⇄ Σ = Mᄃ² ⇆
- keybase
- https://ecksmc.keybase.pub
- https://twitter.com/exksmc
- CoSo PLP
- https://counter.social/@ecksmc
- Twitter 2.0
- https://twitter.com/3ck5mc
E = Mc2 - Energy Milk Coffee
Fáilte Abhaile 🏴 “a nod’s as guid as a wink tae a blind horse”
ta be aff yer heid helps
Joined Nov 2017
Tips on how to use simple-login
Replacing your email with an alias also protects you in the case of a data breach
🧵
No matter which authenticator is your favorite, it’s important to use 2FA to add an additional layer of protection to your accounts. And a Password manager to store/create all passwords
Check out the other favorite data privacy tools from the Bitwarden community:
Survey Highlights
We polled the Bitwarden community for their favorite data privacy apps. There were many close calls in the survey results. Here are the main standouts from each category:
Ivanti discloses fifth vulnerability, doesn't credit researchers who found it
Software company's claim of there being no active exploits also being questioned
https://www.theregister.com/2024/02/09/ivanti_discloses_fifth_ics_vulnerability
Beware of Facebook Ads That Deliver Password-Stealing Malware
Facebook Ads Delivering Password Stealing Malware
A weaponized PDF file is used for the malware’s first access and transmission. The file impersonates a shared file on OneDrive. A simple clickable OneDrive link was found on a fake Facebook profile purporting to be Amazon CEO Andy Jassy.
Windows encryption feature defeated by $10 and a YouTube tutorial
video demonstrated how a Raspberry Pi Pico can be used to gain access to a BitLocker-secured device in under a minute, provided you have physical access to the device.
A Lenovo laptop was used in the video, posted by user stacksmashing
The technique also relies on having a Trusted Platform Module (TPM) separate from the CPU.
Horse, meet stable door
AnyDesk revokes signing certs, portal passwords after crooks sneak into systems
PSA:
1Password says it’s looking into reports that users are unable to log in to the app. The company’s status page says the issue “is currently impacting sign-ins to the 1Password web interface” and is affecting users in Europe, the US, Canada, and elsewhere.
iwe all kinda knew Bouzy was taking pish in his press release right?
but hot-dam >> email and IP address, phone number, gender, bcrypt hashed password, 2FA secret and backup code and the code that can be immediately used to reset the password all exposed
#CoSoSec #SocialMedia #Spoutible
the vulnerable APIs was requested organically as a natural part of using the service as it was intended, Spoutible almost certainly won't be able to fully identify abuse of it
https://www.troyhunt.com/how-spoutibles-leaky-api-spurted-out-a-deluge-of-personal-data/
The FTC’s full report makes shocking reading
(PDF URL) #CoSoSec
https://www.ftc.gov/system/files/ftc_gov/pdf/Blackbaud-Complaint.pdf
Blackbaud "failed to monitor attempts by hackers to breach its networks, segment data to prevent hackers from easily accessing its networks and databases, ensure data that is no longer needed is deleted, adequately implement multifactor authentication, and test, review and assess its security controls" and that it "allowed employees to use default, weak, or identical passwords for their accounts."
AnyDesk confirmed today that it suffered a recent cyberattack that allowed hackers to gain access to the company's production systems.
AnyDesk is a remote access solution that allows users to remotely access computers over a network or the internet.
The software is also popular among threat actors who use it for persistent access to breached devices and networks.
China is hacking Wi-Fi routers for attack on US electrical grid and water supplies, FBI warns
According to the FBI’s Wray, Volt Typhoon is compromising small businesses and home office routers to hide the origin of future Chinese-backed cyber attacks.
FBI director Christopher Wray warned the US Congress earlier this week of the risks posed by Chinese state-sponsored hackers.
Wizz, a growing social media app among US teenagers, was removed from the Apple App Store and the Google Play Store on January 30.
Teen Chatting App Wizz Removed from Apple and Google Stores for Sextortion Concerns
https://www.infosecurity-magazine.com/news/wizz-removed-apple-google-stores/
Sextortion thread:
Cloudflare Falls Victim to Okta Breach, Atlassian Systems Cracked
https://blog.cloudflare.com/thanksgiving-2023-security-incident
The cyberattackers, believed to be state sponsored, didn't get far into Cloudflare's global network, but not for lack of trying
Yet Another Okta Breach Victim
With major elections in the UK, US and India due this year, there are also concerns audio deepfakes - the name for the kind of sophisticated fake voices AI can create - could be used to generate misinformation aimed at manipulating the democratic outcomes
Should we fear an attack of the voice clones?
You may have heard recently that Apple is planning to implement Rich Communication Services (RCS) on iPhones, once again igniting the green versus blue bubble debate.
RCS will thankfully bring a number of long-missing features to those green bubble conversations in Message
But is it a win for security?
Apple's proposed implementation has a murkier future when it comes to security.
https://www.eff.org/deeplinks/2024/01/what-apples-promise-support-rcs-means-text-messaging
Evolution of UNC4990: Uncovering USB Malware's Hidden Depths
The actor has moved from using seemingly benign encoded text files to hosting payloads on popular websites such as Ars Technica, GitHub, GitLab, and Vimeo.
https://www.mandiant.com/resources/blog/unc4990-evolution-usb-malware
more here: posted by @peterquirk
"mother of all breaches"
Every single data breach ever reported or sold was carefully collected by an unknown actor and left in a misconfigured instance. I'd say it is even bigger than troy hunt's HIBP(have-i-been-pwnd)
-- MayhemDayOne
https://counter.social/@ecksmc/111804295103740607
The Data Breach "Personal Stash" Ecosystem
https://www.troyhunt.com/the-data-breach-personal-stash-ecosystem
The FBI has several resources to help caregivers and young people better understand what sextortion is, how to protect against it, and how to talk about this growing and devastating threat.
Sextortion: What Kids and Caregivers Need to Know
How do you deal with sextortion in the UK?
What to do if you, your child or a friend are a victim of sextortion
Midnight Blizzard: Guidance for responders on nation-state attack
New evidence shows that Iran’s intelligence and military services are associated with cyber activities targeting Western countries through their network of contracting companies.
A string of multi-year leaks and doxxing efforts led by anti-Iranian government hacktivists and dissident networks has uncovered an intricate web of entities associated with the Islamic Revolutionary Guard Corps (IRGC) involved in cyber-attacks and information manipulation campaigns.
⇄ Σ = Mᄃ² ⇆
- keybase
- https://ecksmc.keybase.pub
- https://twitter.com/exksmc
- CoSo PLP
- https://counter.social/@ecksmc
- Twitter 2.0
- https://twitter.com/3ck5mc
E = Mc2 - Energy Milk Coffee
Fáilte Abhaile 🏴 “a nod’s as guid as a wink tae a blind horse”
ta be aff yer heid helps
Joined Nov 2017