1000 results for “infosecdj”
The fourth and last die looks like it was made by the same company who made die 3, but the seal ring is slightly different. The only marking is D1. The inputs seem to be on the right side with multiple passives, while the middle is likely active devices. I am not sure what this does.
Full-res map: https://infosecdj.net/map/skyworks/smm6037/infosecdj_mz_nikpa40x_d/
The third die was fabbed using a different process. Metal layers are super thick and, for some reason, golden coloured. Two inductors dominate the scene, with a couple capacitors and what looks like resistors as well. A filter, maybe?
Full-res map: https://infosecdj.net/map/skyworks/smm6037/infosecdj_mz_nikpa40x_c/
The next die is smaller. I believe this is also made by Freescale, even though the logo is not present. M90B likely refers to the maskset. Looks like a RF chip.
The die had top plating which was exposed and got severely oxidised and partially lifted during extraction. The plating metal was scraped on the left half, exposing fresh metal. Interestingly, bonding pads were unaffected, so the composition must be different.
Full-res map: https://infosecdj.net/map/skyworks/smm6037/infosecdj_mz_nikpa40x_b/
This is the one stuck to the substrate. It sports a prominent Freescale logo together with maskset ID of M54BS. I am not sure what 06 and S2 signifies here. The chip has three metal layers, and the process node is large enough for standard cells in the digital section to be readable.
Full-res map: https://infosecdj.net/map/skyworks/smm6037/infosecdj_mz_nikpa60x_a/
Woohoo, unbelievably enough, this account has hit 1000 followers! Thank you, and I hope to keep you entertained in the years to come.
And that'd be it for today. A short one but with multiple dies instead, for a change. I find old RF parts rather interesting to look at.
Stay healthy, stay safe, and until next Friday! Ta-ta!
Sorry for potato quality here, the chip itself it rather small and my phone's camera is certainly showing its age at macro shots.
Inside the package is a whole assembly, with multiple passives and silicon dies. One of them still stuck to the substrate, the others stuck inside the molding compound. Bond wires can still be seen around the dies. Unfortunately, the smaller dies were too challenging to handle. But we can have a look at the larger ones!
Well. A gloomy day and being let go is not a reason to skip #NakedDieFriday so without further ado!
Today's sample is SMM6037, a chip or rather assembly by Skyworks. I did not find a datasheet for this one, but it seems to be equivalent/related MMM6027 by Freescale. The chip itself came from an e-waste pile on a mangled board, which likely was a Motorola branded phone but impossible to tell which one.
🧵
New blog: ChoiceJacking at Public Charging Ports — A New Twist on Mobile Data Theft. Public USB chargers and shared power stations can be weaponized to prompt unintended data access. Read the article for clear, practical advice on safeguarding devices and organizational policies to reduce risk. Read more: https://wix.to/ji8zCee
How to start this weekend well?
Watch the recorded Hackers-Arise course.
This time, I focus on red team.
Japan cybersecurity week in review, Oct 18-24:
- Sagawa Express: up to 53M records, the largest count this year
- php2shell: companies, cities and the PM back pausing websites
- AI pentest tools (ARTEX, Cairn) confirmed by GMO, JPCERT/CC and Microsoft
- Email delivery services Arcadia, Yumil Link and Blastmail breached within a month
- GMO extorted over its FX trading VPS breach
Our list of 1M+ breaches: 37 this year.
https://japancyberwatch.com/articles/japan-cyber-week-2026-10-24
GMO Internet's FX trading VPS breach: attackers are extorting GMO, threatening more orders in customers' accounts at 70+ brokers. GMO refuses to pay, will give every user ¥5,000, cover trading losses and not restart the platform.
It also asked for the "first activation" of active cyber defense. In our view, that misreads the law: it is not a hack-back, nothing is "activated" per incident, and GMO isn't a designated operator.
https://japancyberwatch.com/articles/gmo-onamae-desktop-cloud-fx-vps-breach-2026
CVE-2026-85010: RestroPress WordPress plugin before 3.4.6 lets unauthenticated users set arbitrary cart prices, orders down to zero. CVSS 5.3, no patch confirmed. Update immediately. #CVE #WordPress #infosec https://www.valtersit.com/cve/CVE-2026-85010/
🔓🚨 SIGINT // Cybersecurity Watch — 2026-10-24
Leaked private keys from 8 CA certs let attackers impersonate any domain—billions of older devices/software remain exposed until patched.
https://www.tomshardware.com/tech-industry/cyber-security/leaked-private-keys-for-eight-ca-certificates-let-any-attacker-impersonate-any-domain-billions-of-older-devices-and-software-installations-may-be-vulnerable-after-round-of-fixes-patch-yours-immediately
#InfoSec #PKI #Cybersecurity #CVE
Japan's trade minister says IPA will set up a team of "off-white hackers" in November, using AI to "attack beyond what attackers do" and find weaknesses first. It follows an LDP proposal calling the breach wave the "eve of a cyber emergency".
In our view, "off-white" is the wrong word: ethical hacking is defined by permission, not by shade. And why IPA, under one ministry, when the NCO is the command center?
https://japancyberwatch.com/articles/japan-off-white-hacker-team-ipa-ldp-cyber-emergency-2026
The detail that sticks from Any.Run's fake AI-tool analysis: one fake Ollama page installs the real Ollama alongside the infostealer. The tool works, so the compromise stays invisible. 45% of the 1,258 analyses involved a command pasted into PowerShell or a terminal — and that's a lower bound. #infosec #AI
New short: fake Claude and ChatGPT install pages are stealing credentials, and the install command is the attack. Any.Run analysed 1,258 sandbox submissions tied to fake AI-tool activity — Claude was impersonated in 60%. Hosted on GitHub, Cloudflare Pages and Google Sites, so domain blocking won't save you. #infosec #AI
CW: adatszivárgás — Az OpenCode konzolját érintő okt.17-i incidens miatt ~1,4% felhasználó OpenAI/Anthropic/Google API-kulcsai illetéktelenek számára hozzáférhetővé válhattak. A cég modell-desztillációs támadással hozza összefüggésbe; helyi kliens(ek) állítólag nem érintettek. Vizsgálat folyamatban. #Infosec #AI #OpenSource #Linux https://linuxmint.hu/hir/2026/10/adatszivargas-az-opencode-rendszereben
Web3 Domains: What They Can Do, How to Get One, and Who They Make Sense For
In the second part of my series on custom domains, I did not recommend Web3 domains for a long-term address.
railway paused every deploy this week. someone reached the systems holding customer env vars, and for some got the decrypted values
on railway?
rotate every env var and api key
rotate registry creds
make new railway api tokens (old ones were invalidated)
check aws and gcp logs for access you don't recognize
railway thinks it's part of a series of attacks aimed at AI inference providers
https://blog.railway.com/p/security-disclosure-wednesday-october-21st
GMO Internet found malicious programs on Onamae.com Desktop Cloud, a Windows VPS traders use to run MT4/MT5 bots 24/7, and shut down all 26,739 servers. Broker logins saved in the trading tools may have been taken, and brokers including OANDA Japan report unauthorized logins.
Software that logs in by itself can't use MFA. A small case of the non-human identity problem.
https://japancyberwatch.com/articles/gmo-onamae-desktop-cloud-fx-vps-breach-2026
My colleague put together a dashboard using the Censys platform data:
https://php2shell.censys.io
We're hiring, so hit me up if you find a position on our site that interests you!
In 1984, Ken Thompson asked us to reconsider what it means to trust software.
More than forty years later, a compromised WordPress plugin raises a related question:
**If we replace the compromised component, can we trust the system it was running on?**
Patching is not the same as recovery.
My latest article explores why.
I got curious how risky MCP servers actually are, so I pulled the published tool definitions from 28 of the most popular Python ones and counted. 1,384 tools, all read from public source, nothing run.
Two things jumped out:
14 of the 28 give an agent a tool that ingests untrusted stuff (a URL, a file) and a tool that acts (runs a query, sends a message) in the same context, with nothing flagging either one.
And the tool descriptions themselves are written as orders to the model ("you MUST call X first"). That's the same channel a poisoning attack would use, so a bad one blends right in.
Not calling any of it a vuln. It's just what the surface looks like. Harness is reproducible if you want to check my numbers.
github.com/agentsploit/agentsploit/blob/main/docs/mcp-tool-survey.md
Gamers Nexus video on chaining ASUS router and LG TV exploits does a good job in explaining these things in layman’s terms.
The week only keeps getting better... apparently, multiple not yet fixed Linux kernel vulnerabilities were disclosed by accident when they were posted to the public mailing list rather than the private one. Oops.
https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities
This week’s BTH News has a theme: forgotten systems and hidden trust.
Two critical PHP flaws. A 16-year-old Broadcom Wi-Fi bug still in deployed routers. AI agents probing 1,200+ sites. CA private keys that were practically guessable.
The hard part is often not reading the advisory. It’s finding what you actually run.
