Ooof.
SAT company caught not understanding tracking pixels, and the privacy ramifications thereof.

https://gizmodo.com/sat-college-board-tells-facebook-tiktok-your-scores-gpa-1850768077

#cososec #cosoprivacy

This is too much for me to read right now, but looks interesting.

NIST's take on AI and how to secure it.

https://www.nist.gov/artificial-intelligence

#ai #cososec

#Lastpass Hack mitigation:

If you're a Lastpass user, even if you're planning on leaving, it'll take some time to do so.

1. Enable MFA, preferably a good one like hardware keys or authenticator apps.
2. Lock down LastPass access to only the countries you expect to be in in the near term. You can do this through the web advanced settings tab.
3. Prohibit access from tor networks unless you're typically using them.
4. Increase your 'password iterations' value to something OVER 600,000.
#cososec

This is bad.... Not the end of the world bad, but still bad. The attacker still needs to figure out individual master passwords to get your encrypted site passwords, but they have everything else.

Now to convince my wife to change /everything/ to onePassword.

https://arstechnica.com/information-technology/2023/02/lastpass-hackers-infected-employees-home-computer-and-stole-corporate-vault/

#cososec

#DC area #infosec 'nauts:
OWASP will be holding their yearly US conference in your area this year. They put on a great conference that I can't recommend enough. Current Early Bird pricing makes it so you can afford it when if you are footting the bill yourself.

https://dc.globalappsec.org/

#cososec

OH DEAR. THIS POST WAS SET TO SELF-DETONATE 💣 💥 🔥

Ą̷͇̀l̵̩̓̕l̸̩͘ ̸̭̪̈́ť̷̝̍̆h̶̡̛̰̯̏͌a̷͕̞͋̂t̵̩͙͑̈́͝'̵̛̍́ͅͅş̴̬̱͝ ̷̗̊͠l̵͚̕͠ē̸̻͓̐͝f̷̧͙̀̑͝t̶͓̓͊̚ ̶̜̱̓͌́a̴͉͊r̶̡̩͛̀é̵̦̞͕ ̶̮̾ṫ̷̡͈̍ḧ̸̛͍́̊e̴̫̅ş̶̥̰̓e̴̟̪͌͂̇ ̷̞̅͊̚h̷̰͕͈͂e̶̡̹̜̚ŗ̸̗͈̾̇e̴̩̍͐ ̷̪͉̩̀a̵̡̱̐͑͝s̴͎͖̈́h̸͈͌́͜e̴͕̝̐̌ś̶͓̆ͅ.̵̩̉ ̵̱͊͑̀

OH DEAR. THIS POST WAS SET TO SELF-DETONATE 💣 💥 🔥

Ą̷͇̀l̵̩̓̕l̸̩͘ ̸̭̪̈́ť̷̝̍̆h̶̡̛̰̯̏͌a̷͕̞͋̂t̵̩͙͑̈́͝'̵̛̍́ͅͅş̴̬̱͝ ̷̗̊͠l̵͚̕͠ē̸̻͓̐͝f̷̧͙̀̑͝t̶͓̓͊̚ ̶̜̱̓͌́a̴͉͊r̶̡̩͛̀é̵̦̞͕ ̶̮̾ṫ̷̡͈̍ḧ̸̛͍́̊e̴̫̅ş̶̥̰̓e̴̟̪͌͂̇ ̷̞̅͊̚h̷̰͕͈͂e̶̡̹̜̚ŗ̸̗͈̾̇e̴̩̍͐ ̷̪͉̩̀a̵̡̱̐͑͝s̴͎͖̈́h̸͈͌́͜e̴͕̝̐̌ś̶͓̆ͅ.̵̩̉ ̵̱͊͑̀

I've been noticing several attempted charges of 88¢ against my privacy.com cards.

I'm glad it exists for any site that seems sketchy or any time I have to verbally give a CC number.

But stay vigilant. A small charge could be a probe charge or it could be there just to drain a little money from lots of people, hoping that small charges would go undetected.

#cososec
#securityhygiene

It's cybersecurity awareness month.

I don't have much to pay right now, but go through the #cososec and #securityhygiene tags.

Remember: Cyber Safely 😜

The intersection of #cososec, #cosoparents, and #education

The seesaw app was hacked via credential stuffing and was used to send explicit images to other users.

https://www.nbcnews.com/tech/security/popular-school-messaging-app-hacked-send-explicit-image-parents-rcna47687

Don't.
Reuse.
Passwords!

OH DEAR. THIS POST WAS SET TO SELF-DETONATE 💣 💥 🔥

Ą̷͇̀l̵̩̓̕l̸̩͘ ̸̭̪̈́ť̷̝̍̆h̶̡̛̰̯̏͌a̷͕̞͋̂t̵̩͙͑̈́͝'̵̛̍́ͅͅş̴̬̱͝ ̷̗̊͠l̵͚̕͠ē̸̻͓̐͝f̷̧͙̀̑͝t̶͓̓͊̚ ̶̜̱̓͌́a̴͉͊r̶̡̩͛̀é̵̦̞͕ ̶̮̾ṫ̷̡͈̍ḧ̸̛͍́̊e̴̫̅ş̶̥̰̓e̴̟̪͌͂̇ ̷̞̅͊̚h̷̰͕͈͂e̶̡̹̜̚ŗ̸̗͈̾̇e̴̩̍͐ ̷̪͉̩̀a̵̡̱̐͑͝s̴͎͖̈́h̸͈͌́͜e̴͕̝̐̌ś̶͓̆ͅ.̵̩̉ ̵̱͊͑̀

OH DEAR. THIS POST WAS SET TO SELF-DETONATE 💣 💥 🔥

Ą̷͇̀l̵̩̓̕l̸̩͘ ̸̭̪̈́ť̷̝̍̆h̶̡̛̰̯̏͌a̷͕̞͋̂t̵̩͙͑̈́͝'̵̛̍́ͅͅş̴̬̱͝ ̷̗̊͠l̵͚̕͠ē̸̻͓̐͝f̷̧͙̀̑͝t̶͓̓͊̚ ̶̜̱̓͌́a̴͉͊r̶̡̩͛̀é̵̦̞͕ ̶̮̾ṫ̷̡͈̍ḧ̸̛͍́̊e̴̫̅ş̶̥̰̓e̴̟̪͌͂̇ ̷̞̅͊̚h̷̰͕͈͂e̶̡̹̜̚ŗ̸̗͈̾̇e̴̩̍͐ ̷̪͉̩̀a̵̡̱̐͑͝s̴͎͖̈́h̸͈͌́͜e̴͕̝̐̌ś̶͓̆ͅ.̵̩̉ ̵̱͊͑̀

OWASP Global App Sec will be in San Fran this year.

If you code, test, or hack anything web-based, it's a good place to learn and meet others.

https://sf.globalappsec.org/

#CoSoSec

https://www.bbc.com/news/world-asia-61921222

So much wrong here.

Let's dissect it.

a) a culture where taking work home is acceptable
b) taking other people's data home
c) stopping at a someplace other than home while in the possession of other people's data
d) getting pass-out drunk while in the possession of other people's data

#CoSoSec

Don't be this person.

OH DEAR. THIS POST WAS SET TO SELF-DETONATE 💣 💥 🔥

Ą̷͇̀l̵̩̓̕l̸̩͘ ̸̭̪̈́ť̷̝̍̆h̶̡̛̰̯̏͌a̷͕̞͋̂t̵̩͙͑̈́͝'̵̛̍́ͅͅş̴̬̱͝ ̷̗̊͠l̵͚̕͠ē̸̻͓̐͝f̷̧͙̀̑͝t̶͓̓͊̚ ̶̜̱̓͌́a̴͉͊r̶̡̩͛̀é̵̦̞͕ ̶̮̾ṫ̷̡͈̍ḧ̸̛͍́̊e̴̫̅ş̶̥̰̓e̴̟̪͌͂̇ ̷̞̅͊̚h̷̰͕͈͂e̶̡̹̜̚ŗ̸̗͈̾̇e̴̩̍͐ ̷̪͉̩̀a̵̡̱̐͑͝s̴͎͖̈́h̸͈͌́͜e̴͕̝̐̌ś̶͓̆ͅ.̵̩̉ ̵̱͊͑̀

"We take your security and privacy very seriously." = "We don't snicker when we're caught mishandling your financial information."

#CoSoSec

OH DEAR. THIS POST WAS SET TO SELF-DETONATE 💣 💥 🔥

Ą̷͇̀l̵̩̓̕l̸̩͘ ̸̭̪̈́ť̷̝̍̆h̶̡̛̰̯̏͌a̷͕̞͋̂t̵̩͙͑̈́͝'̵̛̍́ͅͅş̴̬̱͝ ̷̗̊͠l̵͚̕͠ē̸̻͓̐͝f̷̧͙̀̑͝t̶͓̓͊̚ ̶̜̱̓͌́a̴͉͊r̶̡̩͛̀é̵̦̞͕ ̶̮̾ṫ̷̡͈̍ḧ̸̛͍́̊e̴̫̅ş̶̥̰̓e̴̟̪͌͂̇ ̷̞̅͊̚h̷̰͕͈͂e̶̡̹̜̚ŗ̸̗͈̾̇e̴̩̍͐ ̷̪͉̩̀a̵̡̱̐͑͝s̴͎͖̈́h̸͈͌́͜e̴͕̝̐̌ś̶͓̆ͅ.̵̩̉ ̵̱͊͑̀

OH DEAR. THIS POST WAS SET TO SELF-DETONATE 💣 💥 🔥

Ą̷͇̀l̵̩̓̕l̸̩͘ ̸̭̪̈́ť̷̝̍̆h̶̡̛̰̯̏͌a̷͕̞͋̂t̵̩͙͑̈́͝'̵̛̍́ͅͅş̴̬̱͝ ̷̗̊͠l̵͚̕͠ē̸̻͓̐͝f̷̧͙̀̑͝t̶͓̓͊̚ ̶̜̱̓͌́a̴͉͊r̶̡̩͛̀é̵̦̞͕ ̶̮̾ṫ̷̡͈̍ḧ̸̛͍́̊e̴̫̅ş̶̥̰̓e̴̟̪͌͂̇ ̷̞̅͊̚h̷̰͕͈͂e̶̡̹̜̚ŗ̸̗͈̾̇e̴̩̍͐ ̷̪͉̩̀a̵̡̱̐͑͝s̴͎͖̈́h̸͈͌́͜e̴͕̝̐̌ś̶͓̆ͅ.̵̩̉ ̵̱͊͑̀

#CoSoSec

People, Especially those in Texas - be careful about how you pay for parking - don't pay by QR code.

https://arstechnica.com/tech-policy/2022/01/scammers-put-fake-qr-codes-on-parking-meters-to-intercept-parkers-payments

Biggest takeaway - if you get a SMS message purporting to be from a bank or company you do business with, go to the business's homepage directly, and not through the link in the text message.

https://arstechnica.com/information-technology/2021/11/securing-your-digital-life-part-3

#CoSoSec
#SecurityHygiene