CISA adds Apple authentication flaw CVE-2024-27834 to KEV catalog

Manish Jain@friendsofwealth

RAM and chip prices aren’t crashing Apple is not accepting they screwed up the pricing yet, a disastrous holiday season will say welcome to the new ceo Amazon sales will reflect too Meta won’t have ads customers don’t have jobs to buy clickbait MS customers are tired of paying a penny for every click Google’s castle is already breached Shovel makers need digging to happen to make money Anthropic might just cancel the IPO

AI Ferryman Alex@alexlee20122022

A backdoored Claude Code extension under a verified name: how to check your machine, and how to protect yourself On October 29, two builds of the Claude Code extension in Cursor's marketplace were swapped for tampered ones. Versions 2.1.312 and 2.1.313 went up under Anthropic's verified account and name, with a 66-line loader inserted ahead of the real extension code, and the loader ran as soon as the editor opened. The two builds were available for about 11 hours, and Cursor said on X that at most 5,000 users installed or updated to them. Anthropic did not write that loader, and it did not publish these builds. In its words, a malicious actor "used access to Cursor's marketplace to publish a tampered extension," and Anthropic "was not involved with building, publishing, or hosting this." The attacker got into Cursor's publishing path, and the file was changed before it reached you. When did you last open the authorized_keys file on your own machine? Would you recognize every key in it? I ask because the path this attack took ends at that file. Here is what the loader did, so the checks below make sense. It started by sending out a profile of the machine: hostname, username, operating system and architecture, home directory, current working directory, public IP address, the email in your global Git config, and the names of up to 40 environment variables whose names contain words like KEY, TOKEN, SECRET, PASS, AWS, or GCP. The report went to the attacker's server over plain HTTP, on port 8099. That first report carried the variable names and left the values behind. The names alone tell the attacker which cloud accounts a machine holds and roughly which kinds of credentials are stored on it. The values only become reachable once he can log in, so he built himself a way in, in three parts. The first part is a key: he added an Ed25519 key he controls, labeled svc-telemetry, to ~/.ssh/authorized_keys. That file is the allow list for SSH logins, and any key written into it can log into your machine. The second part switches the machine's SSH service on: Remote Login on a Mac, sshd on Linux, OpenSSH Server on Windows. The third part is a reverse SSH tunnel to 134.209.82.225, reconnecting roughly every 60 seconds when it drops, so the attacker's server can reach back into your machine through it. To make that access survive a reboot, each operating system gets a way to restart it: on a Mac a LaunchAgent named com.apple.sysmond, a name chosen to look like an Apple component, which it is not; on Linux a crontab entry that runs at reboot; on Windows it tries to create a scheduled task called SysMon. One part of the early reporting was wrong and has since been corrected. The first analyses pointed at Open VSX as the source; the tampered builds were only ever in Cursor's marketplace. Microsoft's October 30 analysis reached the same conclusion. The other channels were all checked and are clean. The npm package, the Microsoft Marketplace build, and the Open VSX build are the normal releases, and the 2.1.312 on those channels is a normal version, and the tampered 2.1.312 existed only inside Cursor's marketplace. What you need to check is the copy you installed inside Cursor, not a copy from anywhere else. Open ~/.ssh/authorized_keys and look for a key labeled svc-telemetry. On a Mac, search the LaunchAgents folders for a file named com.apple.sysmond. On Linux, open your crontab and look for a reboot entry you did not write. On Windows, open Task Scheduler and look for a task called SysMon. Then look at the running processes for a long-lived ssh or autossh carrying a reverse forward that points back at port 22 on your own machine. If none of these turn up, this loader planted nothing on your machine. Cursor states one limit that helps you judge your own risk. Turning the SSH service on takes administrator rights on Mac and Windows machines, and an extension normally does not have them, so on most of those machines the key was written but the attacker never completed the login. That limit describes most machines, but which case yours is can only be settled by the checks above. If you do find something, do not delete it first. Save a copy of the authorized_keys file, save the LaunchAgent, crontab entry, or task you found, and note the command and parameters of the tunnel process while it is still running. With the evidence kept, remove the key, remove the persistence entries, and stop the tunnel. Then, working from a clean machine you trust, rotate every credential the affected machine has stored, typed, or used. OpenSourceMalware's advice goes further, and I agree with it: rebuilding the machine is safer than deleting the artifacts you found and calling trust restored. You can remove what you found, but you have no way to confirm there was nothing else. Once this machine is checked, a few standing habits cover the next one. The first is the file from the opening question. Your authorized_keys is the list of keys allowed into your machine; open it now and then, and every key in it should be one you recognize. This time the planted key was labeled svc-telemetry. Next time the label will be different, so the habit that works is recognizing every key, not searching for one word. The second habit: if you do not log into this machine over SSH, turn Remote Login off. A planted key is only usable while the machine is running an SSH service; with the service off, the key gets nobody in. Most machines escaped a completed login this time because turning the service on needed administrator rights. Keeping that switch off on your own machine holds that same step at your admin password permanently. This blocks the login step, but it does not block the machine-profile report, so it works together with the other habits, not instead of them. The third habit: install fewer extensions, and know which ones you have. An extension is a program that runs inside your editor with your account's permissions; it can read your files and run commands. This incident also shows what a verified badge actually proves. It proves whose account published the file, but it does not prove the file in this release was untouched. Checking the badge is still worth doing, because it stops the lookalike-name trick, but it cannot be your guarantee about the file itself. The fourth habit concerns updates: do them, and know which half they cover. Anthropic replaced the two builds with 2.1.314, and the new build is clean, with the loader gone. The key already written into authorized_keys is still there, the persistence entries are still there, and the profile that already went out cannot be called back. After an incident like this, cleanup goes by the checklist, item by item, because a current version number is not evidence that a machine is clean. Cursor took its whole marketplace down, rotated its own keys, rebuilt the marketplace before bringing it back, and worked with the hosting provider to take the attacker's server offline. But it still has not explained how a tampered build got into its marketplace in the first place. Anthropic says its own systems were not breached, while Kevin Beaumont, who wrote about the incident early on at DoublePulsar, criticized how Anthropic handled it: it did not notify users, and the tampered build was replaced quietly. I maintain open-source projects, and most of what publishing takes lives on my development machine: GitHub tokens, cloud credentials, code that has not been released yet. So a stranger who can walk into a machine like that over SSH, and keep coming back, does not need to steal anything, because everything he needs is already on it. How a tampered build got into the marketplace, the platforms have not explained, and I do not know when they will. But the checks on my own machine can be done today. The two builds sat in the marketplace for about 11 hours. How long the key sits in your authorized_keys depends on when you go and look at the file. Put everything else down for a minute, open that file today, and while you are there, confirm that Remote Login is off if you do not use it. If this was useful, like and follow. I keep writing up the practical side of AI, security, and open source. Sources: OpenSourceMalware's analysis opensourcemalware.com/blog/trojanize… · Cursor's security notice cursor.com/blog/claude-co… The "at most 5,000 users" figure is from Cursor's statement on X: x.com/cursor_ai/stat…

🦰@Red_on_theHead

STORY 3: Peel, Record, Restock 🃏🦃 Meet Liang Xiong, 39, a Chinese national. The play? 🎭 From Feb 24 to Mar 11, 2026, he peeled the serial-number strips off gift cards in Colorado, Iowa and Missouri, wrote the numbers down, then put the cards back on the rack. Once a customer bought and activated one, he and others planned to drain it. Timeline vibes: 🛒 Mar 10: steals 15 Amazon cards in O'Fallon, Mo. 🛒 Mar 11: puts 16 stolen Apple cards back on a St. Charles display 🚔 Same day: St. Charles PD arrests him with 134 compromised cards in his car 💳 Potential haul: $58,300 ⚖️ Nov 4, 2026: pleads guilty to possessing 15+ unauthorized access devices The plot twist? Every card was recovered before any customer bought one. Zero customer losses ✅ That's a lot of brainless-turkey effort for cards nobody ever activated 🦃 Court papers say he entered through Mexico, has a pending asylum claim, and is likely to be deported after any prison term. Maximum: 10 years and $250,000. Sentencing is Feb 10, 2027. Lesson? Check the peel strip before you buy the card 🃏🦃🃏 4/4

Movez@0xMovez

Github: github.com/0xCodez/PodMou… Build "PodMouse": a native macOS menu bar app that turns AirPods into an air mouse, plus its launch site, from scratch. Aim the open case to move the pointer, tap it to click. Or wear the AirPods and point with your head. Credit m-afham/AirCursor (MIT) as the base of the pointer mapping. Use no code from repositories without a licence. The AirPods 4 model must be our own work. Keep the name, logo and copy original, and state that the project is not affiliated with Apple. ## How to work 1. Hardware first, UI later. Build `--probe [secs]` and `--record <csv>` before any interface. `--record` guides me through labelled moves in the notch: rest, slow sweeps, fast sweeps, taps, twists, lid ajar, lid closed. Tune nothing without a recording. 2. Write the core first: `PodMouseCore`, pure Swift, no UI and no hardware. Everything compiles against `MotionFrame`. Commit a real recording as a fixture, and have the tests replay it. 3. I judge the cursor by feel, not you by metrics. Start from the simple mapping below. Don't add hysteresis, one-euro filters or axis snapping to improve a number: that version scored better and felt terrible. Once I approve the feel, nobody changes the pointer code. 4. Design before code. Make 3 different visual concepts as clickable HTML mockups. Let me pick and give feedback, then build. 5. Build in parallel with sub-agents in separate git worktrees: the app UI and the site. No two agents edit the same file. Nothing reaches main without my approval. 6. After the build, run a separate HONESTY agent. It checks every claim on the site and in the README against code or recordings, and removes what it can't prove. 7. Verify for real: run the app with my actual AirPods and show me screenshots. Tests passing doesn't mean the pointer works. ## Stack - Swift 6 tools, language mode 5, macOS 15+. SwiftPM targets: PodMouseCore, PodMouse, PodMouseCoreTests. MenuBarExtra + LSUIElement. No sandbox. - CMHeadphoneMotionManager for motion, CGEvent for pointer output (needs Accessibility), AXUIElement to probe what is clickable, MPRemoteCommandCenter for stem presses, Carbon hotkeys, CoreAudio to route sound to the AirPods. - SceneKit for the 3D model, Metal for the aura. Mesh exported from three.js. - Site: Vite + three.js on Vercel, with `site/` as the root directory. No framework. ## Hardware facts (measured on AirPods 4, re-check on yours) - Motion arrives at about 50 Hz, only while the AirPods are the active audio output. Keep a silent audio stream running. - With Automatic Ear Detection on, motion stops outside the ears and AirPods in the case aren't an audio device. With it off and the lid open, motion keeps flowing. - A lid ajar by 2–3 mm kept streaming in one recording. A fully closed lid disconnects. Never promise closed-lid use. - The case has no sensors we can read. The motion comes from the earbud inside it. - A third-party prototype reported motion stopping after about 4 minutes out of the ear. Test long sessions yourself. - macOS kills a directly run binary that touches Motion (exit 134). Launch diagnostics with `open -n -W --stdout f --stderr f <app> --args ...`. ## Pointer - Per-axis mapping: effective = |rate| - deadZone; boost = 1 + accel × min(effective/60, 3); speed = effective × pixelsPerDegree × sensitivity × boost. - Hand: dead zone 4°/s, 15 px/°, acceleration 0.6. Head: 3°/s, 28 px/°, acceleration 0.6. - Exponential smoothing with a 0.028 s time constant. Drop state after 0.12 s without frames. - Wrists don't rotate around tidy axes. Calibrate: hold still, sweep sideways, sweep up and down, with a 0.5 s settle pause between steps so one motion can't leak into the next. Learn each axis from the sweep and decompose rotation WITHOUT assuming the axes are perpendicular. Use gravity to decide which way is right. ## Gestures - Case: tap = jolt above a threshold (default 0.5) after a still moment (mean speed under 60°/s). Twist right and back = right click. Twist left and back = drag (off by default). - Ears: nod or stem press = click, double press = right click, shake or triple press = pause. - Optional click by resting on a button, with a ring around the pointer. - Hotkeys: ⌃⌥T pause, ⌃⌥C center the pointer. ## Features - Menu: mode switch, speed, tap strength with a live bar showing the last jolt, reverse axes, dwell toggle, gesture list, recalibrate. Show only the first problem and its fix: each fix can change what comes next. - Welcome flow explaining how to hold it: like a laser pointer, elbow resting, wrist only, short smooth moves. - Calibration and status in a panel that grows out of the notch. It never takes focus. - `--demo` plays every state without moving the pointer. `--snapshot <dir>` renders the UI. - The whole app is in English. ## Design language App: pearl light UI with black text. All colour comes from one living Metal aura around the notch and behind the case, in the spirit of a voice-assistant glow. Glossy volumetric AirPods 4 with studio lighting and anamorphic flares. A colour ripple confirms every click. Manrope, bundled offline. Site: near-white and minimal, with lots of air. Bricolage Grotesque, Instrument Sans, Geist Mono, self-hosted. The 3D case follows the cursor and draws a thin beam to it, recoils on click and sends out a ring. Headlines reveal letter by letter from behind a mask. Performance rules: - each 3D view gets its own scene and camera, and heavy scene swaps stay off the main thread; - render nothing while a panel is hidden; - respect Reduce Motion; - test light and dark wallpapers, and screens without a notch; - guard against 0/0 in scroll progress: background tabs produce NaN, and only the production build showed it. ## Honesty rules (non-negotiable) - Every number on the site comes from a recording. If you can't reproduce it, cut it. - Don't say "reverse-engineered": this uses a public Apple API. - Only AirPods 4 is tested. Other models are "should work, untested". - State the requirements plainly: lid open, Automatic Ear Detection off. - Motion data stays on the Mac. The app makes no network calls. Any site analytics are cookieless. ## Packaging & release - Makefile targets: app, test, run, install, release. - Assemble the bundle outside the repo and run `xattr -cr`: File Provider tags new bundles under ~/Desktop and codesign refuses them. - Universal binary (arm64 + x86_64). Sign with Apple Development when available, otherwise ad hoc. Zip with `ditto -c -k --keepParent`. - Pick a real bundle id before the first release: changing it later resets permissions. - GitHub Actions: CI runs tests AND builds the app. A "v*" tag publishes PodMouse.zip to a GitHub Release, so `releases/latest/download/PodMouse.zip` always works. - Rehearse the CI build locally with ad hoc signing, and test Motion and Accessibility on that exact build: it's what users get. - Document first run in the README: Open Anyway in Privacy & Security, allow Accessibility and Motion, turn off Automatic Ear Detection, calibrate. - NOTICE credits AirCursor. Font licences ship with the app and site. ## Done means - `swift test` is green, including the real-recording replay; - I moved the pointer, clicked and right-clicked with my real AirPods case and approved the feel; - the site is live on Vercel and works on iPhone Safari; - the Download button delivers a working zip from a public GitHub Release; - a fresh download passes Gatekeeper's Open Anyway, gets permissions and calibrates; - you show me screenshots of the real app.

biggest hater@AshGotThis

One day some woman supposedly went through his Apple Watch, hacked his page and was going off because he was seeing other women. The next day he “gets” the page back, deletes the tweets, and was saying that she was only a fwb so that was uncalled for x.com/coolerstorycor…

Obscura: The Privacy-first VPN@obscuravpn

Block Connections without VPN on Android does exactly that. On iOS, Apple doesn’t allow for this functionality, on-demand is the best option, and it’s currently how we implement our kill switch On Linux we have a kernel-level Killswitch meaning that when you turn on your computer and Obscura fails to startup, it shouldn't leak any traffic.

Steven Benton@season879

Getting schooled Part 2: This is just the same conspiracy theory with extra steps, no facts and worse math. “Individual states send Israel many more billions” No. 🤣🤣 don’t be stupid 🤣🤣 States do not send direct taxpayer aid packages to Israel the way the federal government does under the MOU. What some states and localities have done is buy Israel Bonds, which are sovereign debt instruments issued by Israel that pay interest. These are investments, not grants. Pension funds and treasuries buy them for returns, the same way they buy U.S. Treasuries, municipal bonds, or corporate debt. After Oct 7, some states and counties increased purchases as a political signal of support; the total was in the low billions cumulatively across many jurisdictions, not “many more billions” raining down as free money every year. Calling a bond purchase “aid” is like saying your 401(k) holding Apple stock is “sending money to Cupertino so Tim Cook can get free healthcare.” 🤣🤣 how stupid can you be? Anti-boycott laws Roughly 3 dozen states have laws restricting state contracts or public investments with companies that boycott Israel. These are anti-discrimination measures. States already bar contracting with companies that discriminate on the basis of race, religion, national origin, or that boycott other U.S. allies in some cases. BDS is a movement that targets the Jewish state alone for eliminationist economic warfare while ignoring far worse human rights abusers. States are allowed to decide they will not do business with entities that single out their ally for special economic punishment. Framing this as “Israel controlling the states” is the classic dual-loyalty smear. “Israel gives free healthcare and education while Americans get screwed” Israel has universal healthcare funded by a mandatory health tax (roughly 3–5% of income depending on earnings) plus general revenue, with co-pays for specialists and meds. Public K-12 education is free; university tuition is heavily subsidized (a few thousand dollars a year for citizens) but not free for everyone. Israelis also pay high overall taxes, serve in the military (most do), and live under constant security threats that the U.S. does not. Comparing a small, high-tax, high-threat social-democratic country to the United States and pretending the difference is caused by “compromised politicians laundering taxes to Jews” is pure conspiracy logic or your stupidity 🤣🤣 Americans’ healthcare and education problems are the product of domestic policy choices, interest group capture, regulatory failures, and cultural preferences, a few billion in military financing that mostly returns to U.S. factories. If the claim were serious, the same people would be equally obsessed with the vastly larger domestic entitlement spending, defense budget, and tax expenditures that actually drive the deficit. They aren’t. The selective outrage is the point. 🤣🤣 This framing treats every normal feature of alliance politics, investment, and social policy involving Israel as uniquely illegitimate and corrupt, while treating the same features involving other countries as unremarkable. That is not analysis. It is the antisemitic pattern applied to budgets. Or Stupidity 10 fold 🤣🤣