⇄ Σ = Mᄃ² ⇆
- keybase
- https://ecksmc.keybase.pub
- https://twitter.com/exksmc
- CoSo PLP
- https://counter.social/@ecksmc
- Twitter 2.0
- https://twitter.com/3ck5mc
E = Mc2 - Energy Milk Coffee
Fáilte Abhaile 🏴 “a nod’s as guid as a wink tae a blind horse”
ta be aff yer heid helps
Joined Nov 2017
A performance-sapping conflict between Mozilla Firefox and Microsoft Defender was first discussed on Bugzilla half a decade ago.
However, Firefox users can now rejoice, as Mozilla devs and Microsoft worked together to release an update to MsMpEng.exe (a core process of Windows Defender), which is currently being rolled out
/nosanitize
While car hacking is hardly new, in a blog post published April 3, Ken Tindell, CTO of Canis Automotive Labs, described how attackers manipulated an electronic control unit (ECU) in a Toyota RAV4's headlight to gain access to its CAN bus, through which they were able to, ultimately, steal the vehicle
https://kentindell.github.io/2023/04/03/can-injection/
That's an approach that hasn't been seen before
After Meta (Facebook and Instagram) switched the legal basis for targeting advertising from automatic consent to opt-out, privacy watchdog noyb has built a tool for users to opt out of targeted advertising and various other claims made by Meta in an easy and legally sound way.
https://noyb.eu/en/no-bullsht-opt-out-free-noyb-tool-quick-and-broad-facebook-objections
A new kind of arms race is underway to develop technologies that leverage generative AI to create thousands of malicious text and voice messages, Web links, attachments, and video files. The hackers are seeking to exploit vulnerable targets by expanding their range of social engineering tricks.
It Takes AI Security to Fight AI Cyberattacks
New threats from generative AI demand a generative AI security response.
https://www.darkreading.com/attacks-breaches/it-takes-ai-security-to-fight-ai-cyberattacks
Police arrested 119 individuals and conducted 208 searches and interviews across the globe,
Cops put the squeeze on Genesis crime souk denizens, not just the admins this time
https://www.theregister.com/2023/04/05/genesis_market_takedown/
Also today, in a related action the US Treasury issued sanctions against Genesis Market
“Operation Cookie Monster”
Genesis - shop closed
https://therecord.media/genesis-market-takedown-cybercrime
Alexander Leslie, an associate threat intelligence analyst with Recorded Future, wrote in a Twitter thread Tuesday that Genesis was “one of the world’s largest ‘log’ shops,”
https://twitter.com/aejleslie/status/1643323965077594118
In an February 2020 analysis, Israeli security researcher Alon Gal reported that, at the time, the site was offering 230,000 “infected computers you can buy the logs from.”
Hackers Can Remotely Open Smart Garage Doors Across the World
security researcher found a series of vulnerabilities with the Nexx brand of smart garage openers. says he could remotely find garages to target, and then open them across the internet.
#CoSoSec
https://www.vice.com/en/article/pkadqy/hackers-can-remotely-open-smart-garage-doors-across-the-world-simpaltek
Uber faces various cyber attacks that result in the disclosure of employee email addresses, company reports, and information related to IT assets.
The servers of Genova Burns, a legal services firm, have been compromised, resulting in the theft of driver data belonging to the company
Scammers Can Use AI to Fake Anyone’s Voice
It didn't take long for scammers to start using AI "voice cloning" to fool people.
As you can see from this NBC News report, it’s easy to grab samples of a person’s voice from social media and use it to generate anything you want to say
Good news for those seeking online privacy and anonymity as Mullvad Browser is now available for free download.
#MullvadVPN and the Tor Project have partnered to launch the Mullvad Browser, a new privacy-focused web browser. The browser has been developed to offer users a secure browsing experience and to minimize tracking and fingerprinting.
The Mullvad browser is available for free and can be downloaded on Windows, MacOS, and Linux platforms.
Western Digital shuts down several of its services after discovering a network security breach.
https://status.mycloud.com/os4
impacting the following products: My Cloud, My Cloud Home, My Cloud Home Duo, My Cloud OS5, SanDisk ibi, SanDisk Ixpand Wireless Charger.
In a press release issued on April 3, the company said it’s responding to an ongoing network security incident that involves an unauthorized third party gaining access to “a number” of its systems.
https://www.securityweek.com/western-digital-shuts-down-services-due-to-cybersecurity-breach/
New ‘Hack the Pentagon’ website helps DoD organizations launch bug bounty programs and recruit security researchers.
https://www.hackthepentagon.mil/
launched by the Chief Digital and Artificial Intelligence Office (CDAO) Directorate for Digital Services (DDS), is meant as a companion for the DoD’s long-running bug bounty program with the same name.
https://www.securityweek.com/us-defense-department-launches-hack-the-pentagon-website/
Crypto-Stealing OpcJacker Malware Targets Users with Fake VPN Service
https://thehackernews.com/2023/04/crypto-stealing-opcjacker-malware.html
a Sim-Swap tail - credit card & phone theft
https://www.businessinsider.com/credit-card-phone-theft-sim-swap-identity-theft-investigation-2023-4
How to Protect Yourself Against a SIM Swap Attack
Your phone number is increasingly tied to your online identity. You need to do everything possible to protect it.
On Wednesday night, news broke that VoIP communications company 3CX was compromised
A 10-year-old Windows vulnerability is still being exploited in attacks to make it appear that executables are legitimately signed, with the fix from Microsoft still "opt-in" after all these years. Even worse, the fix is removed after upgrading to Windows 11.
A misconfigured Microsoft application allowed anyone to log in and modify Bing.com search results in real-time, as well as inject XSS attacks to potentially breach the accounts of Office 365 users.
Wiz researchers found that when creating an application in Azure App Services and Azure Functions, the app can be mistakenly configured to allow users from any Microsoft tenant, including public users, to log in to the application.
Hackers compromise 3CX desktop app in a supply chain attack
3CX is a VoIP IPBX software development company whose 3CX Phone System is used by more than 600,000 companies worldwide and has over 12 million daily users.
Researchers from Google's Threat Analysis Group (TAG) have discovered two separate, highly-targeted campaigns that use various, unpatched zero-day exploits against users of both iPhone and Android smartphones to deploy spyware.(Chrome also)
initial access attempts that affect both Android and iOS that were delivered via bit.ly links sent over SMS
Also Samsung Browser Cyber-Espionage Campaign includes a complete exploit chain
Trojanized installers for the TOR anonymity browser are being used to target users in Russia and Eastern Europe with clipper malware designed to siphon cryptocurrencies since September 2022.
https://thehackernews.com/2023/03/trojanized-tor-browser-installers.html
Apple patches everything, including a zero-day fix for iOS 15 users
Got an older iPhone that can't run iOS 16? You've got a zero-day to deal with! That super-cool Studio Display monitor needs patching, too
⇄ Σ = Mᄃ² ⇆
- keybase
- https://ecksmc.keybase.pub
- https://twitter.com/exksmc
- CoSo PLP
- https://counter.social/@ecksmc
- Twitter 2.0
- https://twitter.com/3ck5mc
E = Mc2 - Energy Milk Coffee
Fáilte Abhaile 🏴 “a nod’s as guid as a wink tae a blind horse”
ta be aff yer heid helps
Joined Nov 2017