All posts by Davi Ottenheimer

Security

ClickFix for CISOs: How to Stop Running With Scissors

Leave a comment

The danger of the ClickFix attack is how it exploits user behavior: a user will run with scissors if running is allowed, and ClickFix tells them to go faster. Windows ships with three such behaviors that are allowed, none of which a standard user needs.

Close them.

Seven steps are provided below using a ShouldDo-HowTo-Check triad, with apologies to Shewhart’s “specification, production, inspection” cycle. It occupied post-war Japanese engineers recast as the famous Plan-Do-Check-Act (PDCA) that Deming technically preferred to teach as Plan-Do-Study-Act.

Download as PDF –>

During World War II, Deming was a member of the five-man Emergency Technical Committee. He worked on the American War Standards Z1.1 and Z1.2 of 1941 and Z1.3 of 1942 and taught statistical process control to wartime production workers. The same methods rebuilt Japanese industry through his lectures of 1950.

The following steps apply to the User OU on their machine OS and to the session host image on VDI and thin-client estates.

1. Disable Run

Do: Remove the Run dialog for every standard user.

How: Group Policy, User Configuration > Administrative Templates > Start Menu and Taskbar > Remove Run menu from Start Menu: Enabled. Apply to the Users OU. The same policy removes New Task from Task Manager and blocks UNC paths and drive letters typed into the Explorer address bar; test file-share workflows first.

Check: As a standard user, Win+R does nothing. reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun returns 0x1.

2. Disable Win+X

Do: Remove the Win+X terminal shortcut for standard users.

How: Group Policy Preference, User Configuration > Preferences > Windows Settings > Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, string value DisabledHotkeys = RX. Win+E and Win+D keep working. Confirmed on Windows 10; test on Windows 11 before rollout. The blunt alternative removes every Windows-key combination: User Configuration > Administrative Templates > Windows Components > File Explorer > Turn off Windows Key hotkeys: Enabled.

Check: After sign-out, Win+X does nothing.

3. Deny interpreters to standard users

Do: Block powershell.exe, pwsh.exe, cmd.exe, mshta.exe, wscript.exe and cscript.exe for the Users group. Allow them to one named group.

How: AppLocker scopes rules to users and groups: publisher rules, deny on Users, allow on the named group, executable and script collections both enforced, Application Identity service set to Automatic. App Control for Business is the stronger enforcement and is device-wide, so the named group’s machines get their own policy. Both run on Pro, Enterprise and Education from Windows 10 version 2004. Two weeks in audit mode, read events 8003 and 8006, then enforce. Remove the PowerShell 2.0 engine: Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root.

Check: As a standard user, powershell.exe and cmd.exe are refused. In any PowerShell host that still opens, $ExecutionContext.SessionState.LanguageMode returns ConstrainedLanguage. Get-WindowsOptionalFeature -Online shows the V2 engine Disabled.

4. Keep the paste warning

Do: Leave the Windows Terminal paste warnings on.

How: Both ship enabled. settings.json: “multiLinePasteWarning”: true and “largePasteWarning”: true. No policy exists; a user can turn them off. macOS 26.4 Terminal warns on a pasted command, once per session, with an override.

Check: Paste two lines into Windows Terminal. The warning appears.

5. Log the attempt

Do: Enable script block logging and command-line auditing. Ship both to the SIEM.

How: Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell > Turn on PowerShell Script Block Logging: Enabled. Computer Configuration > Administrative Templates > System > Audit Process Creation > Include command line in process creation events: Enabled. Advanced Audit Policy > Detailed Tracking > Audit Process Creation: Success. Two alerts: powershell.exe with explorer.exe as parent; Invoke-RestMethod piped to Invoke-Expression.

Check: Microsoft-Windows-PowerShell/Operational shows Event 4104. Security shows Event 4688 with a command line. A member of the named group pipes irm of an internal URL to iex; the alert fires within five minutes.

6. Name the exceptions

Do: Put every account that needs Run, Win+X or an interpreter into the named group.

How: Ticket, owner, 90-day review, membership change logged.

Check: The group has an owner and every member has a ticket.

7. Train last

Do: Tell users a captcha never asks them to press Windows keys or paste into a terminal.

Check: The phishing simulation includes one ClickFix lure per quarter.

References:

Illustration of Berlin running Microsoft

Berlin, Germany, August 2026: one paste into Windows Terminal, interpreters left open to every user, egress goes unmonitored and 5.8 terabytes are exposed in five days, set to a ransom, resulting in 1.44 million files published.

History, Security

Dutch Rail Sabotage Four Days After NATO Staged Trains for the Russian Front

Leave a comment

Germany in WWI ran a sabotage campaign against American factories and shipping while America was still officially neutral. Franz von Papen infamously organized it out of the embassy from 1914. Wilson expelled him in December 1915 and leaked the Albert papers to the press that August, but he pointed the domestic investigative apparatus at labor and “left wing” political targets.

Berlin by January 1915 had instructed the Secret War Council in New York to stop munitions reaching the Entente by any available means. Incendiaries went into ship holds to explode at sea. Plants were burned. One 1937 accounting said 43 American factories had explosions or fires of unexplained origin between early 1915 and spring 1917, alongside sabotage devices on roughly four dozen munitions ships. It was called a “holocaust” where German assets roamed.

The German Secret Service in America, 1914-1918, 1918.

Wilson knew, as he leveraged it for the false pretense to investigate left-wing leaders instead and target his political opposition, cynically enabling foreign enemies of the state as his personal allies.

The cover is the part worth studying. Franz von Rintelen spent half a million dollars standing up Labor’s National Peace Council, a false flag front built to generate strikes and slowdowns at munitions plants. He went after the actual labor organizer Samuel Gompers.

The design of the operation made German strategic sabotage read as American labor grievance, because a neutral country arguing with itself about wages and war profiteering looks nothing like a foreign operation against a supply line. The charge that eventually stuck to Rintelen at his trial was a conspiracy to restrain trade by inducing dockworkers to strike.

The evidence was never hidden. The Albert briefcase ran on the front page of the New York World. The Providence Journal published German sabotage exposures through 1915. Black Tom shook windows across Manhattan. Americans could read all of it and still filed foreign sabotage as a domestic radical problem, which is the part worth carrying forward.

Labor and anarchism were the available flags in 1915. The history is useful today because the Dutch farmer protest movement is the flag already being offered, with climate and anti-militarism in reserve. They supply a real domestic constituency with real grievances about exactly the thing that a Russian operation wants stopped, and both hand investigators a “local politics” file to open instead of the more relevant counterintelligence one.

Germany has been running that mistake for fifteen years with zero convictions, if you wonder how well it’s been going.

The Netherlands and Poland agreed in December 2025 to deepen military mobility and logistics, moving troops through the Netherlands and Germany toward Poland. That builds on the January 2024 declaration among the Netherlands, Germany and Poland to run a corridor from the North Sea ports to the eastern flank, including priority for military trains over civilian traffic. On 11 September Dutch Defence moved 16 NS ICRmh carriages to the Vlasakkers military rail facility at Amersfoort, routed Arnhem to Deventer to Amersfoort. Those carriages become casualty evacuation trains. Medical evacuation capacity running west out of Poland not the kind of component in the corridor attracting public notice, while it is the one that Russia monitors as what NATO expects to need on the front.

Four days later pipes were fastened to the rails at Barneveld, Twello, Brummen, Putten, Lunteren, Ermelo, Veenendaal, Olst and Steenwijk. Barneveld sits on Amersfoort to Apeldoorn. Twello sits on Apeldoorn to Deventer. Brummen sits on the Arnhem to Zutphen approach to Deventer. Three points on the 11 September path. NOS mapped Amersfoort to Deventer as the one segment classified as probable sabotage rather than knock-on disruption.

Source: NOS

The pipes bridge the rails and short the track circuit. Relay de-energised therefore train present is an inference the system cannot verify, and a shunt satisfies it. The section reports occupied and signals hold at danger. Integrity of the input fails and availability of the corridor goes down with it. ProRail knew which baanvak was reporting and not where the object sat, which put crews on foot across kilometres of track for hours.

Large metal pipes cost almost nothing to source and drop, which is why material alone identifies nobody. Nine of those sites are named. Placements in one night across four provinces takes planning and more than one pair of hands. What the method establishes is that the Dutch signalling layer carries no integrity check on its own input channel. Anyone working a classic target of intelligence operations (because it’s so hard to prevent) can hold the corridor closed.

German federal security services published the template in September 2025. Foreign intelligence, mostly Russian, recruits Wegwerf-Agenten through social media and messenger apps for small sums, and the BKA target list names transport and rail.

Within hours, the Farmers Defence Force secretary Sieta van Keimpema told WNL that farmers being behind it cannot be ruled out, that the national group coordinates nothing, and that regional groups prepare regional actions. Agractie chairman Erik Luiten said he does not know and is waiting for the investigation. It’s a claim of motive coupled with the denial of coordinated methods, which sows political points yet leaves responsibility unclaimed.

With no claim of responsibility, the Netherlands has been here before. Some thirty rail cables burned as the NATO summit opened at The Hague in June 2025, cutting train services to the country’s main airport, with pro-Russian denial of service against summit municipalities the day before, and no claim of responsibility then either.

Caretaker Justice Minister David van Weel told the NATO Public Forum:

It could be an activist group. It could be another state. It could be anything.

The absence itself is notable. A domestic group is motivated to have its grievance heard. That was the point of Labor’s National Peace Council: a front publishes their cover. Silence fits a different operation, where the outage itself is the message, for the people who scheduled military trains to reach the front lines of war with Russia.

Security

CA Tesla Kills One in Intersection Crash

Leave a comment

Police are investigating.

Firefighters and paramedics responded to a traffic collision involving two vehicles that occurred around 11:11 a.m. at the intersection of Ventura Boulevard and Densmore Avenue.

Six people were transported to hospitals, and a woman was pronounced dead upon arrival. The condition of the other five is unknown.

[…]

LAPD confirmed that the incident involved a Tesla and a Lexus. Authorities also said one vehicle struck a pole and that a pedestrian was injured.

This comes as Elon Musk promotes a video of a Tesla driver ignoring intersections.

“I don’t want to look at every intersection and see, ‘Is this intersection clear, and is that one clear? Is there anybody behind me?’ I don’t want any of that, and I don’t have any of it,” Larry says in the video.