Hiding Virtualization From Other Software

October 26, 2026 by Bryan Cockfield 18 Comments

The Kernel-based Virtual Machine (KVM) allows Linux systems to function as hypervisors without needing any extra software, but VMs created with it don’t behave exactly like real hardware does. Sometimes that’s important, though, so [sandwich] built a tool called vfio-native that obscures the fact that software might be running in a virtual machine.

There are plenty of the ways that virtual hardware differs from bare metal. The VM may behave slightly differently for obscure instructions in ways that are measurable, it may take slightly longer to perform some tasks, or the hypervisor may simply announce itself directly. vfio-native includes some kernel patches that solve some bugs which address the different behaviors, changes the way that the kernel identifies itself, and attempts to force the CPUs to behave in ways that real hardware would behave. With all of this applied to the virtual machine, it scores a 1/85 against a VM detection tool, with a standard KVM virtual machine scoring 10/85.

For anyone looking to test this out, it’s available in the AUR for Arch Linux. Also, it’s probably worth mentioning that there are more reasons to use this than cheating at Counter-Strike. For example, security researchers testing malware need to know how that software behaves when it thinks its on real hardware, and some may behave in benign ways when confined to virtual machines. Some licensed software also may disable itself when it detects its running in a VM, which can be a nuisance for things like software controlling industrial tools which only run on operating systems that are no longer maintained or hardware that can’t be found anymore. Some other tools we’ve seen before perform similar tasks as well.

This Week In Security: Record Patch Tuesday, PHP’s Bad Time, The Oldest Vuln, AI Armies, And More

October 23, 2026 by Mike Kershaw 26 Comments

It’s no longer a proper month without Microsoft breaking its own record for security fixes, and October’s Patch Tuesday was no exception. Brian Krebs brings the roundup: more than 1,400 vulnerabilities fixed in a single batch, dwarfing September’s record of nearly 1,000, which itself was about ten times the normal monthly load. According to Tenable, Microsoft has now passed 4,000 CVEs for the year with two months still to go.

Only one of the fixes is for a vulnerability already being exploited in the wild: CVE-2026-96951, a security feature bypass in the Windows Shell affecting Windows 10, 11, and some Server versions. A .NET Framework bypass, CVE-2026-108398, was publicly disclosed before the patch, giving attackers a head start, and with modern AI tooling, it seems like not much of a head start is needed. At least 78 of the bugs are rated critical, and most of those allow remote code execution with little or no user interaction. Windows 10 holdouts can relax a little: Microsoft quietly extended free updates through October 2027. Given the pace of exploitation, this is probably the only way to prevent an Internet-scale meltdown.

Microsoft credits LLM-driven bug hunting for the volume, which leaves the poor admins who have to test and deploy all of this in an unenviable spot. Fortra’s analysis shows that only 26 Microsoft vulnerabilities have landed in the CISA KEV catalog of actively exploited bugs so far this year, so start there. For the rest, the SANS Internet Storm Center and Cisco Talos have the usual breakdowns by severity. Or, you know, just patch everything and hope for the best, which is roughly what everyone does anyhow.

Continue reading “This Week In Security: Record Patch Tuesday, PHP’s Bad Time, The Oldest Vuln, AI Armies, And More” →

Trying To Get Linux Running On A Nokia E6

October 22, 2026 by Zoe Skyforest 30 Comments

The Nokia E6 is a smartphone from back in the old days when Symbian was a thing. [fluffleswaffled] has been doing the work to get the ancient handset running Linux instead, because that’s ultimately cooler than what the phone shipped with out of the box.

There isn’t an unlocked bootloader on the E6, so instead, [fluffleswaffled] used an altogether different route to boot Linux. A Symbian app is used to load the kernel and device tree into RAM, at which point the MMU and caches are turned off and the device jumps into Linux. It’s a one-way trip, from which there is no way back to Symbian without a power cycle. The setup nets a terminal on the phone’s own screen, and the hardware keyboard and touchscreen are functional. The display is controlled by a Broadcom VideoCore III, with [fluffleswaffled] capturing messages from Nokia’s original display driver to create a custom kernel driver that replays them.

There’s an issue, though. The phone doesn’t stay in Linux land for long — it always resets within a couple minutes of booting into the alternative OS. [fluffleswaffled] believes this is because the phone’s baseband chip is supervising the application processor, and killing things once it’s detected that the Symbian mobile stack has stopped running. They’re hoping that someone with experience with Nokia basebands or the relevant hardware can point them in the right direction to get this hack running for more than 3.5 minutes at a time.

There probably isn’t a great deal of utility in getting Linux running on a 2011 smartphone, but we love the hustle nonetheless. We’ve seen this done before, though, and it’s always interesting to learn what it takes to get the OS booting on a new platform. If you’re whipping up similar hacks in your home lab, don’t hesitate to let us know on the tipsline.

Meshtastic Sniffer For DragonOS

October 19, 2026 by Bryan Cockfield 1 Comment

Meshtastic has gained a lot of popularity over the last few years thanks to its low barrier of entry. No licenses are needed and the hardware is dirt cheap, at least when compared to a lot of ham radio gear. But while that physical barrier is low, there is a bit of a learning curve. Part of that comes from the fact that there are a lot of channels and modes that people could be communicating on, and unless the user knows that information up front it can be hard to find where the conversations are happening. [cemaxecuter] noticed this problem and built a Meshtastic sniffer into his radio-forward Linux distribution, DragonOS.

The sniffing software is built in C and comes as a complete standalone binary and does not rely on GNU Radio. With DragonOS up and running and the software loaded, it can look at the entire bandwidth that Meshtastic operates on and detect any traffic and decode it (as long as the key is known). [cemaxecuter] is using a HackRF as a software-defined radio for this project, which he notes doesn’t quite have enough bandwidth to cover every Meshtastic operating frequency, but it can get most of them. After firing up his own node, the software quickly detects it and shows its details in the terminal.

Software like this opens up a lot of opportunities for things that would be tedious, difficult, or impossible to do with with a standard Meshtastic node. Besides finding places where conversations are happening more easily, [cemaxecuter] also suggests that it could be used for wardriving and for locating or finding other networks much more easily. For those who still haven’t tried it out, take a look at this 2023 treatise on the protocol and hardware and then dive right in.

Continue reading “Meshtastic Sniffer For DragonOS” →

This Week In Security: New Spectre Attacks, Crushing Quantity Of Linux Vulns, Google Gets Too Much AI, And Hacking Lawnmowers

October 9, 2026 by Mike Kershaw 11 Comments

Just-in-time, or JIT, compilation could be considered a fundamental backbone of modern computing. JIT compilation turns scripting languages like JavaScript or intermediary binary forms like Web Assembly into native code on the fly, giving web apps, and things that are web apps under the covers like Electron-based tools, near native speed. A new paper explores leveraging JIT systems to revive Spectre-v2 attacks against processors.

Most modern processors gain performance by using a trick called “speculative execution”. The processor guesses the likely result of a compare, and begins executing some of the next instructions before the results are actually known. If the processor guessed right, things continue and there is a speed gain because it can jump ahead, but if the processor guessed wrong, any instructions that were run and any side effects of running them are discarded and execution resumes on the actual path. In theory, anyhow.

In practice, the Spectre class of attacks targets branch prediction. It was discovered that when the wrong branch was chosen, not all of the results were truly hidden; Patterns of failures in guessing branches can be used to leak behavior processing encryption keys and other activities. The attacks evolved with the research dubbed Spectre-V2, which showed that non-privileged contexts, like non-root users and virtual machines, could poison the instruction prediction and use it to read arbitrary memory. Fixes to the Linux kernel and other platforms were required to mitigate the worst of the effects.

The paper shows that by using self-modifying code in the JIT, the processor can be tricked into loading cached versions of the instructions. The fixes to the kernel to prevent Spectre attacks include identifying malicious code patterns that attack the branch prediction, and stopping or changing them: By causing the CPU to execute the cached copy of instructions instead of the live copy, the attack ignores the fixed instructions entirely and can attack the branch prediction algorithm.

To prove the attack is feasible in the real world, the researchers targeted several JIT compilers, including the SpiderMonkey JavaScript engine used by Firefox, the eBPF JIT found in the Linux kernel, and GraalVM, the JIT used in Python. They found success with each, demonstrating that the attack is at least plausible.

Research like this is unlikely to be an instant world-melter, and will help find possible mitigations in the future to prevent these sorts of attacks. Operating systems that support a high-security “lock-down” mode, like macOS and iOS, often disable JIT entirely, out of concern about these sorts of attacks. There’s probably no need to start disabling JIT on every system, but attacks like these have a tendency to evolve.

Continue reading “This Week In Security: New Spectre Attacks, Crushing Quantity Of Linux Vulns, Google Gets Too Much AI, And Hacking Lawnmowers” →

No More Windows For The Dutch Government, Ze Kiezen Nu Linux

September 29, 2026 by Jenny List 101 Comments

The events of the last few years have caused many in Europe to re-evaluate their reliance on large offshore technology companies, with a corresponding move to home-grown EU-based alternatives. It’s one thing when individuals or companies do this, but another entirely when it’s an entire country. So the news that the Netherlands is building their own Linux distribution to replace Microsoft Windows in government installations, is not inconsequential. The Tweakers site linked actively breaks out of Google Translate, so you may have to rely on your browser’s translation tool if you are not a Dutch speaker.

The Digitaal Autonome Werkomgeving Overheid, or Digital Autonomous Work Environment, is a distro based upon NixOS, itself originally a product of a Dutch university. It comes complete with all the office and collaboration applications needed to replace Windows, and is reported to have been tested already by a small group of Dutch government workers.

The influence of this move is likely to be a huge one for Microsoft, given that governments have huge numbers of operating system seats. But perhaps more important than the OS itself are the extras that Microsoft would like to sell to its OS customers, such as AI services. We’d expect that there will be managers in Redmond paying close attention to Europe in the wake of this move.

Meanwhile the Netherlands has a vibrant hacker community, and we can imagine that this move will be welcomed in those quarters. All Netherlands government online services are accessed through an ID verification app called DigID, and it’s a lament we’ve heard from our Dutch friends that this only works with Windows, Android and Apple platforms. If this means a Linux version will appear on the back of an NL government Linux distro, we know some people who will be very happy indeed.

NL flag: SpinnerLaserzthe2nd, CC0. Tux: Larry Ewing (lewing@isc.tamu.edu) and The GIMP. Attribution.

Hackaday Links: September 27, 2026

September 27, 2026 by Al Williams 7 Comments

It isn’t quite hailing frequencies open, but researchers from Harvard claim they’ve picked up a radio signal directly from a nearby exoplanet. Before you get too excited, planets in our solar system also emit RF, so no one credible is claiming these are extraterrestrial reruns of their version of I Love Lucy, but it is the first time they’ve localized a radio signal to an exoplanet, in this case, Beta Pictoris B.

Speaking of space, the asteroid formerly known as 1981 EC26 is now sporting a new moniker: (14331) Alyankovic. If you think that sounds like (Weird) Al Yankovic, you aren’t wrong. The Tucson Star reports that, thanks to the efforts of several planetary scientists who are also Weird Al fans, the International Astronomical Union made the name official. Apparently, another asteroid now bears a name in honor of Weird Al’s predecessor, Tom Lehrer.

If you follow open mobile phone software, you probably know the name postmarketOS, a Linux distribution based on Alpine aimed at mobile phones and tablets. Well, now you can forget it. The project announced a name change, so we’re now talking about Nura. Why Nura? According to the team, it is a shortened form of Nuraghe, some granite structures in Sardinia that are over 5,000 years old. The FAQ mentions that postmarketOS was hard to remember. We aren’t sure Nura is that much more memorable. Perhaps they should have pivoted to Phonz OS.

Continue reading “Hackaday Links: September 27, 2026” →