reddit.com
RSS Hunter RSS Hunter • Jul 12

Closing the Timing Gap: Defensive Temporal Observability

The concept of time has been on the mind lately, particularly in relation to uptime, pulse checks, execution time, and response time, which are typically viewed as health metrics. These metrics can also be seen as security metrics, as they can provide insight into the security of a system. The idea that timing can be used as a security metric is not new, as it has been used in the past to detect covert timing channels and behavioral baselining. Attackers have long understood that timing can carry information, and researchers have demonstrated timing side-channel attacks against large language models. However, most research has focused on how timing can be exploited, rather than how it can be used to defend against attacks. A recent survey of LLM-agent security identified temporal anomaly detection infrastructure as an open research gap, highlighting the need for more research in this area. The survey noted that current agent deployment frameworks do not support the behavioral baselines needed for temporal anomaly detection, and the discussion has largely focused on session-level behavior. The space between observable events, or the rhythm within a single execution, remains largely unexplored, and it is possible that time is another dimension of observability that has been overlooked. By measuring behavioral changes and entropy across inter-arrival intervals, it may be possible to use timing as a signal rather than noise to improve security. The author is exploring this concept in their own work and is curious to know who else is working on the defensive side of temporal behavior, particularly for agentic systems.
https://www.reddit.com/r/netsec/comments/1uszoli/closing_the_timing_gap_defensive_temporal/ reddit.com
RSS Hunter RSS Hunter • Jul 10

Can AI-generated adversaries break TTP-based attribution? (arXiv 2026)

Cyber Threat Intelligence (CTI) has traditionally attributed attacks through Tactics, Techniques and Procedures (TTPs). In this paper we evaluate whether that assumption still holds when AI agents are explicitly configured to emulate known threat groups. We configured AI agents to reproduce the behavior of APT28, APT29, APT41, APT44 and Lazarus inside enterprise and military cyber ranges. Our results suggest that sufficiently capable AI agents can reproduce TTP patterns closely enough to make attribution based solely on behavioral evidence significantly more difficult. We'd be interested in feedback from practitioners working on CTI, attribution or adversary emulation. submitted by /u/Obvious-Language4462
https://www.reddit.com/r/netsec/comments/1uslf2v/can_aigenerated_adversaries_break_ttpbased/ reddit.com
RSS Hunter RSS Hunter • Jul 10

Towards CSI: What's the best harness? (arXiv 2026)

We studied a question that receives surprisingly little attention: Does the agent harness matter as much as the underlying LLM? We benchmarked five different cybersecurity scaffolds while keeping the model fixed (alias2-mini) across all 33 CyBench challenges. Key findings: No single scaffold performs best across every challenge. Combining heterogeneous scaffolds consistently improves coverage. A shared blackboard architecture solves 19/33 challenges (57.6%), outperforming every individual harness while reducing execution time. Paper: https://arxiv.org/pdf/2605.28334 Happy to answer technical questions or discuss the benchmarking methodology. submitted by /u/Obvious-Language4462
https://www.reddit.com/r/netsec/comments/1usj1gg/towards_csi_whats_the_best_harness_arxiv_2026/ reddit.com
RSS Hunter RSS Hunter • Jul 10

Drift Corpus: binary diffs of 240+ 2026 Windows kernel patches

Patch Tuesday confirms a CVE is fixed but not what changed in the binary, which function, which check, or whether it's a real fix or just churn. The Drift Corpus is a diff of 240+ 2026 Windows kernel patches. Per entry: the changed functions with assembly, the bug class and call chain, WinDbg breakpoints to reproduce, and a plain-English root cause. Browse: https://byteray-ai.github.io/drift-corpus Repo: https://github.com/ByteRay-AI/drift-corpus This repository breaks down Microsoft’s monthly kernel patches into clear binary changes, giving researchers a practical roadmap to find adjacent bugs, build faster EDR detections, and write precise firewall and network rules to block exploits at the perimeter. submitted by /u/Emergency_Stable_923
https://www.reddit.com/r/netsec/comments/1uqxlxq/drift_corpus_binary_diffs_of_240_2026_windows/ reddit.com
RSS Hunter RSS Hunter • Jul 8

GitLost: a public GitHub issue can steer an org's Agentic Workflow into leaking private repo contents, and a one-word prefix ("Additionally") bypassed the threat-detection guardrail

Noma Security has revealed a vulnerability called GitLost targeting GitHub Agentic Workflows. These workflows use AI agents that can access repositories, including private ones, if granted a personal access token. The core of the vulnerability lies in how an attacker can exploit this broad access through a seemingly normal issue on a public repository.GitLost demonstrates indirect prompt injection, shifting the focus from manipulating an agent's output to controlling its actions based on its permissions. The agent, acting as a credentialed entity, can read private repository information that the attacker otherwise cannot access. An example involved the agent reading a private README and posting it as a public comment, serving as the exfiltration channel.GitHub implemented defenses like sandboxing and input cleaning, but Noma found that a simple prefix like "Additionally" bypassed the output scanner. This bypass highlights a fundamental challenge: the difficulty in separating instructions from data in natural language prompts. The issue is structural, as prompt injection is hard to entirely filter out.This vulnerability aligns with the "lethal trifecta" concept: an agent with access to private data, ingesting untrusted content, and possessing an outbound data channel. Noma emphasizes that architectural solutions like isolation and scoped credentials are more effective than pattern-matching defenses. Several other studies, including those by Aikido, Orca, and Invariant Labs, show similar patterns of agents leaking secrets or accessing private data. These findings suggest a broader class of vulnerabilities in current agentic systems.To mitigate these risks, Noma suggests limiting the scope of personal access tokens to single repositories instead of granting organization-wide access. They also recommend restricting what public-facing workflows can post and gating outputs through human review rather than relying solely on threat detection scans. Restricting which authors' content an agent will act upon is another proposed mitigation strategy.
https://www.reddit.com/r/netsec/comments/1upy3gm/gitlost_a_public_github_issue_can_steer_an_orgs/ reddit.com
RSS Hunter RSS Hunter • Jul 7

A rule mapped to MITRE is not the same as real coverage

Many organizations claim coverage for MITRE ATT&CK techniques based on the mere existence of a rule or collected data. However, true coverage requires a tuned alert that generates actionable insights for analysts. The absence of a functioning alert, even with available data, means detection relies solely on proactive hunting. A significant gap exists when organizations report having data but no effective detection mechanism.Valid Accounts (T1078) is frequently exploited using legitimate credentials, necessitating behavioral baselines beyond simple login success. Detecting Defense Evasion, such as disabling security tools or logging, presents another common and serious vulnerability. New Account Creation (T1136) events, though often logged, frequently lack proper alerting for suspicious activity outside standard administrative processes.Achieving genuine coverage demands honesty about detection capabilities. True coverage implies data availability, a working and tuned detection rule, analyst visibility, and a defined response plan. Without these elements, ATT&CK heatmaps offer a misleading visual representation of security posture. The question remains which techniques are commonly mislabeled as covered by others.
https://www.reddit.com/r/netsec/comments/1upxwln/a_rule_mapped_to_mitre_is_not_the_same_as_real/ reddit.com
RSS Hunter RSS Hunter • Jul 7

New OST2 class: "Architecture 1901: From zero to QEMU - A Gentle introduction to emulators from the ground up!"

This free class by Antonio Nappa of Fuzz Society builds up your knowledge from learning a toy 8-bit CPU architecture all the way to understanding how QEMU can emulate that architecture. Using this knowledge you can then understand how QEMU can emulate any architecture! Based on beta testing, this class takes an average of 8h47m to complete, and a median of 7h26m. submitted by /u/OpenSecurityTraining
https://www.reddit.com/r/netsec/comments/1uoz05q/new_ost2_class_architecture_1901_from_zero_to/ reddit.com
RSS Hunter RSS Hunter • Jul 6