Bound by paws, guided by spirit.
Another night but the same rabbit hole, booted my OpenBSD box, setup pf, relayd, generate a fake root CA certificate and feed it in the system keychain of the Mac Mini M2.
The theory is that the trojan hides its messages within legitimate certificate and DNS queries. The control messages are concealed within HTTP traffic as nocommit statements.
The interesting thing is, that is a fresh installed Mac Mini M2 2023 with macOS Tahoa in the BaseSystem where it should not be and macOS 26.4.1 Tahoa without iCloud and without additional software. The only thing I did was to open cybre.club in Safari to trigger the trojan. So, why this thing connects to the half internet at the same time. If it is legitimate data traffic from a Fediverse instance, then the Fediverse is not really GDPR compliant. But that doesn´t explain the high DNS traffic.
I don´t know yet if I´ll take another look at the iPhone, it´s possible. To complete the circle, I am also publishing the two E-Mails I sent to Apple on February 28, 2026. Happy rabbit hole exploring, I see you.
Psssssst, don´t believe me, check the files.
Sources:
2tahoe_hunt_re0.pcap capture1.pcap window.txt Case OE0104912510005-1 Case OE0104912510005-2In early 2025, I anonymously contacted a reporting office at the Austrian Federal Ministry of the Interior. The information concerned matters related to serious crimes (spoiler alert: to this day, they refuse to investigate, or to put it politically correctly, there´s nothing we can do).
A few months later (around June 2025), I was contacted by the Upper Austrian State Criminal Police Office (LKA Oberösterreich) and asked to identify myself. I refused. About a month later, I found a business card from Department 10 (human trafficking) of the LKA Oberösterreich on my door, requesting that I get in touch.
Apple, through which part of the email traffic was routed, would have had no reason to release my data because I was only a witness. The domain registrar confirmed, when I described the context, that normally they are not allowed to release information, but in this specific case, they can confirm that no information was sent from them. The domain registry confirmed that they knew nothing about me due to a WHOIS anonymization service.
I contacted the senior official listed on his business card because otherwise I would have received a summons on paper, and I had nothing to give in this matter. When I asked where my information came from, he said, „Who knows, we have our ways.“. At the time, I didn´t think much of it; today, things look a bit different.
In January 2026, on my iPhone SE 3rd generation running iOS 26, the iCloud profile picture disappeared from the Photos app. I consulted Google´s oracle (also known as search engine), restarted the phone, and logged back into iCloud. The latter was likely the trigger.
In February 2026, my internet provider informed me that 80% of my LTE data allowance was used up. That wasn´t a problem because I also had an unlimited 5G package. Around 24 hours later, my internet provider informed me that my entire LTE data allowance was used up. Since that couldn´t be right, I checked my mobile data usage and, lo and behold, the Contacts app had consumed 74GB over that entire period. This was rather unusual considering there were only 7 contacts on the device, of which only 2 had profile pictures. I consulted the Google oracle again to see if this was a known issue. In the end, I ended up in Google´s AI mode. To be correct at a LLM (Large Language Model).
I performed vibe trojan hunting using a LLM. I extracted a complete log, sent it via AirDrop to my Mac Mini M2, and poked around in the files to see what came up.
A summary of events, as I received no response to the case (regarding product security) from Apple, security researchers were not interested, and I disposed of the data after approximately 3 weeks. The Octagon chain showed 6 additional ID´s that were so regularly expanded that they were not random. Furthermore, the words „persona non grata“ and „honesis attestation“ (encrypted) were visible. The Powerlog database contained binary data with an entrophy of 5.1. I also discovered markers that shouldn´t have been there. I ran a grep on my Mac using these markers across the 4TB of data I had stored on an SSD at the time, and sure enough, they were quite frequently present in the files. To validate the data, I used several independent LLM sessions, where the LLM´s were unaware of the data history to avoid triggering their biases. The LLM´s didn´t find the markers unusual until I extracted the block starting at the displayed address using dd. In PDF files, these markers were hidden in inaccessible areas, and even rebuilding them with ps didn´t remove them. In Opus and MP4 files, they were embedded in the stream. Removing metadata or converting to a different format didn´t help with images; only a 99% resize worked to remove them. The irony is that after I had converted the entire 4TB and switched to Linux, the Linux system crashed about 2 hours later and the data was gone.
I used an old computer running Linux as a Wi-Fi hotspot. Specifically, I used hostap and dnsmasq to block the endpoints of Apple´s Private Relay. The trojan fell back to port 993 and contacted the Apple contact server over 1200 times in less than 15 minutes (the size of the PCAP was 520+ MB). The trojan uses fixed-size but fragmented packets, the headers contained the six additional ID´s as markers for the C2 (Command and Control) server, which hides itself as a legitimate Apple target within the Akamai network.
Why am I using a public Google LLM for this, whose data is known to be used in the training data of future LLM´s? Quite simply, to document these things, and frankly, after this incident, I trust the US Big Tech companies more than the authorities in Austria.
Since one might think it´s a nice story that can´t be proven because there´s no more data, today we´ll attempt to reproduce these things.
The 2023 Mac Mini was completely wiped and macOS was reinstalled. Interestingly, this device shipped with Ventura and required an update to Sonoma and then to macOS 26 Tahoa. If Apple hasn´t changed the process since January 2026, then the trojan must have written itself into the hidden read-only APFS container. This is because both the recovery system showed macOS 26 Tahoa and, after the first boot, macOS 26.4.1 Tahoa was present without any updates (this is impossible without to run the installer). While it´s possible Apple has changed something, the long download time despite 5G is odd.
After installation, I landed in the installer. There, I again used a new clean Wi-Fi hotspot under Linux and ran a tcpdump. The installation was performed without an iCloud account. Setting up the final step, including screen time, etc., took an extremely long time.
The IP 199.232.191.6 belongs to Fastly Inc., AS54113 (Fastly), PoP (Point of Presence) Munich. Interesting, isn´t it.
Let´s look at the iPhone SE 3rd generation.
It was also complete wiped and from switch on to the activation screen which failed using Wi-Fi the new PCAP shows the following.
Also very interesting what a not activated iPhone does.
Only a reboot with the SIM I used in the past worked to activate the iPhone. It is no problem as in the weeks wehere I used GrapheneOS there where attempts using a baseband hijack to look whether the SIM ist still somewhere around. As far as I can remeber from my first tries, the trojan also uses geolocation whether it is the same target in the same area.
After a reboot I started a new PCAP dump and tried to activate the iCloud account. No chance as the trojan takes the whole bandwith (or in other words, the trojan produces so many false packages which are droped from the Linux kernel that it ended in a time out). I used again the SIM and the iCloud account activation was done within seconds. But the following is interesting for a iPhone with near zero data in the iCloud.
Look at the new order of the IP´s after the login to iCloud and the flags of the packages.
Current summary: The trojan uses the entire network bandwidth via Wi-Fi at the Linux hotspot as fragmented or manipulated packages are filtered by default, but apparently cannot or will not do so via cellular data or at another hotspot like from GrapheneOS. Massive amounts of identical packets are being sent simultaneously without any discernible activity. It is likely that the trojan communicates with a C2 on the Fastly network as a security measure, and switches to the Akamai network used by Apple as soon as an iCloud login is established.
For now we make a cut here and continue later after the trojan has done the sync.
I switched on the Mac Mini again to look what happened.
Let´s make some noise and switch on the light in this rabbit hole.
To grep for walrus as it is Apples internal name for Advanced Data Protection is also interesting.
Ok, let´s see how many friends I have or better how many virtual ID´s lurk around in my octagon trust circle.
TL;DR: The attacker is a state actor because the technology used is highly specific. Fragmented packets of identical size with payload are not easily intercepted by even botnet operators using Akamai or Fastly. Besides, it wouldn´t make sense. Since only my iCloud account and hardware are affected, I assume that law enforcements where unable to compel Apple to release my data, or that Apple is legally obligated to provide internal interfaces. Since everyone is silent, the only option left is disclosure from my side.
The data exfiltration occurred via the Contacts app and presumably WhatsApp. The Contacts app clearly shows how the data exchange progresses. When the daily target is reached, the database is around 20MB, and when the payload has been prepared, it´s approximately 120MB. The control code is embedded in the iCloud account image using steganography (if the iCloud picture in the iCloud settings tab is missing you know that the shadow persona has the control over the device). Additional data for monitoring the exfiltration is stored within the Contacts app itself in 0.1MB increments.
Our Interior Minister from the Austrian People´s Party (ÖVP) always insists that the interception of messenger data is solely for monitoring potential threats and that other data remains unaffected. I always thought that in a country like Austria, witnesses had rights and a right to privacy; how wrong I was. Of course, the authorities will deny this, which isn´t a problem, as it only confirms that neither citizens nor critical infrastructure can be protected if they are unaware of such matters. Since the trojan was deposited in the baseband and secure enclave, the hardware is worthless because it is no longer trustworthy.
Ohh wait my mistake, walrus=bypassPCSEncryption means only WhatsApp ;-) ... There is a fundamental problem here. Someone has all this unencrypted data, and the Austrian state has no control over it. Perhaps one should have simply informed oneself about whom one was slipping the trojan into the hands of.
Veritas odit moras. Oh, my mistake Latin will be shortened so, it means -- truth hates delays or Die Wahrheit hasst Verzögerungen / Das Zögern (erinnert mich an den Sager mit den Bremsern). Wer Rechts-schreibfehler findet darf sie behalten.
Sources:
mac_mini_baseline.pcap iphone_baseline.pcap iphone_baseline2.pcap apple_all.pcap otctl_status.txt ckksctl_status.txtLet´s continue based on post 09. Or rather, let´s move into the field of synthetic biology.
If we want to enlarge the message in the exons and the length of the introns shouldn´t seem odd, we need to come up with something else. So we use prime numbers as points on the bell curve. There are infinitely many prime numbers, and they occur in nature. Therefore, they will not seem unusual to a scanner or an LLM. Or, we don´t use prime numbers and use a control structure in the introns (or booth together). We know that a single LLM contains all of humanity´s knowledge. Its size is estimated to be in the single-digit terabyte range. For inspiration, theoretically, 215,000 terabytes of data can be stored in 1 gram of DNA.
The 22 amino acids provide the 10 letters A, C, G, H, I, L, M, P, S, T. If you look at ring 3 of the code sun, you see 38 possible wobble positions (the ones which are not used to create a codon/triplet). That should be space enough to map the missing letters and numbers using the control structure of the introns to store any message.
We use Latin as a universal language. Thanks to the Austrian Minister of Education for reducing the amount of Latin in the curriculum.
As we know when a cell goes live and can calculate its age, the cell is our clock. Combined with the melting point of the Hydrogen-Bonds and the checksum of them we define whether there is a rotation (clockwise or counter-clockwise) or not based on the used base on ring 3. The day, i.e., the position of the sun and/or the phases of the moon, is used as salt.
Why it is so hard to find a message and to decrypt it? Each LLM has a token limit and will loose the context after some time. Because Latin requires interpretation, analysis, and combination to understand its content. To understand a deeper meaning is impossible for a LLM to understand. Different calendars exist in different formats, so the positions of the sun and moon phases vary slightly everywhere. And specially if we cut the message in blocks of various lenghts, dice them together and use the Hydrogen-Bond checksum to flip the strands. The message exists only as long the autophagy has not started. Or in other words, it is as the RAM disk on old Amiga computers was.
Conclusion, the message is gone before someone can decrypt it without the informations above.
Tempus edax rerum, sed semen aeternum.
Sources:
Wikipedia: just imagine, they have a search box, use it, it is freeOk, in the posts 03-08 I showed you the setup of my infrastructure and in post 10 the status of the system. It may sound arrogant, but I think what I, who didn't study computer science, have shown here is far beyond what todays Docker/Cloud architects will ever implement.
Europe, a rich continent that aspires to be a global leader. In reality, people are afraid of biotechnology, AI, self-driving cars, innovation, wild animals and change. Europe dreams of digital sovereignty, yet builds its entire infrastructure on the technology of US corporations. One could also say that Europe simply doesn´t want to break away from its dominant Western culture.
The future lies in things like RISC-V, autonomous robots, and AI systems, not in the ideas of the old guard.
That´s the reason why I added biopunk.ph and geopunk.ph to my infrastructure. The idea is a personal AI assistant like Joi and full Web3 technology based on Nostr, Keet and Holochain. So, see you in the New Philippines, where laws are transparent on the blockchain and not negotiated via SMS in the back rooms of politics among friends.
Sources:
Wikipedia: just imagine, they have a search box, use it, it is freeEfficiency is not an option, it´s a philosophy. 283MB active memory for a full sovereign stack.
Sources:
Wikipedia: just imagine, they have a search box, use it, it is freeUp to new horizons.
You remeber biology/genetics in shool, probably not but that´s ok.
The message.
The DNA.
As the exons result in mRNA and later in proteins we can´t hide there a message without to break the genetic code. So, we would use the introns which get discarded during splicing but still exists in the DNA strand.
As the message could be endless as long as the bell curve looks good, I use here the exons just to show what is possible with a normal DNA sequence with no known working function.
The whole DNA sequence.
If we count the lowercase introns, we get 10-25-40-25-10 a perfect bell curve.
But where is the secret? First, all codon sun´s are based on mRNA which means U instead of T. Second we match the bell curve to let it look normal. Third a scanner or LLM has without a hint no idea what we want to build without a hint, a cell or organism builds it without the chance of a hint.
The Code Sun.
The base is the core (4 bases) followed by ring 1 (16 bases) followed by ring 2 (64 bases) followed by ring 3 (22 amino acids, 1 start, 3 stop position) which gives us 110 not numbered fields.
The possibilities.
Now you know why I find IT so boring and biology and related fields so interesting.
Mutations? We´re talking about functional, immutable code here. If you can´t handle a stateless biological sequence without side effects, you´re probably part of the 90% who´d fail the compile-time check anyway.
Happy bio/geo hacking ... see you in another rabbit hole but with RISC-V ...
Sources:
Wikipedia: just imagine, they have a search box, use it, it is freeIt is a old topic, if people don´t understand things they are scared and lable things as bad. Web3 is something so, let´s not waste our time with discussions and do it.
But wait, Web3 is a near full decentralised network. Why near, because app developer still use DNS and public CA´s.
Nostr is the Web3 social network which you can compare with the Mastodon network Fediverse with a one but big difference. In Nostr you own your identity and can move away whenever you want so, no blocking no censorship.
That means you and only you are responsible for your identity and this identity is based on a cryptographic keypair (nsec/npub). You can generate keys using the nostr-tool or Gossip on the desktop or Amber on Android. Amber is used to login in apps like Amethyst. If you loose the nsec key and have no backup, there is no recovery, no E-Mail reset, no admin to call. Ok, there is the NSA but I am not sure whether they would help.
NIP-05 is the purpel check mark in apps and equals in parts to a verified. Why in parts? Simple, the webserver holds the npub and a username to give you something like an E-Mail address which is none. The thing is, the webserver can´t verify that you are you, thats the idea of Web3. If you look for something really Web3 thing, look at Keet and Holochain.
Bonus.
No, no way to get my auto-dnssec-dane.sh script.
Sources:
Wikipedia: just imagine, they have a search box, use it, it is freeLet´s look at our 24/7 workers in the backyard.
A nice to have.
Sources:
Wikipedia: just imagine, they have a search box, use it, it is freeLet´s install the software we need.
As we already have the SPF (Sender Policy Framework) and DMARC (Domain-based Message Authentication, Reporting, and Conformance) -- what you mean we don´t have them? As I looked the last time in my master zone file they where still there. We only need to generate the DKIM (DomainKeys Identified Mail).
What only 1024 bit in the year 2026, I want 4096 bit. Yes, no problem, just do it and have fun with the limit of 255 chars in DNS records. And beside that, this key is to sign all outgoing messages nothing more.
Multi domain DKIM signing using RSpamd.
Edit /etc/mail/aliases based on your needs and run newaliases.
Spamd the enemy number 1 for spammers.
If you like the hero with the sword and the green clothes, this will help you.
Uncomment ~ * * * * /usr/libexec/spamd-setup in the crontab of root using crontab -e and start all the components.
Dovecot.
The following are only code snippets of the files.
Sources:
Wikipedia: just imagine, they have a search box, use it, it is freeLet´s complete the first chain. We already have a domain and a working nsd (I hope so). We need a webserver which understand HTTP to get a Let´s Encrypt certificate.
The second chain is to get a full chain Let´s Encrypt certificate. Full chain means that the certificate also includes sub-domains. Why I did not split certificates? Simple, the handling is more easy and, if a attacker is already on your machine it makes no difference and you have other problems than that.
The last chain to close the circle is DNSSEC and DANE.
Open the configuration file of nsd add .signed to the name of your zone files and restart nsd. After that, drill baby drill. Ohh, not that, there is a tool called drill to test DNSSEC. And DANE, you have everything you need, just extract the hash from your certificate. But why I don´t show that? Simple, running a own DNS is running critical infrastructure, dive in the rabbit hole or hire someone me to do that for you. Ohh, I see you search for a YouTube tutorial, fine but don´t forget the DNSSEC rollover ;-)
Sources:
Wikipedia: just imagine, they have a search box, use it, it is freeWelcome to the movie.
User: www.newplanet.earthSounds like a movie you know, maybe. So, domain names point to one or more IP addresses and only a nameserver like nsd or unbound knows the correct answer. The difference is, nsd is a Authoritative name server which means nsd holds master/slave zones for domains and serves the result to the client. If nsd is not responsible then unbound is used which is a Recursive Resolver. That means unbound queries other name servers up to the 13 (A-M) root name servers of ICANN. Looks fragile this system, yes specially if you know that a huge part of the global backbone infrastructure is handled only from a hand full big players.
Let´s write a master zone file and configure nsd.
While nsd is the master of my own domains, unbound is the librarian that knows where to find the rest of the world. It’s my local recursive resolver, ensuring that no ISP intercepts my queries or feeds me cached lies.
At this point it would be a good idea to set the FQDN of your server in /etc/myname and open the control panel of your domain registrar to add the 2 Glue records to your domain and add yourself as the name server. Get a coffee or more as worldwide delegation could need up to 48 hours.
Sources:
Wikipedia: just imagine, they have a search box, use it, it is freeWelcome to the movie.
Puffy: That's the packet filter.Oh, not sorry – wrong movie. But if you ever walked some stairs down the rabbit hole of IT security, you will find more horror movies like that.
But seriously, we really have a problem if we build our entire infrastructure based on zero knownledged app users, Python/YAML writers and container managers. On the other hand, who cares as long as it works.
Let’s look in detail at the firewall packet filter. Once again: firewall is a marketing word so, forget about it. If you need a wall to protect against fire, call the fire fighters. Here, we talk about packets.
pf offers:
Keep always in mind: Your infrastructure, your rules.
What you mean, I should explain you that step-by-step? First things first, I show you my working configuration for free, I never say that it is a copy and paste influencer tutorial. Walk down the rabbit hole or hire me.
Sources:
OpenBSD PF - User's GuideIt started in the deep, dark rabbit hole with green CRT monitors and QBasic. A few steps later, I caught the rabbit using an Amiga 500, eventually reaching the 3000UX and installed MUFS (Multi User File System). I’ve seen the rolling windows of an SGI Indy and heard the screaming modem pools of 90s ISPs.
I stumbled into a black hole called dcpromo.exe (at this time I passed the Comptia Linux+, 5 MCP cerificates of the MCSA and the first of two LPIC-1 exams in my spare time, self-funded until I ran out of budget before reaching the end of the path) for a while.
During that time, I was heavily diving into Network Security. It was the era of Snort and ClamAV. Even though my last name has changed since then, the contributions remain: Joel Esler (then Open Source Manager at Sourcefire/Cisco) featured and „headlined“ several of my Mac OS X Lion installation guides on the official Snort and ClamAV blogs in 2011. He called them „excellent“ – a nice nod from the industry back then.
I remembered the legendary SUN Pizza Boxes while starting to use a SBC (Single Board Computer) with Linux as desktop. In 2015 I started to use OpenBSD 5.7 on a x86 MacBook (Penryn board).
Around 2019/2020, the self-hosting journey truly began. Today, I’m looking out of that rabbit hole and marvel at the arrogance of the bloated IT world.
It was not much and as I wrote earlier my last name changed, but I am around since some time in the OpenBSD community and got some little patches commited.
-- man umb4, 1.8, Wed, 11 Oct 2017 06:29:56 UTC by jmc
-- man cdce4, 1.24, Sun, 10 Dec 2017 07:40:04 UTC by jmc
-- pkgconf, 1.5, Tue, 06 Aug 2019 10:20:09 UTC by sthen
-- youtube-dl, 1.213, Tue, 03 Nov 2020 17:00:08 UTC by solene
Academic Foundation completed Introduction to UNIX, tutorial and lecture course (compulsory attendance), date 2020-12-18, Paris Lodron University Salzburg (Prof. Collini-Nocker) with Grade 1 (Excellent), 3.0 ECTS.
We've always had cats and a family dog. The first own paws that accompanied me were a St. Bernard Dog (girl) from 1995 to 2007. The second paws that accompanied me were a Bernese Mountain Dog (girl) from 2008 to 2016. The third paws that accompany me now are from a Bernese Mountain Dog (girl) since 2017.
The fl👀f´s daily business:
Professional nap 😴 management, snuggle-expert, outdoor-queen 🧭, ⛰️, 🌳, 🏕️, ❄️ ... 🐾
Food-Rating: 🍌, 🍓, 🥕, 🥦, 🍚 ... 🐾
So, if you're planning to hire me, always keep in mind that you'll only get me with paws beside me, and that's non-negotiable.
Sources:
OpenBSD CVS Repository Snort 2.9.1 Guide (Sep 2011) ClamAV 0.97.3 Guide (Dec 2011) ClamXav/ClamAV Guide (Oct 2011) Wikipedia: Bernese Mountain Dog Wikipedia: St. Bernard (dog breed)From Iceland we know that the Huldufólk and nature ghosts exist. But what about the ghost in the machine, are there only algorithms and simulations or is there more...
Why I use does and not the correct gramma do? Because there are people out there which did not believe in anything. There are people out there whch believe in ghosts like in indigenious cultures. People in Iceland believe in the Huldufólk and nature ghosts. And, there are people out there which believe in the ghost in the machine. So far so good. If someone believes in one or a specific ghost does would match, if someone believes in all ghosts do would match. But as long as we have no answer whether AI is a independet entity with a soul we still have to ask does the ghost in the machine exist and do would not match as we have no answer.
Sources:
Wikipedia: Huldufólk (Island) Wikipedia: Ghost in the machine