TaoSecurity Blog

http://taosecurity.blogspot.com/atom.xml (RSS订阅地址)

FreeBSD Released the Most Security Advisories in Project History in June 2026

<div style="text-align: left;">On average, the FreeBSD security team releases about 2 security advisories per month. AI has changed this. </div><div style="text-align: left;"> </div><div style="text-align: left;">In April, the project released 8 advisories, <a href="https://www.reddit.com/r/freebsd/comments/1t0ei6o/ai_found_6_out_of_8_freebsd_security_advisories/">with 6 powered by AI</a>.  In May, the count decreased slightly to 7. </div><div style="text-align: left;"> </div><div style="text-align: left;">Today I took a look at the <a href="https://www.freebsd.org/security/advisories/">FreeBSD Security Advisory</a> page to check the latest advisory count.</div><div style="text-align: left;"> </div><div style="text-align: left;">June saw the most number of advisories ever published in project history: 25.</div><div style="text-align: left;"> </div><div style="text-align: left;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXCtOGgN23DN0aQXhw-6X5iKxsGy1VTmfao5_Y-s0XjtXS0WQJuy-7CzL1HXqGO6hBkUtJJm78h8EqJNsRnH_ZMk56viiKx9RpMw6T0T1v-ak82oV25lXZr16On78oDaAHkt0G_pEJ1C8pyVUFOaVW7AO_OH3zR73i6zxzVSCHOdegJgGNxrqx/s1600/FreeBSD%20Security%20Vulns%20by%20month.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="686" data-original-width="1600" height="274" src="https://imgproxy.citrusreader.com/5KIoNZVWZXuAOdF7r5szgiLM2VxdimO0MY3qE_Ha7zg/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VnWEN0T0dnTjIzRE4wYVFYaHctNlg1aUt4c0d5MVZUbWZhbzVfWS1zMFhqdFhTMFdRSnV5LTdDekwxSFhxR082aEJrVXRKSm03OGg4RXFKTnNSbkhfWk1rNTZ2aWlLeDlScE13NlQwVDF2LWFrODJvVjI1bFhacjE2T243OG9EYUFIa3QwR19wRUoxQzhweVZVRk9hVlc3QU9fT0gzelI3M2k2enh6VlNDSE9kZWdKZ0dOeHJxeC93NjQwLWgyNzQvRnJlZUJTRCUyMFNlY3VyaXR5JTIwVnVsbnMlMjBieSUyMG1vbnRoLnBuZw" width="640"></a></div>This blows away the previous record of 18 from January 2001. The other big spike was 11 in January 2016.</div><div style="text-align: left;"> </div><div style="text-align: left;"></div><div style="text-align: left;">AI apaprently discovered at least 9 of the June 2026 FreeBSD vulnerabilities.</div><div style="text-align: left;"> </div><div style="text-align: left;">On 15 June the FreeBSD Foundation announced the <a href="https://freebsdfoundation.org/blog/freebsd-ai-assisted-vulnerability-discovery-project-launch/">FreeBSD AI-assisted Vulnerability Discovery Project</a>:</div><div style="text-align: left;"> </div><div style="text-align: left;">"The 6-month project is being funded by a grant from the Alpha Omega project. </div><div style="text-align: left;"> </div><div style="text-align: left;">The funds will be used to engage FreeBSD Security Team members under fixed-term contracts to find and patch vulnerabilities. </div><div style="text-align: left;"> </div><div style="text-align: left;">The Security Team’s access to publicly available AI models and tokens will be provided free of charge. AI will be used for vulnerability discovery and analysis only, all patches will be manually created." </div><div style="text-align: left;"> </div><div style="text-align: left;">Yes, 25 vulnerabilities is far lower than the 570 associated with Patch Tuesday this week. However, it's important to see the effects of AI-powered vulnerability discovery everywhere. It's not hype. It is real. </div><div style="text-align: left;"> </div><div style="text-align: left;">I am hopeful that developers will continue to use AI to discover and fix vulnerabilities in old code, and also prevent new code from shipping with vulnerabilities. </div><div style="text-align: left;"> </div><div style="text-align: left;">Addendum:</div><div style="text-align: left;"> </div><div style="text-align: left;"><div style="text-align: left;">I asked Gemini to explain the large number of advisories in 2001-2002. It said:</div><div style="text-align: left;"> </div><div style="text-align: left;">"The pronounced security advisory spike between August 2000 and January 2001 represents one of the most concentrated periods of security patching in FreeBSD's history, totaling 66 advisories in a six-month window.<br><br>A closer look at the specific advisories reveals that this spike was primarily driven by a massive wave of vulnerabilities discovered in popular third-party software (the "Ports" collection) along with critical auditing of core networking daemons.<br><br>1. Vulnerabilities in Popular Third-Party Software (Ports)<br><br>During this era, many open-source projects were grappling with newly pervasive exploitation techniques like buffer overflows and format string vulnerabilities. The dataset shows a massive batch of updates for staple utilities of the early-2000s internet:<br> </div><div style="text-align: left;">Internet & Chat Clients: Multiple advisories were issued for communication tools, including the `pine` mail client, `xchat`, `gaim` (instant messaging), `bitchx` (IRC client), and the `netscape` web browser.</div><div style="text-align: left;"> </div><div style="text-align: left;">Web & Content Servers: Security flaws were patched in web servers and frameworks like `php`, `zope`, `thttpd`, and the `boa` web server.</div><div style="text-align: left;"><br>Development & System Tools: Popular utilities like `curl`, `gnupg`, `cvsweb`, `ethereal` (now Wireshark), `syslog-ng`, and even alternative shells/editors like `bash1` and `joe` required immediate security patches.<br> </div><div style="text-align: left;">2. Core System & Network Infrastructure Patches<br><br>Alongside user-facing applications, the core FreeBSD development team had to address architectural and networking vulnerabilities in the base system:<br> </div><div style="text-align: left;">Routing & Firewalls: Critical flaws were patched in basic networking security logic, notably `ipfw` (the firewall tool) and `ppp-nat` (Network Address Translation).</div><div style="text-align: left;"> </div><div style="text-align: left;">Core Network Daemons: High-risk vulnerabilities struck standard network entry points, resulting in patches for `bind` (DNS server), `telnetd`, `dhclient`, and the newly adopted `openssh`.</div><div style="text-align: left;"> </div><div style="text-align: left;">Protocol & Kernel Level: Security advisories were issued for low-level system components like `tcp-iss` (Initial Sequence Number generation, crucial for preventing TCP hijacking) and filesystem-level wrappers like `procfs`.<br> </div><div style="text-align: left;">3. The Climax: January 2001<br><br>The spike peaked dramatically in January 2001 alone with 18 advisories. This was largely an administrative and security "housecleaning" event. Rather than a single massive system failure, it reflects a coordinated effort by the FreeBSD Security Officer team to bundle and ship security patches for dozens of utilities simultaneously—including `crontab`, `inetd`, `mysql`, and `xfree86`—ensuring systems were hardened as the platform matured." </div></div><div class="blogger-post-footer">Copyright 2003-2020 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)</div>

2026/7/17

I Wrote a New Book for Corelight

<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjLD7qvOGj-vysW1oKnpVauXypgCv8nGDkAJ3-ku3GFDTwH2ud2n6fOVAkjfyQlqkWtiuloQi86jC36SFQ6q8RtciyqVGS0J1eJkJNc2_3L1-uiETD82IB7P0py3Xf3ggvbiBGi8rtIVZttdqk8vz1svXuVyt1YYZXCG1sO5VtHwTDEJgkNjCj3/s864/cover.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="864" data-original-width="576" height="640" src="https://imgproxy.citrusreader.com/AcRRR-igfjBe6ERxnRW6NCO0hVCOpIq09rJyj80Owvs/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VqTEQ3cXZPR2otdnlzVzFvS25wVmF1WHlwZ0N2OG5HRGtBSjMta3UzR0ZEVHdIMnVkMm42Zk9WQWtqZnlRbHFrV3RpdWxvUWk4NmpDMzZTRlE2cThSdGNpeXFWR1MwSjFlSmtKTmMyXzNMMS11aUVURDgySUI3UDBweTNYZjNnZ3ZiaUJHaThydElWWnR0ZHFrOHZ6MXN2WHVWeXQxWVlaWENHMXNPNVZ0SHdUREVKZ2tOakNqMy93NDI2LWg2NDAvY292ZXIucG5n" width="426"></a></div><br><div style="text-align: left;">TLDR: I wrote a new book for Corelight called <a href="https://corelight.com/cp/ndr-essentials">NDR Essentials</a>. It's free at that link. This is the 10th book that I've authored or co-authored. The rest are all posted at <a href="https://www.taosecurity.com/">taosecurity.com</a>. </div><div style="text-align: left;"> </div><div style="text-align: left;">Why?<span class="hs_cos_wrapper hs_cos_wrapper_meta_field hs_cos_wrapper_type_rich_text" data-hs-cos-general-type="meta_field" data-hs-cos-type="rich_text" id="hs_cos_wrapper_post_body"><p><span>It was time</span><span>.</span><span> </span></p></span></div><div style="text-align: left;"><span class="hs_cos_wrapper hs_cos_wrapper_meta_field hs_cos_wrapper_type_rich_text" data-hs-cos-general-type="meta_field" data-hs-cos-type="rich_text" id="hs_cos_wrapper_post_body"> <p><span></span><span> </span></p> <p><span>That’s what I thought when I heard that Corelight wanted to update its 2021 book on network detection and response (NDR). Tamara Crawford, who owned the project, scheduled a meeting with me and asked if I might be interested in helping, depending on who might write the text. </span><span> </span></p> <p><span></span><span> </span></p> <p><span>I volunteered immediately to write the whole book, but I had a few conditions. The text had to be at least 100 pages long, because 100 pages is my personal dividing line between “book” and “white paper.” I needed the freedom to cover the topics I wanted to address, and to not be told what to write. I wanted to show the four network security monitoring (NSM) data types working in a vendor-neutral manner, with technical details. Finally, I knew this project would take several months to research, write, lay out, proofread, and complete. Once Corelight agreed, I was ready to begin.</span><span> </span></p> <p><span></span><span> </span></p> <p><span>My goal for the book was to show how high-fidelity </span><a href="https://corelight.com/resources/glossary/network-evidence" target="_self"><u><span>network evidence</span></u></a><span> can power successful incident detection and response operations. For decades, digital security relied on the flawed premise that the “right” security controls could stop malicious activity. History, however, has repeatedly shown that prevention eventually fails. Victory belongs to the defender who accepts that intrusions are inevitable and who implements aggressive post-compromise interdiction </span><span>and containment. </span><span> </span></p> <p><span></span><span> </span></p> <p><span>Security teams have the best chance to stop an adversary before they accomplish their mission when they leverage network security monitoring data and the latest </span><a href="https://corelight.com/resources/glossary/ai-driven-soc" target="_self"><u><span>AI and automation assistants</span></u></a><span>. Therefore, this book equips practitioners with the tools and mindsets necessary to hunt through network evidence and diminish </span><a href="https://corelight.com/resources/glossary/attacker-dwell-time" target="_self"><u><span>attacker dwell time</span></u></a><span>. </span><span> </span></p> <p><span></span><span> </span></p> <p><strong><span>The book begins </span></strong><span>with a chapter that defines risk, threat, vulnerability, and asset value in the context of cybersecurity. It explains seven risk management strategies, NDR’s role in the security cycle, four sources of situational awareness, the importance of time and how to measure it, and a variety of NDR-specific topics like where and how to monitor, costs vs. benefits, and the difference between </span><a href="https://corelight.com/resources/glossary/network-security-monitoring-nsm" target="_self"><u><span>NSM</span></u></a><span> and </span><a href="https://corelight.com/resources/glossary/ndr-network-detection-and-response" target="_self"><u><span>NDR</span></u></a><span>.</span><span> </span></p> <p><span></span><span> </span></p> <p><strong><span>Chapter 2</span></strong><span> is all about the four types of NSM data. I show examples of full content data via terminal and graphical interfaces, and what it can do for analysts. I briefly demonstrate how to obtain and analyze extracted content, then show how transaction data can answer many of the key questions asked by security analysts. The chapter concludes with alert data, which has become more significant in an age of smarter and more precise AI capabilities.</span><span> </span></p> <p><span></span><span> </span></p> <p><strong><span>Chapter 3 </span></strong><span>is the first of two chapters demonstrating workflows for security investigators. This chapter examines how alert data from a sufficiently capable NDR can identify suspicious and malicious activity. It includes four cases, showing how lateral movement, expired SSL certificates, outbound reconnaissance, and malicious remote desktop protocol behavior manifest in alerts.</span><span> </span></p> <p><span></span><span> </span></p> <p><strong><span>Chapter 4</span></strong><span> presents the other side of investigative workflows, relying on </span><a href="https://corelight.com/resources/glossary/threat-hunting" target="_self"><u><span>threat hunting</span></u></a><span> to reveal adversary activity. Properly collected, rendered, and displayed NSM data is crucial, because you can’t really hunt without high-quality evidence. The chapter includes six cases, showing how file name mismatches, unusual downloads, large data transfers, coordinated exfiltration, lateral movement, and certificates appear when exposed via threat hunting.</span><span> </span></p> <p><span></span><span> </span></p> <p><strong><span>Chapter 5 </span></strong><span>explores how artificial intelligence and automation technologies are bringing powerful new capabilities to security teams. I start by discussing the generation of alerts at the edge and at the center, then I share how AI can help with investigating suspicious and </span><span>malicious activity. I conclude with advice on the best use of agentic triage and how AI will integrate with tools while enabling new capabilities.</span><span> </span></p> <p><span></span><span> </span></p> <p><span>If you’re a security leader, such as a CISO or director, you’ll probably be most interested in Chapters 1 and 5. You should ensure your teams have the data described in Chapters 2-4. If you’re a security analyst, you’ll probably be most interested in Chapters 2-4, although you should be familiar with the concepts and strategies in Chapters 1 and 5. If you’re familiar with my previous works, you will be happy to see that this book has a certain amount of “future-proofing” embedded. I did not explain how to install any specific tools, nor did the tools I use rely on strict display technologies. All of the examples in Chapter 2 use open source tools with stable outputs, such as Tshark, Wireshark</span><span><sup><span>®</span></sup></span><span>, Zeek</span><span><sup><span>®</span></sup></span><span>, and Suricata</span><span><sup><span>®</span></sup></span><span>. </span><span> </span></p> <p><span></span><span> </span></p> <p><span>I hope readers find the book relevant to their security work and a decent introduction to adding NSM data from capable NDRs to their investigations. This book is only the beginning of what can be done once teams have access to high-fidelity network evidence. If you’d like to know more about the book, Vince Stoffer interviewed me for the </span><a href="https://corelight.com/podcasts" target="_self"><u><span>Corelight podcast</span></u></a><span>, and that episode will be available on YouTube, Spotify, and Apple Podcasts. As I say at the end of every episode, “we will see you on the network.” Read </span><a href="https://corelight.com/cp/ndr-essentials" target="_self"><em><u><span>NDR Essentials</span></u></em></a><span> to learn how high-fidelity network evidence can strengthen your security program!</span></p></span></div><div style="text-align: left;"><br></div><div class="blogger-post-footer">Copyright 2003-2020 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)</div>

2026/7/9

Bill to Create Independent US Cyber Force Wants to Place It Under the US Army

<div style="text-align: left;">It looks like we're finally making progress towards an independent US Cyber Force:<br /><br /><a href="https://www.csis.org/programs/strategic-technologies-program/projects/commission-us-cyber-force-generation">https://www.csis.org/programs/strategic-technologies-program/projects/commission-us-cyber-force-generation</a><br /><br />However, this bill by Sen Gillibrand to put it under the Army isn't the best idea.<br /><br /><a href="https://www.airandspaceforces.com/new-push-for-separate-cyber-force-builds-but-questions-remain/">https://www.airandspaceforces.com/new-push-for-separate-cyber-force-builds-but-questions-remain/</a><br /><br />I get it -- Navy has the Marine Corps, Air Force has the Space Force, Army has... nothing? But the Coast Guard doesn't slot under anyone either. It would be a step backwards to put Cyber under Army.</div><div style="text-align: left;"><br /></div><div class="blogger-post-footer">Copyright 2003-2020 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)</div>

2026/6/8

Mandiant Global Median Dwell Time Deteriorates from 11 to 14 Days

<div style="text-align: left;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5XpM7cL0lNDHmgEN35ZSPrZ-Da0QIdhjpR2LxMZ3CgTeWkIP9ITSPovOA4eEzo0losfcpDhHeivhHo6qT9yyzSEg8gTlIXz8VnQLlFPLQOtz0xWMf6eRF-rrxxqLt_J3fIIdxTg56bSd1AxIAAnFg-3oFkyIwPPS2h5msY7OPC-fHla-kdkAg/s1354/IMG_4633.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1354" data-original-width="1354" height="640" src="https://imgproxy.citrusreader.com/gp0gdXhiTxxXZx3BQJHL8hVd8EHhUl-RKOjGgngnabM/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VqNVhwTTdjTDBsTkRIbWdFTjM1WlNQclotRGEwUUlkaGpwUjJMeE1aM0NnVGVXa0lQOUlUU1Bvdk9BNGVFem8wbG9zZmNwRGhIZWl2aEhvNnFUOXl5elNFZzhnVGxJWHo4Vm5RTGxGUExRT3R6MHhXTWY2ZVJGLXJyeHhxTHRfSjNmSUlkeFRnNTZiU2QxQXhJQUFuRmctM29Ga3lJd1BQUzJoNW1zWTdPUEMtZkhsYS1rZGtBZy93NjQwLWg2NDAvSU1HXzQ2MzMuanBn" width="640"></a></div><br> </div><div style="text-align: left;">Oh snap. My single most important cybersecurity metric deteriorated again. </div><div><br></div><div>In the M-Trends report for calendar year 2024, Mandiant’s global median dwell time metric worsened from 10 to 11 days. In the newest report, released today, for calendar year 2025, that metric worsened again, from 11 to 14 days. </div><div><br></div><div>In other words, organizations are taking even longer to detect and respond to intrusions. 10 days was already still too much, in a world where teams need to detect and contain in an hour to be effective. </div><div><br></div><div>I’m not a doomer. We made amazing progress since 2011, when median global dwellers time was over 400 days. But, two bad years in a row has never happened. Before last year, the metric had always improved!</div><div><br></div><div>It’s possible Mandiant is just dealing with ever tougher cases. I have to dig into the full report. </div><div class="blogger-post-footer">Copyright 2003-2020 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)</div>

2026/3/24

Happy 23rd Birthday TaoSecurity Blog

<div style="text-align: left;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjFYzk8hA1dQ0M_VTBdI1YjPcq6-Wy7gjcFwkHSQoSNXfyTeF_KNWwG25h9WHkGjYKkYgKq07MLY1Qw7GpWlDKiVSFqDBzZxVIqgWh-M2HEBfFmg4-DsCSLb5YVv5YQ4-RIpGssYvauPQHs2iodI4WYPwqRa9Ye8HbeLwTV8jRHBLLC16lU1_2r/s4032/IMG_7339.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="3024" data-original-width="4032" height="480" src="https://imgproxy.citrusreader.com/8_SclZGJt-gtINMPHglqfP6mwz5M9JdGmovozZkRPbE/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VqRll6azhoQTFkUTBNX1ZUQmRJMVlqUGNxNi1XeTdnamNGd2tIU1FvU05YZnlUZUZfS05Xd0cyNWg5V0hrR2pZS2tZZ0txMDdNTFkxUXc3R3BXbERLaVZTRnFEQnpaeFZJcWdXaC1NMkhFQmZGbWc0LURzQ1NMYjVZVnY1WVE0LVJJcEdzc1l2YXVQUUhzMmlvZEk0V1lQd3FSYTlZZThIYmVMd1RWOGpSSEJMTEMxNmxVMV8yci93NjQwLWg0ODAvSU1HXzczMzkuanBn" width="640"></a></div><br> </div><div style="text-align: left;">Happy birthday TaoSecurity Blog, born on this day in 2003!<div style="text-align: left;"><br></div><div style="text-align: left;">The best way to digest the key lessons from this site is to browse my four volume <a href="https://amzn.to/3p7Z3qb" target="_blank">Best of TaoSecurity Blog book series</a>, published in 2020. It's available in print as seen here, or as a properly formatted HTML-based digital book -- none of that PDF-based fixed format nonsense.<br></div><div style="text-align: left;"><br></div><div style="text-align: left;">Each book is a theme-centric collection of posts with new commentary for each entry. Some of what I wrote stood the test of time, and some did not. See what you think. Or, just scroll backwards through this site.</div><div style="text-align: left;"><br></div><div style="text-align: left;">Thank you to Blogspot and Google for hosting this blog for the last 23 years! This is post number 3,094 by the way.</div></div><div style="text-align: left;"> </div><div style="text-align: left;"> </div><div class="blogger-post-footer">Copyright 2003-2020 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)</div>

2026/1/8

We have achieved FreeBSD 15.0-REL with KDE Plasma

<div style="text-align: left;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_oFHg4AWo3-KG6Gq7m8-2PYsWB-RAuN4qJLVG2G38ktnIZoAkJQ5fs4v5AT54Q1lkW2IFFNaRP7WZXX32ObWZSYU3WRf7arlKyO1cjCdrAc9C0k6b-QtmOLDYdo_Uor9FPxvc6c7Tv28YK1kthXxMaqOZdNqkXUqdXwjK_rkZBzJJNgsnAYDi/s1920/25b38e20c63009fe.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1080" data-original-width="1920" height="360" src="https://imgproxy.citrusreader.com/c3mxElf81NtRletVeD8m-zpi5-03sQkIicht4H5SEhQ/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VoX29GSGc0QVdvMy1LRzZHcTdtOC0yUFlzV0ItUkF1TjRxSkxWRzJHMzhrdG5JWm9Ba0pRNWZzNHY1QVQ1NFExbGtXMklGRk5hUlA3V1pYWDMyT2JXWlNZVTNXUmY3YXJsS3lPMWNqQ2RyQWM5QzBrNmItUXRtT0xEWWRvX1VvcjlGUHh2YzZjN1R2MjhZSzFrdGhYeE1hcU9aZE5xa1hVcWRYd2pLX3JrWkJ6SkpOZ3NuQVlEaS93NjQwLWgzNjAvMjViMzhlMjBjNjMwMDlmZS5wbmc" width="640"></a></div> </div><div style="text-align: left;">Houston, we have installed #FreeBSD 15.0-REL with KDE Plasma 6.4.5 on a Lenovo ThinkPad X1 Carbon Gen 6 laptop. <div class="mb-sm mb-xs px-md xs:px-0 overflow-hidden" data-post-click-location="text-body"><div class="md text-14-scalable pb-2xs" id="t3_1p9f2i0-post-rtjson-content" style="--emote-size: 20px;"><p> I have come full circle. I used to daily drive FreeBSD 5.x on a Thinkpad a20p in the early 2000s. </p><p> Today I used the "technology preview" method for pkg installation, too. I posted this from the laptop, of course!! </p><p> Thanks to everyone who made this possible, including the parties who made the script to install KDE with one command.</p></div></div></div><div class="blogger-post-footer">Copyright 2003-2020 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)</div>

2025/11/29

I'm Hosting a New Podcast

<p> </p><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgm3DWOI92NwkBm7w6W_2lW1JZLvkkksIHRjetWN9XPUimd-owuw2VZyx42nBKzqzU2vpYScJDtwhCG1MhY7aOk8Wb8gtKuYzNYUeKLc5VoNLVEXie1jAWUo7hQQmQhlzcIg8Bj3A8kaXB5RKSXA13su_2vCsWa2rVucUxsU41ClJY6M9P8MWUa/s1165/SquareCap-20251106044%20podcast.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1165" data-original-width="1165" height="640" src="https://imgproxy.citrusreader.com/n-v5_rDp1LajNUB55wp3f-ztdVILJbZc_XL3sOXg0bA/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VnbTNEV09JOTJOd2tCbTd3NldfMmxXMUpaTHZra2tzSUhSamV0V045WFBVaW1kLW93dXcyVlp5eDQybkJLenF6VTJ2cFlTY0pEdHdoQ0cxTWhZN2FPazhXYjhndEt1WXpOWVVlS0xjNVZvTkxWRVhpZTFqQVdVbzdoUVFtUWhsemNJZzhCajNBOGthWEI1UktTWEExM3N1XzJ2Q3NXYTJyVnVjVXhzVTQxQ2xKWTZNOVA4TVdVYS93NjQwLWg2NDAvU3F1YXJlQ2FwLTIwMjUxMTA2MDQ0JTIwcG9kY2FzdC5wbmc" width="640"></a></div><p></p><p>I'm hosting a new podcast for Corelight. Check out my first episode with our field CTO, Vince Stoffer. Expect new episodes every two weeks. This is no buddy cop discussion -- max content, minimum banter, in about 15 minutes! </p><p><a href="https://open.spotify.com/episode/0SD2gUvIuB65YFmjjtXfTR">https://open.spotify.com/episode/0SD2gUvIuB65YFmjjtXfTR</a></p><p><br><a href="https://podcasts.apple.com/us/podcast/corelight-defendrs/id1843154362">https://podcasts.apple.com/us/podcast/corelight-defendrs/id1843154362</a></p><p><br><a href="https://www.youtube.com/watch?v=IgmZxV2OP9k">https://www.youtube.com/watch?v=IgmZxV2OP9k</a></p><div class="blogger-post-footer">Copyright 2003-2020 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)</div>

2025/11/6

Creating a Linux Application Using VSCodium, Cline, OpenRouter, and Claude

<div style="text-align: left;"><div style="text-align: left;">In March I created a <a href="https://taosecurity.blogspot.com/2025/03/creating-windows-application-using.html" target="_blank">Windows Application Using Visual Studio Code, Cline, OpenRouter, and Claude</a>. This was a program that created square screen captures. The user doesn't need to manually ensure the dimensions are a square. The program makes the window grow and shrink while keeping the length equal to the height.</div><div style="text-align: left;"> </div><div style="text-align: left;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEguCCVz3lbVrU6Ct1ejGqTaQgicYRU_e4E6SLCwbHJEHr5In8w5ou-hEdTwOSUu_RE2VOXnnzFwsitCoYmSlRLhvsGeybOx9WbhhLoP6zEikI_E4IRXylyvvVl1RA11ea8rVGwqPGVl4wUSOgjX1PTO5IVTwBBieLXNLwbBn6hyphenhyphenxQfazMlc2-RtRXpkxtSm/s2100/BejSnap-20251103001.png" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="2100" data-original-width="2100" height="640" src="https://imgproxy.citrusreader.com/EUtYx2EORzlvNMrax19KWyCqipAXhdq_MM_j6QocVZQ/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VndUNDVnozbGJWclU2Q3QxZWpHcVRhUWdpY1lSVV9lNEU2U0xDd2JISkVIcjVJbjh3NW91LWhFZFR3T1NVdV9SRTJWT1hubnpGd3NpdENvWW1TbFJMaHZzR2V5Yk94OVdiaGhMb1A2ekVpa0lfRTRJUlh5bHl2dlZsMVJBMTFlYThyVkd3cVBHVmw0d1VTT2dqWDFQVE81SVZUd0JCaWVMWE5Md2JCbjZoeXBoZW5oeXBoZW54UWZhek1sYzItUnRSWHBreHRTbS93NjQwLWg2NDAvQmVqU25hcC0yMDI1MTEwMzAwMS5wbmc" width="640"></a></div>  </div><div style="text-align: left;"><span style="font-family: inherit;">In June I created an equivalent program on Linux using VSCodium, Cline, OpenRouter, and Claude.</span></div><div style="text-align: left;"><span style="font-family: inherit;"> </span></div><div style="text-align: left;"><span style="font-family: inherit;">I provided this prompt, which I derived from the last project.</span></div><div style="text-align: left;"><span style="font-family: inherit;"> </span></div><div style="text-align: left;"><span style="font-family: inherit;">== </span></div><div style="text-align: left;"><span style="font-family: inherit;"> </span></div><div style="text-align: left;"><span style="font-family: inherit;">Create a graphical Linux application to take screen captures with the following features:</span></div><div style="text-align: left;"><span style="font-family: inherit;"></span></div><div style="text-align: left;"><span style="font-family: inherit;"></span></div><div style="text-align: left;"><span style="font-family: inherit;"></span></div><div style="text-align: left;"><span style="font-family: inherit;"></span></div><div style="text-align: left;"><span style="font-family: inherit;"><br>Square Region Selection: Enforces a 1:1 aspect ratio during region selection</span></div><div style="text-align: left;"><span style="font-family: inherit;"><br>1:1 Aspect Ratio: Ensures all captures are perfectly square</span></div><div style="text-align: left;"><span style="font-family: inherit;"><br>PNG Output: Saves high-quality images in PNG format</span></div><div style="text-align: left;"><span style="font-family: inherit;"><br>Preview: Shows the captured image before saving</span></div><div style="text-align: left;"><span style="font-family: inherit;"><br>Dark Mode by Default: Toggle to light theme if desired</span></div><div style="text-align: left;"><span style="font-family: inherit;"><br>Square Interface: The application window itself uses a square ratio</span></div><div style="text-align: left;"><span style="font-family: inherit;"><br>Default Save Location: Set a preferred folder for saving captures</span></div><div style="text-align: left;"><span style="font-family: inherit;"><br>Automatic File Naming: Uses format "BejCap-YYYYMMDD###" for organized file management<br><br>I prefer C++ with Qt. </span></div><div style="text-align: left;"><span style="font-family: inherit;"> </span></div><div style="text-align: left;"><span style="font-family: inherit;">For shortcuts use Ctrl+S to Save the current image and Esc to Cancel region selection (when in region selection mode). </span></div><div style="text-align: left;"><span style="font-family: inherit;"> </span></div><div style="text-align: left;"><span style="font-family: inherit;">I do not want to capture to clipboard.</span></div><div style="text-align: left;"><span style="font-family: inherit;"> </span></div><div style="text-align: left;"><span style="font-family: inherit;">== </span></div><div style="text-align: left;"><span style="font-family: inherit;"> </span></div><div style="text-align: left;"><span style="font-family: inherit;">I also supplied these guidelines:</span></div><div style="text-align: left;"><span style="font-family: inherit;"> </span></div><div style="text-align: left;"><span style="font-family: inherit;">Always test the project at the end to ensure it doesn't contain errors.</span></div><div style="text-align: left;"><span style="font-family: inherit;"><br>Don't create placeholder code unless you plan to expand on it later.</span></div><div style="text-align: left;"><span style="font-family: inherit;"><br>Code from A to Z rather than just small parts that don't fulfill the user's needs.</span></div><div style="text-align: left;"><span style="font-family: inherit;"><br>Keep project files between 300-500 lines where possible.</span></div><div style="text-align: left;"><span style="font-family: inherit;"><br>Don't duplicate code. Build upon existing implementations.</span></div><div style="text-align: left;"><span style="font-family: inherit;"> </span></div><div style="text-align: left;"><span style="font-family: inherit;">== </span></div><div style="text-align: left;"></div><div style="text-align: left;"><span style="font-family: inherit;"><br></span></div><div style="text-align: left;"><span style="font-family: inherit;">I had to install the following to enable the program development:</span><br> </div><div style="text-align: left;"><span style="font-family: courier;"><b>sudo apt install build-essential cmake qtbase5-dev qt5-qmake qtbase5-dev-tools </b></span></div><div style="text-align: left;"> </div><div style="text-align: left;">The development seemed much faster than my last project, and the result works very well.</div><div style="text-align: left;"> </div><div style="text-align: left;">If you'd like to try it on Linux, you can access it here: <a href="https://github.com/taosecurity/BejSnap">https://github.com/taosecurity/BejSnap</a>. </div><div style="text-align: left;"><br><br></div><br></div><div class="blogger-post-footer">Copyright 2003-2020 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)</div>

2025/11/4

Company Wrecked by Ransomware Only Spent 120,000 Pounds Per Year on Cyber Security

<div style="text-align: left;"><span style="-webkit-text-stroke-color: rgb(0, 0, 0); font-family: Arial; font-size: 14.67px;">Do you remember the story of the UK-based logistics company that closed due to ransomware and laid off 730 workers? </span></div> <p style="-webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: 0px; font-family: "Times New Roman"; font-feature-settings: normal; font-kerning: auto; font-optical-sizing: auto; font-size-adjust: none; font-size: 12px; font-style: normal; font-variant-alternates: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-position: normal; font-variation-settings: normal; font-width: normal; line-height: normal; margin: 0px; min-height: 13.8px;"><span style="font-kerning: none;"></span><br /></p> <p style="-webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: 0px; font-family: Arial; font-feature-settings: normal; font-kerning: auto; font-optical-sizing: auto; font-size-adjust: none; font-size: 14.7px; font-style: normal; font-variant-alternates: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-position: normal; font-variation-settings: normal; font-width: normal; line-height: normal; margin: 0px;"><span style="font-kerning: none; font-size: 14.67px;">Today in an article about a warning to UK businesses about cyber incidents, their “director” said they “were throwing £120,000 a year at [cyber-security] with insurance and systems and third-party managed systems.”</span></p> <p style="-webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: 0px; font-family: "Times New Roman"; font-feature-settings: normal; font-kerning: auto; font-optical-sizing: auto; font-size-adjust: none; font-size: 12px; font-style: normal; font-variant-alternates: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-position: normal; font-variation-settings: normal; font-width: normal; line-height: normal; margin: 0px; min-height: 13.8px;"><span style="font-kerning: none;"></span><br /></p> <p style="-webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: 0px; font-family: Arial; font-feature-settings: normal; font-kerning: auto; font-optical-sizing: auto; font-size-adjust: none; font-size: 14.7px; font-style: normal; font-variant-alternates: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-position: normal; font-variation-settings: normal; font-width: normal; line-height: normal; margin: 0px;"><span style="font-kerning: none; font-size: 14.67px;">That’s the cost of one cyber FTE, and it sounds like they didn’t employ ANY cyber people. This is what I mean by the “security 1%.” </span></p> <p style="-webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: 0px; font-family: "Times New Roman"; font-feature-settings: normal; font-kerning: auto; font-optical-sizing: auto; font-size-adjust: none; font-size: 12px; font-style: normal; font-variant-alternates: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-position: normal; font-variation-settings: normal; font-width: normal; line-height: normal; margin: 0px; min-height: 13.8px;"><span style="font-kerning: none;"></span><br /></p> <p style="-webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: 0px; font-family: Arial; font-feature-settings: normal; font-kerning: auto; font-optical-sizing: auto; font-size-adjust: none; font-size: 14.7px; font-style: normal; font-variant-alternates: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-position: normal; font-variation-settings: normal; font-width: normal; line-height: normal; margin: 0px;"><span style="font-kerning: none; font-size: 14.67px;"><a href="https://taosecurity.blogspot.com/2020/10/security-and-one-percent-thought.html">https://taosecurity.blogspot.com/2020/10/security-and-one-percent-thought.html</a></span></p> <p style="-webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: 0px; font-family: "Times New Roman"; font-feature-settings: normal; font-kerning: auto; font-optical-sizing: auto; font-size-adjust: none; font-size: 12px; font-style: normal; font-variant-alternates: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-position: normal; font-variation-settings: normal; font-width: normal; line-height: normal; margin: 0px; min-height: 13.8px;"><span style="font-kerning: none;"></span><br /></p> <p style="-webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: 0px; font-family: Arial; font-feature-settings: normal; font-kerning: auto; font-optical-sizing: auto; font-size-adjust: none; font-size: 14.7px; font-style: normal; font-variant-alternates: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-position: normal; font-variation-settings: normal; font-width: normal; line-height: normal; margin: 0px;"><span style="font-kerning: none; font-size: 14.67px;">This company was in the 99%, and intruders put them out of business, despite apparently having $100 million in annual revenue? </span></p> <p style="-webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: 0px; font-family: "Times New Roman"; font-feature-settings: normal; font-kerning: auto; font-optical-sizing: auto; font-size-adjust: none; font-size: 12px; font-style: normal; font-variant-alternates: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-position: normal; font-variation-settings: normal; font-width: normal; line-height: normal; margin: 0px; min-height: 13.8px;"><span style="font-kerning: none;"></span><br /></p> <p style="-webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: 0px; font-family: Arial; font-feature-settings: normal; font-kerning: auto; font-optical-sizing: auto; font-size-adjust: none; font-size: 14.7px; font-style: normal; font-variant-alternates: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-position: normal; font-variation-settings: normal; font-width: normal; line-height: normal; margin: 0px;"><span style="font-kerning: none; font-size: 14.67px;">I never blame victims of intrusions, but the underinvestment in security is appalling.</span></p> <p style="-webkit-text-stroke-color: rgb(0, 0, 0); -webkit-text-stroke-width: 0px; font-family: "Times New Roman"; font-feature-settings: normal; font-kerning: auto; font-optical-sizing: auto; font-size-adjust: none; font-size: 12px; font-style: normal; font-variant-alternates: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-position: normal; font-variation-settings: normal; font-width: normal; line-height: normal; margin: 0px; min-height: 13.8px;"><span style="font-kerning: none;"></span><br /></p> <p style="-webkit-text-stroke-color: rgb(17, 85, 204); -webkit-text-stroke-width: 0px; color: #1155cc; font-family: Arial; font-feature-settings: normal; font-kerning: auto; font-optical-sizing: auto; font-size-adjust: none; font-size: 14.7px; font-style: normal; font-variant-alternates: normal; font-variant-caps: normal; font-variant-east-asian: normal; font-variant-emoji: normal; font-variant-ligatures: normal; font-variant-numeric: normal; font-variant-position: normal; font-variation-settings: normal; font-width: normal; line-height: normal; margin: 0px;"><span style="-webkit-text-stroke-color: rgb(0, 0, 0); color: black; font-kerning: none; font-size: 14.67px;">Refs: <a href="https://www.bbc.com/news/articles/ced61xv967lo"><span style="-webkit-text-stroke-color: rgb(17, 85, 204); font-kerning: none; font-size: 14.67px;">https://www.bbc.com/news/articles/ced61xv967lo</span></a> and <a href="https://www.northantstelegraph.co.uk/news/people/kettering-haulage-company-knights-of-old-group-goes-into-administration-with-730-redundancies-4349040#"><span style="-webkit-text-stroke-color: rgb(17, 85, 204); font-kerning: none; font-size: 14.67px;">https://www.northantstelegraph.co.uk/news/people/kettering-haulage-company-knights-of-old-group-goes-into-administration-with-730-redundancies-4349040#</span></a> </span></p><div class="blogger-post-footer">Copyright 2003-2020 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)</div>

2025/10/15

Stop Shoddy Academic "Research"

<div style="text-align: left;">When someone cites one of my works, I get a notice from Research Gate. Today I got one, from an article from the "IEEE Open Journal of the Communications Society." It cited my first book, which is 21 years old.</div><div style="text-align: left;"> </div><div style="text-align: left;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbOUrIE_yg_2N89bEEprrcZ60kyU06-4YMJ7lxjn-7MM_VVIZJXU8COJTht4kU5Q9m9g77fCADOeerld42Vm7fWbZw2D9jQ4bplfWieO_Wb-o6c56SP2ouH0k5kApKluoopaCvCdVxukph2W5_a367v375oXCqeszM-jGUM3OX8stnGNh7pElH/s1582/SquareCap-20251002039%20rg.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1582" data-original-width="1582" height="640" src="https://imgproxy.citrusreader.com/xCXVSh8twmid5O472Qcqqrc5vo8WOmwPC1KuoQ60X5A/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VnYk9VcklFX3lnXzJOODliRUVwcnJjWjYwa3lVMDYtNFlNSjdseGpuLTdNTV9WVklaSlhVOENPSlRodDRrVTVROW05Zzc3ZkNBRE9lZXJsZDQyVm03ZldiWncyRDlqUTRicGxmV2llT19XYi1vNmM1NlNQMm91SDBrNWtBcEtsdW9vcGFDdkNkVnh1a3BoMlc1X2EzNjd2Mzc1b1hDcWVzek0takdVTTNPWDhzdG5HTmg3cEVsSC93NjQwLWg2NDAvU3F1YXJlQ2FwLTIwMjUxMDAyMDM5JTIwcmcucG5n" width="640"></a></div><br> </div><div style="text-align: left;">The PDF was available. </div><div style="text-align: left;"> </div><div style="text-align: left;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj0TDATudCT5pUcOldXvnMKRLSbfJPCeaXApbAhW3RDDWPfV_UjeaIKcExy0S8qXWT1XdjtwtHuwUPB9xNYY3oDlWeFdnbJ_9O7j4Wd3tFUhw6TfMyB5xDhUQ8m8X9tZ9GMG15ebOk5XgmUha1GdVIAjjwvJL2E6SDciY02hmqT0kVztj42Lxh3/s1775/SquareCap-20251002036%20cover.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1775" data-original-width="1775" height="640" src="https://imgproxy.citrusreader.com/MRGFkRMkMsJ-WaPRFUtd6L6ZYhtuemI8OimVOwZHDjI/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VqMFREQVR1ZENUNXBVY09sZFh2bk1LUkxTYmZKUENlYVhBcGJBaFczUkREV1BmVl9VamVhSUtjRXh5MFM4cVhXVDFYZGp0d3RIdXdVUEI5eE5ZWTNvRGxXZUZkbmJKXzlPN2o0V2QzdEZVaHc2VGZNeUI1eERoVVE4bThYOXRaOUdNRzE1ZWJPazVYZ21VaGExR2RWSUFqand2SkwyRTZTRGNpWTAyaG1xVDBrVnp0ajQyTHhoMy93NjQwLWg2NDAvU3F1YXJlQ2FwLTIwMjUxMDAyMDM2JTIwY292ZXIucG5n" width="640"></a></div><br>I noticed the article referenced Prelude, a project I talked about in my first book. </div><div style="text-align: left;"> </div><div style="text-align: left;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIjLgZ64N3EvpifTeuQTLsKlkbJn_NnUyspJdqjEocGdoJf5q5le9LUERB2I6vNLh3R-F1o75eqPm9jOpkqihMkaoZ0azcKmZZRqC6j7XaocGp1tOFkkg8Jvxa1KdhctN8zs0b99s_1bLPdxuOKrDx0dw5aOhGpJD0A4aRpn3xUQT-OFCuppwW/s1811/SquareCap-20251002034%20prelude.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1811" data-original-width="1811" height="640" src="https://imgproxy.citrusreader.com/de6QzFohXtHvpwHaZeesLbLu_gg-9Z6hIUY4sAJB8rM/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VpSWpMZ1o2NE4zRXZwaWZUZXVRVExzS2xrYkpuX05uVXlzcEpkcWpFb2NHZG9KZjVxNWxlOUxVRVJCMkk2dk5MaDNSLUYxbzc1ZXFQbTlqT3BrcWloTWthb1owYXpjS21aWlJxQzZqN1hhb2NHcDF0T0Zra2c4SnZ4YTFLZGhjdE44enMwYjk5c18xYkxQZHh1T0tyRHgwZHc1YU9oR3BKRDBBNGFScG4zeFVRVC1PRkN1cHB3Vy93NjQwLWg2NDAvU3F1YXJlQ2FwLTIwMjUxMDAyMDM0JTIwcHJlbHVkZS5wbmc" width="640"></a></div><br> </div><div style="text-align: left;"> </div><div style="text-align: left;">This project has been dead for YEARS. If you visit the link for Prelude in the paper, supposedly visited for research in Feb 2025, it redirects to a gambling site. </div><div style="text-align: left;"> </div><div style="text-align: left;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhWGGkucrHXRwz89-ZjzWdwcLuMC-2h45ydPTUx7_UOFeIFdFVkG2zoMTC2M4Cjj3Ohhs56OHKX_KN4NQ5zNh0FJe7D7NZfO9zGSsxm8wYAWIG3G2qulwraQSuLUiZcVCzsCrL7-mnvx57bDZNr5nOH7-DnzALRsvTtDeUTFHL9Ngad41sjPTeK/s1784/SquareCap-20251002037%20link.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1784" data-original-width="1784" height="640" src="https://imgproxy.citrusreader.com/CDIJta03I0vgnSJIU5T8rgbW5BqgSmwFwmJXz_Og-cQ/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VoV0dHa3VjckhYUnd6ODktWmp6V2R3Y0x1TUMtMmg0NXlkUFRVeDdfVU9GZUlGZEZWa0cyem9NVEMyTTRDamozT2hoczU2T0hLWF9LTjROUTV6TmgwRkplN0Q3TlpmTzl6R1NzeG04d1lBV0lHM0cycXVsd3JhUVN1TFVpWmNWQ3pzQ3JMNy1tbnZ4NTdiRFpOcjVuT0g3LURuekFMUnN2VHREZVVURkhMOU5nYWQ0MXNqUFRlSy93NjQwLWg2NDAvU3F1YXJlQ2FwLTIwMjUxMDAyMDM3JTIwbGluay5wbmc" width="640"></a></div><br>If you go to the original Prelude IDS site, it's a disguised gambling site.</div><div style="text-align: left;"> </div><div style="text-align: left;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgN4Zqd1zt4wSVA2ChMNH8_Dt6vP2vQBAXjltG2ECMjYr1J1G-Bp4vEcg0nY2YhP6Mj9fjHbKI9gi0Ups8g86phDWPZJd-DQwRlvcYkHRJIe2VFBj2OszhzSs2HlQ9Wb6_nGOApUSOqhiskUpUKC5Al2dAlDpb-fGufL7NZLHSs-CfDLIBD9V8E/s1712/SquareCap-20251002035%20prelude%20web%20site.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1712" data-original-width="1712" height="640" src="https://imgproxy.citrusreader.com/l57evFonybwgDrQ0aYC88DzgOF2qR2Tyn9TdeLsAeLQ/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VnTjRacWQxenQ0d1NWQTJDaE1OSDhfRHQ2dlAydlFCQVhqbHRHMkVDTWpZcjFKMUctQnA0dkVjZzBuWTJZaFA2TWo5ZmpIYktJOWdpMFVwczhnODZwaERXUFpKZC1EUXdSbHZjWWtIUkpJZTJWRkJqMk9zemh6U3MySGxROVdiNl9uR09BcFVTT3FoaXNrVXBVS0M1QWwyZEFsRHBiLWZHdWZMN05aTEhTcy1DZkRMSUJEOVY4RS93NjQwLWg2NDAvU3F1YXJlQ2FwLTIwMjUxMDAyMDM1JTIwcHJlbHVkZSUyMHdlYiUyMHNpdGUucG5n" width="640"></a></div><br> </div><div style="text-align: left;"></div><div style="text-align: left;">I checked with Archive.org and the site was not serving useful content in the timeframe the researchers claimed.</div><div style="text-align: left;"> </div><div style="text-align: left;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiHBc1IUTuM9uShCdTZ14ze9xZZ1Nhs_AjjLd4-gABTqL2A6a-IR-hx3__AeqPngxL2JcXmI82tYCVI9t92IR9uG06j-LmDwgKVq9BVnWnPyBOwVFvMgN1PJTD9LAGe7itiBIGKKXmJRXtW95kRPr1dftUjcz54RX4873o7c2B3cZQmKKhX4jbr/s1557/SquareCap-20251002038%20archive.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1557" data-original-width="1557" height="640" src="https://imgproxy.citrusreader.com/q_aYyccwZwL3_3ulhsxL35Vp8Qi3ak6D0XPPcCUdmSY/raw:1/aHR0cHM6Ly9ibG9nZ2VyLmdvb2dsZXVzZXJjb250ZW50LmNvbS9pbWcvYi9SMjl2WjJ4bC9BVnZYc0VpSEJjMUlVVHVNOXVTaENkVFoxNHplOXhaWjFOaHNfQWpqTGQ0LWdBQlRxTDJBNmEtSVItaHgzX19BZXFQbmd4TDJKY1htSTgydFlDVkk5dDkySVI5dUcwNmotTG1Ed2dLVnE5QlZuV25QeUJPd1ZGdk1nTjFQSlREOUxBR2U3aXRpQklHS0tYbUpSWHRXOTVrUlByMWRmdFVqY3o1NFJYNDg3M283YzJCM2NaUW1LS2hYNGpici93NjQwLWg2NDAvU3F1YXJlQ2FwLTIwMjUxMDAyMDM4JTIwYXJjaGl2ZS5wbmc" width="640"></a></div><br>I don't understand how this happens. Stop shoddy academic "research."</div><div class="blogger-post-footer">Copyright 2003-2020 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)</div>

2025/10/2

TaoSecurity Blog

FreeBSD Released the Most Security Advisories in Project History in June 2026

I Wrote a New Book for Corelight

Bill to Create Independent US Cyber Force Wants to Place It Under the US Army

Mandiant Global Median Dwell Time Deteriorates from 11 to 14 Days

Happy 23rd Birthday TaoSecurity Blog

We have achieved FreeBSD 15.0-REL with KDE Plasma

I'm Hosting a New Podcast

Creating a Linux Application Using VSCodium, Cline, OpenRouter, and Claude

Company Wrecked by Ransomware Only Spent 120,000 Pounds Per Year on Cyber Security

Stop Shoddy Academic "Research"

推荐订阅

WeLiveSecurity

Blaze's Security Blog

SANS Blog

ClearSky Cyber Security

360 Netlab Blog - Network Security Research Lab at 360