Lmst

#SecurityHacks

Removing the BIOS Administrator Password on a ThinkPad Takes Timing

https://fed.brid.gy/r/https://hackaday.com/2026/02/15/removing-the-bios-administrator-password-on-a-thinkpad-takes-timing/

<div><img alt="" class="attachment-large size-large wp-post-image" height="486" src="https://hackaday.com/wp-content/uploads/2026/02/bios_unlocking_thinkpad_gotcha_onionboots_youtube.jpg?w=800" style="margin: 0 auto; margin-bottom: 15px;" width="800" /></div><figure class="wp-caption alignright" id="attachment_915623" style="width: 400px;"><a href="https://hackaday.com/wp-content/uploads/2026/02/bios_unlocking_thinkpad_onionboots_youtube.jpg"><img alt="This would be a bad time to slip. (Credit: onionboots, YouTube)" class="size-medium wp-image-915623" height="400" src="https://hackaday.com/wp-content/uploads/2026/02/bios_unlocking_thinkpad_onionboots_youtube.jpg?w=400" width="400" /></a><figcaption class="wp-caption-text" id="caption-attachment-915623">This would be a bad time to slip. (Credit: onionboots, YouTube)</figcaption></figure>
<p>In the olden days, an administrator password on a BIOS was a mere annoyance, one quickly remedied by powering off the system and pulling its CMOS battery or moving a jumper around. These days, you’re more likely to find a separate EEPROM on the mainboard that preserves the password. This, too, is mostly just another annoyance, as [onionboots] knew. All it takes is <a href="https://www.youtube.com/watch?v=AOAA6aWwplM" target="_blank">shorting out this EEPROM</a> at the right time to knock it offline, with the ‘right time’ turning out to be rather crucial.</p>
<p>While refurbishing this laptop for a customer, he thought it&#

Removing the BIOS Administrator Password on a ThinkPad Takes Timing https://hackaday.com/2026/02/15/removing-the-bios-administrator-password-on-a-thinkpad-takes-timing/
#SecurityHacks #Bios #Passwordcracking

When Clever Hardware Hacks Bite Back: A Password Keeper Device Autopsy https://hackaday.com/2026/02/07/when-clever-hardware-hacks-bite-back-a-password-keeper-device-autopsy/
#ATtinyHacks #PeripheralsHacks #SecurityHacks #Attiny85 #Capslock #Hd44780 #Mooltipass #Passwordkeeper #USBHIDKeyboard

When Clever Hardware Hacks Bite Back: A Password Keeper Device Autopsy

https://fed.brid.gy/r/https://hackaday.com/2026/02/07/when-clever-hardware-hacks-bite-back-a-password-keeper-device-autopsy/

<div><img alt="" class="attachment-large size-large wp-post-image" height="497" src="https://hackaday.com/wp-content/uploads/2026/01/hardware_password_keeper_alessandro_carminati.jpg?w=800" style="margin: 0 auto; margin-bottom: 15px;" width="800" /></div><p>Sometimes you have this project idea in your mind that seems so simple and straightforward, and which feels just so <em>right</em> that you have to roll with it. Then, years later you stumble across the sad remnants of the tearful saga and the dismal failure that it portrays. Do you put it away again, like an unpleasant memory, or write it up in an article, as a tearful confession of past sins? After some coaxing by a friend, [Alessandro] worked up the courage to detail how he set about <a href="https://carminatialessandro.blogspot.com/2026/01/when-clever-hardware-hacks-bite-back.html" target="_blank">making a hardware-only password keeper</a>, and why it failed.</p>
<p>The idea was so simple: the device would pretend to be a keyboard and type the passwords for you. This is not that unusual, as hardware devices like <a href="https://hackaday.com/2020/07/23/hands-on-wireless-login-with-the-new-mooltipass-mini-ble-secure-password-keeper/">the Mooltipass</a> do something similar. Even better, it’d be constructed only out of parts lying around, including an ATtiny85 and an HD44780 display, with bit-banged USB connectivity.</p>
<figure class="wp-caption alignright" id="attachment_915514" style="width: 400px;"><a href="htt

Tamper Detection with Time-Domain Reflectometry https://hackaday.com/2026/01/24/tamper-detection-with-time-domain-reflectometry/
#SecurityHacks #Antitamper #Tamperprotectionmesh #Tdr #Timedomainreflectometer #Timedomainreflectometry

Embedded TPM: Watch Out! https://hackaday.com/2026/01/23/embedded-tpm-watch-out/
#SecurityHacks #TPM

Great Trains, Not So Great AI Chatbot Security https://hackaday.com/2026/01/13/great-trains-not-so-great-ai-chatbot-security/
#ArtificialIntelligence #SecurityHacks #Ai #Chatbot #Vulnerability

Great Trains, Not So Great AI Chatbot Security

https://web.brid.gy/r/https://hackaday.com/2026/01/13/great-trains-not-so-great-ai-chatbot-security/

<div><img alt="" class="attachment-large size-large wp-post-image" height="450" src="https://hackaday.com/wp-content/uploads/2026/01/eurostar-featured.jpg?w=800" style="margin: 0 auto; margin-bottom: 15px;" width="800" /></div><p>A joy of covering the world of the European hackerspace community is that it offers the chance for train travel across the continent using the ever-good-value Interrail pass. For a British traveler such a journey inevitably starts with a Eurostar train that whisks you in comfort through the Channel Tunnel, so <a href="https://www.pentestpartners.com/security-blog/eurostar-ai-vulnerability-when-a-chatbot-goes-off-the-rails/" target="_blank">a report of an AI vulnerability on the Eurostar website</a> from [Ross Donald] particularly caught our eye. What it reveals goes beyond the train company, and tells us some interesting tidbits about how safeguards in AI chatbots can be circumvented.</p>
<p>The bot sits on the Eurostar website, and is a simple HTML and JavaScript client that talks to the LLM back-end itself through an API. The API queries contain the whole conversation, because as AI toy manufacturers whose products have been persuaded to spout adult context will tell you, large language models (LLM)s as commonly implemented do not have a context memory for the conversation in hand.</p>
<p>The Eurostar developers had not made a bot without guardrails, but the vulnerability lay in those guardrails only being applied to the most recent message. Thus a

🧐🤔 Who knew? Just ditch all those pesky security prompts and *boom* 💥 you're a productivity wizard 🧙‍♂️! Sure, Peter's Mac might catch fire 🔥 any minute, but hey, as long as he saves an hour a day, right? $200 a month for this "privilege" 🤣.
https://steipete.me/posts/2025/claude-code-is-my-computer #securityhacks #productivitytips #MacLife #techhumor #riskandreward #HackerNews #ngated

This Week in Security: Malicious Rollback, WHOIS, and More https://hackaday.com/2024/09/13/this-week-in-security-malicious-rollback-whois-and-more/ #ThisWeekinSecurity #HackadayColumns #SecurityHacks #Rollback #WHOIS #News

This Week in Security: EUCLEAK, Revival Hijack, and More https://hackaday.com/2024/09/06/this-week-in-security-eucleak-revival-hijack-and-more/ #ThisWeekinSecurity #HackadayColumns #SecurityHacks #RevivalHijack #EUCLEAK #News

This Week in Security: The Rest of the IPv6 Story, CVE Hunting, and Hacking the TSA https://hackaday.com/2024/08/30/this-week-in-security-the-rest-of-the-ipv6-story-cve-hunting-and-hacking-the-tsa/ #ThisWeekinSecurity #HackadayColumns #SecurityHacks #wordpress #News #IPv6 #RCE

This Week in Security: Three Billion SS Numbers, IPv6 RCE, and Ring -2 https://hackaday.com/2024/08/16/this-week-in-security-three-billion-ss-numbers-ipv6-rce-and-ring-2/ #ThisWeekinSecurity #HackadayColumns #SecurityHacks #databreach #News #IPv6 #RCE

Can You Hack The RP2350? There’s $10,000 On The Line https://hackaday.com/2024/08/12/can-you-hack-the-rp2350-theres-10000-on-the-line/ #Microcontrollers #raspberrypipico2 #microcontroller #SecurityHacks #raspberrypi #rp2350 #RPi

This Week in Security: GhostWrite, Localhost, and More https://hackaday.com/2024/08/09/this-week-in-security-ghostwrite-localhost-and-more/ #ThisWeekinSecurity #HackadayColumns #SecurityHacks #Ghostwire #Localhost #News #PNA

This Week in Security: Echospoofing, Ransomware Records, and Github Attestations https://hackaday.com/2024/08/02/this-week-in-security-echospoofing-ransomware-records-and-github-attestations/ #ThisWeekinSecurity #HackadayColumns #SecurityHacks #Attestation #ransomware #News #spam

This Week in Security: EvilVideo, Crowdstrike, and InSecure Boot https://hackaday.com/2024/07/26/this-week-in-security-evilvideo-crowdstrike-and-insecure-boot/ #ThisWeekinSecurity #HackadayColumns #SecurityHacks #CrowdStrike #EvilVideo

Hacking an IoT Camera Reveals Hard-Coded Root Password https://hackaday.com/2024/07/24/hacking-an-iot-camera-reveals-hard-coded-root-password/ #SecurityHacks #ipaddress #firmware #Binwalk #strings #camera #Ghidra #linux #uboot #boot #hash #root #IoT

This Week in Security: Snowflake, The CVD Tension, and Kaspersky’s Exit — And Breaking BSOD https://hackaday.com/2024/07/19/this-week-in-security-snowflake-the-cvd-tension-and-kasperskys-exit-and-breaking-bsod/ #ThisWeekinSecurity #HackadayColumns #SecurityHacks #BreakingBSOD #snowflake #News

Linksys Velop Routers Caught Sending WiFi Creds in the Clear https://hackaday.com/2024/07/15/linksys-velop-routers-caught-sending-wifi-creds-in-the-clear/ #internethacks #SecurityHacks #plaintext #linksys #router

Client Info

Server: https://mastodon.social

Version: 2025.07

Repository: https://github.com/cyevgeniy/lmst