It’s worth noting that while the Security Explorations project focused on Kigen products, eUICC/eSIM chips from several other vendors may be vulnerable to similar attacks as the underlying issue is related to a series of vulnerabilities found in Oracle’s Java Card technology.

The Java Card flaws were disclosed by Security Explorations in 2019, but Oracle and SIM card manufacturers using the technology downplayed their potential impact at the time.

In order to conduct an attack, the attacker needs temporary physical access to the device with the targeted eSIM. The goal is to extract a key that allows the installation of a malicious Java Card application.

27% of all PIN numbers

PIN Numbers

Number Numbers

Okay, this didn’t make me twitch at all. Nope.

Air Force generative AI chatbot

NIPRGPT, developed as an experimental project of by the Air Force Research Laboratory, aims to give military personnel a generative AI Large Language Model (LLM) comparable to OpenAI’s ChatGPT, but free of the security, data protection and privacy concerns posed by consumer AI products.

I am not against AI in principal but this shit is absurd.

Or might as well say “Yes, I like money and want to sell to the DoD.” Source: may have used it in a slide deck once. Not actually sure, as the phrase wasnt as popular back then.

ew. Tell your government to stop mandating spyware.

Graphene does let you re-lock the bootloader. IIRC, whether an app works depends on whether they require SafetyNet full, or just basic. I have so far only found one app that refuses to work. However… it looks like MitID was recently updated and no longer works.

https://gist.github.com/lbschenkel/4199be415f2a139b64688ae74c92a7fc

Starting on 2024-06-12, MitID have started using Google Play Integrity API during activation. This means that new installations will no longer work in GrapheneOS nor any other non-stock Android, as they are not certified by Google and will not pass the required checks. The app still works (for now) if you managed to get it activated before that date.

I agree it would be concerning if I allowed Gemini access to my phone. Fuck that. This shit is exactly why I am on GrapheneOS.

The blog series, for the uninitiated:

Derek Lowe’s blog on science.org

https://www.science.org/topic/blog-category/things-i-wont-work-with

Holy shit you actually covered my use case perfectly (pocket+kobo > koreader+wallabag)! Thanks for putting this together, it is great.

ATT does financing for phones, etc. Presumably that is why.

Detailed technical analysis by GreyNoise

https://www.labs.greynoise.io/grimoire/2025-03-28-ayysshush/

I still have a few Asus routers capable of running the older version with the CVE-2023-39780 vulnerability. This makes me wonder whether it might be worth making one into a honeypot for fun.

Yes, and where I work the HV line is several times that.

I am re-re-factoring my plans for homelab 3.0 and the migration to it. Hardware budget is non-existant so I am trying to figure out how to do everything with what I already own, while re-organizing to better use what I have to make some room. Adding a few sticks of RAM and replacing some older cat5 are all I will do this year.

Not much, really. I do comment changes to config files and such.

I have only tested them a bit and it worked fine, but I havent relied on it “in production”, as it were. I use that machine for too many things for it to be any kind of benchmark. Mine is running on an old HP workstation w/ a 7th gen iGPU chip. I am also relying on it for plex and unmanic using QSV for transcoding. It only ever has trouble if I over-tax it with those.

I use Nextcloud (currently using their AIO docker images) for all of that. Not sure if it checks all the boxes perfectly, but if not it is probably as close as youll find ready-made.

It seems likely you are using it tethered, vs wireless.

Yeap, same. I have given up on Android Auto because of that. I am not going to let Google hold my phone hostage so they can force me to pay ransom (with my data.)

I never use a Play Store version of anything I can find on F-droid or other repos I trust. Then I try it using Aurora Store. Only as a last-resort I try Google. Play Store is only for things I cannot obtian or replace another way.

the Kligon Empire is experiencing the tail and of a very long fall from grace. It explains a lot about how such a violent fuedal society could have science on par with the Federation.

It turns out the real 'merica was the Klingons we met along the way.

https://www.schneier.com/blog/archives/2014/03/firewalk_nsa_ex.html

FIREWALK is a bidirectional network implant, capable of passively collecting Gigabit Ethernet network traffic, and actively injecting Ethernet packets onto the same target network.