Catalin Cimpanu

Public Key

npub1tqfukrqgh928vktkl6vx063ck2c4yn3ek8m44v3txfhztqe65anq63aefw

NIP-05 Address

[email protected]

Profile Code

nprofile1qqs9sy7tpsytj4rkt9m0axr8agut9v2jfcumra66kg4nym39sva2wes53lt44

Publishing to

nostr.coinfundit.com

relay.mostr.pub

relay.shitforce.one

Author Public Key

npub1tqfukrqgh928vktkl6vx063ck2c4yn3ek8m44v3txfhztqe65anq63aefw

Show more details

Last Notes

2024-06-11 01:53:53

Unredacted has open-sourced FreeSocks, a Shadowsocks proxy-based system for bypassing internet censorship
https://unredacted.org/blog/2024/06/freesocks-is-now-open-source/
https://github.com/unredacted/freesocks-control-plane

2024-06-09 17:30:12

The Cyber Partisans say they hacked the Belarusian State University.
The group claims it obtained documents and audio records from the university's internal network showing how its leadership dismissed staff and students who participated in anti-government protests.
The files show that the university declined to admit new students who participated in protests and left comments online against the dictatorship.
https://www.by.cpartisans.org/en/post/bsu-uncut-2020-2024-part-1 #infosec #cybersecurity #security

2024-06-06 19:49:55

French authorities have detained a 16-year-old teen for running a malware rental business.
The teen used nicknames such as ChatNoir and Cap and was part of the Epsilon hacker group that breached the Altice French multinational earlier this year.
According to posts on the group's Telegram channel, the teenager appears to be behind the WaveStealer malware.
https://www.lemonde.fr/pixels/article/2024/06/05/cybercriminalite-un-adolescent-interpelle-dans-l-enquete-sur-le-groupe-de-pirates-epsilon_6237496_4408996.html

2024-06-04 19:15:51

Security researcher Alexander Hagenah has released TotalRecall, a tool that extracts and displays data from the Recall feature in Windows 11.
https://github.com/xaitax/TotalRecall
https://files.mastodon.social/media_attachments/files/112/559/479/057/254/936/original/e05fb804e08cd64c.png

2024-06-04 18:45:32

- reply

Just look at this chart!
What are we doing JS developers?
Do we actually code anymore or we just playing with legos at this point?
https://files.mastodon.social/media_attachments/files/112/559/357/803/289/939/original/441d9d8ce1252160.png

2024-06-04 10:44:47

HIBP has recently indexed more than 361 million email addresses that a security researcher scrapped from Telegram channels.
There's no Telegram leak. These are emails shared inside Telegram groups and channels—typically in ones advertising hacked data. That's quite a lot if I'm being honest!
https://www.troyhunt.com/telegram-combolists-and-361m-email-addresses/

2024-05-30 21:38:21

Recorded Future has published a report on a cyber-espionage campaign carried out by Russian APT group BlueDelta that primarily targeted Ukrainian and European organizations with a tangent to Russia's war in Ukraine.
The final payload in this campaign was the Headlace infostealer.
The campaign started in late 2023 and is ongoing.
https://www.recordedfuture.com/grus-bluedelta-targets-key-networks-in-europe-with-multi-phase-espionage-camp
https://files.mastodon.social/media_attachments/files/112/531/727/734/825/834/original/70effbee60cd9d02.png

2024-05-30 15:57:32

The US National Institute of Standards and Technology says it hired a new contractor to help the agency deal with the backlog of unprocessed entries in the National Vulnerability Database.
NIST staff slowed down the pace of new NVD entries in mid-February, citing a need to re-organize and the increasing volume of vulnerabilities.
The agency now says it expects the backlog to be cleared by the end of the fiscal year.
https://www.nist.gov/itl/nvd

2024-05-22 19:21:32

Just think about it!
In just 14 days, Microsoft pivoted from "do security" in an internal memo on May 5 to "let's install an infostealer on everyone's PC" on May 21.
That's must be a world record in bad corporate management

2024-05-17 16:35:03

- reply

@npub136x…mwy4
"because they're in the kitchen"
~~ probably Harrison Butker :blobpeek:

2024-05-05 13:13:58

Please never stream on Twitch if you have a bad mic.... literally half the audio on this site is just room noise

2024-04-25 23:24:12

- reply

@npub13vc…a293 you can start with Sekoia's talk on the PlugX takedown

2024-04-25 22:24:21

- reply

These talks are amazing... I'm being reminded why Botconf has always been my favorite conference

2024-04-25 21:52:47

Talks from the Botconf 2024 security conference, which took place this week, are available on YouTube
https://www.youtube.com/playlist?list=PL8fFmUArVzKj1hTdulLfht1OosYqSp4sO

2024-04-25 21:40:17

Apparently Edge had support for mouse gestures for a year now and I haven't noticed
https://textslashplain.com/2024/04/23/mouse-gestures-in-edge/
https://files.mastodon.social/media_attachments/files/112/333/554/689/392/476/original/9209045715718caf.png

2024-04-25 01:26:30

DevSecOps company Phylum says that North Korean hackers have returned to uploading malicious packages on npm. They previously ran similar campaigns in November 2023 and January this year.
The latest campaign expanded to target macOS devices on top of Windows users.
Chinese security firm QiAnXin previously linked the campaign to the Lazarus Group.
https://blog.phylum.io/north-korean-state-actors/

2024-04-23 16:42:34

Security researcher Matt Burch has published Dauthi, a tool designed to perform authentication attacks against various Mobile Device Management (MDM) solutions: https://github.com/emptynebuli/dauthi
Burch says Dauthi can be used to hack BlackBerry MDM solutions: https://emptynebuli.github.io/tooling/2024/04/22/blackberryMDM.html

2024-04-21 20:24:05

Discord has rolled out new terms of service on April 15 that remove a user's ability to sue the company by forcing everyone into a forced arbitration process.
These types of clauses are usually secretly inserted into ToS documents right before a company does something extremely shady.
According to Polygon, there's a way to opt-out: https://www.polygon.com/2024/4/20/24134970/discord-arbitration-how-to-opt-out

2024-04-16 18:09:23

I've been feeding the pigeons around my home for several years now. Recently, crows also started showing up.
As is their custom, they are now bringing me shiny objects as gifts.
Here's what I got so far.
https://files.mastodon.social/media_attachments/files/112/281/760/234/031/022/original/471ca58caa234aa2.png

2024-03-26 12:30:54

...and now you know why all the Russian internet troll farms defend cryptocurrencies like it was their own child
"Today, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned thirteen entities and two individuals for operating in the financial services and technology sectors of the Russian Federation economy including persons developing or offering services in virtual assets that enable the evasion of U.S. sanctions."
https://home.treasury.gov/news/press-releases/jy2204

2024-03-13 06:30:19

- reply

@npub1kj5…4vu8 "sorry your IP has been blocked" is not very free speechey of them

2024-03-12 12:31:53

Tuta has enabled quantum-safe encryption by default on all new Tuta Mail accounts.
https://tuta.com/blog/post-quantum-cryptography

2024-03-04 23:56:04

JetBrains tried to bury a security patch before Rapid7 called them out on it
https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/
https://files.mastodon.social/media_attachments/files/112/039/883/784/169/785/original/f8d9668465202042.png

2024-02-20 12:05:04

The moment I closed the Pocket browser tab, Firefox RAM and CPU usage went down by half.
The Pocket login page is also in some sort of CloudFront loop.
What's going on over there?

2024-01-23 15:15:34

HP cites threat of viruses from non-HP printer cartridges to justify blocking their use
https://arstechnica.com/gadgets/2024/01/hp-ceo-blocking-third-party-ink-from-printers-fights-viruses/

2024-01-09 17:23:03

Security researcher Daniel J. Bernstein has published details on KyberSlash, a collection of flaws in libraries that support Kyber, a quantum-resistant key encapsulation mechanism.
Many libraries remain unpatched.
http://kyberslash.cr.yp.to/

2024-01-02 18:10:34

Security researcher James Brine has open-sourced Honeydet, a tool to detect online honeypots.
https://github.com/referefref/honeydet/
https://files.mastodon.social/media_attachments/files/111/687/462/614/083/391/original/0c3250a33bfb3089.png

2023-12-07 17:38:15

Meta has started enabling end-to-end encryption (E2EE) conversations for all Facebook Messenger users.
The company says the roll-out phase will take a few months to complete, but it will cover all of its one billion Messenger users.
https://about.fb.com/news/2023/12/default-end-to-end-encryption-on-messenger/

2023-12-07 15:28:21

- reply

No US Treasury sanctions yet. Gonna check throughout the day and let you know.

2023-12-07 15:27:05

- reply

It appears this is also the first time Star Blizzard has been formally linked to the FSB's Center 18, marking the group's official dox!
Congrats FSB Center 18! Big day! :thinkerguns: 🥳

2023-12-07 15:21:13

UK summons Russian ambassador over hacking campaigns: https://www.gov.uk/government/news/uk-exposes-attempted-russian-cyber-interference-in-politics-and-democratic-processes
NCSC report on Star Blizzard (ColdRiver) activity is here: https://www.ncsc.gov.uk/news/star-blizzard-continues-spear-phishing-campaigns
PDF: https://www.ncsc.gov.uk/files/Advisory-Russian-FSB-cyber-actor-star-blizzard-continues-worldwide-spear-sphishing-campaigns.pdf
Sanctions were also levied against two Russians, including an FSB officer, for their role in the APT group
https://files.mastodon.social/media_attachments/files/111/539/574/490/384/547/original/abc922653fb1829f.png

2023-12-07 00:21:56

SecurityScorecard has identified six IP addresses used by Iranian group CyberAv3ngers to scan the internet for unsecured Unitronics PLCs.
88.135.36[.]82
5.144.130[.]35
217.144.104[.]53
31.7.73[.]176
217.144.107[.]183
185.143.233[.]120
https://securityscorecard.com/blog/iran-linked-attack-on-us-water-treatment-station/

2023-12-03 01:02:03

- reply

@npub17lg…9uux Was actually thinking of pinging you :)))

2023-11-23 13:42:41

Spotify saying the quiet part out loud
Article title: Spotify will end service in Uruguay due to bill requiring fair pay for artists
https://mixmag.net/read/spotify-end-service-uruguay-copyright-law-change-artists-fair-pay-amendment-news

2023-11-21 17:13:51

The Microsoft bug bounty program turned 10 years old this year.
Microsoft says it awarded almost $60 million in rewards to more than 1,100 security researchers who participated in the program since 2013
https://msrc.microsoft.com/blog/2023/11/celebrating-ten-years-of-the-microsoft-bug-bounty-program-and-more-than-60m-awarded/
https://files.mastodon.social/media_attachments/files/111/449/421/483/005/453/original/c5de041beb605c96.png

2023-11-16 20:05:42

Biden Campaign Looking for CISO
https://www.securityweek.com/biden-campaign-looking-for-ciso/

2023-11-13 09:48:19

- reply

Plus:
-Windows Server 2012 gets paid security updates
-Data of almost all Maine residents stolen in MOVEit hack
-TDS supply chain attack
-Australian ports down after cyberattack
-Optus gets refused the right to hide IR report
-Ransomware hits one of the world's largest law firms
-Class-action lawsuit filed against Intel for Downfall bug
-Raft hacked for $3.3mil
-Russia moves to formally ban VPNs
-Greek spy agency EYP spied on its own with Predator
-Infosec execs sign open letter for CISA funding
https://files.mastodon.social/media_attachments/files/111/402/357/753/397/008/original/b80f9f4f1ac56f9c.png

2023-11-13 09:44:17

Newsletter: https://riskybiznews.substack.com/p/malay-officials-take-bulletproftlink-phaas
Podcast: https://risky.biz/RBNEWS221/
-Phobos ransomware affiliates charged in France
-Malay officials take down BulletProftLink, one of the largest PhaaS providers
-UAE tricks and arrests BEC scam group
-UK returns funds stolen in IOTA 2018 hack
-Poloniex hacked for $130 million
-Thai citizens working in Myanmar scam centers returned home
-BiBi wiper ported to Windows, used in Israel
-South Korea conducts national clean-up operation to remove vuln software
https://files.mastodon.social/media_attachments/files/111/402/355/575/953/514/original/33e5cc93e54eaf2c.png

2023-11-12 19:21:39

Binarly has an analysis of the private key leaks that took place at Lenovo in September 2022 and MSI in April 2023.
The report's main finding was that multiple companies were apparently using the same Intel Boot Guard private keys to sign different types of firmware images.
https://binarly.io/posts/Dissecting_Intels_Explanation_of_Key_Usage_in_Integrated_Firmware_Images_IFWI/index.html

2023-11-12 13:54:07

- reply

@npub17lg…9uux @npub1dw5…w3tk
I'm not sure they want to either. After the REvil-Medibank kerfuffle, Australia promised to "release the hounds" on ransomware crews. Do they really want to make it this public?

2023-11-10 00:56:56

- reply

@npub1h55…jfjp yep... Reddit is full of these "Americans" attacking Biden and calling Ukrainian nazis every 4-5 comments

2023-11-09 19:20:10

Live video chat website Omegle has shut down after 14 years and after countless claims of child abuse
https://www.bbc.com/news/business-67364634

2023-11-08 09:58:07

Newsletter: https://riskybiznews.substack.com/p/chinese-apts-evolve-stealth-zero-day-abuse
Podcast: https://risky.biz/RBNEWS219/
-Microsoft makes MFA mandatory for cloud admin portals
-US lawmakers introduce FISA Section 702 reform bill
-Confluence servers targeted with ransomware
-85% of Chinese APT zero-days targeted web-facing appliances
-Official Monero project gets hacked
-Bitfinex reports customer support breach
-Troy Hunt debunks Fake LinkedIn leak
-Discord switches to temp file URLs
-Indian cryptoscam group detained
-QNAP, Veeam security updates
https://files.mastodon.social/media_attachments/files/111/374/094/443/036/068/original/f6e5bb43584cbe1e.png

2023-11-05 18:15:57

- reply

@npub1n3p…jee0 https://soundcloud.com/dancyhub/benny-benassi-satisfaction-push-push-push-ultra-slowed-reverb-best-part-looped
https://soundcloud.com/aequet-823494991/fluxxwave-but-the-intro-is-looped-slowed-reverb
https://soundcloud.com/virmokun/lady-gaga-government-hooker-d00nik-remix-slowed

2023-10-29 02:44:38

The 2023 edition of the Pwn2Own Toronto hacking contest has come to an end. The contest win went to Team Viettel, with 30 points and $180,000 in prize money. The Toronto (fall) edition of Pwn2Own focuses on hacking smartphones and IoT devices.
https://www.zerodayinitiative.com/blog/2023/10/27/pwn2own-toronto-2023-day-four-results
https://files.mastodon.social/media_attachments/files/111/315/770/335/442/438/original/b35f9928cdde29af.jpg

2023-10-28 21:38:27

Trying to write the newsletter while watching the rugby WC final is turning out to be mission impossible

2023-10-28 01:33:40

Talks from the BSides Canberra 2023 security conference, which took place at the end of September, are available on YouTube.
https://www.youtube.com/playlist?list=PLqJd3UBdW7z4xI0cNJyJ9nVwZmKm3fAZ9

2023-10-28 00:40:34

Enterprise software giant VMWare has published two security advisories to fix two sets of issues in its vCenter Server and Tools applications.
The worst of the two is the vCenter update, which fixes a 9.8/10-rated memory issue that can lead to remote code execution attacks (CVE-2023-34048).
https://www.vmware.com/security/advisories/VMSA-2023-0023.html

2023-10-27 11:06:13

Newsletter: https://riskybiznews.substack.com/p/risky-biz-news-first-kazakhstan-based
Podcast: https://risky.biz/RBNEWS214/
-First Kazakhstan APT discovered, tries to pass as Azerbaijan
-New side-channel attack impacts Apple devices
-US states sue Meta for giving social media cocaine to their children
-Two crypto-mining botnets infect 1.25 million PCs
-UA hacktivists prove Russia Army still recruiting Cubans
-CCleaner joins MOVEit list
-Online Safety Bill becomes law in UK
-Poland to finally investigate Pegasus abuse
-Google VRP expands to AI
https://files.mastodon.social/media_attachments/files/111/306/183/194/253/313/original/351474f4c55b2192.png

2023-10-26 19:42:08

Praetorian researchers have discovered a pre-auth RCE vulnerability (CVE-2023-46747) in the F5 BIG-IP load balancer.
https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/
Don't see the F5 security advisory. Prolly not out yet. But apparently patches are coming.

2023-10-26 17:48:45

Dragos has published part two of a technical analysis of MOUSEHOLE, one of the five modules of PIPEDREAM, an ICS malware framework developed by the Chernovite group: https://www.dragos.com/blog/potential-impact-of-pipedream-malware-module-mousehole/
See part one here: https://www.dragos.com/blog/pipedream-mousehole-opcua-module/

2023-10-26 16:45:40

Microsoft has published its own report on Octo Tempest, a group whose activity overlaps with what's publicly known as 0ktapus, Scattered Spider, and UNC3944.
https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/
https://files.mastodon.social/media_attachments/files/111/301/851/467/064/835/original/b4ce63320d025015.png

2023-10-26 14:54:46

- reply

@npub1kj5…4vu8 @npub1s58…n9gw yeah, but I thought he asked if the NSA was directly involved with those operations, which is an obvious "no"

2023-10-24 19:16:56

The Canadian government says that a Chinese disinformation campaign named Spamouflage is targeting lawmakers and public institutions. The operation began in early August 2023 and continued through September and Facebook and Twitter bot networks. The accounts posted content accusing Canadian politicians of criminal and ethical violations and tried to silence CCP critics. Some of the posts also used deepfaked videos.
https://www.canada.ca/en/global-affairs/news/2023/10/rapid-response-mechanism-canada-detects-spamouflage-campaign-targeting-members-of-parliament.html

2023-10-24 18:42:10

Mozilla has released Firefox 119. New features and security fixes are included. The biggest change in this release is the ability to edit PDFs.
https://www.mozilla.org/en-US/firefox/119.0/releasenotes/
https://files.mastodon.social/media_attachments/files/111/290/986/215/866/861/original/d6e919768d7f79c7.png

2023-10-24 18:20:15

The mobile and IoT edition of the Pwn2Own hacking contest is taking place in Toronto, Canada. See the schedule and live results.
https://www.zerodayinitiative.com/blog/2023/10/23/pwn2own-toronto-2023-the-schedule
https://www.zerodayinitiative.com/blog/2023/10/24/pwn2own-toronto-2023-day-one-results

2023-10-24 02:18:00

Kaspersky researchers have published a second analysis of TriangleDB, the iOS spyware implant that was used to spy on diplomats and Kaspersky employees in Russia.
The first report focused on the implant itself. This second one focuses on a pre-infection component named the JavaScript Validator that the attackers used to triage victims for infection.
https://securelist.com/triangulation-validators-modules/110847/
https://files.mastodon.social/media_attachments/files/111/287/118/353/066/612/original/dc91e332349f29f5.png

2023-10-23 10:29:34

Newsletter: https://riskybiznews.substack.com/p/cisco-ios-xe-hackers-cover-tracks-patches
Podcast: https://risky.biz/RBNEWS212/
-Cisco IOS XE hackers are hiding their tracks as patches come out
-Okta hacked again
-RagnarLocker ransomware boss arrested in Paris
-A new botnet targets C-level execs with slow-and-low brute-force attacks
-Philippines govt sites hacked by 19yo hacktivist
-City of Philadelphia has a security breach
-International Criminal Court says recent hack was cyberespionage-related
-Jabber[.]ru gets MitMed, possibly by police
https://files.mastodon.social/media_attachments/files/111/283/381/689/214/924/original/71ec7677b39c38af.png

2023-10-22 17:23:33

The EU postponed the vote on its chat control legislation for the second time last week.
https://www.patrick-breyer.de/en/chat-control-vote-postponed-huge-success-in-defense-of-digital-privacy-of-correspondence/
https://tutanota.com/blog/chat-control-criticism

2023-10-22 16:55:11

Security researcher Adam "Hexacorn" Blaszczyk has published a list that maps Chrome extension IDs with their real names.
It is a useful file to have if you're conducting security research on malicious extensions.
https://www.hexacorn.com/blog/2023/10/20/mapping-chrome-extension-ids-to-their-names-part-2/
https://files.mastodon.social/media_attachments/files/111/279/243/127/085/444/original/b2b13288e6981a65.png

2023-10-22 16:44:02

VMware's Carbon Black security team looks at the LummaStealer Malware-as-a-Service (MaaS)
https://blogs.vmware.com/security/2023/10/an-ilummanation-on-lummastealer.html

2023-10-22 16:08:59

PortSwigger researchers have taken the concept behind the HTTP2 Rapid Reset attack that was being used to launch DDoS attacks and have applied it in a manner that allows threat actors to perform remote race condition attacks with just one single TCP package
https://portswigger.net/research/the-single-packet-attack-making-remote-race-conditions-local
https://files.mastodon.social/media_attachments/files/111/279/061/410/194/748/original/2cf4fd5d65e2cfca.png

2023-10-20 15:28:26

House cybersecurity subcommittee chairman says GOP speaker drama is impacting cyber legislation
https://cyberscoop.com/house-speaker-chaos-garbarino-cyber-funding-bills/

2023-10-19 21:21:29

Claroty researchers have discovered that Synology NAS devices are using a weak RNG algorithm that can allow threat actors to reconstruct the admin account password and take over the device.
https://claroty.com/team82/research/synology-nas-dsm-account-takeover-when-random-is-not-secure
Tracked as CVE-2023-2729, the issue was fixed in June.
https://www.synology.com/en-us/security/advisory/Synology_SA_23_08

2023-10-19 20:27:43

In my last newsletter I covered this mysterious APT that compromised secure USB drives used by an Asian country's government
https://riskybiznews.substack.com/p/mysterious-apt-compromises-secure-usbs
Kaspersky has now named this group TetrisPhantom and says it will provide more details at its upcoming SAS conference:
https://www.kaspersky.com/about/press-releases/2023_kaspersky-uncovers-apt-campaign-targeting-apac-government-entities

2023-10-19 19:25:30

In September, Google TAG says DPRK hackers targeted infosec researchers again... this time with an unnamed zero-day: https://blog.google/threat-analysis-group/active-north-korean-campaign-targeting-security-researchers/
This week, Project Zero revealed the zero-day was in Adobe Reader
https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2023/CVE-2023-26369.html
#infosec #apt #google #cybersecurity
https://files.mastodon.social/media_attachments/files/111/262/846/338/887/247/original/49020f5cdfe695c4.png

2023-10-19 17:51:28

Google says it will pick up legal costs if you get sued for copyright infringement for using Google's Duet and Vertex AI tools
https://cloud.google.com/blog/products/ai-machine-learning/protecting-customers-with-generative-ai-indemnification

2023-10-13 10:33:57

- reply

Also:
-Splunk survey found 83% of CISO paid ransomware gangs
-Malware reports on Nexus, AvosLocker, Qakbot, Darkgate, SpyNote
-DarkEye Stealer gets leaked online
-New PyPI and NuGet malware
-OneinStack hit by two supply chain attacks
-ShadowPC platform hacked
-ToddyCat APT goes after Asian telcos
-Survey: Most IT teams confused about what to patch first
-cURL security update goes meh
-Major Magento patch is out
-Microsoft launches AI Bug Bounty Program
-Phishers abuse LinkedIn Smart Links
https://files.mastodon.social/media_attachments/files/111/226/765/790/812/048/original/a687a7cacca3002e.png

2023-10-13 10:28:57

Newsletter: https://riskybiznews.substack.com/p/microsoft-takes-ntlm-behind-the-shed
Podcast: https://risky.biz/RBNEWS208/
-Microsoft takes NTLM behind the shed
-Chinese APT behind recent Confluence zero-day
-SEC launches MOVEit investigation
-Some FTX stolen funds lead back to Russian cybercrime
-35 vulnerabilities remain unpatched in Squid
-3Commas hacked again
-Platypus Finance hacked for the 3rd time
-Steam to require devs a phone number by end of month
-Magniber ransomware enter dormancy
-Ten 9.8 CVSS vulns remain unpatched in OT/ICS router
https://files.mastodon.social/media_attachments/files/111/226/742/359/951/265/original/5a95f2e3d59b108f.png

2023-10-08 16:01:05

Caesars formally discloses its security incident to OAGs
Total number of persons affected: TBD
https://apps.web.maine.gov/online/aeviewer/ME/40/b21dc5d1-0bee-4a4c-92dc-bef4bbb519c9.shtml

2023-10-02 22:15:50

For the love of God infosec community.... stop dumping PoCs two days after a patch is out.
At least allow IT teams to schedule a patch.
jfc almighty!

2023-09-28 13:43:15

Reddit has removed the ability for its users to opt out of personalized ads.
https://www.reddit.com/r/reddit/comments/16tqihd/settings_updateschanges_to_ad_personalization/

2023-09-24 10:31:18

For those who haven't caught on yet: the AI-fixes-everything hype is the new (old) blockchain hype.

2023-09-20 12:54:16

Just a reminder to everyone to never use Chrome for anything than downloading another browser.

2023-09-07 15:35:36

AT&T Customers Doxed Themselves En Masse In Reply-All Nightmare
https://www.vice.com/en/article/bvjyz8/atandt-customers-doxed-themselves-en-masse-in-reply-all-nightmare

2023-09-07 03:12:35

Vulnerabilities in Proton Mail, Skiff, and Tutanota
https://www.sonarsource.com/blog/code-vulnerabilities-leak-emails-in-proton-mail/

2023-08-31 17:11:55

PyPI malware found last month linked to Lazarus/DPRK: https://www.reversinglabs.com/blog/vmconnect-supply-chain-campaign-continues
DPRK hackers are known to use malicious libraries for their attacks, but have previously been linked to npm only: https://github.blog/2023-07-18-security-alert-social-engineering-campaign-targets-technology-industry-employees/

2023-08-31 13:35:29

AhnLab researchers have published a report on Andariel's latest campaigns and operations.
The report covers malware like NukeSped variant Volgmer, Andardoor, AndarLoader, DuarianBeacon, TigerRAT, Black RAT, Goat RAT, and the Troy reverse shell.
That's quite the arsenal.
https://asec.ahnlab.com/en/56405/

2023-08-31 01:27:29

The Sudo Linux utility has been rewritten in Rust.
https://www.memorysafety.org/blog/sudo-first-stable-release/

2023-08-27 15:39:11

InQuest researchers look at the history of Antibot, an open-source tool that started as a GitHub project but is now one of the go-to solutions used to filter bot and authentic traffic on phishing sites and other malware control panels.
https://inquest.net/blog/adversary-on-the-defense-antibot-pw/
https://files.mastodon.social/media_attachments/files/110/961/855/041/487/365/original/2c39ae16750d9c64.webp

2023-08-27 15:02:55

An investigation by web developer Travis Brown has found that around 70% of Elon Musk's Twitter followers are likely bot accounts there to just inflate his follower numbers.
Raw data: https://gist.github.com/travisbrown/82de45bccd760032635ebef7bfeb4d83
Article: https://mashable.com/article/elon-musk-x-twitter-follower-data

2023-08-24 16:16:30

The FBI says that Chinese hackers are still exploiting a Barracuda zero-day (CVE-2023-2868) to compromise email servers across the world.
The agency published this week a security alert with new IOCs related to these attacks: https://www.ic3.gov/Media/News/2023/230823.pdf
https://files.mastodon.social/media_attachments/files/110/945/014/118/732/952/original/eee54e905ee2751e.png

2023-08-20 17:45:02

I've lost track of all the clones. Where's BreachForums hosted now?

2023-08-15 16:39:18

After PSNI, it's now the turn of UK police to leak data via FOI websites
https://www.suffolk.police.uk/news/latest-news/press-notice-regarding-data-breach-norfolk-and-suffolk-police

2023-08-14 23:06:23

"Discord.io has suffered a data breach."
https://discord.io/
http://web.archive.org/web/20230814204626/https://discord.io/
https://files.mastodon.social/media_attachments/files/110/890/003/550/823/293/original/424885cb00dc3f84.png

2023-08-13 13:55:47

"Did you put the Christmas hats on the logos?
No, researchers did that. And honestly I had lost a battle. I tried to use that as our official logo next time, and I was told we couldn’t"
https://techcrunch.com/2023/08/12/fbi-ddos-for-hire-cyberattackers/
https://files.mastodon.social/media_attachments/files/110/882/175/370/509/291/original/c403042f916b0cbf.webp

2023-08-11 10:20:17

Newsletter: https://riskybiznews.substack.com/p/russia-blocks-openvpn-wireguard-vpn-protocols
Podcast: https://risky.biz/RBNEWS184/
-Russia blocks OpenVPN and WireGuard VPN protocols
-Northern Ireland police deals with data breach
-New TunnelCrack attack leaks VPN traffic
-MilkSad vulnerability exploited to steal from crypto-wallets
-Hundred Finance shuts down after hack
-Dallas ransomware attack to cost city $8.6mil
-Canada exposes WeChat disinfo campaign
-Indian military to replace Windows with Linux
-New Belarusian APT MitMs ISP traffic
https://files.mastodon.social/media_attachments/files/110/870/004/539/795/716/original/63e79546f5f9d9f1.png

2023-08-08 20:37:06

"The SBU cyber experts blocked attempts of russia’s military intelligence to gain access to the combat data exchange system of the Armed Forces of Ukraine."
"The SBU identified nearly 10 malware samples designed to extract information from the system."
SBU links the operation to Sandworm
https://ssu.gov.ua/en/novyny/sbu-exposes-russian-intelligence-attempts-to-penetrate-armed-forces-planning-operations-system
https://files.mastodon.social/media_attachments/files/110/855/443/146/073/148/original/1a167105a6d44507.png

2023-08-08 18:09:57

Interpol takes down 16Shop phishing-as-a-service platform
https://www.interpol.int/News-and-Events/News/2023/Notorious-phishing-platform-shut-down-arrests-in-international-police-operation
Image via ZeroFox: https://www.zerofox.com/blog/16shop-cash-app-phishing-kit/
https://files.mastodon.social/media_attachments/files/110/854/863/852/978/432/original/f80db16f381aa4a3.webp

2023-07-25 14:22:23

Dutch police arrest their largest local user on "the Genesis Market"
https://www.politie.nl/nieuws/2023/juli/24/07-vermoedelijk-grootste-nederlandse-gebruiker-van-de-genesis-market-aangehouden.html

2023-07-05 17:02:14

Newsletter: https://riskybiznews.substack.com/p/risky-biz-news-922-million-worth
Podcast: https://risky.biz/RBNEWS168/
-$922 million worth of crypto-assets stolen in H1 2023
-CISA launches CyberSentry platform
-Sweden becomes fifth EU state to advise against use of Google Analytics
-hackers leak data of 1,100 French magistrates
-US Marines triples cyber jobs bonuses
-FTC proposes ban on fake reviews
-New SmugX APT campaign
-Upcoming Mastodon security update
-CVSSv4 CVE calculator is out
-New voice authentication attack
-New Neo_Net group
https://files.mastodon.social/media_attachments/files/110/662/063/909/961/573/original/b05ec6426b399c5b.png

2023-07-04 14:41:35

Remember when the 4th of July meant a global cyberattack?
Man, I miss those days! Too quiet today!

2023-05-07 01:27:37

Mozilla's Mastodon instance is now live
https://blog.mozilla.org/en/mozilla/mozilla-social-mastodon-private-beta-announcement/

2023-05-04 16:28:36

A security researcher with the pseudonym 'neskafe3v1' hijacked 14 PHP libraries published on the Packagist repository as part of a stunt to help them find a job.
Four of the packages had more than 20 million downloads, with one package having 528 million lifetime downloads.
All done via breaking into weakly secured dev accounts.
Very reassuring our software supply chains are in good hands!
https://www.bleepingcomputer.com/news/security/researcher-hijacks-popular-packagist-php-packages-to-get-a-job/

2023-04-16 00:19:50

Giraffe Security says it managed to successfully execute a dependency confusion attack that compromised 50+ computers inside Google's internal network.
https://giraffesecurity.dev/posts/google-remote-code-execution/

2023-04-04 20:40:21

Genesis Market seized by authorities
https://genesis.market/
https://files.mastodon.social/media_attachments/files/110/142/004/871/358/539/original/8fee8589fc08c7d4.png