ja4-mcp; Whole Cloth; Bring A Different Kind Of Pi To Your Family Gatherings
No Friday Drop, as I spent the normal Drop time making what we’re covering in the first section (and then jetting to Boothbay to see Gardens Aglow tonight).
This whole Bonus Drop has a bouquet of “security” and/or “privacy”. The first two sections are mostly for practitioners, but the last section is intended for everyone.
TL;DR
(This is an LLM/GPT-generated summary of today’s Drop. This week, I’m playing with Ollama’s “cloud” models for fun and for $WORK (free tier, so far), and gave gpt-oss:120b-cloud a go with the Zed task. Even with shunting context to the cloud and back, the response was almost instantaneous. They claim to now keep logs, context, or answers, but I need to dig into that a bit more.)
- The ja4‑mcp project provides an MCP server that parses JA4 fingerprints, looks them up in JA4DB and helps analysts detect and group threat patterns (https://codeberg.org/hrbrmstr/ja4-mcp)
- Anthropic’s announcement of an “AI‑orchestrated cyber espionage campaign” is critiqued as overstated, noting that AI tools were unreliable and human oversight remained essential (https://www.anthropic.com/news/disrupting-AI-espionage)
- Tailscale’s guide shows how to turn a low‑cost device like a Raspberry Pi into a remote exit‑node/subnet router, enabling easy, secure access to family networks for support and troubleshooting (https://tailscale.com/blog/exit-node-parents-streaming-support)
ja4-mcp
If you’ve been anywhere near network security in the past couple years, you’ve probably heard whispers about JA4 fingerprinting. For those of you who haven’t been neck-deep in packet captures, the concept is pretty straightforward: when your computer or phone or any device talks to another device over an encrypted connection, it has to introduce itself first through something called a TLS handshake. The way it says hello reveals a surprising amount about what application is talking, what operating system it’s running on, and sometimes even what kind of network it’s traveling through. JA4 is a way to take all those hellos and turn them into compact fingerprints that both humans and machines can actually read and use for threat hunting. (Parts of JA4 also work for unencrypted traffic, but I’m leaning into the seekrits part.)
The cool part is that this all works even though the traffic itself is fully encrypted. You’re not breaking into anyone’s messages or data, you’re just observing how applications shake hands before they start whispering secrets to each other. JA4 replaced an older method called JA3 that had some problems, like being easy to fool by just randomizing the order of things. JA4 fixes that by sorting certain values and capturing additional context like which application protocol is being negotiated. It also works across different transport protocols, so whether something is using traditional TCP or the newer QUIC protocol that Google rammed into HTTP/3, you get consistent fingerprints. The format is this modular thing where each fingerprint has three parts separated by underscores, which means you can hunt on just part of a fingerprint if you want to track threat actors who keep changing one aspect of their tools but not others.
So the thing I made is a Model Context Protocol (MCP) server that lets anything that can talk to MCP servers analyze these JA4 fingerprints like a security analyst steeped in JA4 would. You can feed it a fingerprint and it’ll break down what protocol is being used, what TLS version, how many cipher suites and extensions were offered, and what application protocol was requested. It automatically checks against a community database called JA4DB to see if anyone else has seen that fingerprint and associated it with specific applications or malware families. The really useful bits are the pattern detection tools, where you can throw a bunch of fingerprints at it and have some smart script or LLM (you don’t need to use MCP servers with LLMs; good ol’ determinstic logic flows work great) identify outliers or group similar ones together, which is exactly what you’d want to do when trying to figure out if a bunch of suspicious connections are actually part of the same attack campaign.
The reason this matters right now is that JA4 is still pretty new and the tooling around it is sparse. These novel methods were released in 2023 and 2024 and kind of require folks to understand the internals of TCP options, TLS extensions, signature algorithms, and HTTP header ordering. Most security tools will collect this data for you from packet captures, but then you’re stuck squinting at strings like “ja4h:po11cn050000_0b4164a3b800_17b788a70eec_3695643d8b74” trying to remember what each component means and whether you’ve seen something similar before. Having tools be able to explain what each part means, look it up in known databases, compare it against other fingerprints, and suggest investigation steps makes this accessible to way more humans than just the handful of folks who can decode these things in their sleep. Plus the MCP server includes resources for reference documentation and built-in prompts to guide LLMs (or humans) through proper analysis workflows, so it’s not just translating the fingerprints but actually helping you hunt through them like you would if you’d spent years doing this work manually.
Kick the tyres, if so inclined, and let me know if any corners need rounding out!
Whole Cloth
I am likely going to get into trouble for posting this but I felt compelled to offer a less ranty version of my Mastodon thread. What Anthropic did is too dangerous to remain silent in this forum.
Anthropic would have you believe that a fundamental shift in cyber threats has occurred with the disclosure of what they call the “first reported AI-orchestrated cyber espionage campaign.” A more sober look suggests this is less a revolution and more a well-packaged demonstration of existing trends, heavily inflated by AI hype. The report outlines a six-phase attack lifecycle, but a dispassionate examination reveals that most phases either didn’t use AI at all, could have been accomplished faster (and more deterministically) with existing tools, or still required significant human oversight to correct for the AI’s inevitable hallucinations. The implied narrative of an omniscient AI seamlessly navigating foreign networks is undercut by the admission that the campaign succeeded in only a “handful of cases” and that operators had to constantly validate the AI’s often-fabricated findings.
The real danger here isn’t the attacker’s new AI-powered capability, but the potential for defenders to be fooled into thinking generative AI belongs in the critical path of incident response. These are not deterministic processes. As the report itself admits, the AI regularly hallucinated credentials and discoveries. In a real response, every piece of output would require verification by a skilled human, making it a liability rather than an asset when speed and accuracy are paramount.
The true lesson is the opposite of Anthropic’s dramatic conclusion: the threat model hasn’t expanded meaningfully. Attackers are just using a new, unreliable tool to perform the same old attacks, while defenders who rush to adopt similar non-deterministic tools for defense may find themselves overseeing a cargo cult response, mistaking AI-generated text for actionable intelligence. If there’s any advantage to be gained from AI, it’s likely for the defenders who can use it for triage and scaling, provided they never forget it’s a hallucinating sidekick, not a replacement for expert judgment.
Bring A Different Kind Of Pi To Your Family Gatherings
The good folks at Tailscale have put together a genuinely clever use case that goes beyond the usual VPN stuff. The basic idea is this: you take a tiny, cheap computer like a Raspberry Pi or even an Apple TV, load it up with Tailscale, and mail it to your parents or relatives (as the section title notes, perhaps bring some with you to holday family gatherings!). Once they plug it into their router, you’ve got secure access to their entire home network from anywhere. No more trying to walk them through tech support over the phone when you can just SSH in and fix things yourself.
What makes this particularly interesting is how it solves real problems folks actually have. Need to troubleshoot why mom’s printer stopped working? You’re in. Want to monitor a family member who needs extra care? Done. Living somewhere with restrictive internet censorship and need to help relatives stay connected? Tailscale becomes the lifeline. One story noted how they set up a Raspberry Pi with a NAS for their mother who has dementia, letting their sister easily handle all the paperwork and finances with automatic backups between locations. Another person uses it as an exit node for family members in a country that recently blocked WhatsApp, giving them access to independent media and keeping video calls running.
The technical setup is straightforward if you’re comfortable with Linux. You get Tailscale running on the device, enable it as an exit node and subnet router, configure SSH access, then ship it off with an ethernet cable and power adapter. (If that sounds likle “alot”, it’s really not. The Tailscale UX is great.) Once it’s plugged in at the destination, the device shows up in your Tailscale admin console with a friendly green dot, and you can access their network as if you were sitting right there. The guide walks through doing this with a Raspberry Pi, Apple TV, or Android TV box, each with different tradeoffs around remote access and ease of setup.
The whole thing feels very much in the spirit of actual helpful technology rather than technology for its own sake. You’re not setting up some complicated infrastructure, you’re solving genuine human problems like “how do I help my parents when I live three states away” or “how do we stay in touch when authoritarian governments keep blocking communication tools.” (I mean, U.S. folks might need friends or relatives in other locales help you in a similar fashion if things keep going pear shaped, here.) Plus there’s something delightfully tangible about mailing someone a box that creates an invisible network bridge between your locations.
FIN
Remember, you can follow and interact with the full text of The Daily Drop’s free posts on:
- 🐘 Mastodon via
@dailydrop.hrbrmstr.dev@dailydrop.hrbrmstr.dev - 🦋 Bluesky via
https://bsky.app/profile/dailydrop.hrbrmstr.dev.web.brid.gy
☮️
hrbrmstr's Daily Drop 
Leave a comment