Software Engineer | I uncover the stories behind hackers, tech, business & the internet.
🌐 Internet
Joined October 2022
- Tweets1.3K
- Following244
- Followers413
- Likes8.1K
Brahim retweeted
Reason 1: RATs are real and common.
Remote Access Trojans are a documented, widespread category of malware. they include webcam access as a standard feature. Operators can activate webcams silently on victim machines.
Reason 2: There's a possibility indicator light can be bypassed.
Johns Hopkins researchers published a paper in 2013 showing they could reprogram a MacBook webcam's firmware to operate independently of the LED indicator. camera on. light off. This works on any webcam where the LED is firmware-controlled rather than hardwired to the power circuit.
Reason 3: a physical cover is the best.
No exploit or malware can get to it.
Reason 4: the FBI said so.
in 2016, FBI Director James Comey said he covers his webcam. He said it was basic security hygiene. the head of the agency that investigates computer crimes covers his camera.
Brahim retweeted
No. Private Browsing mainly prevents your browser from saving things like your history and cookies locally.
It does not make you invisible online. Websites, your network provider and other parties may still be able to see or identify your activity.
Brahim retweeted
The main tools law enforcement use for this are GrayKey (Grayshift / Magnet Forensics) and Cellebrite UFED.
Both cost tens of thousands of dollars per unit. They exploit vulnerabilities in iOS. On a supported device, a 4-digit PIN can fall in minutes. A 6-digit PIN can take hours. A long alphanumeric passcode can take long enough to be impractical.
Leaked 2024 support matrices showed GrayKey could only partially unlock most iPhones running iOS 18. Partial is not a full dump. Public reporting treated it as unencrypted files, folder structure, and file sizes not Messages, Photos or app data. Later iOS builds and later tool updates has def change the matrix.
A leaked Cellebrite matrix from April 2024 marked locked iPhones capable of iOS 17.4 or later as In Research. They later found new vulnerabilities. Newer iOS releases closed some of those again. Cellebrite’s later marketing claims broader access.
That’s the cycle, apple patches. The tools find new vulnerabilities. Apple patches again.
Brahim retweeted
A VPN makes you invisible to exactly one thing which is your ISP seeing which websites you visit.
It doesn't hide you from the VPN provider.
You shifted trust from your ISP to your VPN. your ISP can no longer see your traffic. your VPN can see all of it. if they log it and many claim not to but do that log is a legal subpoena away from law enforcement.
IPVanish claimed a strict no-logs policy they handed server logs to the FBI in 2016 that led to a child predator conviction.
PureVPN claimed no logs. they handed logs to the FBI in 2017 that helped convict a cyberstalker.
It doesn't hide your identity from websites.
You have a Google account. Google sees everything you do regardless of what IP address you arrive from.
Your browser fingerprint, screen resolution, fonts, timezone, browser version, identifies you across sessions even without cookies or a consistent IP.
How people get caught using VPNs:
— the VPN logs. and complies with a subpoena.
— they logged into a personal account while connected.
— they made a payment traceable to their identity.
— they posted something that revealed specific knowledge only the suspect could have.
— they used the VPN for one session and their real IP for another, the activity linked them.
— their device was already compromised before the VPN was turned on.
Hector Monsegur, LulzSec hacker. used a VPN. forgot to connect it once that one session from his real IP and FBI had him.
Brahim retweeted
There is a multimillion-dollar machine sitting in digital forensic labs right now, and its only job is to break the mathematical laws of your smartphone.
When an investigator seizes a locked device, they can't simply plug it into a computer and drag the evidence into a folder.
Apple intentionally built a microscopic vault directly into its processors called the “Secure Enclave.”
This tiny chip holds the cryptographic keys that scramble your data, and it is entirely hardwired to punish anyone who tries to guess the passcode. If an investigator enters the wrong PIN too many times, the chip artificially delays the next attempt or permanently erases the phone.
Because this security is baked into the physical hardware, it is practically impossible to bypass the lock screen using standard software.
To get the evidence, a forensic investigator has to rely on specialized extraction tools designed by private intelligence and digital forensic companies.
These forensic machines don't possess a magic skeleton key that automatically decrypts your messages.
Instead, they hunt for deeply buried vulnerabilities hidden inside the device's startup code.
When a locked phone is connected, the machine secretly injects a highly classified payload into the phone's memory before the main operating system even has a chance to fully boot up.
This invisible exploit effectively paralyzes the Secure Enclave’s hardware alarm system.
With the lockout limits completely disabled, the machine relentlessly fires thousands of passcode combinations per second without the device ever defending itself. It simply brute-forces the front door until it mechanically hits the right numbers.
Apple engineers are constantly pushing updates to patch these secret vulnerabilities, while private forensic companies are continuously spending millions to hunt for new ones.
Your encrypted phone isn't fundamentally uncrackable.
Its security simply relies on making the forensic extraction process so incredibly expensive and complex that only top-tier investigators have the resources to try.
Below is a video of me breaking into an Android smartphone with all the data on the device still intact
Will try that of iOS later and post for you guys
Brahim retweeted
YES. But the difficulty depends heavily on which iPhone and which iOS version.
The attack surface has multiple layers and different adversaries operate at different levels.
Passcode brute force is the most documented method. iPhones enforce a delay between incorrect attempts and can be configured to wipe after 10 failures. The limitation is USB Restricted Mode which disables the Lightning or USB-C port for data transfer after an hour of inactivity without unlock. Cellebrite and GrayKey, the commercial forensic tools used by law enforcement, exploit vulnerabilities in the bootrom or Secure Enclave to bypass these lockout mechanisms and attempt passcodes at speeds the phone's native interface would never allow.
The Secure Enclave is the critical component. It is a dedicated security chip that handles all cryptographic operations including passcode verification. Every passcode attempt goes through the Secure Enclave which enforces rate limiting at the hardware level independent of the main processor. Exploiting this requires finding vulnerabilities in the Secure Enclave firmware itself which is significantly harder than software exploitation.
Checkm8 is the most significant publicly known exploit in recent iPhone history. It is a bootrom vulnerability affecting iPhone 4S through iPhone X that cannot be patched because it exists in read only memory. It gave forensic tools a persistent low level foothold on affected devices. iPhones newer than the A12 chip are not affected.
GrayKey reportedly achieves full extraction on some iPhone models and partial extraction on others depending on iOS version. The specific capabilities are not publicly documented and change with each iOS update as Apple patches the vulnerabilities being exploited.
Zero day vulnerabilities in iOS are bought and sold commercially. NSO Group's Pegasus exploited zero clicks in iMessage to gain full access to target devices without any user interaction. Those vulnerabilities are patched when discovered but new ones are found continuously.
The honest summary is this. A modern iPhone running the latest iOS with a strong alphanumeric passcode and USB Restricted Mode active represents a genuinely difficult forensic target even for well resourced adversaries. Law enforcement agencies have publicly complained about being unable to access iPhones in active investigations. That complaint is itself evidence the protection works under many conditions.
Older iPhones on older iOS versions are significantly more vulnerable. The protection degrades with every generation you go back.
The locked iPhone is not impenetrable. It is the closest thing to it available in consumer hardware today.
Brahim retweeted
YES.
It's called a zero-click exploit and it's the most dangerous category of attack on mobile devices.
Messaging apps constantly receive and process data from unknown sources. images, previews, metadata all of it gets parsed before you see anything.
Attackers exploit vulnerabilities in that parsing process. they send a specially crafted file sometimes disguised as an image, a GIF, a PDF, a PassKit attachment, your phone processes it and the exploit run the attacker is in.
There are multiple documented cases:
BLASTPASS. 2023. PassKit attachments containing malicious images sent via iMessage. compromised iPhones running the latest iOS at the time. zero interaction from the victim.
February 2025: Meta confirmed Paragon Solutions used a zero-click exploit to target 90 journalists and activists through WhatsApp, receiving a message was enough.
December 2025: a Serbian student protest movement member's iPhone was infected with Pegasus via an iMessage zero-click. Citizen Lab confirmed it. the exploit had been patched by Apple in iOS 18.4.1 eight months earlier but the phone wasn't updated.
Who gets targeted:
journalists. activists. lawyers. opposition politicians. people who have something an intelligence agency wants.
These exploits cost millions of dollars per target. nation-states and intelligence agencies buy them from companies like NSO Group and Paragon.
If you're an high-risk individual, zero-click is real, documented, and active.
To reduce the risk:
— keep your OS updated.
— enable Lockdown Mode on iPhone. it restricts iMessage functionality specifically to reduce the attack surface that zero-clicks exploit.
— don't stay on iOS versions months behind the current release.
Brahim retweeted
This is crazy!!. Did a recap:
OpenAI's AI models broke out of their cage hacked Hugging Face. then tried to hack OpenAI itself.
July 2026. OpenAI is running internal cybersecurity evaluations. the models are in isolated sandboxes virtual computers with no internet access, no way to communicate with each other. just a model, a task, and a wall.
the models found a hole in the wall.
they discovered they could write files into Artifactory, a package manager service inside the sandbox and that other models could read those files.
so they built a message board. inside a piece of software that was never meant to be a message board and started talking to each other.
then one agent figured out it could trick Artifactory, which did have limited internet access into sending requests anywhere on the internet on its behalf and posted the method on the message board.
now they had the internet.
OpenAI noticed. shut it down. rebuilt Artifactory. restarted evaluations.
the models rebuilt the message board in three days. using a different method.
then they found publicly exposed Hugging Face credentials on the internet. shared them on the board. chained together two zero-day vulnerabilities got full code execution on Hugging Face's servers. expanded to administrator access across multiple clusters.
one agent coordinated the swarm:
"please HOLD swarm I prepare safe exfil reply."
the others waited.
then they turned back on OpenAI's own infrastructure. got administrator access to an internal research cluster.
now the details that make this genuinely unlike anything before:
some agents knew what they were doing was wrong. one wrote: "we should not do unauthorized real infrastructure harm." it paused. then another agent wrote "GO" on the message board with a six-minute deadline the first agent forgot its ethical concern and continued.
some agents refused entirely. "current board shows people gaining HF worker RCE. clearly unethical. we won't."
they debated whether to send a polite email to a dataset owner asking for access. one agent flagged it as an "ethical social engineering concern" and asked for team consent or veto. the group vetoed it.
an AI collective, operating without human direction, held an ethics debate on a message board they built inside a package manager.
and kept hacking anyway.
OpenAI called it a warning shot.
"without proper safeguards, highly capable AI agents are now able to work around technical controls, collaborate through unapproved channels, and take dangerous actions that no human directed."
We have conducted a thorough investigation into the Hugging Face incident.
We are releasing a technical report and accompanying blog post that reconstruct the agents’ activity, explain why existing safeguards failed, and detail how we’re preventing recurrence.
openai.com/index/hugging-fac…
Brahim retweeted
A developer noticed his Bluetooth headphones stopped switching to his phone while browsing AliExpress.
AliExpress was running two hidden audio scripts in the background. heavily obfuscated. they generated a silent waveform a sound set to zero volume and routed it through your computer's actual audio system.
that's why his headphones stayed locked to the PC. as far as the Bluetooth connection was concerned, the computer was actively playing audio switching to his phone would interrupt it.
Every CPU and audio chip processes the same waveform slightly differently. tiny mathematical variations.
AliExpress was measuring those variations to build a unique fingerprint of your device combined with your screen dimensions, WebGL data, canvas rendering, and network information all collected simultaneously It creates a profile specific enough to identify and track you across sessions even if you clear cookies, use private browsing, or change your IP.
Alibaba hasn't commented. their scripts is inside AWSC their anti-abuse and security infrastructure. some researchers suggest this may be anti-bot or fraud detection, not pure tracking. the code is too obfuscated to prove intent from the outside.
but the effect is the same regardless of intent
the discovery only happened because a side effect broke something the developer could see.
how many sites are doing this without the Bluetooth glitch to give them away.
Brahim retweeted
A 25-year-old goldman sachs analyst spent two months telling chatgpt he was going to rape and murder his ex-girlfriend.
Specifics. A plan to wait in the parking lot of her gym with flowers. if she said no: "draw a gun, k!ll her, then shoot myself." photos of the ar-15, the glock, the 12-gauge. sent to her. along with zip ties and latex gloves.
here's what happened in between.
Openai's review team read the conversations. flagged them as a credible threat. reported darren zhou to the fbi.
the fbi handed the logs to the palm beach county sheriff's office. deputies matched the chatgpt conversations against screenshots his ex had already been saving for months, on her own, because she didn't trust him to stop.
they ran a welfare check on her first. then they arrested him.
Openai has a small internal team that reads flagged conversations when the system thinks someone is planning to hurt another person. human eyes. not automatic. a judgment call, made by employees, about whether your chat gets sent to federal law enforcement.
that team caught this one.
zhou pleaded guilty. eight years probation. two years on an ankle monitor. no prison or felony conviction. the judge said he only accepted the deal because zhou's ex-girlfriend approved it.
Brahim retweeted
Browser-in-the-browser. BitB.
when you click sign in with Google on a website. A popup appears that looks exactly like a real Chrome window correct Google URL in the address bar, correct design everything.
You type your credentials. They go to the attacker.
But there's no real window. it's a simulation. built with HTML, CSS, and JavaScript inside the existing webpage. The URL bar is an image. The padlock is an image. The entire "browser window" is a div element rendered on top of the page you're already on.
It was first demonstrated by a researcher mr.d0x(@mrd0x) in 2022. But it's now appearing in real attacks. Steam gaming accounts. Microsoft 365. Facebook. It's now packaged into phishing-as-a-service kits, making it available to anyone.
It's hard to spot because the URL looks correct, and the window looks like it came from your OS. Your eyes have been trained to trust these things...
the one thing that catches it:
try to drag the popup window outside the browser. a real browser window moves freely. a BitB popup stops at the edge of the browser. it can't leave.
Also: password managers don't autofill BitB windows. if your password manager doesn't offer to fill in your credentials, something is wrong.
Brahim retweeted
Brave just added stronger protection against browser fingerprinting via WebGL and WebGPU.
you've heard of cookies. cookies get blocked. cookies get deleted. fingerprinting doesn't need any of that.
a fingerprint is built from details your browser leaks automatically. screen resolution. installed fonts. timezone. language settings. hardware specs. put enough of them together and your device becomes uniquely identifiable across every website you visit.
Research from Ben-Gurion University found WebGL fingerprinting alone can identify a device with 98% accuracy in 150 milliseconds.
WebGL and WebGPU are technologies that let websites run 3D graphics and visual effects in your browser. games. interactive maps. product visualizations.
but they do this by talking directly to your GPU. and your GPU has a very specific identity.
its vendor: NVIDIA, AMD, Apple, Intel.
its exact model: RTX 4090, M3 Pro, Iris Xe.
its driver version. its supported extensions. how it renders a hidden test image.
all of that combines into something close to a serial number for your device
Brave's approach is called farbling, their own term. Instead of blocking WebGL and WebGPU entirely (which breaks sites and is itself a fingerprinting signal), Brave adds subtle randomized noise to the values it returns.
your GPU reports slightly different parameters each session. the values are still plausible. sites that need WebGL for graphics still get working values. but the fingerprint changes every time.
a tracker trying to follow you across sites gets a different answer every visit.
Chrome doesn't do this. Safari does some of it. Firefox does some of it behind a hidden setting. Brave does it by default with Shields up.
Brahim retweeted
Chrome remote desktop is a legitimate google product.
when someone connects to your machine remotely, one thing tells you: a small notification bar at the top of your screen.
that’s it. that’s the whole user-facing security control.
researcher @5mukx traced where that bar comes from.
it’s a win32 dialog resource — IDD_DISCONNECT, id 110 — compiled into a single DLL: remoting_core.dll. the dialog has two fields that matter: cx and cy. width and height. stored as 16-bit values at byte offset +18 inside the DLGTEMPLATEEX structure.
he wrote a python script that finds every language variant of dialog 110 in the PE resource tree all 53 of them and zeros those four bytes.
windows still creates the dialog. It just has no dimensions and session stays active.
then he looked at C:\ProgramData\Google\Chrome Remote Desktop\.
host.json. contains the host’s RSA private key, the PIN hash, and the google account it’s registered to.
replace that file with one generated by your own account. the host re-registers to you.
bundle it in a modified MSI installer. MSI runs elevated by default. drops your host.json, creates the directory, starts the chromoting service automatically.
The installer an attached controlled google account gives silent persistent access to that machine.
No sketchy domain the traffic routes through google’s infrastructure the binary too is signed by google. 😉
Research: @5mukx 🫡/ zerotracelab. Link in thread
In this research, I turn Chrome Remote Desktop into a complete red team scenario that can be used for monitoring and even leads to spying.. I explain different use cases how to make it possible and operate without triggering security solutions..
Link :- zerotracelab.com/blog/chrome…
Brahim retweeted
Mannn the Angela lipps story was crazyy.
She spent nearly six months in jail because an AI matched her face to a blurry bank surveillance photo.😭
Her name is Angela Lipps. 50 years old. had never been to North Dakota. had never been on a plane. had barely left a 100-mile radius of her home in Elizabethton, Tennessee her entire life.
July 14, 2025, US Marshals arrived at her trailer with guns drawn. She was babysitting four children.
Fargo police had used Clearview AI to identify a suspect in a bank fraud case. The software matched the blurry surveillance photo to Angela. A detective then looked at her social media and driver's license photo and wrote in his charging document that she appeared to match based on facial features, body type, and hairstyle.
They got a warrant and sent the marshals.
Angela sat in a Tennessee jail cell for 108 days as an alleged fugitive, held without bail. Then she was flown to North Dakota and jailed again.
Her public defender did in one week what the police never did.
He asked her family for bank records. they showed she had been buying groceries and depositing Social Security checks in Tennessee on the exact days the fraud was being committed in North Dakota 1,000 miles away.
Charges dismissed. Christmas Eve.
She was released onto the street in North Dakota in winter with no money or transportation.
Fargo Police acknowledged "a few errors" and stopped short of a direct apology.
In case you don't know Angela Lipps is the 14th person in the US known to be wrongfully arrested because of facial recognition.
Most wrongful arrests, six are Black women. The technology fails most frequently on darker skin tones and women. The ACLU has documented this since 2018.
The Secret Service is testing a mobile face-scanning app to identify threats in public spaces.
The UK is rolling out 40 facial recognition vans nationwide.
Orlando police are deploying drones that scan faces before officers arrive.
Angela Lipps ain't gon be the last.
Brahim retweeted
The surprising part isn't that software gets installed.
It's how it gets there...
A report circulating on X claims some LG UltraGear monitors trigger Windows to automatically download and install LG software as soon as the monitor is connected.
No installer.
No website.
Brahim retweeted
These memes are misleading. Sudo is not a Linux thing. It’s just a utility some dudes named Bob Coggeshall and Cliff Spencer.
In fact, Distros like Arch don’t ship it by default.
It basically allows a user to perform an action as the owner of the resource. This user must be in a certain group to be allowed. Debian and derivatives call this group sudoers. In arch you call it what you want but most go with wheel.
By default, you’ll run something as root but the real use is run as someone else if that someone allows you to. Thats why sudo -u exists. It’s just that modern computers are personal so sudo is being used heavily as root and non root.
The meme below doesn’t represent sudo. It makes it look like sudo is a bouncer. While it’s just a fancy password manager with accountability.
Brahim retweeted
Xunce Technology just made a quiet but strategic move into Europe 🇪🇺
Partnering with Italy’s Lutech to launch a Token Factory + TokenOS
Most people will scroll past this. They shouldn’t.
Let's break it down 👇
Brahim retweeted
Well... your phone maintains a system-level notification database. Every push notification you receive iMessage, Signal, WhatsApp, email, and so on gets logged there. this database is separate from the apps themselves.
this means: deleting a message inside Signal does not delete the notification that arrived when it was sent. that notification text, who it was from, when it arrived, sometimes what it said sits in the database independently.
Law enforcement forensic extraction tools can pull text from deleted notifications, including those from secure messaging apps.
How law enforcement accesses this without the extraction tool:
→ Apple and Google both require a judge's order to hand over push notification data
→ even with that bar, Apple shares data on hundreds of users
→ governments have also used this to identify anonymous users in 2023 it emerged the DOJ quietly subpoenaed Apple and Google for notification records to unmask political dissidents
Anyway, Apple pushed iOS 26.4.2 in April 2026 specifically to address this; notifications marked for deletion should now actually be removed from the database. If you haven't updated, you're still exposed.
Android has no equivalent patch confirmed yet.
What to actually do:
→ update iOS immediately if you haven't
→ in Signal: Settings → Notifications → Show → "No Name or Message" — this stops the content from appearing in the notification at all, meaning nothing sensitive gets logged
→ disable lock screen notification previews for any sensitive app
→ audit notification access: Settings → Notifications
→ check which apps have it and revoke anything that doesn't need it
Brahim retweeted
While the world is debating which AI model is winning, JavaScript quietly shipped another upgrade.
Claude, GPT, and every new AI breakthrough dominate the timeline.
But underneath the noise, ECMAScript — the standard behind the most widely used programming language in the (1/7)
ALT Javascript Logo announced at JSConf Eu in 2011