September 16, 2022
Update: A Threat Actor claims to have completely compromised Uber - they have posted screenshots of their AWS instance, HackerOne administration panel, and more.
They are openly taunting and mocking @Uber.
Persistence is the greatest hacker tool:
Apparently there was an internal network share that contained powershell scripts...
"One of the powershell scripts contained the username and password for a admin user in Thycotic (PAM) Using this i was able to extract secrets for all services, DA, DUO, Onelogin, AWS, GSuite" 
-
HISTORIC HANG-UP: Workers remove the last public payphone operating on the streets of New York city. Mass adoption of cellphones have rendered the once-ubiquitous installations obsolete. abcn.ws/3wJMsy6
-
My boyfriend just sent me six texts, all by accident, all intended for his friend. All six were about how much he loved Nicolas Cage. I would have rather found out he was cheating.
-
Geopolitical cyber incidents in Canada, eh.
https://dandurand.uqam.ca/wp-content/uploads/2022/08/2022-08-22-Rapport-OCM-ENG.pdf-
An interview with a foreign volunteer who was in Bucharest while it was occupied.
-
-
An insurer asked a 60-officer police department to "enact more than a dozen changes focused on reducing violent encounters with the public. When police failed to do so, the risk pool pulled its coverage, and the department disbanded."
-
Users:
-
COWORKER: we need to find the root cause asap
ME: *takes long drag* the root cause is that our processes are not robust enough to prevent a person from making this mistake
COWORKER: amy please not right now
-
Agreed. Fuzzing is currently our best tool for finding memory safety bugs. However it's:
- Somewhat effective at discovering spacial safety bugs.
- Much less effective (ineffective, really) at finding temporal safety bugs.
Temporal safety is where we most urgently need solutions
InsanityBit @InsanityBit
-
The more they stay the same https://t.co/aZKucVTUdS
Metlstorm @Metlstorm
-
30 Search Engines for Cybersecurity Researchers:
1. Dehashed—View leaked credentials.
2. SecurityTrails—Extensive DNS data.
3. DorkSearch—Really fast Google dorking.
4. ExploitDB—Archive of various exploits.
#cybersecurity #infosec #bugbounty
-
-
**Zombie Ant Farm: Primitives and Offensive Tooling for Playing Hide and Seek with Linux EDRs**
https://github.com/dsnezhkov/zombieant/wiki/Project-Overview-
Scenario likely happening overseas: An agent braces his case officer "ok, so you're telling me that the info that I'm giving you all, that can get me killed, can be just taken home by a former president? And your vaunted justice system is tied in knots? This is nuts. I quit."
-
-
msrc.microsoft.com/update-guide/v…
-
-
U.S. DOD & DOJ join FCC inquiry into internet routing security (Sep 14) justice.gov/opa/pr/departm…
Said FCC inquiry (Feb 28): fcc.gov/document/fcc-l…
FCC solicited comments from netops who participate in @RoutingMANRS: see screenshots (source: FCC-22-18A1, §13).
#RPKI #BGP
-
Lies. Damn lies. And newspaper headlines.
Take a look at this headline. This is based on an unpublished conference abstract (being presented today at an endocrinology meeting) of a study on rats.
The research finds nothing of the sort. They exposed immature rats to 6/12 hrs of intense blue light. There is nothing remotely relevant to screens or childhood puberty in this study.
-
Don't miss what's next. Subscribe to the grugq's newsletter: