Weekly thread to discuss whatever you’re working on, big or small, at work or in your free time.

making this post hidden because it doesnt seem well recieved. maybe its the wrong community for the feedback im after.

sorry.

TLDR; for my project i wanted the signal protocol that would work in a browser. i couldnt find something suitable... so empowered by AI, i tried to create something myself. i dont want to inspire undue confidence.

IMPORTANT: this project is not professionally audited or production ready.

for my p2p messaging project (a webapp) i wanted to explore an usage of the Signal protocol.... the investigation is still in progress and far from finished. its clear that the Signal protocol is not intended for a p2p architecture with it needing things like pre-keys stored on servers. so it seems nessesary to adapt it.

i looked around for a suitable implementation i could use. compiling the implementation in lib-signal-go to a wasm seemed like an option that worked... i was concerned about it seeming unmaintained and not mention of an audit. perhaps naive, but i decided to see if it could put something together. i started off creating something using browser-based cryptograpy primitives. i would have like to keep it that way, but an ealier AI audit disagreed to using those primitives and so i moved towards an attempt in rust that compiles to wasm.

https://github.com/positive-intentions/cryptography/tree/staging/src/rust

i added several unit tests and and got AI to try create better securty audits, and i think its working well. (or at least well enough). AI's security audit points me to many things i can improve throughout (so i will when i can).

this is fairly complicated stuff and i know better than to ask people to spend their own time to review my experimental project... im not sharing for you to review my code; im sharing this here if this is interesting for anyone to take a look.

(note: the repo is getting a bit too "full" and i will be splitting it into a separate repo for just the signal implementation.)

(note 2: im aiming for it to be aligned to the correct spec. im completely aware about concerns around using AI in the domain of cybersec. its great to have an opinion on the matter, but its not a fruitful conversation to be shocked that "AI is being used in 2025". the source and audit are provided for transparency. if there is something wrong with the details, thats what i want to discuss and fix.)

How can I check to see if a given Onion Service is still in-use?

To be clear: I'm not asking about just Onion Services bound to port 80. Of course I can just curl it, but that won't tell me if the Onion Service is running something on another port.

I'm trying to find an XMPP server that uses an Onion Service. I found several lists of XMPP servers and their .onion names, but I expect most of these services are offline.

2n3tvihf4n27pqyqdtcqywl33kbjuv2kj3eeq6qvbtud57jwiaextmid.onion
32qywqnlnqzbry42nmotr47ebts3k6lhiwfob6xniosmepz2tsnsx7ad.onion
4colmnerbjz3xtsjmqogehtpbt5upjzef57huilibbq3wfgpsylub7yd.onion
6voaf7iamjpufgwoulypzwwecsm2nu7j5jpgadav2rfqixmpl4d65kid.onion
6w5iasklrbr2kw53zqrsjktgjapvjebxodoki3gjnmvb4dvcbmz7n3qd.onion
7drfpncjeom3svqkyjitif26ezb3xvmtgyhgplcvqa7wwbb4qdbsjead.onion
ae3w7fkzr3elfwsk6mhittjj7e7whme2tumdrhw3dfumy2hsiwomc3yd.onion
chillingguw3yu2rmrkqsog4554egiry6fmy264l5wblyadds3c2lnyd.onion
fzdx522fvinbaqgwxdet45wryluchpplrkkzkry33um5tufkjd3wdaqd.onion
gku6irp4e65ikfkbrdx576zz6biapv37vv2cmklo2qyrtobugwz5iaad.onion
gois4b6fahhrlsieupl56xd6ya226m33abzuv26vgfpuvv44wf6vbdad.onion
j4dhkkxfcsvzvh3p5djkmuehhgd6t6l7wmzih6b4ss744hegwkiae7ad.onion
jabjabdea2eewo3gzfurscj2sjqgddptwumlxi3wur57rzf5itje2rid.onion
jaswtrycaot3jzkr7znje4ebazzvbxtzkyyox67frgvgemwfbzzi6uqd.onion
jeirlvruhz22jqduzixi6li4xyoweytqglwjons4mbuif76fgslg5uad.onion
jukrlvyhgguiedqswc5lehrag2fjunfktouuhi4wozxhb6heyzvshuyd.onion
mrbenqxl345o4u7yaln25ayzz5ut6ab3kteulzqusinjdx6oh7obdlad.onion
nixnet54icmeh25qsmcsereuoareofzevjqjnw3kki6oxxey3jonwwyd.onion
qawb5xl3mxiixobjsw2d45dffngyyacp4yd3wjpmhdrazwvt4ytxvayd.onion
qwikoouqore6hxczat3gwbe2ixjpllh3yuhaecixyenprbn6r54mglqd.onion
qwikxxeiw4kgmml6vjw2bsxtviuwjce735dunai2djhu6q7qbacq73id.onion
razpihro3mgydaiykvxwa44l57opvktqeqfrsg3vvwtmvr2srbkcihyd.onion
rurcblzhmdk22kttfkel2zduhyu3r6to7knyc7wiorzrx5gw4c3lftad.onion
szd7r26dbcrrrn4jthercrdypxfdmzzrysusyjohn4mpv2zbwcgmeqqd.onion
xdkriz6cn2avvcr2vks5lvvtmfojz2ohjzj4fhyuka55mvljeso2ztqd.onion
xiynxwxxpw7olq76uhrbvx2ts3i7jagqnqix7arfbknmleuoiwsmt5yd.onion
xmppccwrohw3lmfap6e3quep2yzx3thewkfhw4vptb5gwgnkttlq2vyd.onion
ynnuxkbbiy5gicdydekpihmpbqd4frruax2mqhpc35xqjxp5ayvrjuqd.onion
yxkc2uu3rlwzzhxf2thtnzd7obsdd76vtv7n34zwald76g5ogbvjbbqd.onion

I don't want to eliminate them just for not running an HTTP server (eg port 80, 443, 8080, etc). Nor do I want to eliminate them for not running on a common XMPP port (5222, 5223, 5269, 5298, 8010). I'm trying to find something that checks if an Onion Service has been used in the past days/weeks without requiring me to test a connection on a given port.

My understanding is that Onion Services will (by default) generate and publish hidden service descriptors (HSDir).

Is there some way I can query the Tor directory of HSDirs to see if a given Onion Service is still active?

cross-posted from: https://lemmy.sdf.org/post/45081057

Archived

Oct 31, 2025Ravie LakshmananMalware / Threat Intelligence

A China-affiliated threat actor known as UNC6384 has been linked to a fresh set of attacks exploiting an unpatched Windows shortcut vulnerability to target European diplomatic and government entities between September and October 2025.

The activity targeted diplomatic organizations in Hungary, Belgium, Italy, and the Netherlands, as well as government agencies in Serbia, Arctic Wolf said in a technical report published Thursday.

"The attack chain begins with spear-phishing emails containing an embedded URL that is the first of several stages that lead to the delivery of malicious LNK files themed around European Commission meetings, NATO-related workshops, and multilateral diplomatic coordination events," the cybersecurity company said.

[...]

https://archive.is/LeS5L

Running suspicious software in a virtual machine seems like a basic precaution to figure out whether said software contains naughty code. Unfortunately it’s generally rather easy to detect whether or not one’s software runs inside a VM, with [bRootForce] going through a list of ways that a VirtualBox VM can be detected from inside the guest OS. While there are a range of obvious naming issues, such as the occurrence of the word ‘VirtualBox’ everywhere, there many more subtle ways too.

Demonstrated is the PoC ‘malware’ application called Al-Khaser, which can be used to verify one’s anti-malware systems, such as when trying to unleash a debugger on a piece of malware, run it inside a VM, along with many more uses. Among its anti-virtualization features are specific registry key names and values, file system artefacts, directory names, MAC addresses, virtual devices, etc.

In order to squeeze by those checks, [bRootForce] created the vbox_stealth shell script for Bash-blessed systems in order to use the VirtualBox Manager for the renaming of hardware identifier, along with the VBoxCloak project’s PowerShell script that’s used inside a Windows VirtualBox guest instance to rename registry keys, kill VirtualBox-specific processes, and delete VirtualBox-specific files.

Weekly thread to discuss whatever you’re working on, big or small, at work or in your free time.

Running suspicious software in a virtual machine seems like a basic precaution to figure out whether said software contains naughty code. Unfortunately it’s generally rather easy to detect whether or not one’s software runs inside a VM, with [bRootForce] going through a list of ways that a VirtualBox VM can be detected from inside the guest OS. While there are a range of obvious naming issues, such as the occurrence of the word ‘VirtualBox’ everywhere, there many more subtle ways too.

...

In order to squeeze by those checks, [bRootForce] created the vbox_stealth shell script for Bash-blessed systems in order to use the VirtualBox Manager for the renaming of hardware identifier, along with the VBoxCloak project’s PowerShell script that’s used inside a Windows VirtualBox guest instance to rename registry keys, kill VirtualBox-specific processes, and delete VirtualBox-specific files.

I've been exploring a cryptographic concept I can't find an existing name for, and I'd appreciate the community's insight. While I suspect it's overly redundant or computationally heavy, initial testing suggests performance isn't immediately crippling. I'm keen to know if I'm missing a fundamental security or design principle.

The Core Concept

Imagine nesting established, audited cryptographic protocols (like Signal Protocol and MLS) inside one another, not just for transport, but for recursive key establishment.

1. Layer 1 (Outer): Establish an encrypted channel using Protocol A (e.g., Signal Protocol) for transport security.
2. Layer 2 (Inner): Within the secure channel established by Protocol A, exchange keys and establish a session using a second, distinct Protocol B (e.g., MLS).
3. Layer 3 (Deeper): Within the secure channel established by Protocol B, exchange keys and establish a third session using a deeper instance of Protocol A (or a third protocol).

This creates an "encryption stack."

Key Exchange and Payload Encryption

• Key Exchange: Key material for a deeper layer is always transmitted encrypted by the immediate outer layer. A round-robin approach could even be used, where keys are exchanged multiple times, each time encrypted by the other keys in the stack, though this adds complexity.
• Payload Encryption: When sending a message, the payload would be encrypted sequentially by every layer in the stack, from the deepest inner layer (Layer N) out to the outermost layer (Layer 1).

Authenticity & Verification

To mitigate Man-in-the-Middle (MITM) attacks and ensure consistency across the layers, users could share a hash computed over all the derived public keys/session secrets from each established layer. Verifying this single combined hash would validate the entire recursive key establishment process.

The Question for the Community

Given that modern protocols like Signal and MLS are already robustly designed and audited:

1. Are there existing cryptographic terms for this concept of recursively nesting key exchanges? Is this a known (and perhaps discarded) pattern?
2. What are the fundamental security trade-offs? Does this genuinely add a measurable security margin (e.g., against a massive quantum break on one algorithm but not the other) or is it just security theater due to the principle of "more is not necessarily better"?
3. What are the practical and theoretical cons I may be overlooking, beyond computational overhead and complexity? Is there a risk of creating cascading failure if one layer is compromised?

I'm prototyping this idea, and while the overhead seems tolerable so far, I'd appreciate your technical critique before considering any real-world deployment.

my wording before AI transcription:

i dont know how to describe it more elegantly. i hope the title doesnt trigger you.

i was thinking about a concept and i couldnt find anything online that matched my description.

im sure AI is able to implement this concept, but i dont see it used in other places. maybe its just computationally heavy and so considered bad-practice. its clearly quite redundent... but id like to share. i hope you can highlight anything im overlooking.

in something like the Signal-protocol, you have an encrypted connection to the server as well as an additional layer of encryption for e2e encryption... what if we used that signal-protocol encrypted channel, to then exchange MLS encryption keys... an encryption protocol within an encryption protocol.

... then, from within the MLS encrypted channel, establish an additional set of keys for use in a deeper layer of the signal protocol. this second layer is redundent.

you could run through the "encryption stack" twice over for something like a round-robin approach so each key enchange has been encrypted by the other keys. when encrypting a payload you would be encrypting it it in order of the encryption-stack

for authenticity (avoiding MITM), users can share a hash of all the shared public keys so it can verify that the encryption key hashes match to be sure that each layer of encryption is valid.

this could be very complicated to pull off and unnessesary considering things like the signal, mls, webrtc encryption should already be sufficiently audited.

what could be the pros and cons to do this?... im testing things out (just demo code) and the performance doesnt seem bad. if i can make the ux seamless, then i would consider rolling it out.

same question on reddit (has some responses): https://www.reddit.com/r/crypto/comments/1oi4xqt/multiprotocol_cascading_roundrobin_cipher

In December 2024, the UN General Assembly adopted the United Nations Convention against Cybercrime — the first international treaty on criminal justice in more than two decades.

The adoption of the document was the result of five years of negotiations among UN Member States, with the participation of experts, civil society, academia, and the private sector.

UN Secretary-General António Guterres called the adoption of the Convention “a decisive step” in global efforts to ensure safety online.

On 25 October, the Convention will be opened for signature at an official ceremony in Hanoi, Viet Nam. It will enter into force 90 days after ratification by 40 States.

Global response to global threat

The new document establishes a common international framework for combating cybercrime. It introduces unified definitions, investigation standards, and mechanisms for assisting victims — including compensation, restitution, and removal of illegal content.

States will implement these measures in accordance with their national legislation but within agreed international principles. And perhaps, with this Convention, a new era will begin — one in which a single wrong letter in a website address will no longer cost you everything.

The United Nations Office on Drugs and Crime (UNODC) leads the UN response to cybercrime with training and support to countries across the world.

The Vienna-based agency draws upon its specialized expertise on criminal justice systems to provide technical assistance in prevention and awareness-raising, legislative reform, revamping of law enforcement capabilities, international cooperation, forensic support as well as in data collection, research and analysis on cybercrime.

The name, that is.

I was curious if Burp Suite's Dafydd Stuttard was Welsh, which led me to his AMA video.

PortSwigger was his handle when he was starting out, and was a pun about the fortified wine from Portugal and port scanners.

That vid also answers who is Peter Wiener.

The makers of BIND, the Internet’s most widely used software for resolving domain names, are warning of two vulnerabilities that allow attackers to poison entire caches of results and send users to malicious destinations that are indistinguishable from the real ones.

The vulnerabilities, tracked as CVE-2025-40778 and CVE-2025-40780, stem from a logic error and a weakness in generating pseudo-random numbers, respectively. They each carry a severity rating of 8.6. Separately, makers of the Domain Name System resolver software Unbound warned of similar vulnerabilities that were reported by the same researchers. The unbound vulnerability severity score is 5.6

cross-posted from: https://lemmy.sdf.org/post/44445362

Archived

• Notorious hacking group Salt Typhoon has likely been targeting Telecom orgs
• Researchers identified tactics previously used by the group
• Salt Typhoon breached up to 8 US telecom networks in a huge cyber-espionage campaign

[...]

A new report from Darktrace claims the [Chinese hacking group Salt Typhoon] has been observed, "targeting global infrastructure using stealthy techniques such as DLL sideloading and zero-day exploits."

The early stage intrusion activity detected mirrors previous Salt Typhoon tactics, such as the prolific attacks on up to 8 different telecom organizations in a far reaching and potent multi-year campaign which resulted in the group stealing information from millions of American telecom customers using a high severity Cisco flaw to gain access and eventually collect traffic from the networks devices were connected to.

[...]

Weekly thread for any and all career, learning and general guidance questions. Thinking of taking a training or going for a cert? Wondering how to level up your career? Wondering what NOT to do? Got other questions? This is the time and place to ask!

How did the changes in the binary test files tests/files/bad-3-corrupt_lzma2.xz and tests/files/good-large_compressed.lzma, and the makefile change in m4/build-to-host.m4) manifest to the Debian maintainer? Was there a chance of noticing something odd?

I just watched "Decentralized Authentication is Our Only Hope" and the dude presented a new method of authentication that went over my head. Back when reading SQRL my first thought was "damn, that's genius".

My credentials lie pretty far from cybersecurity and I'm way out of date on auth (OAuth I understand, but not webauthn and FIDO, etc.), so if somebody could maybe explain why SQRL didn't catch on, that'd be great. Was it too complciated? Did something better come along? Just general inertia?

The Microsoft Digital Defense Report 2025 provides an in-depth look at the current state of cybersecurity, emerging threats, and the future of digital defense. The report is structured around three key areas:

Current Threat Landscape: It highlights the current cybersecurity landscape, including the rise of state-sponsored threats, advanced persistent threats (APTs), ransomware, and the increased use of AI in cyber attacks. It discusses the growing trend of cyber threats targeting cloud services, supply chains, and IoT devices.

The report also mentions the evolving threat landscape in the context of the war in Ukraine, emphasizing the impact of cyber warfare and espionage on global digital security.

Emerging Trends and Technologies: The report covers the impact of AI and machine learning on both cybersecurity and cyber threats. On one hand, AI is being used to enhance threat detection and response, but it's also being used by malicious actors to launch more sophisticated attacks.

It discusses the challenges and opportunities in securing the metaverse, including new attack vectors and the need for new security paradigms in virtual and augmented reality environments.

There's also an emphasis on the role of 5G and edge computing in the future of digital defense, highlighting both the potential for improved security (through improved connectivity and data processing capabilities) and new vulnerabilities. Defense Strategies and Recommendations: Microsoft advocates for a shift towards more proactive and predictive approaches to cybersecurity, including the use of AI and automation for threat detection and incident response.

It stresses the importance of a "defense-in-depth" strategy that combines multiple layers of security, including identity and access management, endpoint security, and cloud security.

The report highlights the need for collaboration between the public and private sectors, as well as across international borders, to combat the increasingly globalized nature of cyber threats.

It also touches on the importance of securing software supply chains, enhancing user education and awareness, and the role of cybersecurity as a core aspect of business continuity and resilience planning.

Special Focus on Government and Industry Responses: The report offers insights into how governments and industries worldwide are responding to these threats, including legislative and regulatory efforts, international cooperation, and industry best practices.

It discusses the role of national cybersecurity agencies and international organizations in setting standards and coordinating responses to global threats. There's also a focus on the importance of addressing the skills gap in cybersecurity, with recommendations for education and training programs to ensure there are enough skilled professionals to meet the growing demand.

Future Outlook: Microsoft provides a forward-looking perspective on what the next few years might hold, including predictions for how AI, quantum computing, and the evolution of digital infrastructure might shape both threats and defenses. It also outlines the need for continuous innovation in cybersecurity technologies and practices to stay ahead of threats.

The Microsoft Digital Defense Report 2025 serves as a comprehensive guide for organizations and governments looking to understand the current state of cybersecurity and prepare for future threats, emphasizing collaboration, innovation, and a proactive approach to digital defense.

(Summary by Apertus PublicAI)