Darren McDonald

AmberWolf and @MDSecLabs are jointly disclosing technical details on CVE-2026-40639, a weakness found in how some Dell platforms store BIOS passwords.

New research from @craigsblackie @MDSecLabs and myself @AmberWolfSec . Bug leaks the decryption key for the BIOS password right next to the encrypted password on some Dell platforms. blog.amberwolf.com/blog/2026/july…

@abubakar_AIE @Fried_rice You didnt need to wait for the leak to do this. Its a client app, the code was always on your hard drive. People have been reading and modifying their Claude executable for months. Its not even compiled/decompiled C. It's literally javascript.

@Fried_rice I analyzed the full source code and found mind-blowing things.🤯🤯 Article: x.com/abubakar_AIE/s…

Claude code source code has been leaked via a map file in their npm registry! Code: …a8527898604c1bbb12468b1581d95e.r2.dev/src.zip

ebe03aece5de2239f878035866e388790c51ddb128eb7ce9833204c8fcd588a0 c34dd768764db06718b4df94b6df9b6d9a4d25cd146d0b59f8ccfeb319397bca af3de94412f6279ac85531b62a95aa426f05e3917ff17f4bf8e7c01e6e5f7a13 8e67aee7310678e7b0d55ddc17433e8fca0813f9423911954fe16ea23adc5664

c7ca929278b6715ae82ca7a5c12f611cc1bc8b6c2542dbdee329ad1f6bff5bdd 23b6e279ab7942983928a1859d59f9541e4c5f95c7fb142ca2d4eea6e58f205a 06d51f77075a475e196ec9f13ce2c884bb96e6459b3e37cfcfebfe8f42604f85

My first CVE with AmberWolf has recently been resolved by Dell. Memory dumps on ThinOS Wyse terminals are not stored encrypted despite the use of FDE. blog.amberwolf.com/blog/2025/june…

@craigsblackie It makes it so easy too.

Managed to get BitPixie exploit working in VM and hardware with @R3n5k1 . Cool hack, specially with an fTPM.

@NullMode_ Basically this is the only reason I have burp installed.

Yes m8. This is what everyone uses to decode base64 lol other tools be damned

@MediaTek where can I find the datasheets for the MT7628NN?

shocking photo taken seconds before tragedy

@NullMode_ @BSidesBSK Where else would I drop my 0-days?

@R3n5k1 @BSidesBSK What goodness are you bringing to basingrad young Darren

Friday 25th July, save the date 👀

@NullMode_ But you gave up calling everyone fam many years ago.

My only measure of success is how many people I know start to say m8 on their own

Just released a few new courses - the start of my "Code Review & Architecture Fundamentals" series. 33% off on two of the courses until EOD 2nd Dec. Big thanks to @getCourseStack for their support in making this possible! 👉 ogsec.co.uk/2024/11/13/cod…

We've been looking at FortiWeb Cloud IaaS WAFs. There's a very easy bypass which allows attackers passed all your logging and WAF rules if you've not implemented the origin lock feature. youtu.be/XtAOpiKu3u0?si…

.@buffaloverflow & @johnnyspandex are discussing how to exploit corporate VPN clients for remote root & SYSTEM shells. Join to see live demos on Windows & macOS vulnerabilities & how attackers gain control w/ just one click. Register Free: sans.org/u/1vBt #SANSHackFest

@NullMode_ Darren Dev mode: the function is about a thousand lines long but refactoring and splitting it up doesn't feel like progress. Eventually it's so complex that further work is impossible, only then finally I'll admit defeat and write something that resembles good code.

Luke dev mode: Writing seemingly basic test A helper function would be good but it would be better to edit some actual code to support this 3 hours later still added more actual code

Docker is stupid. “Sorry, we can’t deploy a single statically linked executable of size 10 MB, so LET’S JUST SHIP GIGABYTES OF DATA CONTAINING AN ENTIRE OS WITH ALL DEPENDENCIES FOR EVERY SINGLE SERVICE”

@NullMode_ @_RastaMouse Better yet, they store everyone else's in plain text too.

@_RastaMouse lol yes m8

Did you know that the AWS CLI tool stores your access and secret keys in plaintext? Because I sure as hell didn't.

@NullMode_ @techspence I love it when people half ass it, P*******1!. What could that be.

@techspence Nice m8 you read my course

There’s almost ZERO reason to ever include credentials in a pentest report. And in the small amount of cases where it’s useful to show poc or impact, they should always be properly redacted.