Today I made my threat hunt book publicly known on LinkedIn. So far the feedback has been overwhelming. I do hope my efforts will contribute to educate both threat hunters and SOC analysts!
A quick story/rant.. my cousin got my mother a new coffee maker. I don't expect my mom to use the WiFi functionality, but I'm still concerned about why we would need a whole coffee maker to have a small computer in it... I understand the versatility of not having a hub, and that hubs are also a single point of access for any malicious actors, but I'm sure a hub for multiple devices instead of a thing for a coffee maker would be updated much more frequently, and supported for longer. If nothing else, maybe I can pull it into my janky Home Assistant setup somehow.
Even if it doesn't end up being a gateway for snooping on home network, it is quite silly, in my opinion. Now, I must go check to see if anyone's hacked at these yet lol...
The city of Columbus Ohio got hacked by a ransomware gang, they didn't pay the ransom so the gang released half of the stolen data which included secret police and prosecutor files. The leak exposed countless victims, witness and confidential informants personal info and communications with the city.
The city claimed NO info was leaked. A cyber security enthusiast went to the media and proved otherwise.
When you search for "identita občana" (Citizen Identity, ID for the Czech e-government), the first link #Google gives you (as an ad) is to a malicious website.
I wonder if companies like Google will ever be held accountable for spreading dangerous scams and getting paid for it.
I learned about secure software development on the job, but like ethical computing (which I've talked about before), this should also be included in formal education. Because of the current threat models, topics like security by design and zero-trust frameworks are critical when developing Internet systems. linuxfoundation.org/press/linu…
We've partnered with Abside to create a groundbreaking secure communication solution for government agencies. Our Liberty phone, featuring Made in USA Electronics and running our non-Android PureOS, now integrates with Abside's N79 5G private network. The result? A fully American-made, ultra-secure platform for government personnel to communicate and access critical data on the move. Privacy, security, and performance – all in one package. #Purism #Cybersecurity #Abside
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
Central authentication for all Washington State services
(DoL, ESD, etc).
Password must have *exactly* 10 characters, but form happily
lets you enter more and only throws errors after submit,
providing no useful feedback.
Your password needs to be between 8 and 10 characters long, with no spaces, and must contain only numbers and letters. The first character must be a letter.
Feb 2020 Update: policy remains the same but the description is hidden leaving you to guess the acceptable length/chars. Users are now lef...
Your password needs to be between 8 and 10 characters long, with no
spaces, and must contain only numbers and letters. The first character
must be a letter.
You have to enter your password using this *very* Frenchy keypad. You don't have lowercase letters, the blanks are not spaces but just non-clickable gaps, but as a compensation you have some weird symbols that your keyboard does not have a key for (e.g. `µ`).
You have to enter your password using this *very* Frenchy keypad. You don't have lowercase letters, the blanks are not spaces but just non-clickable gaps, but as a compensation you have some weird symbols that your keyboard does not have a key for (e…
A recap: We've covered a number of things on this channel so far, from an @elementary review to a look at code editors, datascience tools, screen readers, hacking tools like Burp Suite and platforms like TryHackMe, all from a screen raeder user's perspective. I'm only just getting started though, intending to cover a wide variety of different things, from more #FOSS tools, audio/video editing, programming and hacking tools etc. Today's stream will be more #tryHackMe content, with a look at #HackTheBox Academy next week. Anyone who wants this kind of feedback, and doesn't mind constructive, but thorough, feedback, come talk to me :) We'll be going live today at 3 PMeST over at https;//twitch.tv/ic_null and youtube.com/@lindlyCoding #infoSEc #cybersecurity #accessibility #selfPromo #twitch #youtube #streaming
Computer hardware maker #Zotac exposed customers' RMA info on Google Search
Misconfiguration of permissions folders holding customer info related to RMAs have been indexed by search engines like #Google. As a result, it has shown up on SERPs.
Information leaked includes invoices, addresses, and contact information.
Fun fact: Security Misconfiguration is number 6 on the OWASP Top 10 Web app Security Risks.
More of Microsoft's clients are being warned that emails they exchanged with the
company were accessed by Russian hackers who broke into its systems and spied on
staff inboxes.
ID Verification Service for #TikTok, #Uber, X Exposed Driver Licenses
In this case, the ID verification vendor leaked admin credentials and exposed people’s information (sensitive documents and status of verification) for over a year.
All for “age verification” we introduce another EZ mode way for people’s real life identities to be compromised. Companies want you to provide sensitive documents to prove you’re real/your age but can’t be bothered to invest money/time/effort in basic #security to secure what you give them.
As social networks and porn sites move towards a verified identity model, the actions of one cybersecurity researcher show that ID verification services themselves could get hacked too.
Microsoft recently discovered a new type of generative AI jailbreak method called Skeleton Key that could impact the implementations of some large and small language models.
If anyone out there is looking for some #infosec / #cybersecurity-related training, feel free to peruse this giant list I've been putting together over time ⬇️
We've been doing this a while. Let's SWING for the big leagues. Tomorrow, we're doing a deep dive on #burpSuite from a #screenReader perspective. It will be mostly #blind (as in playthrough) as I've not looked at this program for a few years, and fully blind (as in sight) given ... well ... screenReader user :)
I wrote a piece recently about Copilot+ Recall, a new Microsoft Windows 11 feature which — in the words of Microsoft CEO Satya Nadella- takes “screenshots” of your PC constantly, and makes it into an…
Hey, look at that. Mainly through efforts from you lot, I was able to get IC_Null to #twitch Affiliate status in under a month. This allows me to make even better, more varied and interesting content for you all. Thanks for sharing, watching and showing me your interest everyone ... we've only just gotten started :) #infoSec #cybersecurity #streaming
Patch tuesday be upon us once more. That means another IC_Null stream at 3 PM EST/9 PM CEST today. Today we cover more #TryHackMe content in the #webHacking category. SOme announcements about the channel as well. Next week, we'll take a break from pure #THM to go full ham on #burpSuite #accessibility ... or the lack there of. Let's see how long it takes for us to be forced onto the far superior #zaproxy :) See you all tonight at twitch.tv/ic_null #infoSec #cybersecurity #blind #screenReader #a11y #twitch
#Android is getting an AI-powered #scam call detection feature
Will be powered by Gemini Nano, which #Google says can be run locally and offline to process "fraudulent language and other conversation patterns typically associated with scams" and push real-time alerts during calls where detected red flags are present.
It will be opt-in, but Gemini Nano is currently only supported on Google Pixel 8 Pro and Samsung S24 series devices.
Google is testing a new call monitoring feature that warns users if the person they’re talking to is likely attempting to scam them and encourages them to end such calls.
Was responsible for SecOps at a SaaS platform that managed lots of things for companies, including travel bookings.
We had a bunch of customers in the higher education space who used SSO to login to our app. Unfortunately, MFA within the SSO configuration was not common back then, so a compromised university account would lead to much access, including to our platform.
Suddenly, a thing we saw a lot of, was higher-ed customers reporting that they were being charged for trips that just didn't make sense. These were bookings for same day travel, usually between two African cities.
After some digging around and investigation, we figured out that a threat actor would phish or purchase the users university credentials, then, using the SSO into our environment, they'd make bookings using the travel booking feature - those bookings were made on behalf of the threat actors customers, who actually thought they were dealing with a legit, well-connected travel agent.
We were able to advise our customers on how to stop this type of thing happening, with approval rules for bookings, and ya know, MFA, and also managed to build in some detective controls so our team could detect and shut down such bookings as soon as they came in.
What made this particularly interesting though, through some OSINT, we were able to determine the true identity of the actor responsible - and we connected with them on Facebook, mainly because we wanted to ask them about their methods now that we'd all but shut down their scheme.
We chatted for a bit, and got some useful intel. At the end, the actor congratulated the team on our new controls, and said they'd moved on to using another service they'd found to make his bookings.
For more, slightly less mini, Blue Team Diaries stories like this, check out infosecdiaries.com
Start of a new project. As IC_Null on Twitch, I'll be covering hacking, coding and overall tech content. The content will be archived here.Follow my new hack...
Guten Morgen, wer es am Wochenende verpasst hat: Wir haben eine massive Sicherheitslücke bei der Bundeswehr und der Bundesregierung aufgedeckt. Die Bundeswehr hat ihren Webex-Server daraufhin vom Internet genommen (was heute mehrere hundert geplante Meetings betreffen dürfte). Der Bundesregierung hingegen scheint das alles egal zu sein. Der Meetingraum von Olaf Scholz steht jedenfalls auch heute noch offen. zeit.de/digital/datenschutz/20… #Cybersecurity #bundeswehr
Recherchen von ZEIT ONLINE offenbaren eine Sicherheitslücke bei der Bundeswehr und der Bundesregierung: Wer wann zu einem Videocall einlud, ließ sich öffentlich einsehen.
Heads up! #CashApp probably had a big security breach they're about to announce, because they just released new terms of service with a draconian binding arbitration clause, and the only way to opt out is to fill out a specific form on paper and pay to send it to them via postal mail. Personally, I'm just going to delete my account. Ref: cash.app/legal/us/en-us/tos #privacy #infosec #cybersecurity #arbitration #BindingArbitration #ConsumerRights
The Cash App Terms of Service govern your use of Cash App. By using Cash App you agree to be bound by these Terms, and all other terms and policies applicable to each Service.
I implemented Ken Thompson’s Reflections on Trusting Trust (1984 Turing Award Lecture) compiler #backdoor for the GNU Compiler Collection (GCC). The backdoor maintains persistence by re-injecting itself to any new versions of the compiler built. The secondary payload modifies a test application by adding a backdoor password to allow authentication bypass:
I spent most time (around two hours) writing the generalized tooling that produces the final quine version of the malicious payload. Now that this is done, the actual code can be adjusted trivially to exploit more target code without any need to adjust the self-reproducing section of the code. This method of exploitation could be extended to target various binaries: SSH Server, Linux Kernel, Setuid binaries and similar. While itself written in C, the secondary payloads can target any programming languages supported by GCC.
It should be noted that GCC build checks for malicious compiler changes such as this. This check can – of course – also be bypassed. However, most serious projects have measures in place to avoid hacks of this nature.
Some links: - Ken Thompson's "Reflections on Trusting Trust" paper: cs.cmu.edu/~rdriley/487/papers… - David A. Wheeler: "Fully Countering Trusting Trust through Diverse Double-Compiling (DDC) - Countering Trojan Horse attacks on Compilers" dwheeler.com/trusting-trust/
