BlackBox (Security) Archiv

07 Nov 2024 18:06

⚠️ The time has come, we need to destroy Tør, join our forces! ⚠️

Law Enforcement Undermines Tor

https://r00t.monster/

#tor #undermining #lawenforcement
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

27 Sep 2024 17:56

Ransomware Tool Matrix

This repository contains a list of the tools used by each ransomware or extortion gang.

As defenders, we should take advantage of the fact that many of the tools used by these cybercriminals are often reused.

We can threat hunt, deploy detections and block these tools to deny adversaries the ability to launch intrusions.

https://github.com/BushidoUK/Ransomware-Tool-Matrix/

#ransomware #tools #matrix
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

11 Jul 2024 18:05

Is using Signal Desktop considered secure?

https://x.com/i/grok/share/fXnEHsFFRAgEAxfHapnm3KViD

https://x.com/mysk_co/status/1811364535573360787

https://x.com/mysk_co/status/1811163783613862039

https://x.com/mysk_co/status/1811383323677057100

#signal #secure #thinkabout
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

21 Jun 2024 15:14

Mozilla is an advertising company now

Mozilla has acquired Anonym, a [blah blah blah] raise the bar for the advertising industry [blah blah blah] while delivering effective advertising solutions.

Anonym was founded with two core beliefs: [blah blah blah] and second, that digital advertising is critical for the sustainability of free content, services and experiences.

As we integrate Anonym into the Mozilla family, we are excited about the possibilities this partnership brings. While Anonym will continue to serve its customer base, together, we are poised to lead the industry toward a future where privacy and effective advertising go hand in hand, supporting a free and open internet.

Anonym was founded in 2022 by former Facebook executives Brad Smallwood and Graham Mudd. The company was backed by Griffin Gaming Partners, Norwest Venture Partners, Heracles Capital as well as a number of strategic individual investors.

https://www.jwz.org/blog/2024/06/mozilla-is-an-advertising-company-now/

#ff #firefox #mozilla #browser #anonym #advertising
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

31 May 2024 18:23

Very big cyber incident playing out at Snowflake, who describe themselves as “AI Data Cloud”. They have a free trial where anybody can sign up and upload data… and they have.

Threat actors have been scraping customer data using a tool called rapeflake, for about a month.

GossiTheDog/112536407633131499" rel="nofollow">https://cyberplace.social/@GossiTheDog/112536407633131499

#snowflake #cybersecurity #rapeflake #hacked
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

15 May 2024 15:10

CensysGPT Beta

CensysGPT beta simplifies building queries and empowers users to conduct efficient and effective reconnaissance operations. The tool enables users to quickly and easily gain insights into hosts on the internet, streamlining the process and allowing for more proactive threat hunting and exposure management.

https://gpt.censys.io/

#cybersecurity #infosec #ai #censys #gpt
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

15 May 2024 06:42

Tornado Cash Developer Found Guilty of Laundering $1.2 Billion of Crypto

Alexey Pertsev, cofounder of the crypto-anonymizing tool, has been sentenced to more than five years behind bars.

https://www.wired.com/story/tornado-cash-developer-found-guilty-of-laundering-crypto/

#crypto #tornadocash #pertsev
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

14 May 2024 14:20

A Threat Actor Claims Sale of Outlook RCE Exploit 0-Day for $1,700,000

In a concerning development, a threat actor known as “Cvsp” has announced the sale of an alleged Outlook Remote Code Execution (RCE) exploit 0-day. This alleged exploit, designed to target various versions of Microsoft Office across both x86 and x64 architectures, poses a significant security threat to users worldwide.

https://dailydarkweb.net/a-threat-actor-claims-sale-of-outlook-rce-exploit-0-day-for-1700000/

#outlook #zeroday #exploit
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

13 May 2024 08:46

Telegram has launched a pretty intense campaign to malign Signal as insecure, with assistance from Elon Musk. The goal seems to be to get activists to switch away from encrypted Signal to mostly-unencrypted Telegram. I want to talk about this a bit....

https://twitter.com/matthew_d_green/status/1789687898863792453

#signal #telegram #durov #elonmusk
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

10 May 2024 10:32

Dell admits to data breach: sensitive user data in peril

The American technology giant has notified some of its customers about a data breach that involved sensitive data, including users’ physical addresses.

Dell Technologies says that it’s currently investigating an incident “involving a Dell portal,” which contains a database with customer information related to purchases.

https://cybernews.com/news/dell-data-breach/

#dell #breach
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

08 May 2024 10:20

Wireshark RDP resources

Looking for a way to capture and inspect RDP traffic in Wireshark? You've come to the right place!

https://github.com/awakecoding/wireshark-rdp

#wireshark #pentesting
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

07 May 2024 18:00

Ransomware Diaries Volume 5: Unmasking LockBit

Before you read this volume of the Ransomware Diaries, please understand that LockBitSupp’s identity only became known earlier today. Therefore, please make your own assessment and validate my findings before using this research for real-world actions. I have been chasing LockBit for a long time and when I found out the DoJ planned to release this information, I decided to publish my research quicker than I intended.

https://analyst1.com/ransomware-diaries-volume-5-unmasking-lockbit/

#lockbit
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

08 Mar 2024 20:10

You can not simply publicly access private secure links, can you?

turns out, you can even search for them with powerful search engines!

Popular malware/url analysis tools such as urlscan.io, Hybrid Analysis, and Cloudflare radar url scanner store a large number of links for intelligence gathering and sharing. However, it is not as widely known that these services also store a large amount of private and sensitive links, thanks to:

- Sensitive links accidentally submitted for scanning by users unaware that they are public information

- Misconfigured scanners and extensions that submit private links scanned from emails as public data

https://vin01.github.io/piptagole/security-tools/soar/urlscan/hybrid-analysis/data-leaks/urlscan.io/cloudflare-radar%22/2024/03/07/url-database-leaks-private-urls.html

#securelinks #security #tools #urlscan #analysis
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

12 Feb 2024 10:42

Mullvad VPN – an interview with the Swedish mole

The company was founded in March 2009 and we recently spoke to the Managing Director Jan Jonsson.

https://tarnkappe.info/artikel/interviews/mullvad-vpn-an-interview-with-the-swedish-mole-289150.html

#mullvad #vpn #interview
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

28 Dec 2023 06:01

Operation Triangulation: The last (hardware) mystery

Today, on December 27, 2023, we (Boris Larin, Leonid Bezvershenko, and Georgy Kucherin) delivered a presentation, titled, “Operation Triangulation: What You Get When Attack iPhones of Researchers”, at the 37th Chaos Communication Congress (37C3), held at Congress Center Hamburg. The presentation summarized the results of our long-term research into Operation Triangulation, conducted with our colleagues, Igor Kuznetsov, Valentin Pashkov, and Mikhail Vinogradov.

This presentation was also the first time we had publicly disclosed the details of all exploits and vulnerabilities that were used in the attack. We discover and analyze new exploits and attacks using these on a daily basis, and we have discovered and reported more than thirty in-the-wild zero-days in Adobe, Apple, Google, and Microsoft products, but this is definitely the most sophisticated attack chain we have ever seen.

https://securelist.com/operation-triangulation-the-last-hardware-mystery/111669/

#operationtriangulation #attack #iphone
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

26 Oct 2024 11:57

Security research on Private Cloud Compute

Private Cloud Compute (PCC) fulfills computationally intensive requests for Apple Intelligence while providing groundbreaking privacy and security protections — by bringing our industry-leading device security model into the cloud. In our previous post introducing Private Cloud Compute, we explained that to build public trust in the system, we would take the extraordinary step of allowing security and privacy researchers to inspect and verify the end-to-end security and privacy promises of PCC. In the weeks after we announced Apple Intelligence and PCC, we provided third-party auditors and select security researchers early access to the resources we created to enable this inspection, including the PCC Virtual Research Environment (VRE).

Today we’re making these resources publicly available to invite all security and privacy researchers — or anyone with interest and a technical curiosity — to learn more about PCC and perform their own independent verification of our claims. And we’re excited to announce that we’re expanding Apple Security Bounty to include PCC, with significant rewards for reports of issues with our security or privacy claims.

https://security.apple.com/blog/pcc-security-research

#security #research #pcc #vre #apple
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

24 Sep 2024 09:09

Harden Windows Security | A New Threat to Malware

Harden Windows Safely, Securely, Only With Official Microsoft Methods.

https://github.com/HotCakeX/Harden-Windows-Security

#windows #security #hardening
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

10 Jul 2024 08:34

Google Chrome gives all *.google.com sites full access to system / tab CPU usage, GPU usage, and memory usage. It also gives access to detailed processor information, and provides a logging backchannel.

This API is not exposed to other sites - only to *.google.com.

https://x.com/lcasdev/status/1810696257137959018

#google #chrome #extension #privacy
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

02 Jun 2024 06:44

Stealing everything you’ve ever typed or viewed on your own Windows PC is now possible with two lines of code — inside the Copilot+ Recall disaster

https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e

#windows #copilot #recall
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

24 May 2024 16:43

no-defender

A slightly more fun way to disable windows defender.

There's a WSC (Windows Security Center) service in Windows which is used by antiviruses to let Windows know that there's some other antivirus in the hood and it should disable Windows Defender.

This WSC API is undocumented and furthermore requires people to sign an NDA with Microsoft to get its documentation, so I decided to take an interesting approach for such a thing and used an already existing antivirus called Avast. This AV engine includes a so-called wsc_proxy.exe service, which essentially sets up the WSC API for Avast.

With a little bit of reverse engineering, I turned this service into a service that could add my own stuff there.

https://github.com/es3n1n/no-defender

#reverseengineering #windows #defender #microsoft
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

15 May 2024 07:13

Foxit PDF “Flawed Design” Exploitation

Check Point Research has identified an unusual pattern of behavior involving PDF exploitation, mainly targeting users of Foxit Reader. This exploit triggers security warnings that could deceive unsuspecting users into executing harmful commands. Check Point Research has observed variants of this exploit being actively utilized in the wild. Its low detection rate is attributed to the prevalent use of Adobe Reader in most sandboxes or antivirus solutions, as Adobe Reader is not susceptible to this specific exploit. Additionally, Check Point Research has observed various exploit builders, ranging from those coded in .NET to those written in Python, being used to deploy this exploit.

https://research.checkpoint.com/2024/foxit-pdf-flawed-design-exploitation/

#exploit #foxit #pdf
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

14 May 2024 18:35

Firefox now collects data about search queries

https://blog.mozilla.org/en/products/firefox/firefox-search-update/

#firefox #privacy
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

13 May 2024 08:50

ShodanX

ShodanX is a versatile information gathering tool that harnesses the power of Shodan's extensive database. it offers multiple modes and flexible queries to extract valuable insights for security assessments, reconnaissance, and threat intelligence. With colorful output and intuitive commands, ShodanX empowers users to efficiently gather and analyze data from Shodan's facets, enhancing their cybersecurity efforts.

https://github.com/RevoltSecurities/ShodanX/tree/main

#shodan #shodanx #pentesting #cybersecurity #infosec
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

13 May 2024 08:02

Lethal Injection: How We Hacked Microsoft's Healthcare Chat Bot

We have discovered multiple security vulnerabilities in the Azure Health Bot service, a patient-facing chatbot that handles medical information. The vulnerabilities, if exploited, could allow access to sensitive infrastructure and confidential medical data.

All vulnerabilities have been fixed quickly following our report to Microsoft. Microsoft has not detected any sign of abuse of these vulnerabilities. We want to thank the people from Microsoft for their cooperation in remediating these issues: Dhawal, Kirupa, Gaurav, Madeline, and the engineering team behind the service.

The first vulnerability allowed access to authentication credentials belonging to the customers. With continued research, we’ve found vulnerabilities allowing us to take control of a backend server of the service. That server is shared across multiple customers and has access to several databases that contain information belonging to multiple tenants.

https://www.breachproof.net/blog/lethal-injection-how-we-hacked-microsoft-ai-chat-bot

#microsoft #healthcare #ai #chatbot #hacked
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

10 May 2024 08:30

7 Deadly Sins of Distrohopping

What are you doing wrong with distro-hopping? Can you do it better? Yes, you can. Here, we tell you how.

https://itsfoss.com/distrohopping-issues/

#linux #foss #distrohopping
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

08 May 2024 07:54

Proton Mail Discloses User Data Leading to Arrest in Spain

Proton Mail has come under scrutiny for its role in a legal request involving the Spanish authorities and a member of the Catalan independence organization, Democratic Tsunami.

https://restoreprivacy.com/protonmail-discloses-user-data-leading-to-arrest-in-spain/

#protonmail
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

25 Apr 2024 13:32

Docker Security – Step-by-Step Hardening (Docker Hardening)

This article provides practical recommendations for configuring Docker platform aimed at increasing its security. It also suggests tools helpful in automation of some tasks related to securing Docker.

My intention is to guide the reader step by step through the process of preparing a secure configuration. As such, this guide may prove to be more extensive than other similar publications. However, this is a conscious choice. My goal is not merely to present a dry list of parameters and ready-made configuration snippets, but to provide the reader with a fuller context. I want the reader to understand why certain modifications are necessary and what benefits their implementation will bring.

https://reynardsec.com/en/docker-platform-security-step-by-step-hardening/

#docker #hardening #guide
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

15 Feb 2024 08:58

To celebrate Conversations being back on the Play Store and to deny Google their 15% cut I made the app free for the next ~48 hours.

daniel/111933922710829462" rel="nofollow">https://gultsch.social/@daniel/111933922710829462

#conversations #jabber #xmpp #app #free
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

10 Jan 2024 13:49

The Battle for Biometric Privacy

The pushback against ubiquitous surveillance and targeted deepfaking has begun—but regulation may fail to keep up with AI advances.

In 2024, increased adoption of biometric surveillance systems, such as the use of AI-powered facial recognition in public places and access to government services, will spur biometric identity theft and anti-surveillance innovations. Individuals aiming to steal biometric identities to commit fraud or gain access to unauthorized data will be bolstered by generative AI tools and the abundance of face and voice data posted online.

https://www.wired.com/story/the-battle-for-biometric-privacy/

#biometric #privacy #deepfake
📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BlackBox (Security) Archiv

25 Dec 2023 12:10

📡@cRyPtHoN_INFOSEC_IT
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv