Jonathan Care

This special compendium of Wilson Mendes' latest technical articles will take you on a fascinating journey through the complexities of cybersecurity, etc. https://lnkd.in/dMYdFD2U #infosec #cybersecurity #redteam #pentest #pentesting #hacking #hackers #opensource #windows

1

Are you aware of Tycoon 2FA phishing KIT? No :O? Maybe you should go on reading the article… https://lnkd.in/dmy7BKGF #software #programmer #cloud #phishing #cybersecuritytraining #networking #itsecurity #ransomware #hacked #internet #computer #data #iot #hackingtools #networksecurity #bhfyp #cloudcomputing #anonymous #databreach #ai #windows #cloudsecurity #java #developer #microsoft #cybersecuritynews #innovation #datascience #machinelearning #bugbounty

1

End-to-End Encryption vs. Protecting Children: Can We Have Both? A recent proposal by the European Union has ignited a fierce debate: should tech companies be mandated to scan private messages for child sexual abuse material (CSAM)? Protecting children is imperative, but this proposal raises grave concerns about the integrity of end-to-end encryption. Encryption is the cornerstone of our online privacy. It ensures that only the sender and recipient can access a message's contents. Undermining encryption would have profound consequences, leaving our communications vulnerable to malicious actors. How can we trust the government to safeguard our privacy when vulnerabilities exist in platforms like Signal, a widely trusted encrypted messaging service? Consider the following CVEs: Signal Desktop: CVE-2023-36665, CVE-2022-37601, CVE-2021-23440, CVE-2019-10747 Signal Server: CVE-2022-1471, CVE-2022-42889, CVE-2022-0839 libsignal: CVE-2023-42282 These vulnerabilities highlight the ongoing challenges in maintaining secure communication channels, making it even more critical to question any measures that could further weaken encryption. Advocates of the EU's plan assert that it's necessary to combat the proliferation of CSAM. However, critics argue that scanning private messages sets a dangerous precedent, paving the way for mass surveillance and infringing on our right to privacy. Moreover, such measures might prove futile, as criminals could simply migrate to more secure platforms. The critical question is whether we can protect children without compromising our privacy. This issue demands careful deliberation. We must devise solutions that tackle CSAM effectively without dismantling encryption's security advantages. Consider these questions: 1. Are there alternative methods to detect and prevent CSAM that do not involve scanning private messages? 2. Can education and awareness programs be enhanced to empower people to identify and report CSAM? 3. What role can tech companies play in creating solutions that protect children while upholding privacy? I would like you to please engage in this conversation and share your perspectives on this vital issue. Together, we can find a solution that protects our children and our privacy. #Signal #cybersecurity #privacy #encryption #childsafety #EU #technology What do you think? Can we strike a balance between protecting children and safeguarding privacy? Websites reviewed https://lnkd.in/e_CHeGfU

15

1 comentário

Bob creates an RSA cipher for a secret message (msg), and sends it to Eve. Bob will decrypt a message for Eve, but not a cipher that he has previously sent. Eve then applies a Chosen Cipher Attack (CCA) on the cipher (using a scalar value), and sends Bob a new cipher. Bob then decrypts it and sends back the decrypted value. Eve makes a quick calculation and can compute the original message. Determine the message for the following. Bob gives cipher for a message of 142840161502703849750073589382026804570883389350146505265129956637401128645654963819090393504021482991624452255433247931550149502314608827960284242591998867988534209443349834399075860450476766953685274975841434870549784413007458681620300220460913454433543818168031389690498032579443546903900446251885893078076 Eve sends a new of cipher: 26945485888977835131560075835828459221886588345659230234537483503561787017229811182439865491409097165354138664962466468765723880398067682494910698500054527944431476361382544679998621899858947543730241637074900609849352140362303197377462233745475057778933309532692476484168262457600125850869002272221678135786 and asks for it to be decrypted. Bob decrypts and gets a value of 256044255078594. Can you find the car manufacturer in the plaintext? Method: https://lnkd.in/eK6A7G95

3

good to know

1

What a great post from Dries on DORA en NIS2 differences and overlap. Answers most, if not all, of the questions I get on the subject! Must read, especially if you're active in the financial sector!

14

Let’s meet at OWASP Global AppSec Lisbon! On June 27 at 1:15pm, Avishay Zawoznik, Security Research Manager and Member of Cato CTRL, will present: “Start covering your bases & stop chasing APT headlines”. Join us to see an end-to-end simulation of a network breach. This will not be a unique or niche scenario, but a typical breach—one that is highly probable and that you may already have encountered on your network. More info here 👉 https://okt.to/HZDrdB #OWASP #cybersecurity #SASE

44

2 comentários

Tests for 88K+ vulnerabilities + ELEVEN Best Practice Evals - #reducerisk with our exhaustive #ITSecurity Assessment: https://lnkd.in/dW9-Qwa7 #pentesting #penetrationtesting #CISOs #CIOS #CSOs #cybersecurity #complianceofficers #ITdirector #healthcareleaders #banks #iot #infosec

12

Network security is on everyone’s lips these days. It’s not new but the impact and the defense grow daily. In general, the biggest malware threat to networks comes from our users importing those threats. They come in as email attachments, compromised and malicious websites and malware hidden in applications. IT departments expend tremendous technical and human capital to prevent incoming malware with tools like firewalls. We also put effort into preventing unauthorized outgoing data such as corporate intellectual property. It’s a game of Whack-A-Mole but that is the nature of the beast, right? Another side of that coin is investigating risk and threats, along with the gathering of potential evidence. Logs are a good start but there’s more. It’s not too challenging to capture targeted connections or broad spectrum traffic to and from a network. It takes two pieces of to capture selected traffic, a managed switch and a host running an application, such as Tcpdump or WireShark, that can capture and store data. From there, the data can be read and evaluated in real time or can be stored for later review. Please join us this Thursday, April 25th at 7:00 PM Central (01:00a UTC) at https://lnkd.in/ggqge4Sw for our weekly live, interactive show. On this week’s show, we’ll look at the structure of selective data capture from targeted hosts or, if there’s enough storage space, capture all inbound and outbound packet on a network. We’ll use simple SOHO gear and a Raspberry Pi and that’s all that’s needed for a small network. Larger networks work the same way with the same gear but a little more “horse power” may be needed. Our weekly, interactive show includes a major topic as well as plenty of interactive tech talk, tech news of the week, projects and plain ol’ fun. If you can’t join us live, you can see the show anytime at the same link, in the play list anytime later. All of our previous shows are piling up in the playlist/archive. You just might find something you’ll like in one of our archived shows as well as the next upcoming episode. We have a ton of upcoming fun topics on our plate. We would love to hear what you want to talk about or who you want to hear from. Expect new and exciting additions every week. Hope to see you there. We are a community of folks who appreciate and love to find, talk about and adopt (and sometimes, reject) the latest technological innovations. Please join us on the ground floor of our newly created Discord server to accomplish these goals: https://lnkd.in/gY5D-gWY #ama #youtube #daverush #drushtx #adramada #managedswitch #packetcapture #wireshark #tcpdump #networksecurity

5

What does security debt (old, unresolved flaws in code) look like across applications in your organization? Perhaps similar to one of these 20 anonymous organizations we sampled during a recent analysis of #appsec scan data. Each rectangle represents a different organization, which is subdivided into sections corresponding to the size of its active applications. The color applied to those applications measures their density of security debt. You can think of this as a depiction of the shape and status of the application attack surface for each organization. Organization 4 is relatively clear of debt across most of its applications, with a few exceptions in the lower right corner. Organization 9 below it shows pretty much the opposite trend—one tiny debt-free application floats alone in a sea of debt. Other organizations in this sample exhibit a relatively even distribution of debt across applications (e.g., Org 14) to an application attack surface that runs the gamut of debt density (e.g., Org 6). So, what makes one organization look so different from another when it comes to the distribution of security debt across their applications? Is it possible for teams to reverse indebtedness for the applications they develop and manage? Download the full report from Veracode, with analysis by Cyentia Institute, to find out! Get is here: https://lnkd.in/evh5jm2Z #softwaresecurity #applicationsecurity #devsecops #devops

53

Great read on the components of the new EU cyber Rules for Electricity Providers. The Aggressive: "Will require cyber regulators in each EU country to share information with counterparts in other member states within 24 hours of a company disclosing a cyberattack." Complete Opposite of Being Aggressive: "Electricity providers also will need to carry out assessments every three years to identify cyber risks and then implement protections to prevent major problems." #cybersecurity #criticalinfrastructure #riskmanagement #penetrationtesting

3

An interesting study on how human brainwaves can be used as a reliable method of authentication due to the fact that they are unique enough across individuals to be useful as biometrics. https://lnkd.in/gDzp_GpT #cybersecurity #authentication #biometrics #research

10

1 comentário

This requires your immediate attention. Palo Alto Networks GlobalProtect Feature has a high Risk Vulnerability that is getting exploited in the wild. According to the report below, there are 22,500 vulnerable instances across the globe. Check the post below. #cybersecurity #vulnerability #attacksurfacemanagement #attacksurface #vulnerabilitymanagement #threatintelligence #shadowserver

34

🚨 Vulnerability in R leaving projects open to supply chain attacks! 🚨 The vulnerability, assigned the CVE identifier CVE-2024-27322, has a high CVSS score of 8.8 and is related to the use of promise objects and lazy evaluation in R. It allows an attacker to create or alter a malicious RDS (R Data Serialization) file that, when loaded and referenced, can result in arbitrary code execution. This is because R packages leverage the RDS format to save and load data, and the vulnerability can be exploited when a package is decompressed and deserialized. An attacker can overwrite the RDS file of an R package with malicious code and have it executed when victims load the infected package onto their projects. For those that utilise R, please ensure you're on R Core Version 4.4.0 which now addresses the vulnerability.

8

1 comentário

If you’re attending OWASP Lisbon, make sure to catch Yoad Fekete’s presentation on navigating XZ and complex supply chain attacks. And feel free to book a time to meet the team: https://lnkd.in/dtdnSDTg OWASP® Foundation

36