Hive0145 is targeting Spain, Germany, Ukraine with Strela Stealer malware in invoice phishing tactic
American Associated Pharmacies yet to officially confirm infection
Russian actors exploit NTLM flaw in attacks on Ukraine, patched by Microsoft this week
Zoom fixed 6 flaws, including two high-severity issues that could allow remote attackers to escalate privileges or leak sensitive information
Iran's TA455 hackers target aerospace with fake jobs and SnailResin malware, emulating North Korean tactics.
Follow us on Twitter (X) @Hackread - Facebook @ /Hackread
The unpatched security vulnerability, which doesn't have a CVE yet, is due to an exposed Microsoft Message Queuing (MSMQ) instance and the use of the insecure BinaryFormatter.
Follow us on Twitter (X) @Hackread - Facebook @ /Hackread
Ymir ransomware exploits memory management to evade detection, targeting credentials for stealthy network breaches
Follow us on Twitter (X) @Hackread - Facebook @ /Hackread
Researchers have uncovered a surge in phishing attacks using Visio .vsdx files to evade security scans
Learn about a recent IP spoofing attack on the Tor network and how the Tor community responded swiftly to mitigate the threat.
That's why I don't use Kaspersky :)
In my opinion, you will always be at the mercy of a government in this context: US, China, Russia. In the end it's a matter of choosing which one. FOSS maybe a little less, but in the end it's almost the same. That's my view, of course. That doesn't mean you can't give them a hard time ;)
This one does not spark joy.
Update: Israel Planted Explosives in Pagers Sold to Hezbollah, Officials Say (https://www.nytimes.com/2024/09/17/world/middleeast/israel-hezbollah-pagers-explosives.html)
You can use https://tails.net/ booting from another flash drive in memory only.
I like to use the 2013 Target breach case. They lost $1 billion due to the attack, their stocks dropped significantly after the attack, had several lawsuits, they closed a few stores, and changed the CEO and CIO. But a few months later, all was forgiven, their stocks recovered, and life went on.
Don't get me wrong, the risks of a cyber attack have to be taken seriously. But I feel that I have overestimated the impacts of reputational damage my whole life, as an infosec professional. My thinking was always like this: if you get reputational damage, you are done, no chance to recover, it is the end of it.
I'm following the Crowdstrike case, but I would bet that they will lose some market share (mostly prospects), perhaps some layoffs, but stocks will come up eventually.
Not as much as if it contained passwords, for sure. Bu it gives a nice mailing list for phishing and so on.
Depends of the country. Disrupt with Internet/communications may be a crime in some countries.
CrowdStrike report of the incident: https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/
Well, depends. If the user go to a captive portal to "authenticate" before the VPN could closes, than no. But, if the VPN can "pierce" through it (without any intervention from the AP), than yes. Anyways, If the user is willing to provide authentication data (like social media accounts, etc), nothing matters.
Yes.
303,481 servers worldwide, according to Shodan.
Interesting. I didn't know that syncthing does hole punching.
From a defense perspective, how would this work with an enterprise firewall, with UDP/TCP only allowed to specific destinations or specific sources. Example: only the internal DNS relay server can access 53/UDP and only the internal proxy server can access 80/443. What I mean is in a network with a very closed firewall, how would Syncthing be able to connect with peers?
Instance Rules
Be respectful. Everyone should feel welcome here.
Not necessarily. Torrent is a way to find a peer for direct connection or via a relay (of course that is more than that). Syncthing, even using a relay server, requires some ports available for at least outbound connection (22000 TCP/UDP or whatever port the relay is using). This should not be possible in a medium security network, let alone a defense network. I don't know if syncthing works without a direct connection (to the peer or relay, something like transport via http proxy).
Honestly, I didn't think about vulnerability in SyncThing when I read the article. But I wondered why defense forces would have p2p open on their networks.