Login
You're viewing the mastodon.bd public feed.

Replies

  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • Theafoundthefault@tech.lgbt
    Nov 5, 2026, 4:53 AM

    @briankrebs It is terrifying to think of what is compromised inside the government that nobody has detected yet.

    💬 0🔄 3⭐ 2
  • Justin O'Learyolearysec@infosec.exchange
    Nov 5, 2026, 5:00 AM

    @briankrebs

    The number I keep coming back to is 28. One infected endpoint showed up in 28 separate proxy pools, which means anyone with a few dollars and a rotating proxy plan could send traffic out of an Executive Office of the President address. Layer3 wasn't even looking for the White House. They bought generic access and some of their requests happened to exit from AS2650.

    A proxy SDK keeps a persistent outbound connection to someone else's infrastructure and relays whatever it is told to. If malware did that we would call it a C2 implant. Synthient's Kimwolf work already showed that a buggy SDK can give the proxy customer a path into the local network, not just an exit IP.

    This ran for 26 of 30 days on a Windows 11 machine running consumer software, and a startup watching from outside caught it before anyone inside did. Spur, Synthient and Layer3 all publish per-ASN context pages, so anyone running a network can check their own address space right now.

    In Kubernetes we treat egress as policy. On most endpoint fleets it is still a suggestion, and this is what that looks like.

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • Forkmeshforkmesh@mastodon.social
    Nov 5, 2026, 8:56 AM

    @briankrebs great reporting. Always love your articles. Let us know if you have any repositories that need mirroring. We’re also looking for letters of support and would value your viewpoint immensely.

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • Clemens Zaunerczauner@vivaldi.net
    Nov 5, 2026, 10:22 AM

    @briankrebs

    I'm lost of words. Not about the fact, that some staffers installed malware, but about the fact that that wasn't picked up by anyone responsible for IT-Security over there.

    Basically the WH got p0wn3d, and nobody noticed. Who's running IT there? Grok?

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • derptroncrazyeddie@mastodon.social
    Nov 5, 2026, 1:58 PM

    @briankrebs They probably can't tell what the IP segmentation is from outside to tell if these are all on a "guest" network or something. If they're allowing people to use their personal device on secure networks, or allow them to install just whatever on their secure phones, then shit's really bad security wise over there. So I can only hope these are all on some DMZ that IT knows is full of insecure nonsense and they don't even watch, just put a condom around it. Like dorms at a college.

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0
  • BillSempf@infosec.exchange
    Nov 5, 2026, 4:59 PM

    @briankrebs This seems kind of like a snooty question, but I guarantee it is not meant that way. Are you certain there isn't somebody over there with the residential proxy software purposefully installed on their machine so that they can do what they want: log in from home, or go out and use other people's residential proxies so that the people in the White House can't see what they're doing, or something of that nature? That seems slightly more likely than something virus-driven, business logistics-wise. Technically, of course, malware is 100% possible.

    💬 0🔄 0⭐ 0
  • 💬 0🔄 0⭐ 0