cybersecurity

Weekly thread to discuss whatever you’re working on, big or small, at work or in your free time.

Weekly thread for any and all career, learning and general guidance questions. Thinking of taking a training or going for a cert? Wondering how to level up your career? Wondering what NOT to do? Got other questions? This is the time and place to ask!

The upstream xz repository and the xz tarballs have been backdoored.

Another installment of #infosec / #cybersecurity #followfriday! Some awesome accounts below👇

- @4Dgifts
- @hatless1der
- @eatscrayon
- @lcheylus
- @badhorse
- @blastoise
- @hookgab
- @misczak
- @thomrstrom
- @dkohlbre

If you're interested in following along in what is happening in the /c/cybersecurity community on infosec.pub (#Lemmy) than you can follow @cybersecurity!

Weekly thread to discuss whatever you’re working on, big or small, at work or in your free time.

Question for people willing to visit Cloudflare sites:

How do you determine whether to trust a login page on a CF site? A sloppy or naïve admin would simply take the basic steps to putting their site on Cloudflare, in which case the authentication traffic traverses CF. Diligent admins setup a separate non-CF host for authentication.

Doing a view-source on the login page and inspecting the code seems like a lot of effort. The source for the lemmy.world login page is not humanly readable. It looks as if they obfuscated the URLs to make them less readable. Is there a reasonably convenient way to check where the creds go? Do you supply bogus login info and then check the httpput headers?

cross-posted from: https://midwest.social/post/10292094

Source: www.infosecurity-magazine.com – Author: 1 A new phishing kit dubbed Tycoon 2FA has raised significant concerns in the cybersecurity community.  Discovered by the Sekoia Threat Detection & Research (TDR) team in October 2023 and discussed in an advisory published today, the kit is associated with the Adversary-in-The-Middle (AiTM) technique and allegedly utilized by multiple threat […]

Weekly thread for any and all career, learning and general guidance questions. Thinking of taking a training or going for a cert? Wondering how to level up your career? Wondering what NOT to do? Got other questions? This is the time and place to ask!

Part 1: https://venturebeat.com/security/security-expert-chris-krebs-on-tiktok-ai-and-the-key-to-survival/ Part 2: https://venturebeat.com/security/security-expert-chris-krebs-on-tiktok-ai-and-the-key-to-survival-part-2/

An HTML-only email from a gov agency has a logo referencing an URL that looks like this:

https://1wy1y.mjt.lu/tplimg/1wy1y/f/l9hl7/g3q3v.png

It’s not exactly that (apart from the domain) but of course it’s rather unique looking. They send email routinely. The initial emails had an obviously non-suspicious basic logo, like “(their office domain)/files/logo.png”. But then later they switched and every message from them is the URL in the mjt.lu domain. It’s not unique per message but it could be unique to the user, perhaps to keep tabs on when each person reads their messages.

The output of torsocks curl -LI looks like this:

HTTP/2 200
date: (exactly now)
content-type: image/png
accept-ranges: bytes

That’s it. It’s the shortest HTTP header I’ve seen. There’s no content-length. I find that suspicious because if this is a service that facilitates tracker pixels, then they would want to withhold the length in order to dodge detection. Although from its usage in my case it wouldn’t just be a pixel -- it’s a logo.

The date is also suspect. Shouldn’t the date be the date of the object, not the current time this second?

Are there any other checks to investigate this?

Weekly thread to discuss whatever you’re working on, big or small, at work or in your free time.

A thread compiling all Verge articles about AI influence on the upcoming election.

Has its own RSS feed: https://www.theverge.com/rss/stream/23862839

cross-posted from: https://midwest.social/post/10043498

In this interview, Pedro Cameirão discusses emerging cybersecurity trends for 2024 and advises enterprises on preparation strategies.

Weekly thread for any and all career, learning and general guidance questions. Thinking of taking a training or going for a cert? Wondering how to level up your career? Wondering what NOT to do? Got other questions? This is the time and place to ask!

• CSI: Advancing Zero Trust Maturity Throughout the Network and Environment Pillar [pdf]

• CSI: Use Secure Cloud Identity and Access Management Practices [pdf]

• CSI: Account for Complexities Introduced by Hybrid Cloud and Multi-Cloud Environments [pdf]

• CSI: Manage Cloud Logs for Effective Threat Hunting [pdf]

• CSI: Uphold the Cloud Shared Responsibility Model [pdf]

• CSI: Secure Data in the Cloud [pdf]

• CSI: Implement Network Segmentation and Encryption in Cloud Environments [pdf]

• CSI: NSA’s Top Ten Cloud Security Mitigation Strategies [pdf]

• CSI: Mitigate Risks from Managed Service Providers in Cloud Environments [pdf]

• CSI: Use Secure Cloud Key Management Practices [pdf]

• CSI: Enforce Secure Automated Deployment Practices through Infrastructure as Code [pdf]