Catalin Cimpanu

Cybersecurity reporter for Risky Business

#infosec #cybersecurity #security

Public Key

npub1tqfukrqgh928vktkl6vx063ck2c4yn3ek8m44v3txfhztqe65anq63aefw

NIP-05 Address

campuscodi_at_mastodon.social@mostr.pub

Profile Code

nprofile1qqs9sy7tpsytj4rkt9m0axr8agut9v2jfcumra66kg4nym39sva2wes53lt44

Author Public Key

npub1tqfukrqgh928vktkl6vx063ck2c4yn3ek8m44v3txfhztqe65anq63aefw

Show more details

Last Notes

2024-09-08 10:18:31

- reply

@npub19dt…05k8 don't hit CTRL+Shift+T
Let it rest in peace!

2024-09-08 01:21:33

I just removed a bookmark from by browser toolbar after two decades
Yes, I said two decades 😭 😭 😭 😭 😭
Damn, I'm actually old now

2024-08-25 18:48:36

A Chinese gaming studio with ties to the Chinese government acts exactly like you'd expect it to act 🙄
https://www.engadget.com/gaming/black-myth-wukong-breaks-steams-concurrent-single-player-record-within-hours-of-launch-184559634.html

2024-08-20 09:58:36

Phrack 71 is out
http://phrack.org/issues/71/1.html

2024-08-19 19:37:20

HP... the dumbass laptop vendor who decided to put Thunderbolt ports on a Windows laptop
jfc... what donkey did they hire as an engineer over there!

2024-08-15 00:35:40

"CyberCX has identified a network of at least 5,000 inauthentic X accounts almost certainly controlled in concert by an AI large language model system."
"The system controlling the network is strongly associated with China, including the likely use of a Chinese-language LLM system and links to an AI researcher affiliated with Tsinghua University and Zhipu AI, a prominent Chinese AI company."
https://cybercx.com.au/blog/cybercx-unmasks-china-linked-ai-disinformation-capability/

2024-08-13 20:23:33

- reply

@npub157z…2q4w It's an API download. Includes everything, from Edge to Azure

2024-08-13 18:37:12

Microsoft patched 186 vulnerabilities, including six zero-days: https://rawcdn.githack.com/campuscodi/Microsoft-Patch-Tuesday-Security-Reports/fea4520372721dc3d6a5b78beab6e43f73779e60/Reports/MSRC_CVEs2024-Aug.html
Adobe also had a massive patch day with 72 fixes: https://helpx.adobe.com/security/security-bulletin.html
https://files.mastodon.social/media_attachments/files/112/956/160/795/231/732/original/9d6159f5e26447d1.png

2024-08-13 17:12:05

- reply

@npub157z…2q4w what's the hurry... it's not like you have a deadline in 3h or something

2024-08-13 14:53:09

NIST PQE standards are out: https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards

2024-08-13 01:56:10

- reply

@npub1pds…9w57 you're right.
Deleted

2024-08-13 01:33:26

Rental service Airbnb has added a "no crypto-mining" policy after a spat of incidents where tenants installed mining rigs and ran up electricity bills
https://protos.com/airbnb-host-adds-no-crypto-mining-rule-after-tenant-installs-10-rigs/

2024-08-13 00:33:30

- reply

@npub157z…2q4w where are the fancy charts?
all I see is a long block of text :sadness:

2024-08-12 07:54:53

- reply

Plus:
-New web timing attacks
-K8s git-sync bug
-Bucket Monopoly AWS vulnerabilities
-OpenVPN vulnerabilities

2024-08-11 20:19:31

- reply

@npub1zh3…8rtv I'm actually more worried that LinkedIn won't let people back into their accounts if they don't share a government ID. I can deal with the AI spam

2024-08-11 16:55:50

- reply

@npub1q4p…g778 Twitter is now the place where you go to scream racist stuff now

2024-08-11 15:06:48

- reply

@npub14u9…h4pg they're actually horrible... i'd rather have guests use their laptop speakers... completlely trashes audio

2024-08-11 14:56:56

- reply

@npub143w…pykj that plague is slowly making its way here, sadly

2024-08-11 13:52:32

Bluetooth headphones are utter garbage and who disagrees with me on this has a tiny peepee

2024-08-11 12:19:05

Google monopoly explained in fine details via one of their internal documents
https://threadreaderapp.com/thread/1821554841786683554.html

2024-08-11 10:55:52

There are no lessons... I only see post bait engagement gold!
https://mastodon.social/@kevincollier/112940083350768698

2024-08-10 22:31:15

- reply

@npub104g…8993 what were the lessons again? 😁

2024-08-10 12:11:00

- reply

@npub1fvv…yw2w There's some Germans in Nazi uniforms and some people with Kamala and Macron tattoos
I sAw iT wItH mY oWn EyEs!!!

2024-08-08 17:17:32

The Turkish government has blocked access to 27 VPN services across the country.
The ban comes a week after the government also blocked access to Instagram.
https://ifade.org.tr/engelliweb/turkiyeden-erisime-engelli-vpn-servisleri/
https://files.mastodon.social/media_attachments/files/112/927/535/953/743/536/original/64fc740223725ceb.png

2024-08-08 16:06:44

Security firm runZero has released SSHamble (GitHub), a tool that can help security teams validate SSH implementations by testing for uncommon but dangerous misconfigurations and software bugs
https://www.runzero.com/newsroom/runzero-research-uncovers-exposures-in-ssh/
https://www.runzero.com/sshamble/
https://github.com/runZeroInc/sshamble

2024-08-08 14:09:40

The SEC has notified Progress Software that it has closed its investigation into the company's handling of the 2023 MOVEit hacks
https://investors.progress.com/news-releases/news-release-details/progress-announces-conclusion-sec-investigation-moveit

2024-08-08 13:54:53

Calling browsers' support a zero-day is the S tier on the cringe scale. What's next? Localhost relays are Stuxnet? Chill infosec!

2024-08-08 10:48:42

- reply

@npub1xlm…eqhy I know 2 people there... did you just attack my friends? /s

2024-08-08 10:05:33

Accenture has developed a new Extortion Group Maturity Model (EGMM) that assesses the credibility and stability of ransomware and data extortion groups
https://www.accenture.com/us-en/blogs/security/new-model-understanding-extortion-groups
https://files.mastodon.social/media_attachments/files/112/925/837/300/083/594/original/82c794243b8786f6.webp

2024-08-08 09:50:10

- reply

@npub17lg…9uux actual account ban?

2024-08-08 08:51:33

Criminal duo flee Russia and Kazakhstan, seek asylum in US, out of all places, get arrested and charged for said crimes
The definition of "shit for brains" right here
https://www.courtwatch.news/p/exclusive-massive-criminal-online

2024-08-07 21:01:04

- reply

@npub19mc…w44z fixed

2024-08-07 20:19:45

The Global Cyber Alliance has launched the Threat Taming Tools Collection (T3C), an extensive compilation of 300 resources tailored for cybersecurity professionals, researchers, and organizations.
https://docs.google.com/spreadsheets/u/1/d/1H9_xaxQHpWaa4O_Son4Gx0YOIzlcBWMsdvePFX68EKU/pubhtml
https://files.mastodon.social/media_attachments/files/112/922/590/137/999/509/original/ddc3e3dbff5f2800.png

2024-08-07 18:36:51

According to two reports, Google has allegedly sent an email to some customers to notify them that the company is legally bound to provide some of their confidential data to the US government in the case of investigations.
I honestly thought everyone already knew this, but nice from Google to notify users of it.
https://targettrend.com/google-says-it-is-obligated-to-disclose-confidential-information-of-users-to-u-s-government/
https://www.thedailystar.net/tech-startup/news/google-legally-obliged-disclose-confidential-user-information-3671161

2024-08-07 18:16:34

The German cybersecurity agency has published a guide for safely configuring LibreOffice.
https://www.bsi.bund.de/DE/Service-Navi/Presse/Alle-Meldungen-News/Meldungen/Sicherheit_LibreOffice_240807.html

2024-08-06 18:24:33

That Axios CEO internal memo is something else.
"Other outlets are poaching our reporters... so that's we're firing them first"

2024-08-06 13:13:32

Infostealer logs are becoming just as a big of a threat for threat actor OPSEC as they are for the rest of us and I love it!
Dox and catch as many as possible.
https://www.linkedin.com/feed/update/urn:li:activity:7224688739946500097/

2024-08-06 11:26:01

- reply

Now, the actual question:
Why would the site's owner do this?

2024-08-06 11:25:02

HotNews[.]ro, one of the largest and most popular news site in Romania, has been flooded with pro-Russian troll comments for the past two years.
Those comments were usually downvoted and auto-collapsed by other user's votes, who obviously knew what was happening.
The site recently redesigned its comments system to remove the ability to downvote comments and the entire user comments section is just Putin praisers and stupid unrelated anti-EU and "woke liberals" type of comments now

2024-08-06 11:11:32

- reply

@npub157z…2q4w doesn't look to be a zero-day, just a properly disclosed and now-patched bug

2024-08-06 10:27:33

- reply

@npub13kt…6n87 Guess that AI revolution in media isn't coming after all

2024-08-06 09:56:34

Talks from the t2 2024 security conference, which took place in April, are now available on YouTube
https://www.youtube.com/@t2infosec934/videos
This was the conference's last edition. :sadness:

2024-08-06 09:55:37

Live streams from the BSides Las Vegas 2024 security conference will be available on this YouTube page as they happen
https://www.youtube.com/@BsideslvOrg/streams

2024-08-05 21:06:23

The Acronis security team has discovered a new ransomware strain being delivered in campaigns in the wild.
Named Zola, the ransomware was first spotted in May and appears to be a rebrand of the older Proton ransomware.
https://www.acronis.com/en-us/cyber-protection-center/posts/zola-ransomware-the-many-faces-of-the-proton-family/
https://files.mastodon.social/media_attachments/files/112/911/448/196/787/881/original/c202df0b334778a5.webp

2024-08-05 19:42:05

It's 2024 and there still are conspiracy theories about Ayrton Senna being murdered
Chill YouTube

2024-08-05 17:38:46

- reply

@npub13vc…a293 Sorry... copy-pasted the wrong link from the newsletter (which had the Xeefcon videos as well)
Here you go: https://www.youtube.com/playlist?list=PLnWGkkkDVeqilYrIUJpQBKbdnW8v_8bId

2024-08-04 21:43:32

- reply

@npub13ds…cug4 I hate this thing. It made me cry

2024-08-04 15:14:44

The Elementor WordPress plugin is now used by a quarter of all WP sites, making it a bigger attack surface than WooCommerce.
It's also a highly-complex plugin, which means there's lots of bugs to be discovered and exploited in it
#threatIntelTips
https://w3techs.com/technologies/history_details/cm-wordpress
https://files.mastodon.social/media_attachments/files/112/904/402/443/254/021/original/86a008831dc8a659.png

2024-08-04 14:10:52

This (https://mastodon.social/@xarph@rusty.cat/112883189560691757) was covered in Friday's edition here:
https://news.risky.biz/risky-biz-news-sparks-fly-when-lawyers-meet-a-certificate-revocation/
I'm really bad at promoting the newsletter as of late :D
But thank you @npub1mkj…crdy for the tip-off!

2024-08-04 12:18:19

I love Vivaldi so much. I love using that browser.
I just wish it wasn't Chrome-based and ad blockers actually worked properly on it.
:sadness: :sadness: :sadness: :sadness: :sadness: :sadness: :sadness:

2024-08-01 13:26:20

Microsoft has launched the MSRC Researcher Resource Center, a portal hosting educational content for security researchers
https://msrc.microsoft.com/blog/2024/07/introducing-the-msrc-researcher-resource-center/
https://www.microsoft.com/msrc/msrc-researcher-resource-center

2024-07-31 23:57:35

I'll 100% break it!
Trust me. I have a pile of them
https://files.mastodon.social/media_attachments/files/112/883/806/813/975/225/original/3098d95688681e7f.png

2024-07-31 22:12:47

- reply

@npub1crl…mv08 hence why there won't be another debate 🤣

2024-07-31 06:11:25

This week's weekly Risky Business podcast makes its YouTube debut:
https://www.youtube.com/watch?v=mu9xJ2mHayU

2024-07-30 17:39:01

"Today we’re announcing the public preview of Auxiliary Logs, a new inexpensive Azure Monitor plan for verbose logs used in compliance and security scenarios."
👀 👀 👀 👀
https://techcommunity.microsoft.com/t5/azure-observability-blog/azure-monitor-logs-next-evolution-multi-tier-logging/ba-p/4200871

2024-07-30 15:37:07

- reply

@npub1m72…akq6 They'll be included in the ECB's 2024 Supervisory Review and Evaluation Process report later this year

2024-07-30 14:56:31

Some "funny" from tomorrow's edition
https://files.mastodon.social/media_attachments/files/112/876/020/456/371/305/original/e90e5517ca86b426.png

2024-07-28 13:22:57

- reply

@npub1sfh…9gqj I'm specifically interested in a non-Ukrainian source. Have you seen anything on RU Telegram channels or VK?

2024-07-28 12:16:55

I could not find any second source for this. Nobody in Russia seems to be complaining about ATMs being down.
Anyone else with a better view has any clues/evidence this actually took place?
https://www.kyivpost.com/post/36471

2024-07-26 15:37:06

Happy one-week anniversary, CrowdStrike customers!

2024-07-26 15:24:50

- reply

@npub1lwk…3zz0 oops 🤣

2024-07-25 20:56:27

- reply

@npub1qm3…7wu2 what does something from 80 years ago have to do with this?
because at any point some country somewhere did something extremely horrible

2024-07-25 19:08:46

"Recently, two ex-spy chiefs from the German foreign intelligence agency (BND) rang the alarm in a prominent German news outlet. They argued that the German intelligence community was being reduced to ‘toothless watchdogs’ because of ‘an excess of oversight’ and that ‘policies and courts must no longer denigrate intelligence services as a threat to the rights of German citizens’."
https://bindinghook.com/articles-binding-edge/can-lawyers-lose-wars-by-stifling-cyber-capabilities/

2024-07-25 17:34:20

- reply

@npub157z…2q4w no, not really... it's been a busy day... barely looked at social media

2024-07-25 16:44:25

- reply

According to an FBI Cyber Most Wanted page, he appears to have been charged in Kansas
https://www.fbi.gov/wanted/cyber/rim-jong-hyok
https://files.mastodon.social/media_attachments/files/112/848/131/873/742/472/original/b386ace7c1f68ab9.png

2024-07-25 16:31:59

- reply

Sanctions come as both CISA and Google/Mandiant have published reports on the group today:
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a
https://cloud.google.com/blog/topics/threat-intelligence/apt45-north-korea-digital-military-machine
Don't see any sanctions or DOJ indictment yet.

2024-07-25 16:28:56

US offers $10 mil reward for Andariel APT member identified as Rim Jong Hyok
https://www.state.gov/rewards-for-justice-reward-offer-for-information-on-north-korean-malicious-cyber-actor-targeting-u-s-critical-infrastructure/
https://files.mastodon.social/media_attachments/files/112/848/072/557/341/465/original/e51d41a06e6c62f1.jpg

2024-07-25 15:59:20

French authorities take down PlugX botnet
https://www.linkedin.com/posts/parquet-de-paris_communiqu%C3%A9-de-presse-plugx-activity-7222119504518987778-LRCi/

2024-07-25 13:56:32

EvolvedAim, a cheat tool for Escape from Tarkov, was caught installing malware on its users' devices.
Final payload was an infostealer. Estimated number of victims is around 1K.
https://www.cyberark.com/resources/threat-research-blog/double-dipping-cheat-developer-gets-caught-red-handed
https://files.mastodon.social/media_attachments/files/112/847/473/273/430/144/original/455925b90ff73930.png

2024-07-23 16:35:31

- reply

@npub1zh3…8rtv On behalf of all Europeans, please leave us behind

2024-07-23 02:03:45

- reply

@npub136x…mwy4 The Times has been a Trump paper for 1-2 years now. I'm surprised more people haven't noticed. They're the definition of whatabout journalism and opinion pieces disguised as news

2024-07-22 21:47:45

- reply

@npub1zh3…8rtv Google not deprecating third-party cookies after all is their way of saying privacy watchdogs have no teeth or oversight powers after all

2024-07-22 06:29:29

- reply

@npub1wh8…kng0 it's official Microsoft numbers

2024-07-21 16:26:01

- reply

@npub1hxf…g8qu https://x.com/techAU/status/1814919887267242391

2024-07-21 16:24:09

- reply

@npub1hxf…g8qu just saw it earlier... gimme 5

2024-07-21 12:42:25

Mandiant's Dan Kelly has published a Twitter post about how one member of a Chinese APT hacked dozens of MMORPG gaming companies.
Kelly says the individual appears to have been running a secret game cheating service that used his access to the gaming company's database to increase in-game currency for users—some of which were Twitch and YouTube streamers.
https://x.com/int0x00/status/1813937234640617964

2024-07-19 21:12:16

- reply

@npub1lye…xtsp cause none of those super-geniuses use an AV. That's why DPRK hackers love them so much

2024-07-19 18:40:11

I wonder how many customers CrowdStrike is gonna lose. Cause I'm already seeing a few people saying they're removing it for good

2024-07-19 16:58:03

What MSM is focusing on after the CrowdStrike outage:
Automatic updates are bad!
...le sigh! :jennpls: :pensive_party_blob:

2024-07-19 15:43:36

The CrowdStrike outage is also impacting the Mercedes F1 team they're sponsoring... who are in the middle of the Hungarian GP right now :KEKW:
https://www.youtube.com/watch?v=qm735NyExZQ

2024-07-19 08:38:14

- reply

@npub1p8t…479g well, I live in Bitdefenderland... so probably yes

2024-07-19 08:33:26

wtf Crowdstrike... my gym ID scanner is down... get your s**t together

2024-07-18 23:12:23

Two Foreign Nationals Plead Guilty to Participation in LockBit Ransomware Group
-Ruslan Magomedovich Astamirov (АСТАМИРОВ, Руслан Магомедовичь), 21, a Russian national of Chechen Republic, Russia
-Mikhail Vasiliev, 34, a dual Canadian and Russian national of Bradford, Ontario
https://www.justice.gov/usao-nj/pr/two-foreign-nationals-plead-guilty-participation-lockbit-ransomware-group

2024-07-18 19:58:29

- reply

@npub157z…2q4w not, yet... gimme 1-2h... gotta finish the day

2024-07-18 19:49:58

Chengdu 404, one of the APT41 contractors, is in the middle of a hiring spree
No news on i-SOON :sadness:
https://www.intelligenceonline.com/surveillance--interception/2024/07/18/chengdu-404-s-hiring-spree-siren-at-nypd-raid-buys-chinese-drones,110269612-art
In the meantime, GoogleTAGMandiant has published a report on APT41's 2023-2024 campaigns: https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust/

2024-07-18 18:18:55

"Over the last few years, our consumer-focused Pwn2Own event took place in the Trend Micro office in Toronto. However, that office closed, so we needed to find a new home. This isn’t unusual for this event, as it moved from Amsterdam to Tokyo to Austin to Toronto. We’re moving again. This year, we are heading to our offices in Cork, Ireland!"
https://www.zerodayinitiative.com/blog/2024/7/16/announcing-pwn2own-ireland-2024

2024-07-18 17:06:38

Orange CERT has discovered a previously known traffic-distribution system (TDS) used to redirect traffic from hacked sites to affiliate marketing scams.
Named R0BL0CH0N, Orange says the TDS has impacted more than 110 million Internet users.
https://www.orangecyberdefense.com/global/blog/cert-news/r0bl0ch0n-tds-a-deep-dive-into-the-infrastructure-of-an-affiliate-marketing-scam

2024-07-18 16:49:41

A new report claims that Google appears to have switched to a no-index default policy and is refusing to crawl new content unless it deems it necessary
https://www.vincentschmalbach.com/google-now-defaults-to-not-indexing-your-content/

2024-07-18 16:46:24

- reply

@npub1gh8…v7m0 I don't need the entire article inside the RSS. I just need a way to be notified of new content. It's literally a win-win for them.

2024-07-18 16:45:51

- reply

@npub157z…2q4w It's linked in there

2024-07-18 16:14:00

The Ukrainian government says that a threat actor known as UAC-0180 has been targeted local defense enterprises with spear-phishing emails using the topic of UV purchases as lures
https://cip.gov.ua/en/news/kiberzlochinci-vikoristovuyut-tematiku-zakupivel-bpla-dlya-atak-na-oboronni-pidpriyemstva

2024-07-18 16:12:59

Blockchain identity platform Fractal ID suffered a data breach on July 14.
The company says that a threat actor gained access to an employee account and ran an API script that collected personal data from customer accounts.
At least four crypto platforms (Gnosis Pay, Polygon, Ripple, and NEAR) have confirmed that their users were impacted.
PDF: https://app.fractal.id/documents/id/breach-notification.pdf

2024-07-18 15:13:17

Talks from the BlueHat IL 2024 security conference, which took place in May, are now available on YouTube
https://www.youtube.com/watch?v=KhdzIPPW4W0

2024-07-18 15:10:20

European hosting companies Hetzner and Hostinger suspended accounts linked to Russian disinformation group Doppelganger.
The web hosting accounts were exposed in a hoint report last week by Correctiv and the Qurium Foundation.
The suspension has impacted around 35% of the group's web hosting infrastructure.
https://correctiv.org/aktuelles/russland-ukraine-2/2024/07/18/nach-correctiv-recherche-russische-propaganda-kampagne-geraet-ins-stocken/

2024-07-18 14:33:57

Cado Security has discovered threat actors abusing Cloudflare's WARP service to launch scanning and reconnaisance attacks.
Cado says the attacks are leveraging a common misconfiguration where system administrators are allowlisting all of Cloudflare's IP ranges instead of just those specific to a given service.
The company says it has observed crypto-mining and SSH brute-force groups use this technique to bypass Cloudflare security defenses.
https://www.cadosecurity.com/news-and-events/warpscan-cloudflare-warp-abused-to-hijack-cloud-services

2024-07-18 14:19:51

- reply

@npub108p…yy4a
"Ukraine's Cyber Police says the duo kidnapped their own accomplice in an attempt to appropriate his share of the earnings."
I presume some beatings or torture was involved

2024-07-18 14:13:35

Wiz security researchers have uncovered a suite of vulnerabilities collectively in SAP's AI Core that can allow malicious actors to take over the service and access customer data.
Wiz says the vulnerabilities could have also been used to contaminate AI artefacts and even to spread to related customer services.
The vulnerabilities are collectively known as SAPwned and were fixed throughout the year.
https://www.wiz.io/blog/sapwned-sap-ai-vulnerabilities-ai-security

2024-07-18 12:58:13

@npub12e9…qsv6 finds new Chrome badness
https://threadreaderapp.com/thread/1813871195823181918.html

2024-07-18 11:37:14

I'll never understand news outlets that don't have an RSS feed
I just cant... :sadness:

2024-07-18 10:04:24

One of the world's largest boat and yacht retailers is notifying customers of a security breach.
MarineMax says a ransomware gang gained access to its systems in March and stole the personal details of more than 123,000 customers.
The breach is extremely sensitive as it contains details on individuals with considerable financial resources, who are typically the prime targets for extortion and threats.
https://www.bleepingcomputer.com/news/security/yacht-giant-marinemax-data-breach-impacts-over-123-000-people/