zCat / zCat is on Nostr

"4492e5f558aa7d52ce5df3943f68956f1744ae08ba2cf3235b7a8c4cc0efe90237717ea378a1a350ea0dda6bf5737deeffde40fbe3e493da62b624d646c36757"

Last Notes

2024-11-14 00:47:07

Microsoft patches Windows zero-day exploited in attacks on Ukraine
Suspected Russian hackers were caught exploiting a recently patched Windows vulnerability as a zero-day in ongoing attacks targeting Ukrainian entities.
The security flaw (CVE-2024-43451) is an NTLM Hash Disclosure spoofing vulnerability reported by ClearSky security researchers, which can be exploited to steal the logged-in user's NTLMv2 hash by forcing connections to a remote attacker-controlled server.
"Minimal interaction with a malicious file by a user such as selecting (single-click), inspecting (right-click), or performing an action other than opening or executing could trigger this vulnerability.
See more: https://www.bleepingcomputer.com/news/security/microsoft-patches-windows-zero-day-exploited-in-attacks-on-ukraine/
#cybersecurity #patches #zeroday

2024-11-08 08:52:06

Androxgh0st Botnet Integrates Mozi, Expands Attacks on IoT Vulnerabilities
CloudSEK reports that the Androxgh0st botnet has integrated with the Mozi botnet and exploits a wide range of vulnerabilities in web applications and IoT devices. Learn about the specific vulnerabilities being targeted, the techniques used by the attackers, and how to protect your systems from this evolving threat.
Cybersecurity researchers at Contextual AI company, CloudSEK’s AI digital risk platform XVigil have uncovered a new development in the Androxgh0st botnet. This malicious network, initially targeting web servers since January 2024, has re-emerged after undergoing transformation.
Reportedly, the botnet now shares components from the infamous Mozi botnet, historically known for infecting internet-of-things (IoT) devices. The analysis of Androxgh0st‘s C&C logs revealed an operational change as the botnet now appears to be deploying Mozi-linked payloads.
See more: https://hackread.com/androxgh0st-botnet-integrate-mozi-iot-vulnerabilities/
#cybersecurity #botnet

2024-11-05 21:11:45

Pakistani Hackers Targeted High-Profile Indian Entities using Custom RAT
A hacking group associated with the Pakistani government has repeatedly targeted high-profile entities in India with cyber espionage campaigns throughout 2024, according to cybersecurity provider Check Point.
Researchers at Check Point Research are closely tracking the persistent use of ElizaRAT, a custom implant deployed by Transparent Tribe, a cyber espionage group attributed to Pakistan, also known as APT36.
They observed several campaigns using the remote access trojan (RAT) in 2024, with many likely successful.
See more: https://www.infosecurity-magazine.com/news/pakistan-hackers-high-profile/
#cybersecurity

2024-11-01 08:28:35

qBittorrent fixes flaw exposing users to MitM attacks for 14 years
qBittorrent has addressed a remote code execution flaw caused by the failure to validate SSL/TLS certificates in the application's DownloadManager, a component that manages downloads throughout the app.
The flaw, introduced in a commit on April 6, 2010, was eventually fixed in the latest release, version 5.0.1, on October 28, 2024, more than 14 years later.
However, as security researcher Sharp Security highlighted in a blog post, the team fixed a notable flaw without adequately informing the users about it and without assigning a CVE to the problem.
See more: https://www.bleepingcomputer.com/news/security/qbittorrent-fixes-flaw-exposing-users-to-mitm-attacks-for-14-years/
#cybersecurity #torrent

2024-10-31 13:21:58

Tails 6.9 is out! It updates Tor Browser to 14.0.1 and fixes some reliability issues in automatic upgrades.
Changes and updates
- Update Tor Browser to 14.0.1.
- Update the Tor client to 0.4.8.13.
- Update Thunderbird to 115.16.0.
See more
https://tails.net/news/version_6.9/
#privacy #tails #tor

2024-10-31 13:14:08

Fake Meta Ads Hijacking Facebook Accounts to Spread SYS01 Infostealer
A malvertising campaign is exploiting Meta’s platform to spread SYS01 infostealer, targeting men 45+ via fake ads for popular software. The malware steals Facebook credentials, hijacks accounts espicially those administrating business pages, and spreads further attacks globally.
See more: https://hackread.com/fake-meta-ads-hijacking-facebook-sys01-infostealer/
#cybersecurity #facebook

2024-10-31 13:10:59

Honeypot Surprise: Researchers Catch Attackers Exposing 15,000 Stolen Credentials in S3 Bucket
Sysdig researchers trace a bizarre S3 bucket misconfiguration to EmeraldWhale, exposing 1.5 terabytes of stolen credentials and script.
See more: https://www.securityweek.com/honeypot-surprise-researchers-catch-attackers-exposing-15000-stolen-credentials-in-s3-bucket/
#cybersecurity
#nevent1q…h9a7

2024-10-31 11:55:09

Hackers steal 15,000 cloud credentials from exposed Git config files
A large-scale malicious operation named "EmeraldWhale" scanned for exposed Git configuration files to steal over 15,000 cloud account credentials from thousands of private repositories.
Git configuration files, such as /.git/config or .gitlab-ci[.]yml, are used to define various options like repository paths, branches, remotes, and sometimes even authentication information like API keys, access tokens, and passwords.
According to Sysdig, who discovered the campaign, the operation involves using automated tools that scan IP ranges for exposed Git configuration files, which may include authentication tokens.
These tokens are then used to download repositories stored on GitHub, GitLab, and BitBucket, which are scanned for further credentials.
See more: https://www.bleepingcomputer.com/news/security/hackers-steal-15-000-cloud-credentials-from-exposed-git-config-files/
#cybersecurity #git

2024-10-25 11:10:57

Several Linux Kernel Driver Maintainers Removed Due To Their Association To Russia.
It was described as due to "compliance requirements" but vague in what those requirements entailed. Linus Torvalds then commented on the Russian Linux maintainers being de-listed and made it clear that they were done due to government compliance requirements / legal issues around Russia. Now today some additional light has been shed on those new Linux kernel "compliance requirements".
Longtime Linux developer and EXT4 file-system maintainer Ted Ts'o has also provided some clarity on a separate Linux kernel mailing list thread. In response to a suggested patch removing Huawei from the MAINTAINERS file given their known relations with the Chinese government there was more discussion about possible future removals.
See original news:
https://www.phoronix.com/news/Russian-Linux-Maintainers-Drop
See Torvalds statement:
https://www.phoronix.com/news/Linus-Torvalds-Russian-Devs
See Compliance Requirements update:
https://www.phoronix.com/news/Linux-Compliance-Requirements
See the original commit:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6e90b675cf94
#linux #cybersecurity

2024-10-15 05:56:46

Cisco investigates breach after stolen data for sale on hacking forum
"Compromised data: Github projects, Gitlab Projects, SonarQube projects, Source code, hard coded credentials, Certificates, Customer SRCs, Cisco Confidential Documents, Jira tickets, API tokens, AWS Private buckets, Cisco Technology SRCs, Docker Builds, Azure Storage buckets, Private & Public keys, SSL Certificates, Cisco Premium Products & More!," reads the post to a hacking forum.
IntelBroker also shared samples of the alleged stolen data, including a database, customer information, various customer documentation, and screenshots of customer management portals.
However, the threat actor did not provide further details about how the data was obtained.
See more: https://www.bleepingcomputer.com/news/security/cisco-investigates-breach-after-stolen-data-for-sale-on-hacking-forum/
#security #cybersecurity #privacy

2024-09-15 16:34:04

zCat, an Android data aggregator for #Zcash, privacy and security news released a new update. Please, update your app to v0.1.1.
https://image.nostr.build/e02e3156c698af59cdbe46e7aa87eaea676d934cdda513ed48bff42914ae581f.jpg
Available in multiple languages: BR 🇧🇷, CS 🇨🇿, DE 🇩🇪, EN 🇺🇸, ES 🇪🇸, FR 🇫🇷, IN 🇮🇩, PL 🇵🇱, RU 🇷🇺, TR 🇹🇷
https://play.google.com/store/apps/details?id=crypto.crab.app.zcat
The main changes were about the creating of your own news feed. There are couple of more news resources to track now.
Bigger reconstruction was made in feed focused on social networks. There was added option to follow profiles on #Nostr protocol! Furthermore, now you can see also posts from #ZEC Pages!
https://image.nostr.build/e9919af97d4340621b495f3c121ae43a28ac4f5ba39ae381bf52e20735527e5a.jpg
Nostr protocol works in specific way where in rare case you might need to reset relays to which you want to connect to fetch desired data. Be aware it is in your hands, but default pre-set option should work in most cases.
#ZECPages load the whole board, so you can see the latest post. In the future I can add filtering and give more care to keep threads (original posts with responses to be visible in the app). Let's see if there will be demand for it.
https://image.nostr.build/f59b6c5574efcb58d2a3c8716705e184f7cfc978a63011813381a9e242b0742f.jpg
Some of the tracked social network are customizable. That means you can add profiles/channels you want to follow! It is applicable for #Free2Z, #Nostr & #Reddit Just scroll on Resource list and tap 'Add Source'
Insert the username/channel you want to find & track and then, if search is successful, tap on Save button (Reddit data fetch might not working while connected to TOR or some VPNs, since they block it). After return to the feed screen you should be able to see the result!
https://image.nostr.build/1abf88222e8d239bddca0b9959c8ae4433d1199ea00d36e1b8a208450e0bed77.jpg
These feeds are created for tracking only (cannot create a post from zCat app) and it is limited to public posts. There is no login or profile creation in the app (if there is special content for subscribers only, it might not be shown)
Another new option is to turn off the noisy ads in the Setting screen, if you want. These ads are not real ads, just hard-coded links to other apps made by myself in the past. Do not worry to turn it off, I do not lose anything on that.
Of course, there were smaller bug fixes and code cleanup. I replaced some libraries, which might introduce new bugs. If you notice anything, please, let me know. I decided to not implement any tracking tools like crashlytics (which is probably stupid), I need to know from you.
If you will have any suggestion for improvements, please, let me know, too. Apart of functionality I am also a little bit suspicious about machine translations, so, any feedback is appreciated. Enjoy the app!

2024-09-12 17:57:45

Run #Zcash Zebra node on raspberry 🦓
Follow the ZecHub guide for the smooth setup: https://zechub.wiki/zebra

2024-09-12 17:54:26

Yubikey vulnerability:
- physical access needed,
- no option to patch.
Read more here:
https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel/
#privacy #security

2024-09-12 00:19:35

https://image.nostr.build/75b27266daf5bc6419ccd65349e0e2ad28e6d80c2e7a0f25afcd5c6d3ebb4656.jpg
zCat - your guide in the #Zcash ecosystem 😺

2024-09-10 21:52:31

What is unified address in #zcash? 🤔
https://electriccoin.co/blog/unified-addresses-in-zcash-explained/

2024-09-10 18:03:39

https://image.nostr.build/d0e17fb88d976a14a60aff3b10e01e702b64812bde03a1d2ed0855945678c5db.jpg
#Zcash

2024-09-09 17:41:14

#Zcash propaganda 😼