Maker, magician, security gadabout, doomscroller, etc. @grymoire@infosec.exchange @grymoire@bsky.social https://xitter.cf/t.co/pKMn5JBFfS

Albany, NY
Joined December 2008
Bruce Barnett (@grymoire.bsky.social) retweeted
Fieldwatch 1.1.31 is out with two big additions. Fieldwatch is a free, open-source Android app that identifies the devices around you, including what might be watching or following you: trackers, cameras, drones (it even decodes their Remote ID), body cams, and more. Over 250 devices, and you can add your own. It listens to nearby Wi-Fi and Bluetooth signals and matches them against a built-in signature database. It only receives, never transmits. No account, no ads, no back end, and it works fully offline. What’s new: Hunt, rebuilt and more useful. Hunt now draws a heat map as you move. Hold the phone out in front of you and walk slowly around the area in a pattern, and the heat map fills in, running from blue where the signal is weak to red where it's strongest. The brightest patch is where the radio was loudest. GPS alone isn't precise enough for this, so Hunt also uses the phone's motion sensors to track your steps between GPS fixes. Live map on the Live screen. Tap the tune icon in the upper right to open Display Options, then turn on Show live path. The screen splits, with a map of your current path on top and your list view underneath, and you can slide the split to show as much map as you want. Alerted radios are plotted on the map. Double-tap to jump between a close-in view and the whole path, tap the compass to switch between north up and heading up, or pinch and drag to move around. More maps. OpenStreetMap and USGS Imagery and Topo work out of the box. You can also add Esri, MapTiler, Stadia and Thunderforest with your own key, which most of them offer free for personal use. Your key stays on your phone and is left out of exported settings. Also new: grid locations on the radio page, a cleaner live path that follows the road through turns, steadier top-bar counts, a crash report screen, and quieter scanning while Location is off. Free and open source on Android. github.com/OffGridPete/Field…
19
50
1
415
11,187
Bruce Barnett (@grymoire.bsky.social) retweeted
arstechnica.com/security/202… The private keys for these certs are literally the numbers 4, 56, 66, 115, 155, 156, 230, and 237 (life imitates XKCD, again).
31
214
51
1,669
270,820
Bruce Barnett (@grymoire.bsky.social) retweeted
Hooo Leee Sheeet... You can now reverse-engineer Android APKs? 🤯 They built Apktool that lets you: ~ Decode app resources, layouts, and images ~ Inspect Android manifests ~ Disassemble compiled code into Smali ~ Modify resources and rebuild APKs If you're an Android developer or reverse-engineering enthusiast, you're about to do some serious damage... 💀🔥 Follow me for more amazing AI, Coding & Web Dev insights 💎
2
4
44
1,926
Bruce Barnett (@grymoire.bsky.social) retweeted
Windows这回算是把脸丢干净了。 有人搞出一套开源PowerShell脚本,GitHub上已经攒到58K+星,不图名不图利,就干一件事:把Win11里那些卸不掉、关不了、天天膈应人的东西,一口气收拾干净。 1️⃣ 预装软件、推广插件,成批清走 2️⃣ 遥测、广告ID、个性化追踪,全部切断 3️⃣ Copilot、Recall、Click to Do这类AI功能,连根拔掉 4️⃣ Bing网页搜索、Edge内嵌AI,统统封死 5️⃣ 顺手还能把Win10那套经典右键菜单找回来 MIT开源,免费用,不捆绑,也不偷偷追踪。 最讽刺的是,微软折腾这么多年,把Windows弄成广告口、搜索口、AI口,结果这脚本一行指令下去,它又变回一台老老实实的电脑。 微软前头塞,社区后头删。 🔗 github.com/Raphire/Win11Debl…
78
430
21
2,690
137,790
Bruce Barnett (@grymoire.bsky.social) retweeted
If you're learning malware analysis or reverse engineering, bookmark this. RPISEC released the full materials from its Malware Analysis university course for FREE. 12 lectures + 10 hands-on labs + 4 projects covering: • Static + dynamic malware analysis • x86 + IDA • Windows internals + WinAPI • Malware behavior + persistence • Anti-disassembly • Anti-VM + anti-debugging + anti-AV • Packing + unpacking • Windows kernel + drivers • Rootkit techniques • Hooking + DKOM • Anti-forensics + covert channels • Runtime process manipulation • APT sample analysis It was designed for students starting with zero reverse engineering experience and built heavily around Practical Malware Analysis. github.com/RPISEC/Malware Huge credit to RPISEC and original authors Branden Clark, Austin Ralls and Aaron Sedlacek for making the course materials publicly available. #MalwareAnalysis #ReverseEngineering #WindowsInternals
13
202
2
1,228
51,540
Bruce Barnett (@grymoire.bsky.social) retweeted
Bruh... they really built an all-in-one downloader for YouTube and 2,000+ other websites and made it open-source. 🔥 It's called Arroxy, and it lets you: ~ Download videos in up to 4K ~ Download entire playlists and channels ~ Extract audio as MP3 ~ Download subtitles ~ Skip sponsored segments with SponsorBlock It works on Windows, macOS, and Linux, with no subscription or ads. Open-source devs never disappoint. 💀 Follow me for more amazing AI, Coding & Web Dev insights 💎
3
28
152
5,701
Bruce Barnett (@grymoire.bsky.social) retweeted
I hate to say this because it goes against everything I believe in. But people are going to need to take down public firmware images for critical infrastructure, like yesterday.
101
153
52
2,420
258,392
Bruce Barnett (@grymoire.bsky.social) retweeted
UPDATE: I can confirm that the Ledger supply chain is compromised in Europe as well. @Ledger should initiate an immediate product recall to protect users. I just purchased a second device from a different Mediamarkt location today, recorded the unboxing process, and discovered spyware once again (video linked in the second tweet). The device was compromised in the exact same manner, featuring identical modifications (such as additional cables and an LTE module). This indicates its a widespread issue rather than an isolated incident, potentially affecting Ledger inventory across MediaMarkt and Saturn stores throughout Europe (comprising over 1,000 stores across 11 countries). My initial hypothesis was that these devices were returns that looked unopened to the employees and were just sold again as new however, a MediaMarkt employee confirmed that the device I purchased was not a return, and that returned Ledgers are sent directly back to the manufacturer rather than resold. Store records show the inventory originated from Aqipa GmbH. While Ledger's CTO was unsure if Aqipa serves as the direct distributor between Ledger and MediaMarkt, it appears to be the case. Given that Aqipa distributes across Europe, any physical retail store receiving stock through them may be at risk. I sent the first ledger to mark and the second one is going to ledger now, so that they can analyse it. If you purchased a ledger from anyone other than the official ledger store, make sure to check your device!!
700
1,984
668
11,468
2,091,102
Bruce Barnett (@grymoire.bsky.social) retweeted
Yes, a light bulb is now an SDR. etherbulb.com/
11
40
6
484
46,514
Bruce Barnett (@grymoire.bsky.social) retweeted
More Ukrainian military confirming that Musk stopped Ukraine's drones mid-flight last night. This was exactly during Russia's massive missile and drone barrage on Kyiv. The US is fully joining Putin's war. From Sergei Flash:
703
6,045
635
17,413
585,157
Bruce Barnett (@grymoire.bsky.social) retweeted
❗️Last ​​night, the operation of Starlink terminals in Ukraine was restricted. Connectivity began to drop when moving at speeds exceeding 160 km/h. As a result, a number of critical missions were disrupted. SpaceX likely took these measures at the request of the Trump administration. Also last night, when Kyiv was attacked by ballistic missiles, Ukraine did not receive intelligence regarding their launch— a failure that could have led to higher casualties. Ukraine did not attack Russian oil refineries, yet Trump has already begun imposing sanctions on my country. Meanwhile, sanctions against Russia have been eased.
1,129
6,244
758
23,220
1,326,192
Bruce Barnett (@grymoire.bsky.social) retweeted
⚡️ 'This cannot be a coincidence' — Ukraine's Starlink access restricted without warning, Zelensky adviser says. Ukraine relies on Starlink to operate its mid-strike drones in Russian-occupied Ukraine. kyivindependent.com/this-can…
427
1,220
233
5,365
1,465,263
Bruce Barnett (@grymoire.bsky.social) retweeted
🚨 BREAKING: Ukrainian military sources are reporting that Elon Musk’s SpaceX abruptly restricted Starlink satellite communications during Ukrainian military operations overnight, disrupting critical missions as Russia unleashed a massive missile and drone barrage against Kyiv. Ukrainian activist Serhii Sternenko reports that Starlink connections began dropping when terminals were moving faster than 100 mph (160 km/h), causing multiple missions to fail. Ukrainian military communications expert Serhii “Flash” Beskrestnov says the restrictions were imposed WITHOUT WARNING. Sternenko suspects SpaceX acted at the request of the Trump administration, though that allegation has not been independently confirmed. It is clear that Trump is furious that Zelenskyy has refused to surrender and give away eastern Ukraine, and now Trump is trying to break Ukraine's resolve by actively supporting Russia. He seems to take that refusal as a personal insult, an attack on his image as the dealmaker who can end the war. Once again, Trump is blaming his own failures on others. This time, the consequences are deadly.
514
3,996
393
12,832
510,436
Bruce Barnett (@grymoire.bsky.social) retweeted
New speed limits on Starlink terminals, operated by billionaire Elon Musk’s SpaceX, disrupted drone attacks over Russian-occupied Ukraine, Ukrainian officials and military units said on.wsj.com/4hVZKz1
669
968
233
3,381
1,618,831
I just got a phishing email apparently from paypal sent to an email unique to my @nostarch account. It looks like their database of email addresses were hacked.
2
1
859
Bruce Barnett (@grymoire.bsky.social) retweeted
Heartfelt prayers for everyone in the path of this hurricane… In case you did not know, your phone has satellite mode. This is a Godsend since virtually none of the 522,000 acres [817 mi.²] of the Great Smoky Mountains National Park has cell service. Fortunately, we have only had to use it once…
3
27
1,027
Bruce Barnett (@grymoire.bsky.social) retweeted
airdrop fully reverse-engineered! works flawlessly on my framework laptop
266
883
190
16,958
788,786
Bruce Barnett (@grymoire.bsky.social) retweeted
Fieldwatch is a free, open-source Android app that can help identify the devices around you, including what might be watching or following you: trackers, cameras, drones (it even decodes their Remote ID), body cams, and more. It can help identify almost 250 device types, and you can add your own. It listens to nearby Wi-Fi and Bluetooth signals and compares them to a built-in signature database. It only receives, never transmits. No account, no ads, no back end, and it works fully offline. What's new: Fieldwatch 1.1.22 adds GPS jamming and spoofing detection, using the receiver that's already in your phone. 🛰️ When your GPS suddenly changes, Fieldwatch lets you know right away: * A popup with details of the interference * A voice alert * A red diamond on your path where it happened * The details saved in your sit * An optional note on your TAK marker It needs a one-time calibration. Choose your sensitivity and you're set. For best performance, keep the phone in a dash holder, or on your chest rig when you're on foot. Also in this build: weak pairing floods stay quiet while you're driving, and a real flood can leave a note on your TAK marker until it ends. Easier setup: Live now shows a banner when Location is off, and Diagnostics opens with a "What to check" list that names the exact switch that's off. The only official release is on my GitHub, link in bio. Each release lists the APK hash and signing certificate so you can check your build. Coming next: a localization framework. I'm building a proper translation system for Fieldwatch, so translating the app will mean filling in a language file instead of forking the codebase and hand-editing text buried in the code. If you've offered to help translate, thank you, and please hold off for now. Once the framework lands, your work will be much easier and won't break with every update.
30
173
10
1,285
34,476