#followfriday is back (after I missed it last week). Once again, here's some cool #infosec / #cybersecurity accounts I've discovered and followed recently...

- @Omkhar
- @zh4ck
- @pietrushnic
- @freddy
- @zerotypic
- @jeFF0Falltrades
- @13reak
- @WPalant

Plus a few cool accounts I've discovered from fun instances around the #fediverse...

- @Shrigglepuss
- @tonicfunk
- @stephan

I've also updated my site's #blogroll with Fediverse handles for each site entry's author - https://shellsharks.com/blogroll

Blogroll

A list of blogs I read and recommend.

^shellsharks

#LLM Agents can Autonomously #Exploit One-day Vulnerabilities

Source: https://arxiv.org/abs/2404.08144

To show this, we collected a dataset of 15 one-day vulnerabilities that include ones categorized as critical severity in the #CVE description. When given the CVE description, GPT-4 is capable of exploiting 87% of these vulnerabilities compared to 0% for every other model we test (GPT-3.5, open-source LLMs) and open-source vulnerability scanners (ZAP and #Metasploit).

#ai #technology #Software #chatgpt #bug #hack #news #cybersecurity

LLM Agents can Autonomously Exploit One-day Vulnerabilities

LLMs have becoming increasingly powerful, both in their benign and malicious uses. With the increase in capabilities, researchers have been increasingly interested in their ability to exploit cybersecurity vulnerabilities.

^arXiv.org

A #crypto wallet maker's warning about an #iMessage bug sounds like a false alarm

https://techcrunch.com/2024/04/16/a-crypto-wallet-makers-warning-about-an-imessage-bug-sounds-like-a-false-alarm/

#cybersecurity #iOS #iPhone #Apple #cryptocurrency #web3

Security folks, I need some help. My wife is looking for a job after taking a few years off to take care of the kids and she's having a hard time finding legit security opportunities. And the legit ones she does find don't like the gap in her resume.

If you have or know of any legit remote openings for someone with experience in identity and access management, can you please share?

She has her CISSP and while most of her experience is in IAM she's willing to branch out and learn a new specialty. She also happens to be both the faster learner and the smarter one of the two of us!

Boosts greatly appreciated!

#InformationSecurity #Cybersecurity #IAM #FediHired #GetFediHired #FediJobs #Jobs

📡 HACKRF PORTAPACK H2: What's New Latest Mayhem Firmware v2.0.1

#radio #sdr #Signals #firmware #mayhem #portapack #HackRF #infosec #cybersecurity #privacy #hardware

https://tube.tchncs.de/w/xvj2ZwbFepkHVginNs4H7n

What's New #HackRF Mayhem #Portapack Firmware v2.0.1 / Upgrading

how to upgrade portapack mayhem firmware and showing first look at NEW APPS: Foxhunt / Wardriver Geotag log BLOG / SUPPORT: https://bmc.link/politictech http://righttoprovacy.i2p #hackrf #portapack...

^tchncs

Let's use @protonprivacy and @Tutanota products.

When will the two largest providers of secure encrypted email make it the default for messages sent between them to be securely encrypted? If even they can't manage it what hope is there for the rest of the email world?

I read some article about them being concerned about AI cyberattacks, and actually recommended 'fighting fire with fire'.

??

Um.. you can't just rely solely on AI systems when the main reason why cyberattacks keep on succeeding is mostly due to social engineering. People are being tricked into enabling attackers access their systems and data.
AI-based attacks are currently mainly driven by deception via fake messages, deepfakes, etc.

#cybersecurity #infosec #socialengineering #AI

Apple has notified iPhone users in 92 countries about a mercenary spyware attack attempting to compromise their devices.

Apple says the attack is likely targeting the victims because of who they are or what they do.

Apple suggests having the latest software updates, enabling lockdown mode and seeking help from specialized experts.

#cybersecurity #threatintel #Apple #iPhone

https://www.bleepingcomputer.com/news/security/apple-mercenary-spyware-attacks-target-iphone-users-in-92-countries/

Let's use @protonprivacy and @Tutanota products.
Encryption is the single best hope against surveillance.

https://www.wired.com/story/house-section-702-vote/

#security #cybersecurity #infosec #nationalsecurity #nsa #fbi #section702 #privacy #government #surveillance #e2ee #tech #proton #protonmail #tuta #tutanota #bigtech #degoogle

House Votes to Extend—and Expand—a Major US Spy Program

The US House of Representatives voted on Friday to extend the Section 702 spy program. It passed without an amendment that would have required the FBI to obtain a warrant to access Americans’ information.

^{Dell Cameron (WIRED)}

Time for a #jobSearch post!

I'm looking for a #typeScript / #python / #RustLang 100% #remote #softwareDev position, both contract and permanent, GMT+2 timezone.

I previously worked as a Senior / Lead / Principal #fullStack developer with #cyberSecurity , #softwareArchitecture and #devOps experience.

I specialize in #react , #nodejs , #django , #fastAPI , #pandas , #postgresql , #docker , #kubernetes , #AWS and #digitalOcean .

https://www.linkedin.com/in/paul-ngei/

#fediHire #fediHired #jobHunt #software

The White House is apparently considering a full ban of Kaspersky software throughout the United States, citing national security concerns.

https://edition.cnn.com/2024/04/09/politics/biden-administration-americans-russian-software/index.html

#cybersecurity #kaspersky #russia

Judge: Clark County schools may have immunity in lawsuit over 2023 cybersecurity breach:

https://thenevadaindependent.com/article/judge-clark-county-schools-may-have-immunity-in-lawsuit-over-2023-cybersecurity-breach

Does Nevada state law provide them with a "Get Out of Jail Free" pass? It sounds like it may.

@douglevin @funnymonkey @brett @mkeierleber

#databreach #EduSec #cybersecurity #edtech #accountability #infosec

Judge: Clark County schools may have immunity in lawsuit over 2023 cybersecurity breach

A Clark County judge said she’s leaning toward granting the Clark County School District’s motion to dismiss a class action lawsuit related to a 2023 cyberattack.

^{Rocio Hernandez (The Nevada Independent)}

CrankySec versus HN
https://crankysec.com/blog/hn/

#cybersecurity

###
#Microsoft employees exposed internal passwords in #security lapse

source: https://techcrunch.com/2024/04/09/microsoft-employees-exposed-internal-passwords-security-lapse/

Security researchers Can Yoleri, Murat Özfidan and Egemen Koçhisarlı with #SOCRadar, a #cybersecurity company that helps organizations find security weaknesses, discovered an open and public storage server hosted on Microsoft’s #Azure #cloud service that was storing internal information relating to Microsoft’s #Bing search engine.

#fail #password #leak #problem #news

#Twitter’s Clumsy Pivot to X.com Is a Gift to Phishers

source: https://krebsonsecurity.com/2024/04/twitters-clumsy-pivot-to-x-com-is-a-gift-to-phishers/

Those include carfatwitter.com, which Twitter/X truncated to carfax.com when the domain appeared in user messages or tweets. Visiting this domain currently displays a message that begins, “Are you serious, X Corp?”

#internet #fail #security #phishing #cybersecurity #twitter #news

Twitter’s Clumsy Pivot to X.com Is a Gift to Phishers

On April 9, Twitter/X began automatically modifying links that mention "twitter.com" to redirect to "x.com" instead. But over the past 48 hours, dozens of new domain names have been registered that demonstrate how this change could be used to craft…

^{krebsonsecurity.com}

Leader Of Israel's Unit 8200 (equivalent to NSA) OPSEC Mistake Exposed Long Held Identity

#News #Privacy #OPSEC #Unit8200 #Israel #SIGINT #NSA #OSINT #intelligence #infosec #Cybersecurity

https://www.theguardian.com/world/2024/apr/05/top-israeli-spy-chief-exposes-his-true-identity-in-online-security-lapse

Top Israeli spy chief exposes his true identity in online security lapse

Exclusive: Yossi Sariel unmasked as head of Unit 8200 and architect of AI strategy after book written under pen name reveals his Google account

^{Harry Davies (The Guardian)}

When #security matters: working with #Qubes OS at the #Guardian

Source: https://www.theguardian.com/info/2024/apr/04/when-security-matters-working-with-qubes-os-at-the-guardian

Configuring a Qubes workstation was a new challenge for the team as we abandoned years of experience writing Infrastructure as Code for the cloud and started learning how to write #Salt #configuration. Salt (also know as SaltStack) is a management engine available by default in Qubes.

#cybersecurity #news #journalism #linux #technology #software #securedrop

When security matters: working with Qubes OS at the Guardian

The latest version of the whistleblowing platform SecureDrop runs on the Qubes operating system. At the Guardian we used the Salt management engine to set up a Qubes environment where journalists could safely interrogate sensitive documents.

^{Philip McMahon (The Guardian)}

Exclusive: #YossiSariel unmasked as head of #Unit8200 and architect of #AI #strategy after book written under pen name reveals his #Google account

Source: https://www.theguardian.com/world/2024/apr/05/top-israeli-spy-chief-exposes-his-true-identity-in-online-security-lapse

The embarrassing #security lapse is linked to a book he published on #Amazon, which left a digital trail to a private Google account created in his name, along with his unique ID and links to the #account’s maps and calendar profiles.

#Israel #internet #Anonymity #privacy #spy #military #CyberSecurity #news #online #leak #identity

Top Israeli spy chief exposes his true identity in online security lapse

Exclusive: Yossi Sariel unmasked as head of Unit 8200 and architect of AI strategy after book written under pen name reveals his Google account

^{Harry Davies (The Guardian)}

📰 XZ Utils Backdoor Attribution Analysis

#News #Linux #XZutils #backdoor #ssh #infosec #cybersecurity #privacy #video #peertube #APT

https://tube.tchncs.de/w/ca2iuxmdqfBE98PwZYY6wh

📰 Linux XZ Utils Backdoor Attribution Analysis

🚨 ALERT: * Linux Backdoored XZ Utils (xz-utils)* How This Was Pulled Off, And Who May Have Done It? This Was A Backdoor In Layers - Many Changes Of Lesser Alarm, Together, Critical Remote Access, ...

^tchncs

@anonymiss

ever hear of https://www.zangi.com?

ever hear of https://Simplex.Chat?

#encryption #communication #messenger #email #question #security #cybersecurity #internet #spy #surveillance #privacy #nsa #snowden #5eyes

🧬Types of DNS Records

🔹A
🔹AAAA
🔹CNAME
🔹MX
🔹PTR
🔹NS
🔹SOA
🔹TXT

🔖#infosec #cybersecurity #hacking #pentesting #security

What #encryption do you use for your everyday #communication?

I'm not talking about your nerd friends, who can be counted on one hand and who know a thing or two about the subject. I'm talking about your normal friends, business partners and colleagues with whom you communicate both professionally and privately.

I was recently called by my support via Microsoft Teams because I had to enter some passwords. The support team proudly said that they were contacting me via Teams because it was more secure than the normal phone. He was then very surprised when I told him that Teams is unencrypted and can be intercepted much more easily.

#messenger #email #question #security #cybersecurity #internet #spy #surveillance #privacy #nsa #snowden #5eyes

Review of the Summer 2023 #Microsoft #Exchange Online #Intrusion

source: https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review_of_the_Summer_2023_MEO_Intrusion_Final_508c.pdf

the cascade of Microsoft’s avoidable errors that allowed this intrusion to succeed;

#attack #hack #fail #security #cybersecurity #news #problem

The Mystery of ‘Jia Tan,’ the XZ Backdoor Mastermind

https://www.wired.com/story/jia-tan-xz-backdoor/

#infosec #cybersecurity

The Mystery of ‘Jia Tan,’ the XZ Backdoor Mastermind

The thwarted XZ Utils supply chain attack was years in the making. Now, clues suggest nation-state hackers were behind the persona that inserted the malicious code.

^{Andy Greenberg (WIRED)}

Several popular messaging apps, including Messenger, Signal, Telegram and WhatsApp, use end-to-end encryption.

Here’s how it protects you:
https://theconversation.com/are-private-conversations-truly-private-a-cybersecurity-expert-explains-how-end-to-end-encryption-protects-you-224477
#Cybersecurity

Are private conversations truly private? A cybersecurity expert explains how end-to-end encryption protects you

End-to-end encryption provides strong protection for keeping your communications private, but not every messaging app uses it, and even some of the ones that do don’t have it turned on by default.

^{The Conversation}

Great news! Amazon has got back to me about the £700 iPhone they failed to deliver (and wouldn't refund or replace) Bad news: what they told me...

Based on this experience, why would anyone buy anything expensive from Amazon ever again? Please share, like and comment if you agree.

Watch my #video.

#amazon #delivery #scam #jeffbezos #cybersecurity

A cybersecurity researcher finds that 20% of software packages recommended by GPT-4 are fake, so he builds one that 15,000 code bases already depend on, to prevent some hacker from writing a malware version.

Disaster averted in this case, but there aren't enough fingers to plug all the AI-generated holes 😬

https://it.slashdot.org/story/24/03/30/1744209/ai-hallucinated-a-dependency-so-a-cybersecurity-researcher-built-it-as-proof-of-concept-malware

#AIethics #Cybersecurity #GPT #OpenAI #LLM #GenAI #GenerativeAI #Python #NodeJS #Ruby #Golang

⚒️35 Top Cybersecurity Tools for 2024

1. Nmap
2. Metasploit
3. Wireshark
4. Invicti
5. John the Ripper
6. Nikto
7. Burp Suite
8. Tor
9. Tcpdump
10. Aircrack-ng
11. Splunk
12. Acunetix
13. Snort
14. Mimecast
15. Malwarebytes
16. OpenVAS
17. SecPod SanerNow
18. UnderDefense
19. Intruder
20. ManageEngine Vulnerability Manager Plus
21. ManageEngine Log360
22. SolarWinds Security Event Manager
23. Norton Security
24.McAfee
25. AVG
26. System Mechanic Ultimate Defense
27. Vipre
28. LifeLock
29. Bitdefender Total Security
30. NordLayer
31. Perimeter 81
32. CIS
33. Webroot
34. GnuPG
35. Sparta Antivirus

🔖#infosec #cybersecurity #hacking #pentesting #security

👤beacons.ai/cyberkid1987
👤t.me/VasileiadisAnastasis
👥t.me/infosec101

PancakesCon 5 (@pancakescon) is happening :D With talks including:

• MITRE ATT&CK mapping and the world’s best muffins
• Stopping botnets with astrophysics
• Thrive or survive: What a life in the mosh pit taught me about cyber security

... and many more.

Here's the schedule: https://pancakescon.com/2024-conference-information/

#PancakesCon #security #CyberSecurity

2024 Conference Information

PancakesCon 5 will occur on March 24, 2024. To participate, join our Slack, linked at the top of this page. Streams are provided over YouTube, live on the day of the conference, and will be linked …

^{PancakesCon 5 - Full Stack Hack}

The truth about Cybersecurity that nobody tells you!

#infosec #cybersecurity #funny