SECURITY NEWS THREAD

I thought I would start this thread for news articles that might be of interest to lains, feel free to post any news you find interesting or relevant to the field of security. Starting with this breddy good article >Shutdown: Government sites with lapsed security certificates pose risk https://www.cnet.com/news/shutdown-government-sites-with-lapsed-security-certificates-pose-risk/

SecBrowser is essentially Tor browser without Tor, but with all of the other hardening improvements. https://www.whonix.org/wiki/SecBrowser

https://www.cnn.com/2019/10/29/africa/johannesburg-hackers-bitcoin-payment/index.html Another city held for ransom by ransomware

>>8991 >Another city that fuarrrked up their backup scheme FTFY

>>8995 Non-zero chance they didn't even have a backup scheme.

Savannah have been DDoS'ed for a week now. Who has anything to gain with something like this? Are big corporations that much bored? https://savannah.nongnu.org/forum/forum.php?forum_id=9618 >The web interfaces on several of the Savannah systems are getting hit with a high volume DDoS attack. This is browning out the web interfaces. When possible members are encouraged to use SSH protocols to avoid the web interfaces which are suffering severe performance degradation and timing out. >No messages in DDoS Attack!!

>>9355 This soykaf is massive: https://lists.gnu.org/archive/html/savannah-users/2019-12/msg00001.html >The attack started late Friday. It is at least 10k IP addresses >strong and probably a lot bigger. It's somewhat hard to tell the >exact size. I know that vcs0 was hit by 45k addresses in 24 hours on >Saturday but I do not know how many of those were the botnet and how >many were just nice people like you and I clicking on the web browser. >But that seems a likely upper end.

https://archive.ph/nCyN9 DePriMon - the most creative name for a APT created malware-loader. It's suposedly the first example of a port monitor in the wild. This is all done by abusing the Windows print spooler service, spoolsv.exe. spoolsv.exe loads all DLLs that have a registry entry in HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors. (Admin is needed to create this entry) Pretty interesting read on the technical side. If you're gonna write malware this is the way it should be done. tl;dr >[insert exploit of choice] >use admin creds to create registry values >drop arbitrary dll >C2 over SSL/TLS >own box hard

https://www.technologyreview.com/f/614947/new-orleans-has-declared-a-state-of-emergency-after-a-cyber-attack/ >New Orleans spotted suspicious activity in its networks at around 5 a.m. on Friday, with a spike in the attempted attacks at 8 a.m. It detected phishing attempts and ransomware, Kim LaGrue, the city’s head of IT, later told reporters. Once they were confident the city was under attack, the team shut down its servers and computers. City authorities then filed a declaration of a state of emergency with the Civil District Court, and pulled local, state, and federal authorities into a (still pending) investigation of the incident. The city is still working to recover data from the attack but will be open as usual from this morning, Mayor LaToya Cantrell said on Twitter.

As of this month, Customers in China who buy SIM cards or register new mobile-phone services must have their faces scanned under a new law that came into effect yesterday. China’s government says the new rule, which was passed into law back in September, will “protect the legitimate rights and interest of citizens in cyberspace.” https://www.technologyreview.com/f/614781/all-new-cellphone-users-in-china-must-now-have-their-face-scanned/

>>9469 Jesus Christ. That's dismal.

>>9469 Most countries ask for ID when buying SIM cards (or registering them). I don't see anyone whining about it. Chinese will have to do the same soykaf as us, buy them on the black market. That's it.

>>9471 Maybe the black market sellers bought them with a fake id though?

>>9472 Oh you don't need [fake] IDs, just find real ones on unsecured companies' servers. It's easy as hell. I used to find them on unsecured amazon AWS.

>>9471 Most countries you can order a free (top up) sim card over the mail to get delivered on your address (that isn't on your name), or go to local market and buy sim card with no ID, wtf you smokin

>>9476 Ok then list those countries. You're speaking about north america. Almost all europe and asia already require an ID.

>>9478 You can get a free simcard without signing anything or giving any of your info anywhere in Europe from carriers like lycamobile, lebera. I'm want to ask the same question the other lain asked, wtf you smokin?

>>9480 Can you actually read? >Most countries ask for ID when buying SIM cards (or registering them). >(or registering them) All the companies you listed do turn off your line after a few weeks and sometimes days if you don't send some form of ID. Wtf are YOU smoking?

>>9481 I have a lebera sim. Use it everytime I go to Europe for 2 years. Didn't send any id. In fact just checking the support website of lebera in case they changed it recently, only reference to identification on lebera websites is on austrialian one since they actually require identification. So yeah i don't even know what to say to you.

>>9475 Care to elaborate? I'm interested lain.

How are mainstream browsers not implementing a security algorithm right in fuarrrking 2020? https://arstechnica.com/information-technology/2020/01/researcher-develops-working-exploit-for-critical-windows-10-vulnerability/?amp=1

>>9915 this is a Windows issue.

>>9916 Your right. I'm kinda tired, but thought it looked like something interesting to post here.

CgAn got v& not to long ago with ties to the yellow vest protest. https://pastebin.com/raw/LRLmy9bS

>https://www.pymnts.com/news/security-and-risk/2020/world-health-organization-target-hack/ Hacker group access WHO (world health organization) >https://www.wired.com/story/china-hacking-windows-zero-day-ios-watering-hole-security-news/ Chinese hackers are using the corona virus as a pretext for phishing and malware campaigns >https://www.wired.com/story/north-korea-hacking-zero-days-google/ APT group DarkHotel (Most likely South Korea) hacks NK using 5 zero days >Booze Allen published a report on all Russian hacking from 2012-19 https://www.zdnet.com/article/booz-allen-analyzed-200-russian-hacking-operations-to-better-understand-their-tactics/ >https://www.forbes.com/sites/zakdoffman/2020/03/21/putins-secret-intelligence-agency-hacked-dangerous-new-cyber-weapons-target-your-devices/#5b0baad778a0 FSB contractor sytech hacked releasing several hundreds of cyber tools and data

https://krebsonsecurity.com/2020/05/ransomware-hit-atm-giant-diebold-nixdorf/ >Ransomware Hit ATM Giant Diebold Nixdorf https://www.schneier.com/blog/archives/2020/05/new_us_electron.html >New US Electronic Warfare Platform https://www.schneier.com/blog/archives/2020/05/another_califor.html >Another California Data Privacy Law

>This new Tor Browser release is focused on helping users understand onion services. >Tor's onion routing remains the best way to achieve end-to-end anonymous communication on the Internet. With onion services (.onion addresses), website administrators can provide their users with anonymous connections that are metadata-free or that hide metadata from any third party. Onion services are also one of the few censorship circumvention technologies that allow users to route around censorship while simultaneously protecting their privacy and identity. >For the first time, Tor Browser users will be able to opt-in for using onion sites automatically whenever the website makes them available. For years, some websites have invisibly used onion services with alternative services, and this continues to be an excellent choice. Now, there is also an option for websites that want their users to know about their onion service to invite them to opt-in to use their .onion address. https://www.torproject.org/releases/tor-browser-95/index.html

Secjuice does a weekly publication about the recent events in sec https://www.secjuice.com/infosec-news-and-events-squeeze-vol-26/

HUGE LEAK OVER 200 POLICE STATIONS DATABASES LEAKED VIA DDOSECRETS https://hunter.ddosecrets.com

>>11295 Where? You're just linking to their search box.

>>11296 its include inside the leak

>>11297 I cant' reach it, is it fully down or is it under attack right now? (around 5-6AM BST)

>>11306 Domain is dead for me as well.

>Facebook goes cyberpunk and pays for a Tails 0-day https://nakedsecurity.sophos.com/2020/06/12/facebook-paid-for-a-0-day-to-help-fbi-unmask-child-predator/

>>11314 >dipshit gets hacked >what goes around comes around

>>11314 This is fuarrrked, means that anyone with money can fuarrrk anyone, we are close to cyberpunk.

>>11316 >This is fuarrrked, means that anyone with money can fuarrrk anyone Hasn't this always been the case? Roman empire is cyberpunk

>>11317 >Roman empire is cyberpunk That's a hot take. I see your point though. That which hath been is now; and that which is to be hath already been. Ecclesiastes 3:15

>Several high-profile twitter accounts are compromised to promote a bitcoin scam https://techcrunch.com/2020/07/15/twitter-accounts-hacked-crypto-scam/ I have fear that one day those fact checker accounts on sites like Facebook and Twitter will get compromised. A theoretical scenario I though is that hackers compromise several fact checking accounts, and use normal accounts to spread something like "Political candidate X arrested after video surfaced of him/her raping minors". They use the fact checking accounts they compromised to say the posts about that are true and flags anything that says otherwise as false. Currently there doesn't seams to be a way to report that fact checkers are wrong, and companies doesn't seam to have protocols (that are known publicly) to use in the event a fact checker account has been compromised. This mass compromise of Twitter accounts should have everyone worried as if this many high-profile accounts have been compromised, nothing can stop hackers from hijacking fact checking accounts can cause all kinds of chaos. If something like that were to ever occur do you think that will convince some amount of people to not instantly believe fact checkers as there isn't a way to tell if they're ever compromised, and will encourage people to do research?

>>11545 Even in neocities I have seen that scam attempt lol About your post, doubt it happens. There is still a human element (that gets treated like soykaf, but it's there) in charge of controlling that kind of stuff. The effort needed to coordinate such an operation doesn't seem worth it to me, it would get debunked quickly. Better to just steal 100k from the gullible masses I guess.

>>11545 https://www.vice.com/en_us/article/jgxd3d/twitter-insider-access-panel-account-hacks-biden-uber-bezos turns out it was a insider job, I follow some infosec guys on twitter saying they made about 110k off the scam. Not a lot considering. I bet .005 bitcoin the insider gets caught.

>>11545 >I have fear that one day those fact checker accounts on sites like Facebook and Twitter will get compromised. But most - if not all - of those "fact checker" accounts tend to use pilpul to push some sort of narrative. I guess the real concern is that enough stupid people use them like some sort of truthsayer or bible...

>>11545 https://www.newsweek.com/twitter-bitcoin-hack-direct-messages-stolen-1518247?fbclid=IwAR0D99nqNpcY4w1LfpxLSmRH3PMKXUZsWRV0NF-VyBBpLyLnwkD871sgZ0o There's now worry that the DMs of the compromised accounts may have been read by the hackers also. I'm surprised the hackers only did it for profit via a doubling scam, with how much access they seam to have they could've caused all kinds of chaos by tweeting all kinds of things or leaking the private information of the accounts. I looked around to see other people's thoughts on this hack and something I found is that many people were pointing out that same wasted potential. Many said it was a waste that the hackers didn't try to do a 2009 Youtube hack, cause twitter beef, or some other kind of dicking around. Someone pointed out this: https://www.marketwatch.com/story/this-day-in-history-hacked-ap-tweet-about-white-house-explosions-triggers-panic-2018-04-23 In 2013 the Twitter account for The Associated Press was hacked and made a tweet that explosions went off at the White House, and it causes the Stock Market to plunge down for a short time. I guess we should be thankful something like that didn't happen (this time). >>11560 Yes they do push a narrative but since most people who see them as truthsayers don't do research, it's probably easy to have them believe anything as fact if the fact checkers say is true.

>>11561 I cannot believe they simply did it for profit and left everything intact. If they were competent enough to accomplish something like that, they must have scraped their messages at the very least.

>>11545 That bitcoin scam was hilarious. The Bittorrent CEO Justin Sun put out a 1 million dollar bounty out for the hackers. Imagine having a corporate ceo put out a bounty on your head for a hacking job. That's cyberpunk as fuarrrk. Also from what I've heard it wasnt even a proper hacking job, just social engineering to gain access to the account credentials. LMAO.

>>11573 >I cannot believe they simply did it for profit and left everything intact i've been thinking it seems like the person who ran the bitcoin scam might have just bought the hack from the actual hacker. i read in some news article that they think they know who did it because he was trying to sell the exploit on some forum. imagine some rich skid or scammer type spending like 50k on it or something and then not knowing what to do with it besides the btc scam.

>>11580 Then it was well-invested with 200% of revenue.

>>11316 Internets is western. Western is cyberpunk. cf. anarco-individualism

>>11582 i mean i just pulled that number out of my ass, but yeah that's kind of my point. i feel like a hacker with the skills to pull this off could probably come up with a better use for it than a bitcoin scam, but if they were just planning to sell it then it makes sense that they wouldn't fuarrrk up the zero day aspect by doing anything with it themselves. the buyer doesnt need any such skills, they just need money, and could still come out on top with an unsophisticated scam.

https://siliconangle.com/2020/07/29/offensive-security-acquires-open-source-vulnerability-resource-service-vulnhub/ Vulnhub was obtained by offensive security and has become part of exploit-db

https://www.wired.com/story/amazon-alexa-bug-exposed-voice-history-hackers/ A recently patched bug in Alexa's allowed hackers to gain access to some data, most noticeable voice history. What do you guys think it will take for people to stop using "smart" assistants?

I don't know if anyone knows, or cares. The guy who runs the scam courses thats also posts on http://cryptbb2gezhohku.onion/ had a news article written about him https://www.forbes.com/sites/daveywinder/2020/09/28/this-hacker-university-offers-dark-web-cybercrime-degrees-for-125/#69f3efd145f2

>>11980 normal people don't know so can't even care about it.

>>11980 Make people destroy their Alexa by creating fake, convincing marketing. It worked before with iPhone.

>>12551 >dark web cybercrime degrees lol imagine falling for this. you can literally learn how to hack stuff by googling it, you don't need a "cybercrime degree" to do any of the stuff they are supposedly teaching you.

>>12597 That's implying that a "cybercrime degree" is even a thing and not just some scam to extort ignorant people out of money.

>>12628 lesson one in fraud school, don't give money to random people on the internet for fraud lessons.

Is it just me, or does it sound like some government officials got socially engineered https://www.politico.com/news/2020/11/04/georgia-election-machine-glitch-434065 >Official claims "company employees" notified the government of a last minute update needed hours before the election >No logs >Company states no employees were present >Localized issue - other districts did not have similar glitches

>>13069 hmm yeah, it very much sounds like they got pwned. "they updated something idk" is a pretty standard response you get when someone shows you their computer that's been infected with a virus. I reckon it was probably some APT trying to fuarrrk around with the elections and cause mayhem.

>>12581 >Apple Wave

Jeremy Hammond famous lulzsec hacker released from prison and is in a halfway house right now. he has a podcast documenting his time in jail and throughout covid https://twintrouble.home.blog https://nitter.net/FreeJeremyNet/status/1328857805395267584

Trump Fires Top U.S. Election Cybersecurity Official Chris Krebs https://nitter.net/C_C_Krebs/status/1328859222071783424 >>13111 Great news.

>>13118 There's a sequel: >[Krebs] reportedly set up a Trump-proof line of succession >https://theweek.com/speedreads/950567/cybersecurity-czar-fired-by-trump-reportedly-set-trumpproof-line-succession To quote a commenter: >"Are you telling me that a cyber security specialist considered the framework he was operating in and created a mechanism to defend against outside exploitation of potential vulnerabilities to ensure the integrity and continuity of the operation?"

So it seems deepdotweb . com was seized by feds. Any informations on this?

>>13133 >>13118 very cheeky. I like it.

>>13239 isn't deepdotweb just a news site, not darknet market?

>>13248 Yes that's why I'm asking.

>>13254 That was my first thought yes. I rarely browsed this site so I was not sure about it.

https://www.zdnet.com/article/amnesia33-vulnerabilities-impact-millions-of-smart-and-industrial-devices/

>>13351 It IS remote code execution. Read the writeup. https://googleprojectzero.blogspot.com/2020/12/an-ios-zero-click-radio-proximity.html

>>13360 Read this, can confirm, it is NOT RCE. Please work on your reading comprehension.

I'm actually shocked that this wasn't posted yet. Security company fireeye hacked by nationstate actor. https://www.nytimes.com/2020/12/08/technology/fireeye-hacked-russians.html

>>13419 The US Treasury was also hacked: https://apnews.com/article/technology-politics-national-security-hacking-e8a2e819f7cc6982f6a72f8c85209b72 Some former NSA guy suspects fireeye and the treasury were hacked by the same actor exploiting the same vuln, and predicts more government agencies will announce breaches, but it looks like he's basing that just on timing.

>>13362 >>13369 >You're a liar, I didn't say that. It is 100% not RCE. No shellcode running, no root, no kernel memory, nothing. What are you talking about? The final portion of that article is detailing how he injected shellcode to send an arbitrary picture over http, with an end-to-end demo video.

>>13426 Are you not talking about the exploit in >>13360 and >>13360

>>13431 and >>13350 *

signal now decryptable by cellebrite (the pig's choice for "evidence gathering") https://www.cellebrite.com/en/blog/cellebrites-new-solution-for-decrypting-the-signal-app/

>>13448 > Signal not only uses end-to-end encryption for the data it sends, but the app also employs a proprietary open-source encryption protocol called “Signal Protocol™“ considering the app data is barely encrypted by default, it's not surprising that such a soykaf-teir company is able to scrape it.

do we know what caused the worldwide google outage this morning? I know that it comes from the authentification service, and I was hoping that it may have been a ru$$ian hack3r or some soykaff, but I can't find any informaion about it

>>13448 Any speculation on how this works? Think they got an actual exploit against the signal protocol or just a vuln that lets them read local storage on a comped phone? I'm guessing the latter but maybe that's wishful thinking.

>>13451 Probably grabbing keys from memory. If you don't want them to get your stuff, turn your phone off.

>>13450 There's probably a lot going on behind the scenes in the U.S. at the moment. It is very unlikely that this happened at the same time with the Russian attack. https://krebsonsecurity.com/2020/12/u-s-treasury-commerce-depts-hacked-through-solarwinds-compromise/

>>13458 >It is very unlikely that this happened at the same time with the Russian attack. I was supposed to say: It is very unlikely to be a coincidence. My brain at 3AM. Anyway, the impact of this attack on the U.S. infrastructure is massive.

>>13448 >but the app also employs a proprietary open-source encryption protocol called “Signal Protocol™ jej Yes, they can read all messages saved on your phone because you're such a braindead nigger who uses messaging app where contacts see your phone number making it easier for police to retrace step of every perpetrator even if one of them is caught, and you're not even capable of deleting or encrypting locally stored message history.

>>13458 >There's probably a lot going on behind the scenes in the U.S. at the moment. I mean, the national political system is melting down, I'm sure the vultures are moving in already

>>13458 Oh fuarrrk, I didn't really bother to pay attention to this because of a lot of family stuff, but my dad mentioned it at dinner yesterday, so I figured it might be big. Im a little concerned that the war hawks are threatening military action and retaliation since it was pretty much the entire US government got backdoored and who knows what got installed. I hope WW3 does not start over some kind of soykafty cyber espionage. If a 20 year billion dollar conflict could be started by some towers getting knocked down, what is going to happen because the ENTIRE government got backdoored and compromised?

>>13533 The general consensus is that nothing super important got accesses as the hack will only have hit surface level systems. Theres no reports of it managing to get past airgaps or onto classified systems.

Schneier: “We don’t know what networks they are in, how deep they are, what access they have, what tools they left” https://apnews.com/article/hacking-russia-bafff5557a8941aa1a5ef239d36c4e28

>>13549 Nah. General Consensus is extent of damage is unknown, and fireeye discovering this before USG is a huge intel failure. Getting the russians out of this many footfolds could be impossible or take years - See Iran Republican Guard compromise of US Naval Systems lasting over two years. Also, DOD and Intel customers may have had unclass systems with Solar Winds Management. Russians reading DOD unclassified email is a big deal.

>>13594 >and fireeye discovering this before USG is a huge intel failure. I bet in 6-12 months a congressional report will come out saying they knew all along but did nothing to stop it because they did not want to alert the hackers (like with the OPM hack where every government employee and contractor had their records including polygraph results stolen)

>>13533 You mean $6 Trillion? Off by a few orders of magnitude there.

>ticketmaster caught hiring hackers to hack into competitors irl corp wars. https://www.theverge.com/2020/12/30/22206955/ticketmaster-songkick-crowdsurge-hacking-deferred-prosecution-fine >russians hacked into microsoft for source code https://www.cnn.com/2020/12/31/tech/microsoft-source-code/index.html

How about secure messaging over dns? Firewalls won't help if dns leaks. https://dnskv.com

>>13448 This ended up being mostly bullshit, as the 'attack' requires physical access to an unlocked device. See edit: https://www.schneier.com/blog/archives/2020/12/cellebrite-can-break-signal.html

$5 says that today's Ameriburger LARP festival will be used as an excuse to write a new patriot act. Stay frosty.

>>13783 Why are you astroturfing this? You posted this on the DNS thread but didnt even bother to reply to why it would be used.

>>13812 probably they made it and they're trying to promote it. It's an interesting idea but pretty impractical.

>>9475 Any online guides or darknet chats where one could learn how to do this?

>>14185 google dorks.

New Old Bugs in the Linux Kernel ==== Dusting off a few new (old) vulns Have you ever been casually perusing the source code of the Linux kernel and thought to yourself "Wait a minute, that can’t be right"? That’s the position we found ourselves in when we found three bugs in a forgotten corner of the mainline Linux kernel that turned out to be about 15 years old. Unlike most things that we find gathering dust, these bugs turned out to still be good, and one turned out to be useable as a Local Privilege Escalation (LPE) in multiple Linux environments. Who you calling SCSI? The particular subsystem in question is the SCSI (Small Computer System Interface) data transport, which is a standard for transferring data made for connecting computers with peripheral devices, originally via a physical cable, like hard drives. SCSI is a venerable standard originally published in 1986 and was the go-to for server setups, and iSCSI is basically SCSI over TCP. SCSI is still in use today, especially if you’re dealing with certain storage situations, but how does this become an attack surface on a default Linux system? Through the magic of extensive package dependencies, rdma-core is one of the packages that ends up being installed in any of the RHEL or CentOS base environments that include a GUI (Workstation, Server with GUI, and Virtualization Host), as well as Fedora Workstations. Additionally, rdma-core could be installed on other distributions, including Ubuntu and Debian, due to its use as a dependency for many other packages (see Figure 1). On Ubuntu Server 18.04 LTS and earlier, this was installed by default. Read more here: https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html

Hacker Tillie (@NyanCrimeW) hacked Security company and got raided. She seems to be fully onboard with phineas phisher and everything else. Working with Donk_enby of Gab fame, and kirtaner of 420 fame. I'm surprised no one here has talked about it yet. https://www.theverge.com/2021/3/12/22328344/tillie-kottmann-hacker-raid-switzerland-verkada-cameras

>>15179 this is why havving a twitter account and posting about your adventures hacking is a stupid idea, kids.

>>15180 why why why why do people have stupid monikers or calling cards. that's the easiest way to get caught. Rule #1 shut the fuarrrk up Rule #2 see #1 Anyone worth a soykaf doesn't fuarrrking attest their own work.

>>15179 Social media skiddies get what's coming to them. I don't get why all these stupid hacker groups think its safe to post soykaf on data hording services.

>>15201 One of the most basic motivations for hackers, there is a great subsection of people who are solely motivated in displaying technological superiority & increasing ones own social status in hacker groups. For many, not publicly showing that they are capable of an act or gaining notoriety would make them not commit to hacking. It is rather strange, as it a stark contrast to professional criminals (or 'pro' hackers) who will often only commit a crime if they have a high probability of not being caught.

>>15180 >>15182 Even the fuarrrking university sec lecturers tell you that. Honestly, if the FBI want a few leads for free, get a sexy woman to visit bars near conferences and listen to all the thirsty nerds bragging about the bank they hacked. >>15179 Now let's see how much personal information dont and kirtaner shared in direct messages to them... hoping kirtaner doesn't get v&

>>15180 A theory could be that they want to join the alphabet soup. If you do not have the level to hire yourself into somewhere you might want use this advertisement method instead. You are guaranteed that they are going to read entirely your resume and you will get to talk to them. Even if the discussion does not go where you want there is a very large chance that you won't spend the next years in the street.

Facebook appears to have had 500+million name, email, phone number pairs leaked. Anyone know where?

>>15344 The Anon who did this is exceedingly based

>>15344 magnet:?xt=urn:btih:0595273ab674e05131a757f69f494a4285b429aa&dn=Facebook+Leak+%5B2019%5D%5B533M+Records%5D%5B106+Countries%5D for anyone who is interested

>>15344 pastebin /EEpSUUfC if one doesnt like torrents

>>15354 >>15355 Thank you, found several of my close family and sent out explenations and warnings.

>>15358 i found myself, lol. it was and old account it didnt have my full name either (even at that time i was paranoid of posting all my information on the internet) and i destroyed the sim card of the phone recently. However it stills scares me, like, that account didnt even exist anymore but the database still have some information of mine. fuarrrk u suckerberg

>>15362 at least his number is in there too, wonder how much he likes it when people trade his private info

>>15371 Do you think we should call him and tell him about it?

>>15355 >This file has been reported as a violation and is under review, download with caution wew, nice provider buddy

>>25355 >doesnt work without js, doesnt even work with js and tor what a fuarrrking soykaf tier site

About the Facebook leak: very disappointed. Just full name and city's . Untill now the only use I found to this was to search where a surname is more common

https://www.nbcnews.com/tech/security/fbi-might-gone-ahead-fixed-microsoft-email-server-rcna680 >The FBI has begun quietly accessing hundreds of American computers hacked through Microsoft’s Exchange email program, removing malicious code that the hackers left behind.

Senators Let NSA Hunt Cyber Actors Inside the US Several members of the Senate Armed Services Committee on Thursday voiced their support for expanded authorities for the NSA and U.S. Cyber Command to conduct more intelligence gathering domestically, something that the Biden administration already is exploring Former NSA general counsel Glenn Gertstell has argued that an expansion of NSA authorities to collect domestic intelligence is overdue. “It can’t possibly be the case that the Fourth Amendment ties our hands"

>>15572 forgot link https://www.defenseone.com/technology/2021/03/senators-offer-let-nsa-hunt-cyber-actors-inside-us/172938/

Beechat Networkshas released a test utility to showcase their Java interface to the post quantum KEM algorithm. It effectively allows you to easily encrypt decrypt files with a post quantum crypto KEM. See it in action: https://www.youtube.com/watch?v=5UeG-aVs_C4

Has anyone found the leaked police data yet, I cannot find it. DDos confirmed leak. https://www.nytimes.com/2021/04/27/us/dc-police-hack.html Police response to leak. https://youtu.be/qQSFKgnBQ7M Malware used. https://blog.cyberint.com/babuk-locker

>>15619 They posted an update today. I think they took down the links while they're negotiating. Maybe they'll put stuff back up. You can find the onion address to their leak site on Raid Forums

>>15623 Present Day, Present Time! AHAHAHAHAHA! https://thehackernews.com/2021/05/ransomware-gang-leaks-metropolitan.html

>>15745 Full leak is up if you're still interested.

>>15748 They got caught using stolen asset money for a secret drone program in chicago. https://chicago.suntimes.com/city-hall/2021/5/11/22425299/cpd-chicago-police-drone-secret-emails-hack-lori-lightfoot-dodsecrets-city-hall

>>15748 I'm interested. Is there a torrent or other means of getting the files up? I can't get to their onion site.

TOR is not compro... https://thehackernews.com/2021/05/over-25-of-tor-exit-relays-are-spying.html https://archive.is/C(u)ck0 [Lainchan Filter] The URL even has the word cuсk on it lul.

>>15767 In other news... https://www.bleepingcomputer.com/news/technology/tor-project-auctions-off-the-first-onion-url-ever-created-as-an-nft/ https://archive.is/2V2Ej

>>15767 This is just a repeat of last years, ironically this is probably good for the intended purpose of the tor network of hiding from state level actors because its organised criminals using it to replace bitcoin addresses rather than the NSA. If you are halfway competent this shouldn't even effect you as it relies on SSL stripping thus you can see when its happening.

>>15767 It has always been standard to treat exit relays as untrusted. It's the most obvious point of attack.

New protonmail has been audited: https://protonmail.com/blog/security-audit/

White house is building a ransomware task force and is considering hackback a potential solution. >“We’ve got to send a very strong, even disproportionate, message to Russia that we’re not going to tolerate this,” House Homeland Security ranking member John Katko (R-N.Y.) https://www.politico.com/news/2021/07/14/white-house-ransomware-task-force-499723 Do you think america will ever pull a russia and just say "go crazy on slavic countries."

>>16654 NSA are almost certainly all up in every slavic country right now, either overtly or covertly including Russia. That said the US isnt going to do some cyber privateer soykaf and let Mandiant ransomware Gazprom.

>>16655 Don't forget rosneftgaz I agree, I don't think the US IC will start ransomware-ing back. It'd be hilarious if we did tho.

>>16661 Sage autofilled, so now I guess I have to contribute to the discussion and bump the thread. >Do you think america will ever pull a russia and just say "go crazy on slavic countries." I personally think that happened already to be honest, but I may also be completely wrong. What I'd like to know is: Do less Non-RU aligned actors target RU as much as the RU targets Non-RU aligned states? If not, why? Not even talking state sponsored. I think a decent percent of RU/CN breaches are state sponsored, but I also think there is a portion of them that RU/CN know exactly who did it, they just don't/won't care. So not overtly sponsoring, but tacit sponsorship through not giving a soykaf. I don't really pay too much attention to that side of things so I stand to be corrected.

>>16661 As we speak the top minds at the NSA are writing a worm that will change the background of any computer with the Russian language pack installed to furry porn.

https://www.zdnet.com/article/nasty-linux-systemd-security-bug-revealed/ Fresh. Linux, susstemd, general crapfest.

All your pipeline are belong to us https://therecord.media/us-says-chinese-hackers-breached-13-pipeline-operators-between-2011-and-2013/

I'm shocked no one is actually talking about this here. Recent hacker angry at employers(Conti a RAAS) leaked manuals and software to piss them off. here is the manuals: https://vxug.fakedoma.in/tmp/ManualsAndSoftware.rar https://www.bleepingcomputer.com/news/security/angry-conti-ransomware-affiliate-leaks-gangs-attack-playbook/

>>17011 dude fuk hyeah i tell you hwat, this is why i browse chans you're doing gods work today anon. i mean real god, the god of the torah, not that kikeonapike

Belarus citizen database leaked. Anyone has sources? https://nitter.unixfox.eu/TadeuszGiczan/status/1424734527713382402

>>17087 As a Belarusian this news made me happy. fuarrrking Lukashitcunt. I hate that fuarrrker so much and all of his supporters can go burn in hell.

>>17081 I'll post if I find any new updates, there was news he was going to leak more doc's. However he plans on charging because of how much his bosses flaked on him

Anons hacked Epik, the domain registrar! https://4chan.partyvan.epikfail.win:55899/ Torrent: https://4chan.partyvan.epikfail.win:55899/OperationEpikFail.torrent

>>17415 anything of interest yet?

>>15573 >The government already has the authority to watch every bit of data going in and out of federal networks. [The Cyber Infrastructure Security Agency] and NSA still missed the SolarWinds backdoor calling home for further instructions. The problem here isn’t our privacy laws, but that the government is failing cybersecurity 101. Some in the government now want to ask for new, warrantless surveillance of Americans’ communications to distract Congress from asking unpleasant questions about why CISA’s $6 billion cyber shield failed to stop or detect the hacks. Absolutely true. CISA is a scam

>>17418 They posted the entire thing on ddosecrets https://ddosecrets.com/wiki/Epik Ofcourse there is the usual passwords that are the same as the username Greg and Kirt jumped into the Q&A with Rob Monster (CEO of Epik) https://www.youtube.com/watch?v=aZ9MFts28XI

>>17829 Dang. That's a pretty cool attack. I can only imagine how weird it must be for people that manage public projects ATM. Anyone worried about this?

>>17839 >Anyone worried about this? I just hope that compilers and other tools will be updated to somehow detect this kind of attacks.

>RCE 0-day exploit found in log4j, a popular Java logging package | LunaSec https://www.lunasec.io/docs/blog/log4j-zero-day/

>>17428 clearly these "patriotism-autism" are just scams, what they target are the citizens who partake into human rights activities, people of clothing, and non-corrupt politicians and journalists/news companies' iMacs, that's all where the budget is going worldwide and for the same reason they targeted and successfully inflicted suicide to lot of turkish/arabian journalists or literally any journalist in some countries with civil unrest with pegasus, and installed backdoors on literally journalists and priests of all people, I guess they don't have the funding to install spyware over actual criminals, offenders, or former convicts, no they chose to backdoor the good guys, install malware over airports and install dirt, infiltrate ceos, this is why most ceos only use throwaway laptops when they go on some foreign conference or hotel. remember the "amazon review killer"? no they don't even have any kind of backdoor or wiretap when those people went missing, even the coordinates which are available over base station logs exist but they just spent an entire year or more to finally have a go signal just because the "facebook account needed court permission". It's funny how there's a lot of missing people around the world and none of these projects had ever helped anyone at all, and most of all these surveillance were instead used against people who had strong opinions (not involving actual violence )against their countries governance but in the end you can even guess who's six feet buried beneath, truly these surveillance/backdoors serve assassins the best, it's the best way to eliminate those that oppose people in power.

>>18278 >org is split into a few sections all with their own IT who all work mostly independently of each other >org doesn't give a soykaf how a section dose things as long as they maintain uptime >boss of my section is hardcore old school unix guy >he dose everything by hand the hard, once told me men use apache and children use nginx >see soykaf about log4j online friday and expect to get call for weekend shift >radio silence....... >come to work on monday ask boss man what the situation is >"well lainon, I've always hated java and made the choice not to use when possible, so i don't think we have anything that would be affected. Find a way to verify for me before the end of the day, but i'm not really worried at all." >go to desk, write 20 line bash script using tool from github to scan for vulnerabilities, deploy to entire network within an hour >decide to check company wide IT chat >find out every other IT Section has had people pulling 24 HR shifts since friday because of this >turns out 50% of their infrastructure is oracle products running on aws and 50% is largely containers they randomly pulled from the internet and configured through a web portal >they have little to no understanding of how their soykaf works under the hood, and they never took the time to automate anything because until today there was a button for everything they wanted to do >check script output 2 vulnerabilities found in some old archived home dir >Delete them and open chat again >"wow crazy morning huh fellas? I'm afk for a bit and go grab some coffee" I would offer to do something, but maybe calling them a priest would be more help?

>>18336 working under oldschool UNIX guys is always the best, they actually understand how software is supposed to work.

>>18272 Does anybody know if there is a DNS based RCE? All i can find is LDAP. We use outbound firewalls so I'm not too afraid but obviously allow DNS so I'm still a bit concerned.

>>18338 There aren't currently any POCs that use DNS to get RCE. That might be because its not possible, or because criminals are the only people who know how to do it ATM. There are a few out right now that can be used to enumerate your internal network. I haven't looked into those specifically yet, but from what i understand normal DNS protections should be able to help you there. BTW most of the attempts we've been seeing randomize their outbound LDAP port every 5 ish requests, so be sure to block on LDAP traffic specifically.

>>18339 >That might be because its not possible Let's hope for that and not that only the criminals know how to. >so be sure to block on LDAP traffic specifically. We block everything by default. You have to explicitly allow every DST IP + port individually even to internal systems.

>>18340 >We block everything by default. You have to explicitly allow every DST IP + port pretty sure both attacks require the victim to hit a malicious server. If you're confident in your whitelist then you should be fine either way.

Israel police uses NSO’s Pegasus to spy on citizens: https://www.calcalistech.com/ctech/articles/0,7340,L-3927410,00.html >"Police first acquired Pegasus from NSO in December 2013 during the tenureship of Yohanan Danino as General Commissioner of Israel Police. The system became operational under his successor Roni Alsheikh, who was appointed as General Commissioner in December 2015 after serving as the deputy head of Shin Bet. Alsheikh was among those who pushed to increase the usage of the spyware, which cost police tens of millions of shekels down the years when calculating its purchase, maintenance, and ongoing usage. The person who negotiated with police on behalf of NSO was then CEO Eran Gorev, who was the representative of investment firm Francisco Partners, which owned NSO at the time."

Ukraine cyberpunks spamming Russian number stations. https://www.vice.com/en/article/y3vbjj/pirates-spammed-an-infamous-soviet-short-wave-radio-station-with-memes-uvb-76

>>18592 oi cheeky wanker you got a loisense for those single quote marks? could be SQL inject'n there mate.

>>18774 Mozilla is supposedly a """non-profit""" organization. Yet their CEO makes 6 million USD a year for sucking Google's cock and selling telemetry. Can some of you anglo swines explain how this majick works?

>>18774 >targeted ads That's not what their system is aiming to do. The goal is to let advertisers see roughly how many impressions their ads have gotten without being able to tie the impressions to the users who saw them. >why would Mozilla need to collaborate with Zuckerberg to make it happen? Meta is one of the worst offenders when it comes to violating privacy with their systems. If you want to fix that, you have to have solutions that Meta is going to use, otherwise they'll just continue using their existing system. It's also worth noting that this is something that anyone who displays ads probably wants. Meta doesn't want any advertiser who uses their service to get your unique ID and use that to run their own targeted ads. They want advertisers to go "whatever blackbox soykaf they're doing over there gave us x unique views and y purchases" The Mozilla blog post about it links to a technical spec and a less technical slideshow ( https://docs.google.com/presentation/d/1NpQz0Wm73eEKw24V7B0yCjq4Tw2qPgeezhMfS0-P-TY/mobilepresent#slide=id.g1069e0191ac_0_130 sorry for Google but that's where they hosted it) >Couldn't they test and prod such a radical concept themselves? They have been. >xda-developers post with Twitter quotes to fuel drama news >>18775 Yes, but it's not /sec/ related.

>>18592 But why would they do this? Are they unaware of the fact that infosec people tend to evolve organically from hubs of petty cybercrime? Putting any sort of friction up in the industry just encourages people to ignore it, rather than to comply with it.

>>18592 UK government being utterly fuarrrking retarded again? God what a surprise.

>>18779 wow you really shut me up, thanks for clearing most of my grievances about this respectfully. appreciate it greatly.

>>18773 I got ya Loicense right here, by the queen.

>>18775 Vast majority of free-opensource software need funding for development especially at large scale, mega-corps donate to fill orders for software and push ad's or at least a good PR with the tech crowd at large.

Raid forums domain seized, confirmed by VXundergound https://twitter.com/vxunderground/status/1500046036060053504 As of right now it's hosting a phishing page to grab creds it may not have the actual server, cloudflare is also confirmed to be working with them.

RIAEvangelist/node-ipc package is malware The package contains obfuscated code that targets users based on their nationality (or users based on the country they are connecting from) This affects at least the node-ipc versions >= 10.1.1, < 10.1.3 https://github.com/advisories/GHSA-97m3-w2cp-4xx6 https://archive.is/n8oBX https://nvd.nist.gov/vuln/detail/CVE-2022-23812 https://github.com/RIAEvangelist/node-ipc/issues/319 https://github.com/RIAEvangelist/node-ipc/issues/236 https://github.com/RIAEvangelist/node-ipc/issues/233 >But, chaos unfolded when [newest] versions of the famous 'node-ipc' library—also maintained by RIAEvangelist, were seen launching a destructive payload to all data and overwrite all files of users installing the package. >Interestingly, the malicious code, committed as early as March 7th by [RIAEvangelist], would read the system's external IP address and only delete data by overwriting files for users based in Russia and Belarus. >The code present within 'node-ipc', specifically in file "ssl-geospec.js" contains base64-encoded strings and obfuscation tactics to mask its true purpose: https://www.bleepingcomputer.com/news/security/big-sabotage-famous-npm-package-deletes-files-to-protest-ukraine-war/

>>18952 >THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED [...] IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY... What did they mean by this?

>>18953 >What did they mean by this? They knew they were going to stir up soykaf and shat out words to "maybe" avoid legal soykaf that guy is a total idiot because it's hurting FOSS rather than helping anything at all, but also this train wreck is hilarious and I still can't believe this happened because one guy doomscrolled too much and tried to "help" by breaching privacy and trust

>>18895 What's the closest thing we have to RF now? The Tor version of /baph/?

>>18952 >virtue signalling code monkey codes his open source to be destructive malware on Russian/Belarus computers. >Server of charity in Belarus collecting evidence of Russian war crimes has evidence deleted. Oh the irony. >hurr durr "no liability clause" it will still be tested in court

>>18965 Defo. They will still get hit with something because the code was intentional and malicious. It feels like shanking someone for no reason and claiming self-defense. >has evidence deleted. smh my head

>>18953 >code malware >make it open source >supply chain attack >haha I can't go to jail because I had this text in my folder I don't think it works that way.

>>18775 if you mean on a financial standpoint, I work for non-profits. you should stop thinking of non-profits as what they literally say they are and more like a company that cannot keep their profits and have stricter reinvestment restrictions. However, their profit margins are directly based around how much they bring in, so for example I will do this real rough: the CEO cannot take more than say, 5% of the actual total income of the year so mozilla is raking in huge amounts of cash from somewhere...that should tell you all you need to know to stay the fuarrrk away from it

LAPSUS$ Teens caught by feds after hacking okta Okta got into a bit of hot water after not notifying anyone for 3 months after hack, teens were eventually caught. https://gizmodo.com/teens-arrested-in-hack-of-microsoft-and-okta-but-havent-1848702141

>>18994 They even asked a journalist at motherboard for help ransoming the company. lmao. >Similarly, Motherboard journalist Joseph Cox has written about his encounters with the gang—the likes of which range from the bizarre to the outright comical. To hear Cox tell it, LAPSUS$ haplessly reached out to him for help after it hacked EA Games last summer. The gang, which was unsure of how to ask EA for a ransom, seemed to think that because Cox was a journalist he could liaise with the company and “act as a conduit” for the gang’s financial demands. https://gizmodo.com/who-is-lapsus-the-gang-hacking-microsoft-samsung-an-1848686059

Technical Report into the AMD Security Processor "The review discovered 19 issues which have been fixed by AMD in public security bulletins. These issues ranged from incorrect use of cryptography to memory corruption in the context of the AMD Secure Processor firmware. The report describes some of the more interesting issues that were uncovered during the review as well as providing a background on the AMD Secure Processor and the process the team took to find security issues." >https://googleprojectzero.blogspot.com/2022/05/release-of-technical-report-into-amd.html >https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/AMD_GPZ-Technical_Report_FINAL_05_2022.pdf >https://cloud.google.com/blog/products/identity-security/google-amd-partner-to-build-a-more-secure-future-with-confidential-computing

>>18964 God damn the FBI. I was trying to download all the leaked databases from RF. Where do I go to get breach data now?

>>19291 Breached.co is the replacement site that's up now. Someone already made a compilation of all of RF dbs

More Pegasus fun! This time targetting Catalonian independence leaders. https://www.reuters.com/world/europe/catalan-independence-leaders-targeted-by-spyware-rights-group-says-2022-04-18/

Hertzbleed >Hertzbleed is a new family of side-channel attacks: frequency side channels. >Hertzbleed takes advantage of our experiments showing that, under certain circumstances, the dynamic frequency scaling of modern x86 processors depends on the data being processed. >To our knowledge, Intel and AMD do not plan to deploy any microcode patches to mitigate Hertzbleed. >Why did Intel ask for a long embargo, considering they are not deploying patches? -- Ask Intel. https://www.hertzbleed.com/ https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1038 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00698.html

>>19305 >independence leaders >journalists >human rights activists (the good kind) >priests >politicians (the good kind) wtf is going on. the anti-christ is going all out now heh?

>>19292 403? gg guess thats it or its phishing now

>>19292 Breach.co demands shekels in return for letting you download breach databases. Are any lain anons interested in making a thread of links to freely available copies of breach data they've found on the web?

Nist finally selected their first round of Quantum-Resistant Cryptographic Algorithms TLDR; when quantum computers reach a point of optimization in which they become productive, they're expected to be able to decipher current encryption, trivially. So using encrypted comms like HTTPS or SSH would be pointless. These new cryptographic algorithms are complex enough that even a quantum computer shouldn't be able to decipher them. https://www.nist.gov/news-events/news/2022/07/nist-announces-first-four-quantum-resistant-cryptographic-algorithms

Just subrscibed to cryptome newsletter and the fella there is just a commie 0ropagandist wtf

>>19662 okay thats great and all but is any of that in the actual communist manfiesto, or is this all marketing.

>>19661 It was stuff most people already knew, Hunter likes drugs and hookers. I heard DDOSecrets was putting up a mirror of their findings. Surprising because their a hardcore anarcho group.

>>19665 >hardcore anti gov group supports distribution of material that makes gov look like degenerate criminal hypocrites I don't see the inconsistency here

>>19665 >Surprising because their a hardcore anarcho group trying to jump on the bandwagon, they're irrelevant to the findings or the search

>>19666 it's that DDOSecrets are far left and 4ch is very far right. >>19667 I wouldn't agree with that assessment they have been mirroring leaks of hunter biden for awhile now. https://ddosecrets.substack.com/p/release-hunter-biden-emails-36-gb

>>19668 I wouldn't even call 4chan "very far right". They're basically just edgy, racist right-wing liberals (Conservatives, basically.) -- Some of them are probably far-right, but I'm finding those guys to be more rare over time.

>>19669 No, conservatives glorify things like hard work, community and family. The average 4channer values none of this and is bitter because life hasn't happened to him yet despite never having put in any effort to make it happen, and is quick to find anyone else to blame for it.

Retbleed: Arbitrary Speculative Code Execution with Return Instructions on x86 CPUs >Unlike its siblings, who trigger harmful branch target speculation by exploiting indirect jumps or calls, Retbleed exploits return instructions. >This means a great deal, since it undermines some of our current Spectre-BTI defenses. >One such defense that many of our operating systems use today is called retpoline. Retpolines work by replacing indirect jumps and calls with returns. >As it turns out however, Retbleed is indeed practical to exploit, thanks to the following two insights: >We found that we can trigger the microarchitectural conditions, on both AMD and Intel CPUs, that forces returns to be predicted like indirect branches. We also built the necessary tools to discover locations in the Linux kernel where these conditions are met. >We found that we can inject branch targets that reside inside the kernel address-space, even as an unprivileged user... >We have verified that Retbleed works on AMD Zen 1, Zen 1+, Zen 2 and Intel Core generation 6–8. https://comsec.ethz.ch/research/microarch/retbleed/

Intel Microcode Decryptor by chip-red-pill "At the beginning of 2020, we discovered the Red Unlock technique that allows extracting Intel Atom Microcode." >Can I make a custom microcode update? No, you can't. Only decryption is supported, because microcode has an RSA signature for integrity protection. >How you had extracted the keys? Using vulnerabilities in Intel TXE we had activated undocumented debugging mode called red unlock and extracted dumps of microcode directly from the CPU. We found the keys and algorithm inside. https://github.com/chip-red-pill/MicrocodeDecryptor https://yewtu.be/watch?v=V1nJeV0Uq0M

>>19711 :OOO Intel microcode laid bare! I really appreciate these guys' efforts so much.

Which tech/sec/privacy sites that I should follow with RSS feed?

I think someone hacked Yahoo 1) Fresh Firefox profile 2) Create Primary/Master password 3) You can even disable `signon.autofillForms` so the password prompt should never show 4) Open https://finance.yahoo.com/quote/SPY 5) It prompts you for password WTF I spent an hour in developer tools trying to figure out wtf this is.

Malicious npm packages steal Discord users’ payment card info >The malware used in these attacks is a variant of the open-source and Python-based Volt Stealer token logger and JavaScript malware dubbed Lofy Stealer, according to Kaspersky security researchers >The malware is automatically deployed after installing the small-sm, pern-valids, lifeculer, or proc-title malicious npm modules. https://www.bleepingcomputer.com/news/security/malicious-npm-packages-steal-discord-users-payment-card-info/

CVE-2022-29582 - An Linux io_uring vulnerability https://ruia-ruia.github.io/2022/08/05/CVE-2022-29582-io-uring/ C23 is Finished: Here is What is on the Menu >constexpr >#embed >the nullptr constant >memset_explicit + see https://man.openbsd.org/explicit_bzero for comparison. >etc... https://thephd.dev/c23-is-coming-here-is-what-is-on-the-menu DHS warns of critical flaws in Emergency Alert System devices The government being incompetent as usual... > The Department of Homeland Security (DHS) warned that attackers could exploit critical security vulnerabilities in unpatched Emergency Alert System (EAS) encoder/decoder devices to send fake emergency alerts via TV and radio networks. > Hackers can disrupt legit warnings or issue fake ones of their own. https://www.bleepingcomputer.com/news/security/dhs-warns-of-critical-flaws-in-emergency-alert-system-devices/ https://arstechnica.com/information-technology/2022/08/huge-flaw-threatens-us-emergency-alert-system-dhs-researcher-warns/ Linus Torvalds uses an ARM-powered M2 MacBook Air to release latest Linux kernel First he took the CoCk and then he become a Mac user?! **He uses Asahi Linux. :)** > Also worth noting is that Torvalds believes that the 5.20 release of the Linux kernel will end up becoming version 6.0, not because of any specific feature updates but because he's "starting to worry about getting confused by big numbers again." https://arstechnica.com/gadgets/2022/08/linus-torvalds-uses-an-arm-powered-m2-macbook-air-to-release-latest-linux-kernel/ Qualcomm’s M1-class laptop chips will be ready for PCs in "late 2023" Hopefully, this will help escaping the x86 botnet. ARM laptops have better battery life, too! https://arstechnica.com/gadgets/2022/04/qualcomms-m1-class-laptop-chips-will-be-ready-for-pcs-in-late-2023/ This 6-inch board turns a Raspberry Pi module into a DIY router https://arstechnica.com/gadgets/2022/08/this-6-inch-board-turns-a-raspberry-pi-module-into-a-diy-router/ Slack resets passwords after exposing hashes in invitation links https://www.bleepingcomputer.com/news/security/slack-resets-passwords-after-exposing-hashes-in-invitation-links/ Post-quantum encryption contender is taken out by single-core PC and 1 hour https://arstechnica.com/information-technology/2022/08/sike-once-a-post-quantum-encryption-contender-is-koed-in-nist-smackdown/

>>19796 >DHS warns of critical flaws in Emergency Alert System devices reminds me of the time it got hacked and faked a zombie apocalypse https://www.tampabay.com/news/A-fake-Zombie-Outbreak-alert-alarms-Lake-Worth-residents-_168461999/

CISA warns of Windows and UnRAR flaws exploited in the wild >CVE-2022-34713 >Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability. >The issue was initially reported to Microsoft by researcher Imre Rad in January 2020 but his report was misclassified as not describing a security risk and dismissed as such. Another case of proprietary software not getting security patches. >CVE-2022-30333 >RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. https://www.bleepingcomputer.com/news/security/cisa-warns-of-windows-and-unrar-flaws-exploited-in-the-wild/ Cisco hacked by Yanluowang ransomware gang, 2.8GB allegedly stolen >The company revealed that the attackers could only harvest and steal non-sensitive data from a Box folder linked to a compromised employee's account. >The Yanluowang threat actors gained access to Cisco's network using an employee's stolen credentials after hijacking the employee's personal Google account containing credentials synced from their browser. https://www.bleepingcomputer.com/news/security/cisco-hacked-by-yanluowang-ransomware-gang-28gb-allegedly-stolen/ GitHub's new privacy policy sparks backlash over tracking cookies >Developers are furious at GitHub's upcoming privacy policy changes that would allow GitHub to place tracking cookies on some of its subdomains. >The Microsoft subsidiary announced this month, it would be adding "non-essential cookies" on some marketing web pages starting in September, and offered a thirty-day "comment period" for users. >The """non-essential cookies""" in this context, better known as "tracking cookies" refer to a class of cookies that are shared across multiple websites and web services. https://www.bleepingcomputer.com/news/security/githubs-new-privacy-policy-sparks-backlash-over-tracking-cookies/ Alternative code hosting sites: >https://gitlab.com/explore >https://gitgud.io >https://codeberg.org >https://bitbucket.org (But I don't know if they are much better, though) >https://notabug.org >https://sr.ht >https://git.lain.church >https://gitlab.lain.la

>>19816 >gitlab.com I'd like to remind you that it's Cloudflared.

1900 Signal users’ phone numbers exposed by Twilio phishing >Signal, like many app companies, uses Twilio to send SMS verification codes to users registering their Signal app. >With access to Twilio's customer support console, attackers could have potentially used the verification codes sent by Twilio to activate Signal on another device and thereby send or receive new Signal messages. >Or an attacker could confirm that these 1,900 phone numbers were actually registered to Signal devices. >Signal is asking users to enable registration lock, which prevents Signal access on new devices until the user's PIN is correctly entered. https://arstechnica.com/information-technology/2022/08/twilio-phishing-attack-exposes-phone-numbers-for-1900-signal-users/ https://support.signal.org/hc/en-us/articles/4850133017242 Update Zoom for Mac now to avoid root-access vulnerability https://arstechnica.com/information-technology/2022/08/zoom-patches-mac-auto-updater-vulnerability-that-granted-root-access/ Microsoft blocks UEFI bootloaders enabling Secure Boot bypass >The three Microsoft-approved UEFI bootloads that were found to bypass the Windows Secure Boot feature and execute unsigned code are: * New Horizon Datasys Inc: CVE-2022-34302 (bypass Secure Boot via custom installer) * CryptoPro Secure Disk: CVE-2022-34303 (bypass Secure Boot via UEFI Shell execution) * Eurosoft (UK) Ltd: CVE-2022-34301 (bypass Secure Boot via UEFI Shell execution) https://www.bleepingcomputer.com/news/security/microsoft-blocks-uefi-bootloaders-enabling-windows-secure-boot-bypass/

>>19865 >>6679 The number of companies caught up in the Twilio hack keeps growing >https://arstechnica.com/information-technology/2022/08/the-number-of-companies-caught-up-in-the-twilio-hack-keeps-growing/ Ransomware Actor Abuses Genshin Impact Anti-Cheat Driver to Kill Antivirus >https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html >https://www.bleepingcomputer.com/news/security/hackers-abuse-genshin-impact-anti-cheat-system-to-disable-antivirus/ ETHERLED: Air-gapped systems leak data via network card LEDs >https://www.bleepingcomputer.com/news/security/etherled-air-gapped-systems-leak-data-via-network-card-leds/ Microsoft: Russian malware hijacks ADFS to log in as anyone in Windows >https://www.bleepingcomputer.com/news/security/microsoft-russian-malware-hijacks-adfs-to-log-in-as-anyone-in-windows/ Atlassian Bitbucket Server vulnerable to critical RCE vulnerability https://www.bleepingcomputer.com/news/security/atlassian-bitbucket-server-vulnerable-to-critical-rce-vulnerability/ GitLab ‘strongly recommends’ patching critical RCE vulnerability >https://www.bleepingcomputer.com/news/security/gitlab-strongly-recommends-patching-critical-rce-vulnerability/ Windows Terminal is now the default terminal in Windows 11 dev builds >https://www.bleepingcomputer.com/news/microsoft/windows-terminal-is-now-the-default-terminal-in-windows-11-dev-builds/ MacBook self-repair program highlights Apple’s flawed repairability progress >On Tuesday, Apple expanded its self-service repair program to M1-based MacBooks. Giving customers repair manuals and the ability to buy parts and buy or rent tools for M1 MacBook Airs and M1 MacBook Pros is a far cry from the Apple of yesteryear. >https://arstechnica.com/gadgets/2022/08/macbook-self-repair-program-highlights-apples-flawed-repairability-progress/ Never buy anything from Apple. They are making it much harder than necessary to even replace the battery. Scientists explore chemistry of tattoo inks amid growing safety concerns >https://arstechnica.com/science/2022/08/whats-in-that-tattoo-ink-labels-are-often-inaccurate-study-finds/ Google’s Fuchsia OS is taking over smart displays, now on its second device >https://arstechnica.com/gadgets/2022/08/googles-fuchsia-os-lands-on-its-second-device-the-nest-hub-max/ LastPass developer systems hacked to steal source code >https://www.bleepingcomputer.com/news/security/lastpass-developer-systems-hacked-to-steal-source-code/ Use KeePass or KeePassXC instead.

https://github.com/kagancapar/CVE-2022-29072 winSHIT got rekt 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area.

Uber got hacked, claimed to be done by a 18 year old. tl;dr SE someone over sms, got vpn access found admin/AD and backup / and everything in some powershell scripts on some open access smb shares. https://www.forbes.com/sites/daveywinder/2022/09/15/has-uber-been-hacked-company-investigates-cybersecurity-incident-as-law-enforcement-alerted/?sh=371f7e7115b4 Twitter's been having fun as he basically posted everything to twitter and told sys admins how he did it.

>>20123 I assume 7zip has to be running with escalated privileges already, so how how would one actually exploit this without already being able to escalate programs? Doesn't the user have to be admin already to grant admin privileges to a program, or does Windows have an analogue to setuid? >>20134 It makes me sad that basically all hacks are accomplished by pretty much just asking people for their passwords.

Apparently Matrix's Olm / Megolm end to end encryption protocol, or more specifically the the Element client in particular, has a few bugs to do with cross signing and authentication that enable a malicious homeserver to compromise authentication and confidentiality for users that trust cross-signed identities. This paper was very refreshing to read, and it explains the crypto used in Matrix quite well, I hope you all enjoy: ###Practically-exploitable Cryptographic Vulnerabilities in Matrix The best part of the paper that you all care about: >A. Vulnerability In the SAS protocol, two parties compute a shared secret, then compare this shared secret through an authenticated out-of-band channel. Once established, the shared secret is used as the MAC key for an m.key.verification.mac message, containing the cryptographic identities for the other party to sign. In our attack, the homeserver is able to trick each party into including a homeserver controlled key inside their message. In effect, requesting the other device to sign a homeserver controlled identity, rather than their own. Recall that in the context of cross-signing, out-of-band verification is used in two cases. First, where two users’ devices verify each other; and, second, where a user verifies a new device (self-verification). However, [6]Element provides a setting to “Never send encrypted messages to unverified sessions from this session”. We suggest this is made the default behaviour. However, this does not prevent attacks against authentication. In [32] a solution to a similar problem is detailed (with the additional requirement that the membership list is kept private). the SAS.SendMAC (Fig. 12) algorithm, which generates m.key.verification.mac messages (Fig. 4), does not distinguish between these two cases. It always sends both keys. {"mac": {"ed25519:<device_id>": SAS.CalcMAC(k, apk, c || "ed25519:<device_id>"), "ed25519:<mpk>": SAS.CalcMAC(k, mpk, c || "ed25519:<mpk>"),}, "keys": SAS.CalcMAC}( k, sort("ed25519:<device_id>", "ed25519:<mpk>"), c || "KEY_IDS") Fig. 4: The format of an m.key.verification.mac message for a user with cross-signing setup. {"mac": {"ed25519:<mpk'>": SAS.CalcMAC(k, apk, c || "ed25519:<mpk'>"), "ed25519:<mpk>": SAS.CalcMAC(k, mpk, c || "ed25519:<mpk>"),}, "keys": SAS.CalcMAC( k, sort("ed25519:<mpk'>", "ed25519:<mpk>"), c || "KEY_IDS")} Fig. 5: An m.key.verification.mac message gener- ated by a user with cross-signing master verification key 𝑚 𝑝𝑘, long-term device key 𝑎 𝑝𝑘 and device identifier 𝑚 𝑝𝑘 ′ (which is also the master verification key of a homeserver controlled cross-signing identity). Whilst the two entries in the mac dictionary could be distinguished by the differing second argument given to SAS.CalcMAC, SAS.VerifyMAC interprets the first entry as a device, and then passes it to SAS.SignDevice which interprets it as a cross-signing identity. 1) Cross-signing keys as devices: Within matrix-js-sdk and Synapse, cross-signing identities are sometimes treated as devices. The same is true in the SAS protocol, as noted in the Client-Server API specification [1].8 Thus, in some cases the string 𝑥 in ed25519:<x> is interpreted as a device identifier, and in others it is interpreted as a cross-signing master verification key. Since the homeserver allocates device identifiers, it is able to generate a string that is both a valid device identifier and a valid cross-signing master verification key. In this attack, the homeserver generates a cross-signing identity for the user they would like to impersonate, then sets this as the device identifier for the user’s first device. Figure 5 demonstrates the format of such a message. 2) Processing of m.key.verification.mac: When processing m.key.verification.mac messages, 8“Verification methods can be used to verify a users master key by using the master public key, encoded using unpadded base64, as the device ID, and treating it as a normal device. For example, if Alice and Bob verify each other using SAS, Alices m.key.verification.mac message to Bob may include “ed25519:alices+master+public+key”: “alices+master+public+key” in the mac property. Servers therefore must ensure that device IDs will not collide with cross-signing public keys.” matrix-js-sdk handles the aforementioned ambiguity inconsistently. Referring to Fig. 5, 𝑚 𝑝𝑘 ′ is both a valid device identifier and cross-signing master verification key. However, the MAC that has been calculated includes the device identity key of the device it maps to. It can only pass the MAC verification as a device, not as a cross-signing master keys. When verifying the MACs in the message, SAS.VerifyMAC (Fig. 12) first checks if the string is a device identifier, then checks if it maps to a cross-signing identity. The entry for 𝑚 𝑝𝑘 ′ passes verification as if it were a request for a device to be verified. When fulfilling the signing request, SAS.SignDevice (Fig. 12) first checks if the string maps to a cross-signing identity, then checks whether it is a device identifier. If the processing device has an entry for 𝑚 𝑝𝑘 ′ in its cross-signing directory, it will sign the user and cross-signing identity then upload it to the homeserver.

>>20273 >B. Attack Consider a setting with two users: Alice 𝐴 and Bob 𝐵, each with device 𝐷 𝐴,1 and 𝐷𝐵,1 respectively. Additionally, they are both registered to a malicious homeserver, whose aim is to compromise their out-of-band verification with the SAS protocol. The attack proceeds as follows: 1) When Alice 𝐴 registers their account with the homeserver, the homeserver generates a parallel cross-signing identity with verification keys (mpk′ 𝐴, spk′ 𝐴, upk′ 𝐴). 2) When Alice 𝐴 logs in for the first time, the homeserver sets the device identifier 𝐷 𝐴,1 ← mpk′ 𝐴. 3) When Bob 𝐵 logs in for the first time, the homeserver sets 𝐷𝐵,1 as normal. 4) Alice and Bob each setup their own cross-signing identities with verification keys (mpk𝐴, spk𝐴, upk𝐴) and (mpk𝐵, spk𝐵, upk𝐵) respectively. They upload these to the homeserver. 5) The homeserver proceeds to present two versions of the cross-signing state: a) When Alice requests their own cross-signing information, they are presented with the version they uploaded (mpk𝐴, spk𝐴, upk𝐴). b) When Bob requests Alice’s cross-signing information, they are presented with the version generated by the malicious homeserver (mpk′ 𝐴, spk′ 𝐴, upk′ 𝐴). 6) Alice and Bob perform an out-of-band verification using the SAS protocol. At the end, they exchange m.key.verification.mac messages containing their cryptographic identity (for signing). Figure 5 shows the structure of the message Alice sends. 𝐷𝐵,1 processes it as follows: a) SAS.VerifyMAC interprets the entry for mpk′ 𝐴 as a request for device verification. It fetches the expected device identity key 𝑎 𝑝𝑘 𝐴,1, then calculates a matching MAC. The device identity key pulled from the homeserver is legitimate, and matches the one used by Alice’s device to generate the MAC. Thus, the message passes verification. b) SAS.SignDevice interprets the entry for mpk′ 𝐴 as a request for cross-signing verification. This is because the homeserver has led Bob’s client to believe that Alice’s cross-signing identity is mpk′ 𝐴. 7) Bob cross-signs the homeserver controlled identity for Alice, and uploads the signature to the homeserver to distribute to their other devices. We implemented this attack and report that it succeeds in practice. We expect that this attack can be performed in parallel against Bob, such that Alice signs a homeserver controlled cross-signing identity for Bob (mpk′ 𝐵, spk′ 𝐵, upk′ 𝐵). From this point onwards, the homeserver can generate their own device identities. These device identities can create Olm connections with Alice as if they were a verified device of Bob, and vice versa. This results in a compromise of all Olm sessions between the two users (for which compromise of Megolm sessions follows). >C. Limitations This attack exploits a specific issue with cross-signing between users’ devices and does not work when a user is verifying two of their own devices. This means that a malicious homeserver cannot compromise Olm connections between devices of the same user. >D. Remediation Alongside public disclosure, the Matrix developers will ensure that master cross-signing keys and device identifiers are not confused for one another. To do this, they plan to consistently process identifiers, checking whether they are key or device identifier in the same order throughout the codebase. We recommend that this order is formalised in the Matrix specification (with the security implications of a mistake explained). The attack is made possible due to a lack of domain separation between device identifiers and cross-signing keys. In the long-term, the Matrix developers plan to separate the format for device identifiers and Ed25519 keys. Additionally, we recommend that the use of device identifiers in m.key.verification.mac messages during self-verification is not necessary. Replacing these with the device’s identity key would serve the same purpose, and reduce the need to include homeserver-controlled information during the processing of these messages. V. Semi-trusted Impersonation against Megolm Authentication In this section we describe an attack that allows a malicious device and homeserver to impersonate other (target) devices. The malicious device and the target devices may or may not belong to the same user. Whilst this attack causes a warning to be shown next to the message, messages sent using legitimately forwarded room keys display the same warning, thus this attack achieves the same level of trust as legitimately forwarded room keys. In Section VI-B we will build on this attack to achieve an impersonation that produces trusted messages.

i hope it doesn't become obligatory in the future https://security.googleblog.com/2022/10/SecurityofPasskeysintheGooglePasswordManager.html

ISC DHCP (aka dhclient) EOL >The 4.4.3-P1 and 4.1-ESV-R16-P2 versions of ISC DHCP, released on October 5, 2022, are the last maintenance versions of this software that ISC plans to publish. >If we become aware of a significant security vulnerability, we might make an exception to this, but it is our intention to cease actively maintaining this codebase. https://www.isc.org/blogs/isc-dhcp-eol/ As far as I know, OpenBSD is not affected because their DHCP daemon is a fork of the ISC DHCP daemon. If you use the ISC DHCP daemon (dhclient), replace it with dhcpcd.

OpenSSL 3.0.7 is a security-fix release The highest severity issue fixed in this release is CRITICAL: >https://mta.openssl.org/pipermail/openssl-announce/2022-October/000238.html >https://xeiaso.net/blog/openssl-3.x-secvuln-incoming >"For people that only have casually followed the OpenSSL project, note that the last time a "CRITICAL" patch was issued was to mitigate the "Heartbleed" vulnerability." >"The patch to fix this issue will become public on Tuesday, November 1st. " Theo de Raadt was right again! Remember Heartbleed? >https://heartbleed.com

>>20435 >OpenSSL 3.0.7 is a security-fix release CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buffer Overflows https://www.openssl.org/news/secadv/20221101.txt https://mta.openssl.org/pipermail/openssl-announce/2022-November/000241.html https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/ Install the patch ASAP or switch to LibreSSL!

https://www.wired.com/story/redact-pdf-online-privacy/ > paper demonstrates a new way to attack PDF documents and use hidden fingerprints to reveal names that have been redacted

>>20530 wasn't a lain working on this? I recall reading essentially the same paper a few months ago, posted here.

>>20531 yes, it is him https://arxiv.org/abs/2206.02285 - lainbro link https://arxiv.org/pdf/2206.02285.pdf - wired article link WHY CANT WE STOP WINNING LAINBROS

Lastpass: Hackers stole customer vault data in cloud storage breach >https://www.bleepingcomputer.com/news/security/lastpass-hackers-stole-customer-vault-data-in-cloud-storage-breach/ Install Keepass/keepassxc.

Hackers are using chatGPT for hacking and developing malware quicker and easier. https://www.hackread.com/hackers-openai-chatgpt-malware/

>>20435 Again? OpenSSL Security Advisory [7th February 2023] https://www.openssl.org/news/secadv/20230207.txt >X.400 address type confusion in X.509 GeneralName (CVE-2023-0286) >Severity: High There are also other vulnerabilities in the advisory.

cURL audit found some bugs >https://blog.trailofbits.com/2023/02/14/curl-audit-fuzzing-libcurl-command-line-interface/ fixed in cURL 7.87.0.

ICMP Remote Code Execution Vulnerability Found in Windows https://nvd.nist.gov/vuln/detail/CVE-2023-23415 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23415 >How could an attacker exploit this vulnerability? >An attacker could send a low-level protocol error containing a fragmented IP packet inside another ICMP packet in its header to the target machine. To trigger the vulnerable code path, an application on the target must be bound to a raw socket. Lol Lmao, even

>>21151 Context for the uninitiated, ICMP is literally just Ping. Forgor to elaborate on it because I'm baffled something that simple has such a weird vulnerability. Also, >Score: 9.8 Critical

https://krebsonsecurity.com/2023/03/feds-charge-ny-man-as-breachforums-boss-pompompurin/ Admin of breached (raid 2.0) got arrested, breached is still up and the admin account is derezzed. Who wants to bet its a honeypot now?

>>21171 Funny you should say that. The forum was recently shut down by the other admin (Baphomet) because they were concerned about the same thing. From the official forum Telegram (https://t.me/s/breached): > I [Baphomet] will be taking down the forum, as I believe we can assume that nothing is safe anymore. > Please see my final confirmation of this here: http://baph.is/finalupdate.txt.asc

>>21364 meh it's cyclical, someone else will set up shop to replace it xdedic > uas > genesis > ?

repost: MyAnimeList got hacked: "A malicious individual overwrote anime database information to modify all titles to "Let's All Love Lain". " https://archive.is/41Xlz

I don't know if this counts as a "news related" question but it doesn't deserve its own thread and plenty of scams make the news. Feel free to direct me somewhere that might be more appropriate for this kind of discussion. I'm researching online scams. Not ransomware or "big" cybercrime, I'm talking run of the mill scams. From what I'm seeing, by and large, the money scammers make isn't transferred to them in the form of cryptocurrency (such as bitcoin or monero), it's usually Paypal, Zelle, Cashapp, or bank wires. Here's what I don't get: how are scammers getting these accounts to begin with? What are their computing setups like? Is it all just done through money mules? Or are they getting "fullz" and opening a bank account (and then subsequent app accounts, like for zelle or cashapp?)? What kind of operating system, browser, IP addresses, and so on, are they using to access and use those accounts? It's hard enough to use your own legitimate accounts privately, so I can't imagine how difficult it would be to access someone else's or a fake account without leaving a big trail. Then, once they have the accounts and they get victims to send them money, how are they "cashing out" that money to their own accounts or local currency? Because that's the whole point, obviously. People have this impression of the sweaty nigerian scammer with a 85 IQ but this stuff seems fairly complicated on the back end when you think about it. Where can I learn more about this process? It's been an extremely difficult thing to research, at least for me. It seems like the most important thing to understand about how scammers operate, too, and yet there's practically NO information about it online (again, that I could find).

>>21600 to answer your question, stolen identities can be used to set up accounts, and then the scammers buy goods that they can resell (Like computer monitors, TVs, appliances or other hard goods) then those get converted into cash that is now clean. If you buy $3000 worth of tvs you can sell them to a pawn shop and maybe get 2200 cash for example. If the scammer is in another country, then interpol may try to act, but it's easier for companies to just write off the loss than to try to go after the scammer. Its literally 85iq niggers doing this soykaf. they just set up paypals or whatever with stolen IDs and then use those along with other online services to clean money. Its the same as the 85iq niggers raiding walgreens and CVS and then selling the cosmetics on amazon. Only high IQ detectives actually investigate supply chains. In the news now are resume writing and hiring scams that harvest data from people who are unemployed. That's how people get info. That or stealing mail.

>>21604 Question: wouldn't it be much easier, safer and more profitable to just buy xmr with the fiat that they obtain from the scams? Then they can just sell it and cash out cleanly.

Google releases new .zip domain >On the domain.google site: >"The web moves at high speed, so show you do too with a .zip domain. When you're offering services where speed is of the essence, a .zip URL lets your audience know that you're fast, efficient, and ready to move." https://domains.google/tld/zip/ It doesn't take a CS genius to understand this is probably a soykaf idea. Oh well. Have fun, scammers and red teams :D

>>21607 What kind of meth were they smoking when they thought this was a good idea? (Where can I get some of that?)

>>21600 There are a lot of techniques that scammers and fraudsters employ. Some are doing identity theft to open accounts, some are using hacked accounts, some are using mules, some are sending the payment to a third party who is unaware of the crime. >What kind of operating system, browser, IP addresses, and so on, are they using to access and use those accounts? It's hard enough to use your own legitimate accounts privately, so I can't imagine how difficult it would be to access someone else's or a fake account without leaving a big trail. Oftentimes they'll pay for a residential proxy (which is usually offered by someone who owns a botnet) that is in the same area as the identity theft victim. But it's not really about hiding their steps since the scammers largely live in countries that don't care if they defraud westerners, it's more about just not flagging any automated system that would flag the account before they can use it. This is only if the scam requires them to access some fraudulent account. Lots of them don't use any proxies when doing email/love/elder-manipulation/sextortion/fake-tech-support/etc scams. It's usually not a sophisticated operation. Just a bunch of people in a call center who couldn't get normal jobs and are barely tech literate enough to do the scam. >Then, once they have the accounts and they get victims to send them money, how are they "cashing out" that money to their own accounts or local currency? The account is usually operated by a mule who probably doesn't realize they're a mule. One technique they use to get unwitting mules is that the scammers post ads offering remote work to people and then convince them they need to handle some customer payment and wire it back to the scam organization's legitimate account in their home country. They don't care to hide it since their countries don't give a soykaf. >>21606 They don't need to launder it in their countries and they dont give a fuarrrk about the mules getting caught since most of the time the mules are just other people they're scamming, so they dont really need to do any crypto. Some still do, but that's just an extra step that comes with transaction fees and volatility. I have no proof of this, but I suspect the cashapp/zelle/whatever payments sometimes are not going to an account operated by the scammers or mules, but instead to someone who is legitimately selling crypto on something like local bitcoins. The scammers contact the seller saying they want to buy crypto, then send the victim the seller's venmo or whatever, the victim pays the seller, the seller gives crypto to the scammer, and there's no connection between the victim and the scammer.

>>21612 >I have no proof of this, but I suspect the cashapp/zelle/whatever payments sometimes are not going to an account operated by the scammers or mules, but instead to someone who is legitimately selling crypto on something like local bitcoins. The scammers contact the seller saying they want to buy crypto, then send the victim the seller's venmo or whatever, the victim pays the seller, the seller gives crypto to the scammer, and there's no connection between the victim and the scammer. I've wondered about this before, never really seen it discussed. It's why I'd be too nervous to sell crypto for cash in the mail, or anything else, really. Let's say there's a drug dealer. He tells his customers to pay him by sending cash in the mail. This cash is going to someone on a p2p exchange selling crypto for cash-in-mail. The customer gets the drugs, the drug dealer gets XMR, and the XMR seller gets cash. Except when the drug dealer is inevitably busted, all the transactions will lead to some dude in Phoenix selling crypto out of his apartment. Are there any documented cases of something like this happening?

Debian 12 aka bookworm will have a new non-free-firmware component in apt sources.list >https://www.debian.org/releases/testing/amd64/release-notes/ch-upgrading.en.html#non-free-firmware non-free got split into non-free and the new non-free-firmware . This change is already live on testing and unstable.

NSA and Partners Identify China State-Sponsored Cyber Actor Using Built-in Network Tools When Targeting U.S. Critical Infrastructure Sectors Summary: >The National Security Agency (NSA) and partners have identified IOCs associated with a PRC state-sponsored cyber actor using living off the land techniques to target networks across U.S. critical infrastructure. >The CSA provides an overview of hunting guidance and associated best practices. It includes examples of the actor’s commands and detection signatures. The authoring agencies also includes a summary of IOC values, such as unique command-line strings, hashes, file paths, exploitation of CVE-2021-40539 and CVE-2021-27860 vulnerabilities, and file names commonly used by this actor. >NSA recommends network defenders apply the detection and hunting guidance in the CSA, such as logging and monitoring of command line execution and WMI events, as well as ensuring log integrity by using a hardened centralized logging server, preferably on a segmented network. >Defenders should also monitor logs for Event ID 1102, which is generated when the audit log is cleared. Source : https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3406058/nsa-and-partners-identify-china-state-sponsored-cyber-actor-using-built-in-netw/ Full report here : https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF I exposed myself to the glowies for you all. kinda part of my job, anyway. I'll also include the PDF in the files if you don't want to click on the link. Honestly, kind of cool soykaf. Good job, ya chinese bastards :)

>>21655 Well done China! The enemy of my enemy is my friend.... for now.

Gigabyte consumer motherboards contain dropper backdoor in firmware >https://eclypsium.com/blog/supply-chain-risk-from-gigabyte-app-center-backdoor/

>>21657 How? I think the proliferation of cyber warfare will impact civilians access to secure computing technology. The terror is no man's friend.

>>21796 >>21799 Baphomet confirmed that they own the domain [0] in their Telegram channel [1]. BreachForums.vc is now the official domain for BreachForums. [0] https://baph.is/updates/safest.txt.asc [1] https://t.me/s/OfficialBaphomet

>>21799 >>21801 This kind of return has me very skeptical, like how AlphaBay eventually returned. It was originally taken down in 2019, then DeSnake brought it back. Then, the site stopped functioning a while ago and just straight up died in what appeared to be a totally bungled exit scam. Bringing a website back under the same name after it was previously compromised raises a lot of suspicion and paints a massive target on the website's back. It doesn't make sense from a security perspective, you would only do it if you want to utilize the reputation behind the name to get people's trust. We'll have to wait and see. As always, users should be extremely careful, only accessing the game via Tor and using throwaway email addresses and maintaining proper opsec procedures. Some more news: The United States Justice Department announced the arrest of 20 year-old Ruslan Magomedovich Astamirov, a Russian national who was residing in Arizona, alleging he is associated with the Lockbit ransomware group. "Astamirov is charged with conspiring to commit wire fraud and conspiring to intentionally damage protected computers and to transmit ransom demands. If convicted, he faces a maximum penalty of 20 years in prison on the first charge and a maximum penalty of five years in prison on the second charge. Both charges are also punishable by a maximum fine of either $250,000 or twice the gain or loss from the offense, whichever is greatest." https://www.justice.gov/opa/pr/russian-national-arrested-and-charged-conspiring-commit-lockbit-ransomware-attacks-against-us (https://archive.ph/kd8tJ)

>>21802 AB was shut down in 2017. My mistake.

>>21796 Its all suspicious. I think everybody on breachforums.vc was logged out yesterday (or the day before) (or the day before before) meaning everyone had to log back in again, meaning users were entering their credentials. A similar thing happened to Raidforums, where every page redirected to a login page. On the other hand, Baphomet (head admin) confirmed that breachforums.vc is safe to use and that he owns the domain. Yet, he confirmed this on the telegram group linked on the website (which is now locked). What about ShinyHunters? They come out of the dark and (seemingly) bought Breachforums from Baph.

>>21810 Suspicious, but certainly entertaining. https://thecyberexpress.com/breachforums-hacked-exposed-shinyhunters Also I just checked the old Breached.vc domain, there's apparently a dump of a BreachForums clone along with the message "BreachForums clone has already been hacked. Do not trust websites impersonating, as said multiple times it wont be returning." Is it talking about BreachForums.vc? https://i.suffer.rip/ht0k4qYO.sql https://i.suffer.rip/buF6mVTL.csv More news: ASUS released patches to fix critical security bugs in multiple router models. https://thehackernews.com/2023/06/asus-releases-patches-to-fix-critical.html Of the nine security flaws, two are rated Critical and six are rated High in severity. One vulnerability is currently awaiting analysis. The list of impacted products are GT6, GT-AXE16000, GT-AX11000 PRO, GT-AXE11000, GT-AX6000, GT-AX11000, GS-AX5400, GS-AX3000, XT9, XT8, XT8 V2, RT-AX86U PRO, RT-AX86U, RT-AX86S, RT-AX82U, RT-AX58U, RT-AX3000, TUF-AX6000, and TUF-AX5400. Remember to keep your devices up to date, everyone.

Pentagon Papers whistleblower and ex-nuclear war planner Daniel Ellsburg dead at 92 https://www.counterpunch.org/2023/06/21/daniel-ellsberg-and-the-endless-federal-lies/

>>21815 Rest in peace, king. o7

>>21815 RIP Dr Ellsburg you were a real American hero. Thank you from Vietnam (;__;)

My RSS feed has a lot of stories, I'll toss a couple of them here today. >Chinese APT15 hackers resurface with new Graphican malware [1] The operation of Graphican includes the following: - Disables Internet Explorer 10's first-run wizard and welcome page using registry keys. - Verifies if the 'iexplore.exe' process is active. - Constructs a global IWebBrowser2 COM object for internet access. - Authenticates with Microsoft Graph API for a valid access token and refresh_token. - Enumerates child files and folders in the "Person" OneDrive folder using the Graph API. - Decrypts the first folder's name for use as a C&C server. - Generates a unique Bot ID using the hostname, local IP, Windows version, default language identifier, and process bitness (32/64-bit). - Registers the bot with the C&C server using a specific format string filled with the collected victim's computer data. - Regularly checks the C&C server for new commands to execute. >Zyxel Releases Urgent Security Updates for Critical Vulnerability in NAS Devices [2] Zyxel has rolled out security updates to address a critical security flaw in its network-attached storage (NAS) devices that could result in the execution of arbitrary commands on affected systems. It is tracked as CVE-2023-27992, and has a severity rating of 9.8 [3]. The following versions are impacted: - NAS326 (V5.21(AAZF.13)C0 and earlier, patched in V5.21(AAZF.14)C0), - NAS540 (V5.21(AATB.10)C0 and earlier, patched in V5.21(AATB.11)C0), and - AS542 (V5.21(ABAG.10)C0 and earlier, patched in V5.21(ABAG.11)C0) [1] https://www.bleepingcomputer.com/news/security/chinese-apt15-hackers-resurface-with-new-graphican-malware/ [2] https://thehackernews.com/2023/06/zyxel-releases-urgent-security-updates.html [3] https://nvd.nist.gov/vuln/detail/CVE-2023-27992

>NHS Psychiatrist Jailed; Dark Web Forum and 7,000 Images Seized 33 year-old Indian psychiatrist Dr. Kabir Garg who worked at South London and Maudsley NHS Trust has been sentenced to six years in prison for his involvement in administering "The Annex", a darkweb forum dedicated for sharing and distributing child sexual abuse material. When the NCA searched his apartment, they recovered several devices, including a laptop and an SD card, from which they found around 7,000 indecent images. Out of these, 522 were category A images, which is the most serious category of indecent material. Hopefully this sick fuarrrk rots in prison. 6 years isn't enough, he deserves life in prison without parole. Creepy fuarrrks like him deserve the absolute worst. [1] https://www.hackread.com/nhs-psychiatrist-jailed-dark-web-forum/

>>21849 How was he caught? The article is far too long with too little relevant information

vm2 discontinued due to huge, unfixable escape. This is a Node.JS library used in a huge number of programs, the library has over 4 million weekly downloads. https://github.com/patriksimek/vm2/issues/533

>>21944 stupid opsec combined with some cooperation with mass surveillance agencies? maybe the site was hacked by law enforcment? there isnt much info out there about this it seems. not that le would want to make it known anyway, they wanna keep doing this over and over again.

July 13th Pompompurin, the previous administrator of the infamous Breached forums, plead guilty to 3 charges in federal court. - Conspiracy to Commit Access Device Fraud - Access Device Fraud – Unauthorized Solicitation - Possession of Child Pornography da fuarrrk... https://nitter.net/vxunderground/status/1679739098204983296#m

>>21993 The man couldn't even run a hacker forum without talking of his IRL identity somewhere ("Haha just searching this randomly specific name in a database for testing") and we're expected to believe he would have CP without dropping hints? Think they just wanted to add that charge for the sake of it.

>>21993 here. >>21995 Found the original court document of it as shared by hackread.com https://storage.courtlistener.com/recap/gov.uscourts.vaed.540114/gov.uscourts.vaed.540114.41.0.pdf https://www.hackread.com/breachforums-admin-pompompurin-pleads-child-crime/ its definitely out of left field thats for sure, but im hesitant to instantly assume that feds are just making soykaf up. if they make up a fake charge, thats hard to successfully prosecute. hell, prosecutors will sometimes choose not to pursue certain charges in order to guarantee a conviction. for example, the ross ulbricht trial left out his attempted hiring of hitmen because it would be really hart to convince a jury that he tried to hire a hit on a guy from someone who didnt really exist per se. it was easier to slap him with what was easier to prove, which was his involvement with silk road. making up a charge out of the blue would be detrimental to the prosecution's goal.

>>22005 I havent read the docs yet, but my understanding is that 'possession of cp' is a very easy charge to make up if they wanted to... with access to the guy's computers they could just plant some if they wanted to. Not saying that happened but it easily could have, for the sake of keeping him under bars for longer.

>>22011 the document doesnt mention him attempting to distribute it himself, so in that sense there isnt as much exposure of that activity and thus it wasnt previously known, as opposed to his quite public activity on BF and such. afaik drive images would record everything about the drive, including when files were last modified, so you couldnt exactly just copy some images over from a flash drive to the laptop and go "haha, csam! youre getting locked up for that buckaroo!" it would certainly not be worth the risk to try to fabricate the charge and risk having the case entirely dropped due to police misconduct. they already have enough to lock him away for a very long time. theres no point to faking soykaf. otherwise, we'd see csam possession charges in many more cases, like in arrests of people associated with lapsus for instance. besides, he apparently tried to kill himself after his arrest, which i think only strengthens the idea that he really was responsible for having abhorrent material and didnt want to deal with the consequences of it. thats just my opinion tho, its not to be taken as any actual evidence or strong argument. i just find it much more believable that pom is just a soykaf human being who has very little empathy or respect for others, suffers from major ego problems and isnt smart when it comes to opsec.

The Hacker Kevin "The Condor" Mitnick died today from pancreatic cancer. He died the way he lived, causing butthurt. https://www.dignitymemorial.com/obituaries/las-vegas-nv/kevin-mitnick-11371668