Mars Groves

Chromium issues a quality ultimatum. In the most recent CA/Browser Forum face-to-face meeting, the Google Chrome root program gave a presentation clearly defining its expectations for quality of incident reporting from CAs with an eye to where many CAs have been failing. Jason Soroko and I relate Chromium's statements and their significance. #pki #security #ssl #cabf https://lnkd.in/ghYPCshs

19

1 Comment

🛸 A common cyber attack attempt right here. Whenever you receive an e-mail, text, pop up or voicemail regarding contacting ANYBODY to resolve something, google that phone number first. 99/100 times this number will have been previously reported as a scam number. Google 8889915696 and you will see nothing but debt collector scams turn up as results. 🌝 I was instantly suspicious because I've never had Verizon account but the chance that whoever they are texting has had Verizon is fairly high. Phishing is a numbers game. 💻 Working as a Service Desk Analyst, there were an abundance of these scams in the form of pop ups that would hide the users mouse and claim that Microsoft Defender detected a trojan or malicious software and that the user should contact Microsoft at a number provided. It was also very bulky data wise and did slow down their computers as well until the web browser was close via the task manager. I always taught the employees to search numbers first and only ever call their employers service desk so we can handle any credential or security issues. 🔑 Cyber Security is for everybody, the knowledge you learn at work can make the difference between getting scammed or not in your personal life. Statistically, the vast majority of scam victims are over the age of 65, a population that many did not work with computers for the majority of their life and are unaware of social engineering tactics that target users emotions (usually fear) in order to manipulate their behavior.

5

1 Comment

Security 101: Never hardcode your passwords and/or cert keys into your devices. Lock control maker Chirp might have missed that introduction to security class since they hardcoded their passwords and private keys (no pun, well sort of a pun) into their applications. Chirp made CISA so mad they they were issued their own advisory (see below), as well as earning a "Exploitable remotely/low attack complexity" on CISA's executive summary. "Low attack complexity" means even your grandmother could attack these locks, remotely too. If you are one of the 50,000 households that use Chirp, well, sit by your front door with a loaded shotgun until Chirp fixes this issue. If you aren't a fan of loaded weapons, take a look at the newest Nerf Blasters. If you aren't a fan of Nerf, get yourself a wonderful mastiff dog (or two, very family friendly and protective, just cowards during lightening storms). https://lnkd.in/gQKWQE9t

8

For those that are curious how to break into the security industry and land yourself that dream job, Jonathan Todd outlines the playbook driving by curiousity and vulnerability. A resume, certifications and eduction become irrelevant when you consistently engage and add value back to the security community. 🤙 #cybersecurity #infosecurity #securityjobs

17

1 Comment

If you are following along on the CUI program home game, you know that the CUI program was created to apply a consistent set of requirements across the entire Executive Branch of the federal government which define what is sensitive, unclassified information and how that information should be safeguarded and disseminated. These requirements are defined in 32 CFR 2002, which was published in 2016. When the United States Department of Defense first created DoDI 5200.48 back in 2016 (DoDI 5200.48 defines DoD's implementation of the CUI program), 32 CFR 2002 was pretty new and, understandably, the early version of 5200.48 had some inconsistencies. DoD released an updated version of DoDI 5200.48 about a year and a half ago, and it addressed some of those inconsistencies. DoD recently released an updated policy memo which makes some additional changes to 5200.48. https://lnkd.in/gmsySBBq Those changes have, unfortunately, created a bit of added confusion about when CUI can be disseminated to authorized holders, and especially when: a) the disseminator is a government contractor; and b) the authorized holders are not US persons. The CMMC Information Institute put together the flowchart, below, to try to help walk government contractors through when CUI can be disseminated to someone who is not a US person (or, really, anytime). Hopefully it is helpful!

56

14 Comments

Soak in some great analysis from Ben Edwards on the state of National Institute of Standards and Technology (NIST) NVD, CVE Program and Cybersecurity and Infrastructure Security Agency's vulnrichment project... #cybersecurity #infosecurity #riskmanagement

11

Trust Wallet Urges Caution for Apple Users Amid Reports of Apple iMessage Zero-Day Exploit This iMessage zero-day exploit poses a threat as it allows hackers to gain control of iPhones without any interaction from the user. This 0day exploit is currently being sold on the dark web for $2 million in BTC. We don't have 100% confirmation at this time if this is real, however, if you want to play it safe, you may want to turn iMessage off on your iOS devices until we have proof and there is an appropriate patch or we discover the seller is hoax. https://lnkd.in/gYUAZBB6 #CyberSecurity #Apple #iOS #0day #iMessage #ZeroInteraction

79

23 Comments

Over the last 10 years, I've hacked some of the world's largest casinos (legally). One thing they always fail to account for is the creativity of attackers. Caspar Conde hit the nail on the head when he said, "It’s almost a cliche that casinos would, or should be, very good at keeping track of money that’s leaving the casino, but here for a period of about a month and a half a group going up to the ticketing cash-out machine and walking away with $3.2m," I see the same cliche when it comes to casino security. As I've previously said, "When most people think of a Casino, they think of high security, underground vaults, and an intimidating complexity. But with great complexity comes great security consequences. It’s easy to think of a casino as one big money-making machine. The reality is, under the hood, casinos are run by many individual moving parts, all relying on each other equally to function. This complexity represents an opportunity for hackers while resulting in obscurity for the people tasked with protecting the casino." If you're interested in learning more about hacking and securing casino's, check out the latest two issues of #HackedIn Stealing $3.2 million dollars using a ticket glitch 👉 https://lnkd.in/e_4ASmkZ How I hacked two of Australia's biggest casino's 👉 https://lnkd.in/eysNz8zZ

153

10 Comments

End-to-End Encryption vs. Protecting Children: Can We Have Both? A recent proposal by the European Union has ignited a fierce debate: should tech companies be mandated to scan private messages for child sexual abuse material (CSAM)? Protecting children is imperative, but this proposal raises grave concerns about the integrity of end-to-end encryption. Encryption is the cornerstone of our online privacy. It ensures that only the sender and recipient can access a message's contents. Undermining encryption would have profound consequences, leaving our communications vulnerable to malicious actors. How can we trust the government to safeguard our privacy when vulnerabilities exist in platforms like Signal, a widely trusted encrypted messaging service? Consider the following CVEs: Signal Desktop: CVE-2023-36665, CVE-2022-37601, CVE-2021-23440, CVE-2019-10747 Signal Server: CVE-2022-1471, CVE-2022-42889, CVE-2022-0839 libsignal: CVE-2023-42282 These vulnerabilities highlight the ongoing challenges in maintaining secure communication channels, making it even more critical to question any measures that could further weaken encryption. Advocates of the EU's plan assert that it's necessary to combat the proliferation of CSAM. However, critics argue that scanning private messages sets a dangerous precedent, paving the way for mass surveillance and infringing on our right to privacy. Moreover, such measures might prove futile, as criminals could simply migrate to more secure platforms. The critical question is whether we can protect children without compromising our privacy. This issue demands careful deliberation. We must devise solutions that tackle CSAM effectively without dismantling encryption's security advantages. Consider these questions: 1. Are there alternative methods to detect and prevent CSAM that do not involve scanning private messages? 2. Can education and awareness programs be enhanced to empower people to identify and report CSAM? 3. What role can tech companies play in creating solutions that protect children while upholding privacy? I would like you to please engage in this conversation and share your perspectives on this vital issue. Together, we can find a solution that protects our children and our privacy. #Signal #cybersecurity #privacy #encryption #childsafety #EU #technology What do you think? Can we strike a balance between protecting children and safeguarding privacy? Websites reviewed https://lnkd.in/e_CHeGfU

15

1 Comment

"The total number of infections within a few months in 2022 and 2023 is thought to be at least 20,000, with a “significant number” likely to still be impacted due to the difficulty of identifying and removing the RAT malware. 'The state actor installed malware at relevant targets at a later time. This gave the state actor permanent access to the systems. Even if a victim installs security updates from FortiGate, the state actor continues to have this access,' the update read." Check and patch your edge devices! #cybersecurity #cyberwar #cybercrime #infosec #criticalinfrastructure https://lnkd.in/eTJfdJf5

5

We all have to think about the best place for "security vs. usability" to meet. Here's a new one that bugs me a little bit. I'm getting legit, real text messages with a bill from a medical provider. The "from" is just five digits and the URL is a shortener. I can usually tell what's legit and what's a scam, but many people cannot. This is going to be a scammer's dream. If medical providers are going to send bills over text, a lot of people are going to get scammed. I get that it's an easy, fast and low cost way to send out bills, but I feel like it's a little too far away from the "security" end of the spectrum. #smishing #SocialEngineering

14

1 Comment

It is time for me to leave. I will pack up my toys in my red wagon and head home, giving up social media and public speaking forever. I will no longer be able to teach cyber security. The reason: my trademark communication skill has been deflated. Researchers at the Antisocial Society of America have created an AI to detect sarcasm. Without sarcasm I am defenseless, powerless, witless. AI will have the better of me in any conversation. My double-entendres will be flat and not exciting. My puns will fall short of being proper paraprosdokians. Shenanigans will just be shags. I ask the sarcasm AI researchers, "just because you can build it, should you put it on the Internet". With this AI operational it is a sad day for all folks who enjoy humor, need a smile, or those who like bad jokes. Curse you ACOUSTICAL SOCIETY OF AMERICA. Fother Muckers https://lnkd.in/gcGeqtkS

4

3 Comments

In tonights live API masterclass I'll be doing some live hacking, bring your own API target and follow along with me - How to approach an API if you're doing a black-box style engagement like bug bounty - How I know when to dig deep or move on - My hacking setup - All your Qs A'd

31

3 Comments

Understanding how to utilize Kroll Artifact Parser and Extractor (KAPE) can significantly enhance your forensic analysis capabilities. KAPE is a tool designed to parse and extract Windows forensics artifacts swiftly, expediting incident response processes. KAPE operates through the concepts of targets and modules. Targets are the forensic artifacts to be collected, while modules are programs that process these artifacts to extract information. With KAPE, you can collect files from live systems or storage devices and process them efficiently. Using KAPE involves configuring targets and modules. Targets specify what artifacts to collect, and modules dictate how to process them. Compound targets allow for the collection of multiple artifacts with a single command, streamlining the triage process. Understanding the structure of KAPE files (.tkape for targets, .mkape for modules) is essential. These files define the paths, categories, and file masks for collection. Similarly, modules (.mkape) specify the commands to run on collected data and their output formats. KAPE's functionality extends to the command line, offering flexibility and automation. Commands can be crafted to specify target sources, destinations, and module processing, granting fine-grained control over forensic procedures. Additionally, batch mode enables the execution of multiple commands in sequence, ideal for repetitive tasks. In a cybersecurity analyst position, mastering KAPE empowers you to conduct efficient forensic analysis, aiding in incident response, evidence collection, and data processing. Through KAPE, you can streamline workflows, optimize resource utilization, and bolster your investigative capabilities. TryHackMe Merit America

2

Huge SBOM Update! We've revamped the SBOM Labs in the latest revision for the SANS SEC547 Defending Product Supply Chains course, and will be releasing this new content at SANSFIRE in July! In this update we've added over 20 new tools to the course virtual machine, a purpose-built Linux OS designed for supply chain security work. And many of these tools feature in 3 completely new labs that will show you how to: ✅ Generate SBOM from open source, binaries, firmware and containers ✅ How to request SBOM from suppliers and validate what they provided ✅ Analyzing SBOMs for vulnerabilities and other risks and managing them at scale ✅ Working with multiple vulnerability databases ✅ Verifying SBOM quality and enriching content such as software provenance and pedigree ✅ Comparing tool output to evaluate your SBOM tool providers ✅ Supply Chain Incident Response ✅ And much more! This is a full lifecycle process that can take you from just getting started, to achieving meaningful value from your SBOM initiative. We cover a lot more than just SBOM across vendor risk, geopolitical and supply chain threats, hardware and HBOM, and supply chain attestations, so check out the course and register below. I can't wait to have you in class this July! https://lnkd.in/eNYNBY7R #sbom #cybersecurity #supplychainsecurity #scrm #softwaretransparency

39

2 Comments

The security market is slowly picking up and moving in the right direction 🙌 More roles being released daily meaning candidates have access to more opportunities. If you are one of the companies that took advantage of a poor market, are paying under market rates and have a poor interview process taking 3 months and 6 stages - you're in for a rude awakening. Candidates may have put up with this when the market was slow due to necessity, but with more opportunity you won't be able to access the best talent if the salaries and process aren't in place. If you want to make sure you are positioned to hire the best people as the market improves, reach out to Cyber Spring to get ahead of the competition 💪

102

15 Comments