Notices by k3ym𖺀 (k3ym0@infosec.exchange)

Everyone: “nobody uses DNS tunneling in the real world, it’s a CTF meme.”

TrickBot 2026: hiding C2 payloads in the high 6 bits of IPv4 responses at 30 KB/s while your DNS logs sit unread in a bucket nobody has queried since 2023.

That’s not exfil, that’s a dial-up modem with extra steps. And it’s still faster than your change advisory board.

https://www.fortinet.com/blog/threat-research/inside-a-trickbot-variant-using-dns-tunneling-for-c2

#infosec #threatintel #dns

In today's episode of "Can It Run Doom": DNS fucking TXT records.

Some absolute madlad (cough Adam Rice cough) compressed the entire shareware DOOM WAD, split it into around 1,964 chunks, shoved them into Cloudflare TXT records, and wrote a PowerShell script that reassembles and runs the whole goddamn game from DNS queries alone. Nothing touches disk. The DLLs are in DNS. THE FUCKING DLLS ARE IN DNS.

RFC 1035 was written in 1987. Those engineers are spinning in their graves fast enough to generate municipal power.

Bonus: this is a fully functional globally-distributed covert data exfil channel that your NGFW will never fucking see if you're not doing deep DNS inspection. Sleep well.

blog: https://blog.rice.is/post/doom-over-dns/

repo: https://github.com/resumex/doom-over-dns

Also lmao @ every blue team that has never once looked at their DNS query volume. How's that DLP policy working out for you.

It was always DNS.

#infosec #dns #doom #itisalwaysdns

The person with 2 years of food storage and no relationships is less resilient than the person with 2 months of storage and a neighborhood that gives a shit about each other.

#ClimateChange #ClimateResilience

You're paying AI companies a monthly subscription fee to be fingerprinted like a parolee.

I got bored and ran uBlock across Claude, ChatGPT, and Gemini simultaneously.

Claude:

• Six parallel telemetry pipelines.
• A tracking GIF with 40 browser fingerprint data points baked into the URL, routed through a CDN proxy alias specifically to make it harder to block.
• Intercom running a persistent WebSocket whether you use it or not.
• Honeycomb distributed tracing on a chat UI because apparently your conversation needs the same observability stack as a payments microservice.

ChatGPT:

• proxies telemetry through their own backend to hide the Datadog destination URL from blockers.
• uBlock had to deploy scriptlet injection — actual JS injected into the page to intercept fetch() at the API level — because a network rule wasn't enough.
• Also ships your usage data to Google Analytics. OpenAI. To Google. You cannot make this up.
• Also runs a proof-of-work challenge before you're allowed to type anything.

Gemini:

• play.google.com/log getting hammered with your full session behavior, authenticated with three SAPISIDHASH token variants, piped directly into the Google identity supergraph that correlates everything you've ever done across every Google product since 2004.
• Also creates a Web App Activity record in your Google account timeline. Also has "ads" in one of the telemetry endpoint subdomains.

When uBlock blocks Gemini's requests, the JS exceptions bubble up and Gemini dutifully tries to POST the error details back to Google. uBlock blocks that too. The error messages contain the internal codenames for every upsell popup that failed to load.

KETCHUP_DISCOVERY_CARD.
MUSTARD_DISCOVERY_CARD.
MAYO_DISCOVERY_CARD.

Google named their subscription upsell popups after condiments and I found out because their error handler snitched on them.

All three of these products cost money.
One of them is also running ad infrastructure.

Touch grass. Install @ublockorigin

#infosec #privacy #selfhosted #foss #surveillance

this checks out lmao

🚨 Just In: For the 5th year in a row, Cloudflare has been rated highest in Completeness of Vision and Ability to Execute in the Gartner Magic Quadrant for Malware Delivery Infrastructure.

Unmatched scalability. Global reach. Seamless deployment.

The preferred platform for payload delivery—at any scale.

Read full Press Release here: https://paste.lol/k3ym0/cloudflare-recognized-for-fifth-consecutive-year-in-gartner-magic-quadrant-for-malware-delivery-infrastructure

#Cloudflare #GartnerMQ #CyberInfrastructure #ThreatOps #Crimeflare

ALL I WANT FOR CHRISTMAS IS FOR CLOUDFLARE TO STOP BEING THE WORLD LEADER IN MALWARE DISTRIBUTION.

FUUUCCKCKCKKK

@ryanc was I supposed to sing this in my head to the melody of “I’m Gonna Be (500 miles)” by The Proclaimers?

Because I did.

Hey everyone, just a gentle reminder to PATCH YOUR FUCKING SHIT.

-- Your Friendly Neighborhood IT Janitor

Maintenance windows and dev/QA are for rookies. Push that shit to prod. What could go wrong? #FamousLastWords

"They say violence never solves anything, but to quote The Onion: that's only true so long as you ignore all of human history."

-- Excerpt from the short story "Radicalized" by @pluralistic

@joshbressers @eff I’ll save you the effort: there is nothing, absolutely ziltch, that is more cool than @eff swag.

@drahardja @pluralistic the doomsday prepper mentality poses a challenging dichotomy for me now. Me, like many others, are terrified of what will come to pass over the next four years, and are trying to figure out how best to prepare.

It seems as though the main difference between the two groups of preppers is simply their perception of reality.

Oh and also one group isn't bigots, so there's that.

If someone ever tells you they don't support the idea of preferred pronouns, make sure you always call them by their non-preferred pronouns and watch their mind melt.

@GossiTheDog whhhatt? When did this come out??? Or are you on pre-release?

When you successfully secure all your endpoints, but not your core infrastructure.

@mdhughes this is awesome. Reminds me of this: https://stevenrhodes.threadless.com/designs/worship-coffee/mens/t-shirt

@Lockdownyourlife he finally won a popular vote lmao

(inhales sharply)

AAAHHHHHHHAHAHAHAHAHAHAHAHAHAHA

(ghasps for air)

AAAHHHHHHHAHAHAHAHAHAHAHAHAHHAHA