|
I listen out of curiosity rather than any relevance to anything I do, but I've take to listening to the weekly Risky Business podcast on my way to work and find most of it pretty interesting. https://risky.biz/
|
#
¿
Sep 1, 2017 19:54
|
|
|
|
| # ¿ May 14, 2024 10:13 |
|
|
An article about Google's AMP. http://www.salon.com/2017/09/24/russian-hackers-exploited-a-google-flaw-and-google-wont-fix-it/
|
|
#
¿
Sep 25, 2017 08:30
|
|
|
It seems to me the security of mailing stuff also depends on the the of type of letterbox prevalent in your country. Nearly all mail in the UK is delivered through slots in front doors, making it harder to intercept mail compared to the roadside boxes that television and movies tell me dominate rural and suburban america. Fraudsters have been experimenting with sticking fake letterboxes to the outside of houses. http://www.manchestereveningnews.co.uk/news/greater-manchester-news/fraudsters-glueing-fake-letter-boxes-11435864
|
|
#
¿
Sep 30, 2017 15:58
|
|
|
So rogue SMB servers can bypass Windows Defender by feeding a different clean file to Defender before delivering the real payload for running, and MS consider fixing this a "feature request". I can't claim to be an expert in the field, but making sure sure you're scanning a copy of what's actually going to be run/opened seems like a key step. edit: forgot the link https://www.bleepingcomputer.com/news/security/new-illusion-gap-attack-bypasses-windows-defender-scans/ Pablo Bluth fucked around with this message at 21:48 on Oct 1, 2017 |
|
#
¿
Oct 1, 2017 21:18
|
|
|
The Hollywood Move would be to turn up to the meeting with the personal details of everyone else in the room and point out that under their proposal you'd now have a loan out in their name.
|
|
#
¿
Oct 25, 2017 07:47
|
|
|
GnuPG who weren't contacted by the original team but have seen the paper hath spoken... https://lists.gnupg.org/pipermail/gnupg-users/2018-May/060315.html The EmbargoFAIL website is now up.... http://email.de Pablo Bluth fucked around with this message at 11:14 on May 14, 2018 |
|
#
¿
May 14, 2018 09:55
|
|
|
Got an email a short while ago to say I'd been 'pwd. https://www.troyhunt.com/the-773-million-record-collection-1-data-reach/ However as he can't/won't provide any information about the password, it's a frustrating bit of knowledge. I think blissful ignorance was more pleasant! Fortunately I don't have that many accounts using that email so I'm just updating them all and making sure they're long lones. Hoping it's just an old password from simpler times that is floating around and has been repacked in to a new collection.
|
|
#
¿
Jan 17, 2019 12:00
|
|
|
There's been another dozy... In an alert from haveibeenpwned: Breach: Verifications.io Date of breach: 25 Feb 2019 Number of accounts: 763,117,241 Compromised data: Dates of birth, Email addresses, Employers, Genders, Geographic locations, IP addresses, Job titles, Names, Phone numbers, Physical addresses Description: In February 2019, the email address validation service verifications.io suffered a data breach. Discovered by Bob Diachenko and Vinny Troia, the breach was due to the data being stored in a MongoDB instance left publicly facing without a password and resulted in 763 million unique email addresses being exposed. Many records within the data also included additional personal attributes such as names, phone numbers, IP addresses, dates of birth and genders. No passwords were included in the data. The Verifications.io website went offline during the disclosure process, although an archived copy remains viewable.
|
|
#
¿
Mar 11, 2019 10:02
|
|
|
I got a haveibeenpwned email, as the dump from the previously announced 500px hack has now turned up.
|
|
#
¿
Mar 25, 2019 20:26
|
|
|
Marcus Hutchins aka @MalwareTech has been released on time-served with a years probation that can be served in the UK. https://techcrunch.com/2019/07/26/m...iaC26ItolTaYuMQ
|
|
#
¿
Jul 26, 2019 21:29
|
|
|
Combat Pretzel posted:What I want is PiHole on my VPN polling stuff via DoH from a trustworthy provider? https://docs.pi-hole.net/guides/dns-over-https/
|
|
#
¿
Nov 10, 2019 19:54
|
|
|
And most smaller sites are on shared hosting with lots of sites behind the same IP address. Was the person visit the site of a local restaurant or the local furry community?
|
|
#
¿
Nov 12, 2019 17:43
|
|
|
Yet another huge data breach... https://www.wired.com/story/billion-records-exposed-online/
|
|
#
¿
Nov 23, 2019 13:29
|
|
|
Unpatched Samba flaw now public... https://arstechnica.com/information-technology/2020/03/windows-has-a-new-wormable-vulnerability-and-theres-no-patch-in-sight/
|
|
#
¿
Mar 12, 2020 11:16
|
|
|
I always forget that SMB isn't pronounced Samba...
|
|
#
¿
Mar 12, 2020 11:42
|
|
|
I don't think I'll be installing Tiktok (not that I had any desire to) https://www.boredpanda.com/tik-tok-reverse-engineered-data-information-collecting/ https://arstechnica.com/gadgets/2020/06/tiktok-and-53-other-ios-apps-still-snoop-your-sensitive-clipboard-data/
|
|
#
¿
Jun 28, 2020 19:01
|
|
|
There's been a take down of a criminal-exclusive encrypted communication network. https://www.theguardian.com/uk-news/2020/jul/02/blow-for-uk-organised-as-command-and-control-network-is-hit I think this falls in the 'Don't put all your eggs in the same basket' clause of DON'T ROLL YOUR OWN CRYPTO. Edit: https://www.vice.com/en_uk/article/3aza95/how-police-secretly-took-over-a-global-phone-network-for-organised-crime Pablo Bluth fucked around with this message at 13:02 on Jul 2, 2020 |
|
#
¿
Jul 2, 2020 12:58
|
|
|
CyberPingu posted:Well it's owned by China's own brand of white supremacists I guess.
|
|
#
¿
Jul 10, 2020 20:11
|
|
|
My last year of school had a PC in the student common room running what must have been Win95 plus some third party security program that was meant to lock it down to a few approved programs. I think it took me a few days to figure out a way of using a Word macro to launch a command prompt that eventually let me re-enable safe boot and ultimately disable the lockdown program. Reboot and PC and use it to play games instead. I don't think they ever figured out who was doing it or how...
|
|
#
¿
Sep 1, 2020 17:57
|
|
|
Internet Explorer posted:I know this has been done before, but I feel like it's been a while. What 3 resources would you all recommend for IT generalists who want to stay up to speed on InfoSec stuff? I feel like I get enough through osmosis these days, but I want something that I can recommend to colleagues who aren't as plugged in. https://risky.biz/
|
|
#
¿
Sep 10, 2020 00:16
|
|
|
I used to use X-Forwarded-For to get around the geoblocking on Comedy Central videos and was sad when they finally fixed it.
|
|
#
¿
Oct 1, 2020 06:55
|
|
|
I have a .co domain so every exchange if my email address has to include the discussion 'not dot UK?'
|
|
#
¿
Oct 7, 2020 19:27
|
|
|
What are the odds that this wasn't known as a zero day by at least one of the major state-backed hacking groups?BlankSystemDaemon posted:Nah, there's going to be a new fun bug in Windows any day now. I do wonder what a modern from-the-ground-up OS where security was the over-riding factor, would look like. Where every design decision is about treating all code as untrustworthy, limiting everything only to the designed behaviour and having multiple independent checking mechanisms.
|
|
#
¿
Jan 27, 2021 16:07
|
|
|
The Fool posted:Seems like a lot of work when you could just turn your computer off.
|
|
#
¿
Jan 27, 2021 16:15
|
|
|
I've just started playing around with HackTheBox. It's a terrible time-sink...
|
|
#
¿
Mar 14, 2021 11:08
|
|
|
CyberPingu posted:It's very fun though. Try hack me is also another great similar platform
|
|
#
¿
Mar 14, 2021 15:37
|
|
|
One upside: it just made me mindlessly do an nmap on my pi-hole, only to discover that when I was getting apticron configured to email me upgrade notifications, I'd accidentally installed a running postfix server.... Postfix gone and the firewall enabled & configured to catch any future mistakes... Pablo Bluth fucked around with this message at 22:41 on Mar 15, 2021 |
|
#
¿
Mar 15, 2021 22:38
|
|
|
Just use exploit-db .com to search for all the exploits that have in-the-wild exploitation code.
|
|
#
¿
Mar 23, 2021 16:16
|
|
|
EVIL Gibson posted:
|
|
#
¿
Mar 23, 2021 21:30
|
|
|
CommieGIR posted:You mean broken Linux.
|
|
#
¿
Mar 24, 2021 01:48
|
|
|
Having got in to HackTheBox, it's amazing how much of the request for help in the official forum is "I want to do X and it's not working. WHY?" pleas. The sort of zero-detail help-ticket I'd expect my Mum to write. So I can believe that 75% of the Kali userbase is 14 year-olds who have mistaken themselves for Elliot Alderson.
Pablo Bluth fucked around with this message at 01:21 on Mar 25, 2021 |
|
#
¿
Mar 25, 2021 01:12
|
|
|
Kali should be run as a VM on top of Hannah Montana Linux.
|
|
#
¿
Mar 25, 2021 13:22
|
|
|
Isn't AWS a dumpster fire of badly configured permission due to the spiderweb of services and configurations?
Pablo Bluth fucked around with this message at 02:06 on Mar 31, 2021 |
|
#
¿
Mar 31, 2021 02:04
|
|
|
Dumpster fire was perhaps too strong. I'm not a AWS user (other than one time playing with the free tier) but when I listen to the Risky.Biz infosec podcast, misconfigured AWS seems to be a perennial problem. Perhaps I'm just remembering the early years too much and it's better it's now more mature?
|
|
#
¿
Mar 31, 2021 08:24
|
|
|
If you can compromise their pc, just replace the exe with a version that uploads everything the first time you unlock it.
|
|
#
¿
Mar 31, 2021 18:00
|
|
|
Isn't GPG a dumpster fire of overcomplexity and outdated design that people want to go away but won't? Is there a decent file encryption tool based on libsodium?
|
|
#
¿
Jun 17, 2021 07:53
|
|
|
The Guardian are doing a big thing on spyware https://www.theguardian.com/news/2021/jul/18/huge-data-leak-shatters-lie-innocent-need-not-fear-surveillance
|
|
#
¿
Jul 18, 2021 22:12
|
|
|
I assume that despite it's privileged execution status, the windows print spooler is a horrendous wobbly tower of legacy code with a core design that dates back to 3.11, and if Microsoft tries to do a ground-up replacement, it'd break every printer out there because trying to get the printer manufacturers new, high quality drivers would be like herding cats?
|
|
#
¿
Jul 20, 2021 18:07
|
|
|
I often listen to the Risky Business podcast, and every so often the guy behind thinkst canary is on the show. How well do canaries work in the real world? Perhaps not surprisingly, there's not too many people shouting about finding out their network is being owned...
|
|
#
¿
Aug 1, 2021 22:44
|
|
|
|
| # ¿ May 14, 2024 10:13 |
|
|
BaseballPCHiker posted:I've actually used them before and had a whole project getting it spun up. I can see the samba server and AWS tokens being hard to tell without having the bit the bullet and try them. On the other hand, stuff like the Excel canary tokens seem like they risk showing your hand, allowing a smart actor to notice the token without triggering it.
|
|
#
¿
Aug 2, 2021 21:22
|
|