thekeys looks for exposed secrets such as AWS, Stripe, GitHub and OpenAI keys in public GitHub repositories. You can scan a whole repo or search by keyword.

Repo scans need no GitHub token. Only keyword search does.

It is strictly defensive. It never tests whether a key is valid and findings are masked. Single Python file. Feedback welcome.

I made a discovery while digging into GSM signaling architecture. When you forward a call cross-carrier, each carrier in the chain only sees adjacent hops. That's just how GSM works. But that means cross-carrier forwarding behaves like a proxy chain. This is a fundamental property of the protocol, not something engineered on top of it. That realization is what CAMO is built on. If cross-carrier forwarding produces partial visibility at each node by default, you can compose that property deliberately. Add M2M private APNs for jurisdictional breaks, rotating eSIM pools so no stable SIM identity persists, WireGuard tunnels between nodes, a signed gossip protocol for node discovery and what you get is onion routing at the cellular radio layer. No single node sees both origin and destination. Chains rotate every 10 minutes. eSIM pools rotate on independent non-synchronized timers. Anyone can run a node. No registration, no fee, no central authority.

The components are all decades-old standards: GSM forwarding, GTP-U, private APNs, GSMA SGP.02, WireGuard. CAMO is the recognition that they compose into something that didn't formally exist before. The enforcement-resistance is structural, not designed. Disabling CAMO requires disabling private APNs and eSIM provisioning which collapses enterprise IoT globally. Tor protects the IP layer. CAMO protects the radio layer. They're complementary.

Spec, threat model, reference deployment: https://github.com/pablo-chacon/camo

CC BY 4.0.

cross-posted from: https://infosec.pub/post/36928579

Here's how to set up CrowdSec to protect your OpenWrt router.

Running the Security Engine in Docker (server), forwarding logs via Syslog, and using the lightweight firewall bouncer on the router.

Result: community-powered IPS on tiny hardware 🚀

WireGuard is a great VPN protocol. However, you may come across networks blocking VPN connections, sometimes including WireGuard. For such cases, try tunneling WireGuard over HTTPS, which is typically (far) less often blocked. Here's how to do so, using Wstunnel.

• Thread on tor-relays mailing list
• Tor Network Health issue

BBoT 2.0 is our new release! Check out our GitHub:

https://github.com/blacklanternsecurity/bbot/tree/dev

cross-posted from: https://lemmy.zip/post/13403067

Microsoft left internal passwords exposed in latest security blunder

An internal Azure-hosted server was left without password protection.