Catalin Cimpanu

Cybersecurity reporter for Risky Business

#infosec #cybersecurity #security

Public Key

npub1tqfukrqgh928vktkl6vx063ck2c4yn3ek8m44v3txfhztqe65anq63aefw

NIP-05 Address

[email protected]

Profile Code

nprofile1qqs9sy7tpsytj4rkt9m0axr8agut9v2jfcumra66kg4nym39sva2wespz4mhxue69uhhyetvv9ujumt0wd68ytnsw43qsg0c7w

Publishing to

relay.mostr.pub

Author Public Key

npub1tqfukrqgh928vktkl6vx063ck2c4yn3ek8m44v3txfhztqe65anq63aefw

Show more details

Last Notes

2024-09-04 17:34:29

A security researcher going by Mistymntncop has released a PoC exploit for CVE-2024-5274, a Chrome zero-day that Google patched back in May
https://github.com/mistymntncop/CVE-2024-5274

2024-08-19 21:37:20

HP... the dumbass laptop vendor who decided to put Thunderbolt ports on a Windows laptop
jfc... what donkey did they hire as an engineer over there!

2024-08-11 22:19:31

- reply

@npub1zh3…8rtv I'm actually more worried that LinkedIn won't let people back into their accounts if they don't share a government ID. I can deal with the AI spam

2024-08-08 19:17:32

The Turkish government has blocked access to 27 VPN services across the country.
The ban comes a week after the government also blocked access to Instagram.
https://ifade.org.tr/engelliweb/turkiyeden-erisime-engelli-vpn-servisleri/
https://files.mastodon.social/media_attachments/files/112/927/535/953/743/536/original/64fc740223725ceb.png

2024-08-08 18:06:44

Security firm runZero has released SSHamble (GitHub), a tool that can help security teams validate SSH implementations by testing for uncommon but dangerous misconfigurations and software bugs
https://www.runzero.com/newsroom/runzero-research-uncovers-exposures-in-ssh/
https://www.runzero.com/sshamble/
https://github.com/runZeroInc/sshamble

2024-08-08 15:54:53

Calling browsers' support a zero-day is the S tier on the cringe scale. What's next? Localhost relays are Stuxnet? Chill infosec!

2024-08-07 20:36:51

According to two reports, Google has allegedly sent an email to some customers to notify them that the company is legally bound to provide some of their confidential data to the US government in the case of investigations.
I honestly thought everyone already knew this, but nice from Google to notify users of it.
https://targettrend.com/google-says-it-is-obligated-to-disclose-confidential-information-of-users-to-u-s-government/
https://www.thedailystar.net/tech-startup/news/google-legally-obliged-disclose-confidential-user-information-3671161

2024-08-06 20:24:33

That Axios CEO internal memo is something else.
"Other outlets are poaching our reporters... so that's we're firing them first"

2024-08-05 19:38:46

- reply

@npub13vc…a293 Sorry... copy-pasted the wrong link from the newsletter (which had the Xeefcon videos as well)
Here you go: https://www.youtube.com/playlist?list=PLnWGkkkDVeqilYrIUJpQBKbdnW8v_8bId

2024-08-04 23:43:32

- reply

@npub13ds…cug4 I hate this thing. It made me cry

2024-08-04 17:14:44

The Elementor WordPress plugin is now used by a quarter of all WP sites, making it a bigger attack surface than WooCommerce.
It's also a highly-complex plugin, which means there's lots of bugs to be discovered and exploited in it
#threatIntelTips
https://w3techs.com/technologies/history_details/cm-wordpress
https://files.mastodon.social/media_attachments/files/112/904/402/443/254/021/original/86a008831dc8a659.png

2024-08-01 15:26:20

Microsoft has launched the MSRC Researcher Resource Center, a portal hosting educational content for security researchers
https://msrc.microsoft.com/blog/2024/07/introducing-the-msrc-researcher-resource-center/
https://www.microsoft.com/msrc/msrc-researcher-resource-center

2024-07-25 15:56:32

EvolvedAim, a cheat tool for Escape from Tarkov, was caught installing malware on its users' devices.
Final payload was an infostealer. Estimated number of victims is around 1K.
https://www.cyberark.com/resources/threat-research-blog/double-dipping-cheat-developer-gets-caught-red-handed
https://files.mastodon.social/media_attachments/files/112/847/473/273/430/144/original/455925b90ff73930.png

2024-07-23 04:03:45

- reply

@npub136x…mwy4 The Times has been a Trump paper for 1-2 years now. I'm surprised more people haven't noticed. They're the definition of whatabout journalism and opinion pieces disguised as news

2024-07-22 23:47:45

- reply

@npub1zh3…8rtv Google not deprecating third-party cookies after all is their way of saying privacy watchdogs have no teeth or oversight powers after all

2024-07-19 17:43:36

The CrowdStrike outage is also impacting the Mercedes F1 team they're sponsoring... who are in the middle of the Hungarian GP right now :KEKW:
https://www.youtube.com/watch?v=qm735NyExZQ

2024-07-19 01:12:23

Two Foreign Nationals Plead Guilty to Participation in LockBit Ransomware Group
-Ruslan Magomedovich Astamirov (АСТАМИРОВ, Руслан Магомедовичь), 21, a Russian national of Chechen Republic, Russia
-Mikhail Vasiliev, 34, a dual Canadian and Russian national of Bradford, Ontario
https://www.justice.gov/usao-nj/pr/two-foreign-nationals-plead-guilty-participation-lockbit-ransomware-group

2024-07-18 19:06:38

Orange CERT has discovered a previously known traffic-distribution system (TDS) used to redirect traffic from hacked sites to affiliate marketing scams.
Named R0BL0CH0N, Orange says the TDS has impacted more than 110 million Internet users.
https://www.orangecyberdefense.com/global/blog/cert-news/r0bl0ch0n-tds-a-deep-dive-into-the-infrastructure-of-an-affiliate-marketing-scam

2024-07-18 18:14:00

The Ukrainian government says that a threat actor known as UAC-0180 has been targeted local defense enterprises with spear-phishing emails using the topic of UV purchases as lures
https://cip.gov.ua/en/news/kiberzlochinci-vikoristovuyut-tematiku-zakupivel-bpla-dlya-atak-na-oboronni-pidpriyemstva

2024-07-18 18:12:59

Blockchain identity platform Fractal ID suffered a data breach on July 14.
The company says that a threat actor gained access to an employee account and ran an API script that collected personal data from customer accounts.
At least four crypto platforms (Gnosis Pay, Polygon, Ripple, and NEAR) have confirmed that their users were impacted.
PDF: https://app.fractal.id/documents/id/breach-notification.pdf

2024-07-18 17:13:17

Talks from the BlueHat IL 2024 security conference, which took place in May, are now available on YouTube
https://www.youtube.com/watch?v=KhdzIPPW4W0

2024-07-18 16:19:51

- reply

@npub108p…yy4a
"Ukraine's Cyber Police says the duo kidnapped their own accomplice in an attempt to appropriate his share of the earnings."
I presume some beatings or torture was involved

2024-07-18 11:39:46

Despite months-long negotiations, member states have not made any meaningful changes to the upcoming UN Cybercrime Convention, which still grants countries expanded surveillance powers with no human rights and privacy safeguards.
https://www.eff.org/deeplinks/2024/07/un-cybercrime-draft-convention-dangerously-expands-state-surveillance-powers

2024-07-17 18:06:06

TrickBot member detained in Moscow at Interpol's request
https://x.com/shakirov2036/status/1813529247090421903

2024-07-14 14:12:32

The Lazarus North Korean hacking group has stolen $2.2 million worth of assets from cryptocurrency service CoinStats.
The company says the hackers orchestrated a massive operation that breached multiple of its third-party service providers.
Lazarus then gained access to its servers and stole the private keys of 1,590 customer wallets.
The incident took place in mid-June, and CoinStats says it rebuilt its entire IT infrastructure after the attack.
https://coinstats.app/blog/security-incident-report/

2024-07-02 17:39:09

It's a storm outside and Romania is about to play in the Euros.
This is the perfect time to ruin a delivery guy's day! 👺

2024-07-02 17:05:32

Russian security firm CICADA8 has published RemoteKrbRelay, a tool to execute KrbRelay and KrbRelayUp attacks remotely.
https://github.com/CICADA8-Research/RemoteKrbRelay
#infosec #cybersecurity #security

2024-06-29 21:51:40

Australian man charged for setting fake WiFi access points to steal data from Australian airport users
https://www.afp.gov.au/news-centre/media-release/man-charged-over-creation-evil-twin-free-wifi-networks-access-personal #infosec #cybersecurity #security

2024-06-27 14:17:20

The company behind the Polyfill supply chain attack claims it was defamed.
They're pretending like thousands of infosec researchers and web devs don't know what they're talking about and it was all a big misunderstanding.
This is not going to end well for them. Good luck with that strategy, boyz!
https://x.com/Polyfill_Global/status/1805923380857897277
https://files.mastodon.social/media_attachments/files/112/688/524/681/257/866/original/f0f0d52743b7cbd2.png

2024-06-23 07:46:17

https://files.mastodon.social/media_attachments/files/112/664/344/345/644/577/original/65caa3139f8437fd.jpeg

2024-06-20 12:00:37

CertiK whitehat-bountying funds from Kraken and then laundering the assets through a sanctioned mixing service is the perfect definition of the s##t show that the crypto-scene has been for the past decade.
https://x.com/jconorgrogan/status/1803486112608034854

2024-06-13 22:37:55

The French government has published a report on Matriochka, a pro-Russian social media influence campaign that tried to discredit Western news media, public figures, and fact-checking organizations.
https://www.sgdsn.gouv.fr/publications/matriochka-une-campagne-prorusse-ciblant-les-medias-et-la-communaute-des-fact-checkers
#infosec #cybersecurity #security

2024-06-13 20:19:52

Cloud security firm Permiso has open-sourced a tool named YetiHunter that can search for signs of compromise in a company's Snowflake accounts.
https://permiso.io/blog/introducing-yetihunter-an-open-source-tool-to-detect-and-hunt-for-suspicious-activity-in-snowflake
https://github.com/Permiso-io-tools/YetiHunter
#infosec #cybersecurity #security

2024-06-13 19:49:02

German security firm G Data has discovered that Fortinet firewalls use weak password hashes to secure backup files.
https://www.gdatasoftware.com/blog/2024/01/37834-passwords-on-a-silver-platter
Tracked as CVE-2024-21754, the vulnerability can be exploited to decrypt backup files and read a device's login credentials.
https://www.fortiguard.com/psirt/FG-IR-23-423
"Those backup files are commonly sent back and forth via email, for review and control purposes."
#infosec #cybersecurity #security

2024-06-13 19:34:26

POC published for a Unauthenticated Path Traversal in the Sonatype Nexus Repository (CVE-2024-4956)
https://medium.com/@verylazytech/poc-cve-2024-4956-unauthenticated-path-traversal-f24b1a595e0e
#infosec #cybersecurity #security

2024-06-13 19:15:58

The CyberVandals research group says it did not see widespread coordinated DDoS attacks from pro-Kremlin groups during the recent EU elections.
https://blog.kybervandals.com/attacks-on-eu-by-russian-activist-summarized/
#infosec #cybersecurity #security

2024-06-13 16:19:57

South Korean firm AhnLab says the Bondnet crypto-mining botnet is still alive seven years later after being first spotted in 2017 by GuardiCore
https://asec.ahnlab.com/en/66662/

2024-06-13 13:05:57

The NCC Group has open-sourced a tool named Stepping Stones that can help red teams with record keeping, situational awareness, and reports.
https://research.nccgroup.com/2024/06/12/stepping-stones-a-red-team-activity-hub/
https://files.mastodon.social/media_attachments/files/112/608/985/505/801/538/original/3cb7eec50655125e.webp

2024-06-12 05:03:10

What the actual f...
https://www.nordbayern.de/panorama/nach-burgerentscheid-hunderte-tauben-sollen-mit-genickbruch-getotet-werden-1.14296366

2024-06-11 18:44:17

US federal agencies have suffered more than 32,000 security incidents over fiscal year 2023, according to a new White House report
PDF: https://www.whitehouse.gov/wp-content/uploads/2024/06/FY23-FISMA-Report.pdf
https://files.mastodon.social/media_attachments/files/112/598/990/063/693/319/original/f35e6d2bfe447e68.png

2024-06-11 17:30:32

More than 458,000 PHP Windows servers are currently exposed on the internet and potentially vulnerable to that nasty PHP-CGI/Windows bug
#infosec #cybersecurity #security
https://censys.com/cve-2024-4577/

2024-06-11 17:30:14

More than 458,000 PHP Windows servers are currently exposed on the internet and potentially vulnerable to that nasty PHP-CGI/Windows bug

2024-06-11 14:13:04

- reply

"Amplified narratives focus on undermining UN missions by portraying them as ineffective, corrupt, and complicit in crimes. They position Russian military involvement as a more effective and transparent alternative."
you know... the recommendation is the troops accused of genocide in many of these countries... used to clear communities from desired mining lands

2024-06-11 14:03:09

Pro-Russian operatives wage relentless disinformation campaigns on Telegram against UN peacekeepers in Mali, DRC, and CAR
https://blog.openmeasures.io/p/pro-russian-telegram-channels-amplify

2024-06-11 01:53:53

Unredacted has open-sourced FreeSocks, a Shadowsocks proxy-based system for bypassing internet censorship
https://unredacted.org/blog/2024/06/freesocks-is-now-open-source/
https://github.com/unredacted/freesocks-control-plane

2024-06-11 01:53:21

After European law enforcement agencies have argued for lawful access to encrypted instant messaging clients for a few years now, their demands have recently expanded. In a new report published this week, Europol has asked that lawful access should be considered for other technologies that use encryption, such as 6G, biometrics, DNS, the blockchain, and quantum computing.
https://www.europol.europa.eu/media-press/newsroom/news/equilibrium-between-security-and-privacy-new-report-encryption

2024-06-09 21:06:56

David Ross, one of the early pioneers of browser security research, has passed away, his family announced on Twitter.
In 1999, together with Georgi Guninski, he authored the first paper on XSS attacks named "Script Injection".
He also worked on implementing X-Frame-Options in Internet Explorer.
https://x.com/randomdross/status/1799284146231185584
#infosec #cybersecurity #security

2024-06-09 20:53:35

- reply

@npub12lx…jvjy It's ok.. I saw this two days later... all is forgiven

2024-06-09 17:30:12

The Cyber Partisans say they hacked the Belarusian State University.
The group claims it obtained documents and audio records from the university's internal network showing how its leadership dismissed staff and students who participated in anti-government protests.
The files show that the university declined to admit new students who participated in protests and left comments online against the dictatorship.
https://www.by.cpartisans.org/en/post/bsu-uncut-2020-2024-part-1 #infosec #cybersecurity #security

2024-06-09 15:40:44

The threat actor behind the Kuiper ransomware tried to sell its source code on the XSS hacking forums only to get immediately banned back in April
https://x.com/Libranalysis/status/1778036668236222483
#infosec #cybersecurity #security

2024-06-09 15:39:32

The EU Agency for Law Enforcement Training (CEPOL) says it was the victim of a cyberattack:
https://www.cepol.europa.eu/newsroom/news/cyber-incident-eu-agency-law-enforcement-training-cepol

2024-06-09 14:59:24

I'm gonna take a wild guess and say probably because the US is one giant country and there's 102,194 different languages in Europe... also previously divided by an "Iron Curtain"
Might be wrong :tinking: :SMOrc:
https://files.mastodon.social/media_attachments/files/112/586/772/669/743/566/original/1e5122f5cda391b7.png

2024-06-09 14:42:07

Security firm watchTowr has published its own analysis of CVE-2024-4577, a PHP-CGI vulnerability impacting Windows systems: https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/
The bug was initially discovered by DEVCORE: https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/
watchTowr has also released proof-of-concept code: https://github.com/watchtowrlabs/CVE-2024-4577

2024-06-09 14:14:05

Morphisec has published a report on a campaign targeting Russia's aviation sector.
The company linked the attacks to a group tracked as Sticky Werewolf, an APT known to target Russia and Belarus exclusively.
This is the first report on the group from a non-Russian security firm.
https://blog.morphisec.com/sticky-werewolfs-aviation-attacks

2024-06-09 13:50:34

Mozilla has launched a new bug bounty program focused on large language models (LLMs) and other deep learning technologies.
The new platform is named 0-Day Investigative Network (0Din) and works as an intermediary between researchers and LLM vendors—similar to the likes of ZDI.
Mozilla says 0Din will accept bug reports for common LLM vulnerabilities and attacks such as Prompt Injection, Training Data Poisoning, Denial-of-Service, and more.
https://blog.mozilla.org/en/mozilla/keeping-genai-technologies-secure-is-a-shared-responsibility/
https://0din.ai/

2024-06-09 13:40:43

- reply

@npub1qa5…gqz7 https://csrc.nist.gov/glossary/term/end_cryptographic_unit

2024-06-09 13:39:36

South Korean security firm S2W has published a comprehensive look at the DDoS-as-a-Service operations that are promoting themselves via Telegram these days. Researchers look at the likes of Project DDoSia, SERVER KILLERS, CYBERBOOTER, DDOS-V4, and more. The research is in Korean.
https://medium.com/s2wblog/trends-of-telegram-daas-ddos-as-a-service-groups-their-hacktivist-motivations-attack-techniques-b222e5bfe0ef

2024-06-09 13:07:50

WolfSSL has open-sourced WolfHSM, a quantum-resistant cryptography framework for Automotive HSMs (Hardware Security Modules)
https://www.prweb.com/releases/wolfssl-inc-announces-wolfhsm-for-automotive-hsms-hardware-security-modules-302163846.html

2024-06-09 13:07:31

Talks from the Privacy Camp 2024 security conference, which took place this January, are available on YouTube
https://www.youtube.com/playlist?list=PLGeR6jS_7N7d0O9TKMDQwta-fZ_mN4ors

2024-06-08 01:24:54

CoinGecko data breach
https://www.coingecko.com/learn/getresponse-data-breach-june-2024

2024-06-06 20:56:19

For infosec practitioners who follow or run Twitch cybersecurity channels, Twitch is changing Tier 1 monthly subscription prices from $4.99 to $5.99 per month on July 11.
https://help.twitch.tv/s/article/local-sub-price-countries?language=en_US

2024-06-06 20:07:15

The FCC has allocated $200 million to fund the acquisition of cybersecurity services and products at K-12 schools and libraries.
The funds will be made available in the next three years through the FCC E-Rate program. Prior to this year, E-Rate funds could previously only be used to purchase internet subscriptions and networking devices.
https://www.fcc.gov/document/fcc-adopts-200m-cybersecurity-pilot-program-schools-libraries

2024-06-06 19:49:55

French authorities have detained a 16-year-old teen for running a malware rental business.
The teen used nicknames such as ChatNoir and Cap and was part of the Epsilon hacker group that breached the Altice French multinational earlier this year.
According to posts on the group's Telegram channel, the teenager appears to be behind the WaveStealer malware.
https://www.lemonde.fr/pixels/article/2024/06/05/cybercriminalite-un-adolescent-interpelle-dans-l-enquete-sur-le-groupe-de-pirates-epsilon_6237496_4408996.html

2024-06-06 19:27:45

Ukraine's GUR military agency took credit for a series of DDoS attacks that targeted the websites and systems of multiple Russian government agencies
https://www.pravda.com.ua/news/2024/06/5/7459288/

2024-06-06 19:25:27

Russian independent news outlet Meduza is warning that Russian propagandists are pushing disinformation using misleading cutouts of its content.
https://meduza.io/en/feature/2024/06/05/we-thought-we-d-return-the-favor

2024-06-06 18:40:38

Ukraine's CERT team says a threat actor it tracks as UAC-0020 (Vermin) is targeting its military with spear-phishing attacks designed to deliver the SPECTR infostealer.
The group has returned with new attacks after first being spotted in March 2022, shortly after Russia's invasion of Ukraine.
Officials claim the Vermin group receives orders from law enforcement agencies in the Luhansk occupied territory.
https://cert.gov.ua/article/6279600

2024-06-06 18:14:12

Security firm Ambionics open-sourced Scalpel, a Burp extension for intercepting and rewriting HTTP traffic
https://www.ambionics.io/blog/scalpel
https://github.com/ambionics/scalpel/

2024-06-06 18:10:04

NIST's CyberSeek project says the US still needs over 225,000 professionals to close its cybersecurity workforce shortage.
The agency says that only 85% of the the 1.2 million cybersecurity jobs in the US are occupied.
https://www.securityweek.com/225000-more-cybersecurity-workers-needed-in-us-cyberseek/
Interactive map: https://www.cyberseek.org/heatmap.html
https://files.mastodon.social/media_attachments/files/112/570/543/844/591/612/original/09be1ad02f125923.png

2024-06-06 17:03:42

A team of Chinese academics has discovered a security flaw in the design of RISC-V SonicBOOM processors: https://www.nwpu.edu.cn/info/1198/86148.htm
Technical details are available here:
https://mp.weixin.qq.com/s/ke8tBpJ7NpvUEAecov--UQ

2024-06-06 16:53:51

Positive Technologies has published a report on ExCobalt, a former cybercrime group that is now conducting cyber-espionage operations against Russian targets. The group's latest attacks involved the use of a Go-based backdoor named GoRed.
https://www.ptsecurity.com/ru-ru/research/pt-esc-threat-intelligence/preview/ex-cobalt-go-red-tehnika-skrytogo-tunnelya/
ExCobalt appears to be related to an APT that Rostelecom tracks as Shedding Zmiy.
https://rt-solar.ru/solar-4rays/blog/4333/

2024-06-06 16:16:51

According to reports from the New York Times and Haaretz, the Israel Ministry of Diaspora Affairs paid a private company named STOIC $2 million for a social media influence campaign that targeted US politicians. (1/2)
https://www.nytimes.com/2024/06/05/technology/israel-campaign-gaza-social-media.html
https://www.nytimes.com/2024/06/05/technology/israel-campaign-gaza-social-media.html

2024-06-06 15:33:59

Privacy organization noyb has asked data protection agencies in 11 EU countries to investigate Meta for its plan to use Facebook user data to train its AI
https://noyb.eu/en/noyb-urges-11-dpas-immediately-stop-metas-abuse-personal-data-ai

2024-06-06 13:28:23

South Korean security firm AhnLab has spotted a spear-phishing campaign that tries to bypass security defenses by asking users to copy-paste malicious PowerShell commands in their Windows Run prompt.
https://asec.ahnlab.com/en/66300/
https://files.mastodon.social/media_attachments/files/112/569/437/443/621/557/original/41c39cc4c7e5f556.png

2024-06-06 13:01:47

A Chinese cybercrime group is targeting websites built using the ThinkPHP framework in attacks designed to install a new web shell named Dama.
The attacks exploit two old 2018 and 2019 vulnerabilities in the framework, mostly used by Chinese-speaking developers.
Akamai says the attacks started last October and are ongoing.
The company couldn't say what the final payload was (i.e., cryptomining, proxy bot, DDoS, etc.).
https://www.akamai.com/blog/security-research/2024/jun/2024-thinkphp-applications-exploit-1-days-dama-webshell

2024-06-06 12:49:36

Cisco under investigation in Romania for allegedly rigging some public IT tenders
RO: https://economie.hotnews.ro/stiri-telecom-27191430-reactia-cisco-dupa-hotnews-scris-vizata-investigatia-privind-posibila-trucare-unor-licitatii-romania.htm
GT: https://economie-hotnews-ro.translate.goog/stiri-telecom-27191430-reactia-cisco-dupa-hotnews-scris-vizata-investigatia-privind-posibila-trucare-unor-licitatii-romania.htm?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp

2024-06-06 12:19:39

Attacks using CVE-2024-4358 have been observed against Progress Telerik Report Servers
https://mastodon.social/@[email protected]/112568641147622840
Attacks began after PoC was published online earlier this week: https://summoning.team/blog/progress-report-server-rce-cve-2024-4358-cve-2024-1800/

2024-06-06 12:04:33

Cisco has rolled out patches for the Webex application to fix a bug that allowed unauthorized access to Webex meetings and metadata information.
The company says the bugs were exploited by security researchers at the end of May.
Cisco is notifying customers who had their data collected during the research.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-june-2024

2024-06-06 12:04:12

Eugenio Benincasa, a Cyber Defense Researcher at the Technical University of Zurich (ETH Zurich), has published a 74-page paper on the connections between China's hacking contests and bug bounty platforms and the country's offensive cyber capabilities.
PDF: https://css.ethz.ch/content/dam/ethz/special-interest/gess/cis/center-for-securities-studies/pdfs/CyberDefenseReport_%20From%20Vegas%20to%20Chengdu.pdf
https://files.mastodon.social/media_attachments/files/112/569/106/514/435/189/original/0a3a7d452ecf83f6.png

2024-06-04 22:48:42

A Zero Day TikTok Hack Is Taking Over Celebrity And Brand Accounts
https://www.forbes.com/sites/emilybaker-white/2024/06/04/a-zero-day-tiktok-hack-is-taking-over-celebrity-and-brand-accounts/?sh=334144b6060a

2024-06-04 20:22:00

Talks from the OffensiveCon24 security conference, which took place at the start of May in Berlin, are available on YouTube:
https://www.youtube.com/playlist?list=PLYvhPWR_XYJlg1SfcKdZY6eXUTPPqnh_G

2024-06-04 19:15:51

Security researcher Alexander Hagenah has released TotalRecall, a tool that extracts and displays data from the Recall feature in Windows 11.
https://github.com/xaitax/TotalRecall
https://files.mastodon.social/media_attachments/files/112/559/479/057/254/936/original/e05fb804e08cd64c.png

2024-06-04 18:58:31

- reply

@npub1d5q…xvy7 glad to hear it! Wishing her a speedy recovery!

2024-06-04 18:54:30

The Bian Lian ransomware gang has taken credit for a ransomware attack on Northern Minerals, one of Australia's largest rare-earth mining companies.
Northern Minerals has confirmed the incident in a filing with the Australian Securities Exchange.
PDF: https://cdn-api.markitdigital.com/apiman-gateway/ASX/asx-research/1.0/file/2924-02814126-6A1210386
Coverage: https://www.cyberdaily.au/security/10662-exclusive-aussie-rare-earth-metals-producer-northern-minerals-confirms-ransomware-attack

2024-06-04 18:45:32

- reply

Just look at this chart!
What are we doing JS developers?
Do we actually code anymore or we just playing with legos at this point?
https://files.mastodon.social/media_attachments/files/112/559/357/803/289/939/original/441d9d8ce1252160.png

2024-06-04 18:44:09

From this report: https://mastodon.social/@[email protected]/112555805013166419
"Including any given PHP library has a greater than 50% chance of bringing a security flaw along with it."
kek 😆

2024-06-04 18:31:40

- reply

Apparently related to this: https://www.england.nhs.uk/london/2024/06/04/nhs-london-statement-on-synnovis-ransomware-cyber-attack/

2024-06-04 18:29:57

- reply

@npub17gf…20ur fixed

2024-06-04 18:25:46

A cyber attack has forced three major UK hospitals to cancel operations and redirect emergency patients to other nearby care facilities.
According to Metro, the incident has impacted transplant surgeries and blood transfusion centers.
https://metro.co.uk/2024/06/04/cyber-attack-forces-three-major-hospitals-cancel-operations-20968948/

2024-06-04 17:40:04

CISA has updated its KEV database with a new vulnerability currently actively exploited in the wild, a 2017 Oracle WebLogic command injection tracked as CVE-2017-3506.
https://www.cisa.gov/news-events/alerts/2024/06/03/cisa-adds-one-known-exploited-vulnerability-catalog

2024-06-04 17:39:33

PQShield cryptography security analyst Antoon Purnal has published a proof-of-concept named ClangOver that exploits a timing leak in the reference implementation of Kyber (ML-KEM), the soon-to-be NIST standard for post-quantum key encapsulation.
https://github.com/antoonpurnal/clangover

2024-06-04 16:23:47

The government of Canada's British Columbia region says a recent state-sponsored hack of its IT systems "hit 22 email boxes containing sensitive information about 19 people."
https://www.cbc.ca/news/canada/british-columbia/farnworth-cybersecurity-attack-security-1.7223125

2024-06-04 11:10:39

Sekoia has published a report on the now-seized PikaBot malware loader botnet.
Sekoia was one of the companies that participated in Europol's Operation Endgame, which took down the botnet last week.
The report looks at PikaBot's history since it launched in February 2023.
https://blog.sekoia.io/pikabot-a-guide-to-its-deep-secrets-and-operations/
https://files.mastodon.social/media_attachments/files/112/557/571/315/849/297/original/5d4bb28c03a61f99.png

2024-06-04 10:45:24

QNAP says it will stop using a device's MAC address as its default password.
Going forward, the company will use a cloud app named Cloud Key and data from the device's label to provide new users access to their devices.
https://www.qnap.com/en/news/2024/qnap-enhances-nas-initialization-process-switches-to-cloud-key-as-default-password-for-improved-security

2024-06-04 10:44:47

HIBP has recently indexed more than 361 million email addresses that a security researcher scrapped from Telegram channels.
There's no Telegram leak. These are emails shared inside Telegram groups and channels—typically in ones advertising hacked data. That's quite a lot if I'm being honest!
https://www.troyhunt.com/telegram-combolists-and-361m-email-addresses/

2024-06-04 03:34:41

Mobile operating system GrapheneOS is adding support for a duress password.
The feature will allow users to set a special password that deletes all their data when entered.
GrapheneOS says the duress-initiated wipe does not require a reboot and cannot be interrupted.
https://grapheneos.org/features#duress

2024-06-03 00:41:56

The German government is investigating a cyber attack on the country's leading party, the German Christian Democrats (CDU).
The country's Interior Ministry described the incident as "serious" and said teams have taken down affected systems.
https://www.dw.com/en/germany-major-hack-targets-center-right-cdu-party/a-69242147

2024-06-03 00:41:29

Oil and gas giant Shell is investigating a security breach after a threat actor began advertising the company's data on a hacking forum
https://www.ctvnews.ca/business/shell-investigating-a-potential-cybersecurity-incident-1.6907509
https://mastodon.social/@[email protected]/112524701891915782

2024-06-02 16:48:27

We now have a Crypto ISAC, and with some respectable founding members too
https://www.cryptoisac.org/news-member-content/crypto-isac-launches-to-spearhead-ecosystem-wide-security-initiatives

2024-06-02 00:35:06

Talks from the Disobey 2024 security conference, which took place in February in Helsinki, are available on YouTube
https://www.youtube.com/playlist?list=PLLvAhAn5sGfiB9AlEt2KD7H9Dnr6kbd64

2024-06-02 00:30:47

IoT search engine Censys is seeing almost 14,000 Check Point security gateways connected to the internet: https://censys.com/cve-2024-24919/
The devices may be vulnerable to CVE-2024-24919, a zero-day in the company's devices that was patched last week: https://support.checkpoint.com/results/sk/sk182336