486 stories
·
0 followers

How the knock-off Signal app used by Trump officials got hacked in 20 minutes

1 Share
How the knock-off Signal app used by Trump officials got hacked in 20 minutes

During the last few weeks I've been consumed with researching TeleMessage, the Israeli firm that makes TM SGNL, the insecure version of Signal that former national security advisor Mike Waltz was photographed using.

After writing a few posts about it, on May 3, an anonymous source told me that they had hacked TeleMessage, and they told me exactly how they did it. When Joseph Cox and I broke the news about the hack for 404 Media, we didn't include any of the juicy details because it would be so trivial for anyone on the internet to reproduce it. Since then, TeleMessage has taken down their service, so this isn't a risk anymore.

Today, I wrote an article for WIRED (my first byline there!) that describes, in detail, exactly how TeleMessage got hacked in "about 15-20 minutes," according to my source. From my article:

“I first looked at the admin panel secure.telemessage.com and noticed that they were hashing passwords to MD5 on the client side, something that negates the security benefits of hashing passwords, as the hash effectively becomes the password,” the hacker said. (Hashing is a way of cryptographically obfuscating a password stored on a system, and MD5 is an inadequate version of the algorithms used to do so.) Drop Site News has since reported that it appears that this admin panel exposed email addresses, passwords, usernames, and phone numbers to the public.

The weak password hashing, and the fact that the TeleMessage site was programmed with JSP—an early 2000s-era technology for creating web apps in Java—gave the hacker “the impression that their security must be poor.” Hoping to find vulnerable JSP files, the hacker then used feroxbuster, a tool that can quickly find publicly available resources on a website, on secure.telemessage.com.

The hacker also used feroxbuster on archive.telemessage.com, another domain used by TeleMessage, which is where they discovered the vulnerable URL: archive.telemessage.com/management/heapdump. When they loaded this URL, the server responded with a Java heap dump, which is a roughly 150 MB file containing a snapshot of the server’s memory at the moment the URL was loaded.

Read my full reporting on WIRED.

Read the whole story
rosskarchner
2 days ago
reply
Share this story
Delete

Musk’s xAI gas turbines: no emission controls, filling Memphis air with smog

1 Share

There’s not enough spare utility power for the xAI data centre in South Memphis, Tennessee — so it runs off 35 gas turbines with no emission controls. They’re just pumping nitrous oxide out into the air. [Politico]

The gas turbines are “temporary” — which means they’re running off no permits in maximum pollution mode because Musk thinks he can get away with it.

xAI’s environmental consultant, Shannon Lynn, says “there’s rules that say temporary sources can be in place for up to 364 days a year. They are not subject to permitting requirements.”

xAI has applied for permits for the first set of turbines. But it won’t install pollution controls unless and until its permits are approved. At that point, xAI will be “the lowest-emitting facility in the country,” allegedly.

The Southern Environmental Law Center says the gas turbines are just straight-up illegal and is pressuring the authorities to act against them.

In fact, the SELC has discovered xAI’s new plans to build a second data centre in South Memphis. That’ll need 1.1 gigawatts, and they plan to power it with another 40 to 90 gas turbines! [SELC; Capacity; SELC]

Other data centre operators are watching closely to see what Musk gets away with at xAI. If this is allowed to pass, they will all be doing the same. Look forward to an AI smog generator in your town!

Read the whole story
rosskarchner
6 days ago
reply
Share this story
Delete

The cryptography behind passkeys

1 Comment and 2 Shares
This post will examine the cryptography behind passkeys, the guarantees they do or do not give, and interesting cryptographic things you can do with them, such as generating cryptographic keys and storing certificates.
Read the whole story
rosskarchner
6 days ago
reply
I found this useful
acdha
6 days ago
reply
Washington, DC
Share this story
Delete

A graph of Myst

1 Share

A few weeks ago, Guillaume Lethuillier posted "The Myst Graph: A New Perspective on Myst":

Upon reflection, Myst has long been more analogous to a graph than a traditional linear game, owing to the relative freedom it affords players. This is particularly evident in its first release (Macintosh, 1993), which was composed of interconnected HyperCard cards.

It is now literally one. Here is Myst as a graph:

A node diagram showing a swirl of hundreds of colored nodes connected by arrows. The diagram is scaled down too far to read the nodes, but there's a zoomed-in popout showing a few of them. One is labelled "Myst:3604 Woodpath2-N", for example. From Guillaume Lethuillier's post (March 29). Click for link to his poster-sized PDF.

The second part of his post digs into his findings, including unreachable states which were left in the game.

That was awesome, and I twooted about it at the time. Now Guillaume has posted a third article, describing how he did it. Also the source code of the tool he used to make the graph!

There's some neat subtleties to how Cyan used Hypercard:

When the first card is pushed (push card), the second card just backtracks to the first.

However, when the first card pushes another card (push card id {ID} of stack “{stack name}”), a more complex transitive relationship emerges, making the player navigate from the first card to the pushed card through an intermediate card (which “pops” to the target card).

-- from "Creating the Graph Using DeMystify" (May 9)


This is all delightful, with only one problem: I am impatient and didn't want to wait six weeks for part three of Guillaume's post!

My goals were somewhat different from Guillaume's. I didn't want to build a graph; he already did that. I just wanted to browse the HyperTalk scripts. The Infocom source code has been wonderful for understanding the context of 1980s text games. I figure that Myst's source code would be just as great for 1990s graphical adventures.

So I, um, wrote my own HyperCard stack extractor.

(Of course I held off releasing it until today, the day after Guillaume released his source code. I'm impatient but I'm not a jerk.)

Guillaume's project uses stackimport, a C++ tool which parses HyperCard stacks and exports their data as XML. The stackimport tool was written by Uli Kusterer, one of the early pioneers of Myst code spelunking. (See this thread, originally posted to Twitter on 2021.)

However, even though I'm familiar with Uli and his GitHub page, I sort of totally missed the existence of stackimport. Whoops!

So I just wrote a Python script to do the same thing. Hey, at least I had fun.


As you see, the MystExtract repo contains all the extracted HyperTalk scripts as text files. I figure I'm already the guy with the archive of Infocom source code; I might as well host the Myst source code too.

To be clear, this is the original 1993 release of Myst for Macintosh. The 1994 Windows port was not based on HyperCard; it was reimplemented from scratch. And of course subsequent releases of Myst have used the Plasma engine (for RealMyst in 2000), then Unity, then Unreal.

Anybody can replicate this work, using either stackimport or my script. The original Mac Myst CD-ROM can be found at the Internet Archive. I used the hfsutils package to extract the files from the ISO disk image. Yes, I own the original Myst CD-ROM -- it's on a shelf right behind me, right next to the external CD drive that I never use any more either. The Archive ISO was easier.

Are there any surprises? Let me refer you to Jeff Barbi's Mysterium presentation last year, where he dug into the source code using HyperCard itself (on a Mac emulator). For example, Jeff refers to this bit of code, which insta-flips every marker switch if you option-click on the Dock marker switch. This is commented out for release (don't bother trying it!) but it was obviously handy for development and testing.

Feel free to browse around and look for more fun stuff!


And now I have to think about the possibility of doing a "Visible Myster", as a followup to the Visible Zorker. Play Myst in your browser, and watch the source code execute every time you take an action!

It's a neat idea. But I'm afraid it's not going to happen any time soon. Sorry! I've played fast and loose with the Infocom IP, but Cyan is a living company and they're making money from Myst right now. (And they do need the money, sadly.)

Anyway, a Visible Myster would be a ton more work. For the Zork project, I had a JavaScript Z-code interpreter ready to go. Are there JavaScript HyperCard interpreters? Well, this one turns up...

Hm. Maybe I should email Cyan and ask for their blessing.

(Yeah, I know, it would still be a ton of work even with a working interpreter to start with. For a start, I'd have to transcode those ancient Quicktime videos into something Web-playable. Animated GIFs? Do I care about sound? I might not care about sound.... Oh, gah, now I'm thinking about the problem.)

Read the whole story
rosskarchner
10 days ago
reply
Share this story
Delete

Note published on May 6, 2025 at 9:37 PM UTC

1 Share

A trader bought 6,000 $TRUMP on April 21, two days before the announcement that top holders would be invited to dinner with the president. They sold it a few hours after the announcement two days later caused the token price to go up, earning $33k on the trade. Impressive timing!

Solscan screenshot showing the trader purchased 6,041.52 TRUMP for $51,051.35 in USDT on April 21
Solscan screenshot showing the trader sold 6,041.52 TRUMP for $84,087.42 in USDT on April 21

They had traded the Trump token a bit for the first few days after it launched in January, then apparently lost interest until suddenly rediscovering it on April 21.

Image

At the moment they still hold 9,130 TRUMP, so as of now they’ll be joining Trump at the dinner in a few weeks.

They regularly transfer funds from Bybit, suggesting they are not based in the US.

Read the whole story
rosskarchner
12 days ago
reply
Share this story
Delete

Fallout 1 & 2 Source Code Preserved Only Through One Person Refusing To Delete Copies Of It

1 Share

It can be really amazing just how bad video game companies have been, and currently still are, when it comes to preserving the very culture that they help to create. While groups like GOG are at least attempting to pressure more developers and publishers to take efforts to preserve older games, it’s simply a fact that there is a massive and historical headwind they’re facing. For a long, long time these companies essentially zeroed out any concern about preserving their work in favor of copyright enforcement coupled with a disinterest in their side of the copyright equation.

We’ve already seen how the ability to legitimately buy some games, such as No One Lives Forever, has been blocked for over a decade over a jumble of potential intellectual property concerns. But the story of the source code for two absolute classic games, Fallout 1 and Fallout 2, and how it almost became completely lost in the ether is a great example of the interest deficit in preservation going back years.

In April, Fallout creator Tim Cain explained that when he left Interplay in 1998 he was ordered to destroy any game assets or code he was holding onto that didn’t belong to him. This included the source code for the OG Fallout. Cain complied, which made it awkward when Interplay called a few years later asking if he had Fallout’s source code still. He thought it was a trap; turns out, Interplay had actually lost the code for it and Fallout 2. And Cain had assumed that due to Interplay’s “destroy it all” policy, the source code for the old RPGs were lost and destroyed. Thankfully, that’s not the case.

On May 5, Videogamer reported that it had heard from Interplay founder and game designer Rebecca Heineman that she had the source code for both Fallout and its sequel, as well as many other Interplay classics. She started preserving every Interplay game after working on the studio’s 10 Year Anthology: Classic Collection and realizing how poorly the company’s past work was being saved for the future.

As Kotaku goes on to note, Heineman received the same order to destroy any copies of any source code she may have made or face litigation as well. She simply chose to ignore that demand. No lawsuit was ever filed and Heineman has indicated she kept her copies because she believed any lawsuit from Interplay would be doomed to fail.

And it’s a damned good thing she did. It appears hers is the only copy of the source code for both of these games. And it should cause all of us who care about game preservation to shiver to our spine that the same company that demanded all copies of source code by deleted couldn’t be bothered to secure the master copy itself. What if Heineman had followed orders like a good soldier? The code would simply be lost to the world, gone forever.

And before anyone thinks otherwise, no, Heineman isn’t some bad actor simply looking to defy all the rules without any deference to corporate interests.

As for why Heineman hasn’t released the code to the internet, she says that could only happen with permission from Bethesda (now the owners of Fallout) as they are still selling Fallout and Fallout 2 today.

“I need expressed permission to release, despite the source code being pretty much obsolete,” said Heineman. “I [haven’t] gotten around to asking them. They are on my list.” She is a busy woman, working on bringing back MacPlay and porting more games to Mac. But hopefully, when she does ask, Bethesda is cool with her sharing these important pieces of game history online.

Yes, hopefully. Otherwise we may be back at this all over again in the future.

Read the whole story
rosskarchner
12 days ago
reply
Share this story
Delete
Next Page of Stories