Avoid The Hack!

An initiative promoting the intersection of internet #privacy and #cybersecurity for all users.

MOVED to infosec.exchange -> @avoidthehack@infosec.exchange

Public Key

npub1vkypeczpkdeu63xx5qdm4sl775wkcdkgmxsw88cyjzcemztwrm6sd7w6p2

NIP-05 Address

avoidthehack_at_mastodon.social@mostr.pub

Profile Code

nprofile1qqsxtzquupqmxu7dgnr2qxa6c0l028tvxmydng8rnuzfpvva39hpaagpz4mhxue69uhhyetvv9ujumt0wd68ytnsw43qujtd7j

Publishing to

relay.mostr.pub

Author Public Key

npub1vkypeczpkdeu63xx5qdm4sl775wkcdkgmxsw88cyjzcemztwrm6sd7w6p2

Show more details

Last Notes

2023-07-12 19:16:00

How to share files and sensitive information securely
@npub1rv5…z2l6 shows you how to use Bitwarden Send to share files and sensitive information in a more secure way.
In most cases, you should avoid sending sensitive information via email (even if not a file).
#opsec #cybersecurity #security
https://bitwarden.com/blog/how-to-share-files-and-sensitive-information-securely/

2023-07-12 16:09:00

Avoidthehack updates #private #browser Comparison Tool
- Added Mullvad @npub1n0m…z5ld browser
- Added Comodo IceDragon
- Fixed image display issues on some #browsers
- Corrected existing information
#privacy #privacymatters #opensource
https://avoidthehack.com/util/browser-comparison

2023-07-12 12:02:29

CISA Adds Five Known #Vulnerabilities to Catalog
CVE-2023-32046 Microsoft Windows MSHTML Platform Privilege Escalation
CVE-2023-32049 Microsoft Windows Defender SmartScreen Security Feature Bypass
CVE-2023-35311 Microsoft Outlook Security Feature Bypass
CVE-2023-36874 Microsoft Windows Error Reporting Service Privilege Escalation
CVE-2022-31199 Netwrix Auditor Insecure Object Deserialization
#cybersecurity #infosec #security
https://www.cisa.gov/news-events/alerts/2023/07/11/cisa-adds-five-known-vulnerabilities-catalog

2023-07-11 22:31:04

- reply

@npub17lg…9uux Git off yer phone

2023-07-11 16:16:00

#Apple releases emergency #update to fix zero-day exploited in attacks
CVE-2023-37450 - code execution in the WebKit browser engine (which powers Safari).
#cybersecurity #infosec #security
https://www.bleepingcomputer.com/news/apple/apple-releases-emergency-update-to-fix-zero-day-exploited-in-attacks/

2023-07-11 12:14:00

#Google Changed Its #Privacy Policy: Does the Tech Giant Now Use All Your Data to Train Its AI?
From @npub1a76…3kkt
Color me surprised. 🤫
#ai #privacymatters
https://tutanota.com/blog/google-trains-ai-with-your-data

2023-07-10 23:35:00

How to block emails on #Gmail, Outlook, Proton Mail, Yahoo Mail, and #Apple Mail
From @npub1wjw…ue5t
#privacy #email #privacymatters
https://proton.me/blog/how-to-block-emails

2023-07-10 18:03:43

- reply

@npub1c5n…uy20 exactly. Connecting #threads to the fediverse for exposure is okay… but the cost for users to do so (through threads) is very high and concerning…

2023-07-10 15:07:00

New ‘Big Head’ ransomware displays fake Windows update alert
Suspected to be spreading primarily through *gasp* Malvertising.
During the encryption stage, this #ransomware displays a loading screen similar to a #windows update.
#cybersecurity #infosec #security
https://www.bleepingcomputer.com/news/security/new-big-head-ransomware-displays-fake-windows-update-alert/

2023-07-10 11:45:04

How Threads’ #privacy policy compares to Twitter’s (and its rivals’)
#threads has abysmal privacy... just reading the list in this article is exhausting.
I fail to see how it is an "acceptable middleground" for users being introduced into the #fediverse (with the talk of ActivityPub integration.)
#privacymatters #mastodon
https://arstechnica.com/security/2023/07/how-threads-privacy-policy-compares-to-twitters-and-its-rivals/

2023-07-08 14:13:00

Critical TootRoot bug lets attackers hijack #Mastodon servers
> bad actor sends malicious toot
> instances process malicious toot
> spawns webshell
> bad actor uses webshell to assume control over the server
There is a #security patch for this - all Mastodon server admins should update if they haven't already.
#cybersecurity #infosec
https://www.bleepingcomputer.com/news/security/critical-tootroot-bug-lets-attackers-hijack-mastodon-servers/

2023-07-08 12:40:00

CISA Adds One Known #Vulnerability to Catalog
CVE-2021-29256 Arm Mali GPU #Kernel Driver Use-After-Free
#cybersecurity #security #infosec #exploit
https://www.cisa.gov/news-events/alerts/2023/07/07/cisa-adds-one-known-vulnerability-catalog

2023-07-07 18:29:13

- reply

Realize this data wouldn’t exist in a vacuum or even as a “single data point.”
Meta has many avenues for data collection for users on its platforms (WhatsApp, Facebook, Instagram, etc) and off (Facebook Pixel and buying/using third party data). If just by interacting with }#threads users, you are now subject to their (Meta’s) policies… how crazy is that?
Stay safe out there, folks.
#privacy #privacymatters

2023-07-07 18:23:53

- reply

@npub1nsy…wa03 you covered most of it! Additionally, it has a phoning home function (but admittedly nothing like browsing data) that can’t be disabled.

2023-07-07 18:21:11

- reply

It looks like Meta could use the #fediverse to collect metadata on… a lot of people. In my opinion, it’s similar to the Facebook Pixel - which allows Meta to collect data on users who are off its platforms.
This could seem like no big deal (and I guess it could be), but let’s face it: Meta isn’t exactly #privacy friendly and has been accused (with proof) of abusing collected information.
#threads

2023-07-07 18:21:10

- reply

#threads also has a supplemental #privacy policy to the #meta privacy policy: (caution this is an Instagram link) https://help.instagram.com/515230437301944
There’s a section, “Information From Third Party Services and Users,” where it states “we collect information about Third Party Services and Third Party Users who interact with Threads.”
(Third Parties would naturally include other Fediverse instances and their users.)
Federated Fediverse platforms share some data, but this seems to be a whole other level.

2023-07-07 18:21:10

- reply

In this section of their #privacy policy, it’s stated “We collect information about the Third Party Services and a third party users who interact with threads…”
Interaction includes following #threads users, interacting with threads content, and especially threads users following/interacting with your “third party” content.
Data collected includes IP address, instance info, profile information
So, in theory, any interaction with a Threads user would subject you to this data collection…

2023-07-07 18:21:09

I’m not going to sit here and pretend like the current #fediverse without Threads is “perfect” for #privacy … But just look at the data #threads collects.
This is insane.
https://files.mastodon.social/media_attachments/files/110/674/023/151/058/300/original/2abb91f10572ff1d.jpeg

2023-07-06 23:36:00

Shell Confirms MOVEit-Related Breach After #Ransomware Group Leaks Data
Affected organizations from MOVEit continue to pile up...
#databreach #cybersecurity #security #moveit
https://www.securityweek.com/shell-confirms-moveit-related-breach-after-ransomware-group-leaks-data/

2023-07-06 16:37:00

Avoidthehack updates "Blocking Ads, Trackers, and #Malware in #Browsers, Devices, and Networks"
Updated this guide with lots of changes. Including removing mentions of Vivaldi, adding more sections/headers for readability, added references where appropriate.
So, what's your method of blocking ads?
#privacy #adblock #privacymatters #security
https://avoidthehack.com/how-to-block-ads

2023-07-06 14:44:01

Is my #password compromised?
@npub1rv5…z2l6 showcases how the locally run Bitwarden Vault Health Report can help you identify reused passwords, exposed passwords, and weak passwords.
#cybersecurity #infosec #opsec
https://bitwarden.com/blog/is-my-password-compromised/

2023-07-05 20:08:42

- reply

This is a #security update - which are updates you should always stay on top of.
In many cases, security updates provide patches/fixes for known security bugs or vulnerabilities in #software or firmware.
Keeping devices updated is an important part of maintaining good #cybersecurity hygiene.
https://avoidthehack.com/installing-updates

2023-07-05 19:46:00

#Firefox 115 Patches High-Severity Use-After-Free #Vulnerabilities
Usa-after-free in WebRTC.
Update to remedy.
#cybersecurity #infosec #security #opsec
https://www.securityweek.com/firefox-115-patches-high-severity-use-after-free-vulnerabilities/

2023-07-05 16:37:08

Who’s Behind the DomainNetworks Snail Mail Scam?
From @briankrebs
+1 for Domain WHOIS privacy protection. Personally, I've never received one of these - but somehow they've pinged the email associated with the record via a relay/aliasing service.
#privacy #privacymatters #scams
https://krebsonsecurity.com/2023/07/whos-behind-the-domainnetworks-snail-mail-scam/

2023-07-05 12:30:27

Gradual removal of port forwarding from the IVPN @npub1q9z…p6lq service
Port forwarding for Pro accounts will stop working after 30 SEP. New Pro accounts after 29 JUN will not have port forwarding offered.
#vpn #privacy #privacymatters
https://www.ivpn.net/blog/gradual-removal-of-port-forwarding/

2023-07-04 16:23:21

- reply

@npub1stq…euam you know it’s nothing but love :underheart: over here for Mojeek and MojeekBot. 😃

2023-07-04 15:21:14

Happy 4th!
Stay safe both online and off.

2023-07-03 22:28:00

CISA Adds Eight Known #Exploited Vulnerabilities to Catalog
CVE-2019-17621 D-Link DIR-859 Router Command Execution
CVE-2019-20500 D-Link DWL-2600AP Command Injection
CVE-2021-25487 Samsung Mobile Devices OOB Read
CVE-2021-25489 Samsung Mobile Devices Improper Input Validation
CVE-2021-25394 + CVE-2021-25395 Samsung Mobile Devices Race Condition
CVE-2021-25371
CVE-2021-25372 Samsung Mobile Devices Improper Boundary Check
#cybersecurity #infosec #security #patching
https://www.cisa.gov/news-events/alerts/2023/06/29/cisa-adds-eight-known-exploited-vulnerabilities-catalog

2023-07-03 19:28:28

- reply

@npub1hv0…7m6n Yes! I should have probably mentioned that.
As of right now, you have to enable MFA by logging into your Mastodon account in the browser. It supports TOTP (using an authenticator app). :)

2023-07-03 15:10:50

Influx of new followers! Exciting! :owi:
First: Welcome!
I have some #security tips for you:
- Make sure you use a strong #password for your new Mastodon account (don’t reuse your Bird Site AKA #twitter password. Or any other password.)
- use multi-factor authentication #mfa to add an additional layer of security to your account
- be aware DMs on Mastodon are not encrypted (admin instances can see read them). Don’t transmit sensitive info over DMs!
#mastodonmigration

2023-06-29 16:57:57

“How do I improve my personal online #security?”
Three easy steps:
- Use a password manager (lengthy, complex, unique #passwords)
- Use multi factor authentication #MFA (ideally TOTP/authenticator app or FIDO2/hardware keys)
- Keep your #software / firmware updated.
#cybersecurity #cyber #opsec
https://avoidthehack.com/getting-started-cybersecurity

2023-06-29 16:40:00

Brave @npub1wng…qj5n privacy updates: localhost resource permission
Brave introduces feature to block websites from potentially accessing images, web pages, and other hosted files/data on your computer.
#privacy #privacymatters #browsers
https://brave.com/privacy-updates/27-localhost-permission/

2023-06-29 12:11:01

Here's the thing about #privacy ...
It should be the default for everyone. Both online and offline.
#privacymatters #privatebydefault

2023-06-28 21:33:01

Introducing Proton Pass – Protecting your #passwords and online identity
Looks like @npub1wjw…ue5t has officially launched Proton Pass, a password manager.
#cybersecurity #privacy #security #privatebydefault
https://proton.me/blog/proton-pass-launch

2023-06-28 15:49:00

The Government Has a Controversial Idea to Track #mentalhealth Crisis Calls
Proposed automatic geolocation pinpointing for callers dialing the 988 line. 😐
#privacy #privacymatters
https://themarkup.org/2023/06/24/the-government-has-a-controversial-idea-to-track-mental-health-crisis-calls

2023-06-28 14:05:16

- reply

@npub1tnh…zlm5 @npub1a76…3kkt Thanks! My oversight, I edited the initial post. :D

2023-06-28 12:28:00

Prominent #cryptocurrency exchange infected with previously unseen Mac #malware
The exchange is unnamed as of posting.
Malware "JokerSpy" can exfiltrate private data and download malicious files (likely for further compromise)
#cybersecurity #infosec #security #opsec
https://arstechnica.com/security/2023/06/prominent-cryptocurrency-exchange-infected-with-previously-unseen-mac-malware/

2023-06-27 23:12:01

Can #Gmail Ads Get Even More Annoying?
From @tutanotateam
I think the answer is: yes.
Use a provider that respects your privacy and doesn't show targeted ads in your inbox,
#privacy #adtech #privacymatters
https://tutanota.com/blog/gmail-ads-annoying

2023-06-27 16:43:00

Secure Time Synchronization on #macOS
From friends at PrivSec
A guide for securely using ChronyControl to setup NTS on a local (virtual) #Linux server.
#opsec #cybersecurity #ntp #virtualization
https://privsec.dev/posts/macos/secure-time-synchronization-on-macos/

2023-06-27 14:17:00

American Airlines, Southwest Airlines Impacted by #databreach at Third-Party Provider
Affects pilot and cadet applications.
Data breached includes:
SSNs
Driver license numbers
Passport ID numbers
+ other
#cybersecurity #infosec #security
https://www.securityweek.com/american-airlines-southwest-airlines-impacted-by-data-breach-at-third-party-provider/

2023-06-27 12:13:01

Anatsa #Android trojan now steals banking info from users in US, UK
Primary distribution is in the #Google Play Store
Steals bank account credentials, credit card info, other payment information.
Not everything in any app store is safe. Be aware!
#cybersecurity #infosec #privacy #opsec #security
https://www.bleepingcomputer.com/news/security/anatsa-android-trojan-now-steals-banking-info-from-users-in-us-uk/

2023-06-26 21:16:01

How Your #Attention Is Auctioned Off to Advertisers
You should block ads.
#privacy #privacymatters #adtech #technology
https://themarkup.org/privacy/2023/06/23/how-your-attention-is-auctioned-off-to-advertisers

2023-06-26 17:03:31

Why browser extension games need access to all websites
From @npub1q94…tm7y
Browser extension games requesting potentially dangerous permissions in the browser, to include search hijacking and code injection.
Apparently many of these extensions are benign (in the sense the malicious code doesn't run initially) at first, but have placeholder code for future potentially malicious updates. Yikes.
#cybersecurity #infosec #security #malware #opsec
https://palant.info/2023/06/14/why-browser-extension-games-need-access-to-all-websites/

2023-06-26 15:03:09

SMS Phishers Harvested Phone Numbers, Shipment Data from UPS Tracking Tool
Benign (and "good") tools can be used to carry out phishing campaigns, such as this #smishing campaign targeting Canadian users who've placed legitimate orders with legitimate retailers.
#privacy #cybersecurity #privacymatters #opsec
https://krebsonsecurity.com/2023/06/sms-phishers-harvested-phone-numbers-shipment-data-from-ups-tracking-tool/
@npub1wf4…94wn

2023-06-26 12:39:42

- reply

@npub16yf…66at …? Brave proxies Google services (doesn’t necessarily remove or eliminate them), which causes it to be chatty by default. So if you have something like Safe Browsing enabled, you’ll see the backend traffic proxying away.
If the end destination is something something updates.brave.com - it checks for updates a lot.
P3a.brave.com is the analytics server. Can be disabled more info @ https://brave.com/privacy-preserving-product-analytics-p3a/
Brave can be “hardened” to reduce this activity.

2023-06-26 12:03:00

How strong is my password?
From @npub1rv5…z2l6
Unique + length = wins the day.
Avoid using personal information to create the password.
Avoid writing down the password or saving it in the browser - use a password manager instead!
#cybersecurty #infosec #security #password
https://bitwarden.com/blog/how-strong-is-my-password/

2023-06-24 18:15:00

CISA Adds Six Known Exploited #Vulnerabilities to Catalog
CVE-2023-20887 VMware Aria Operations for Networks Command Injection
CVE-2020-35730 Roundcube Webmail Cross-Site Scripting (XSS)
CVE-2020-12641 Roundcube Webmail Remote Code Execution
CVE-2021-44026 Roundcube Webmail SQL Injection
CVE-2016-9079 Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free
CVE-2016-0165 Microsoft Win32k Privilege Escalation
#exploit #cybersecurity #infosec #security
https://www.cisa.gov/news-events/alerts/2023/06/22/cisa-adds-six-known-exploited-vulnerabilities-catalog

2023-06-24 17:47:50

- reply

@npub1hgp…pfjx @npub188q…3jlx if by chance you need/want any third party input DMs + contact email are open! 😃

2023-06-24 15:12:00

Avoidthehack updates mobile browser recommendations.
Tried to simplify recommendations for #ios and #android, removing some previously recommended #browsers.
iOS: https://avoidthehack.com/best-privacy-browsers-ios
Android: https://avoidthehack.com/best-privacy-browsers-android
#privacy #security #opsec #privacymatters

2023-06-24 13:09:03

Skiff upgrades Pro Plan and rebuilds Mailbox import feature.
Skiff pro gives 200GB storage, 3 custom domains, 15 aliases.
Mail import features allows importing from #gmail and #outlook, and takes any mbox or .eml file for more universal email importing.
#privacy #opsec #privacymatters #privatebydefault
https://files.mastodon.social/media_attachments/files/110/599/349/330/351/856/original/9b07d87047db7d72.png

2023-06-24 11:54:00

Introducing Mullvad Leta: a search engine used in the Mullvad Browser
Only available with a paid @npub1n0m…z5ld #VPN account.
Uses the #Google Search API as a proxy and caches each search, which is shared across users.
#privacy #privacymatters
https://mullvad.net/en/blog/2023/6/20/introducing-mullvad-leta-a-search-engine-used-in-the-mullvad-browser/

2023-06-24 03:14:58

- reply

@npub1gll…4q2v Standard Notes! I use it daily. :owi:
https://standardnotes.com

2023-06-22 21:38:00

New Information Stealer ‘Mystic Stealer’ Rising to Fame
Like most info stealers out there, steals passwords, cookies, credit card info, and #cryptocurrency wallet extensions in browsers.
Can take screenshots + gather system information.
#malware #cybersecurity #security #opsec
https://www.securityweek.com/new-information-stealer-mystic-stealer-rising-to-fame/

2023-06-22 15:11:02

#Reddit hackers threaten to leak #data stolen in February breach
🤧
#cybersecurity #security #databreach #hacker
https://www.bleepingcomputer.com/news/security/reddit-hackers-threaten-to-leak-data-stolen-in-february-breach/

2023-06-22 13:24:00

Some of you have already found it (thank you! 🥰 ) - the Avoidthehack XMR wallet address = 41ycHn8wePM2b2hth4fXgj15sFnnJ4PQ4LpMv1RqUGNi55Tecbkwtj7ZsqWVDAqo7bYWJFPtRng5ca7Uw8k5ygu96NPrZ5H
Feel free to tip if you have the means!
#privacy #cybersecurity #monero

2023-06-21 21:45:01

#Android #spyware camouflaged as #VPN, chat apps on Google Play
- Primarily distributed as targeted attacks via WhatsApp and Telegram
- Collects contact and location info
Not everything in app stores is safe
Beware of links directing you to download an app (even from the app store) if not sent from the official source/developer of the app
#cybersecurity #infosec #security #opsec
https://www.bleepingcomputer.com/news/security/android-spyware-camouflaged-as-vpn-chat-apps-on-google-play/

2023-06-21 18:10:27

- reply

@npub1uf8…t94h Same. Next time I get a SEO email, I will respond with this. Lol.

2023-06-21 18:00:51

- reply

@npub1gzc…tp5z For a long time, people considered Reddit different from the other big social media platforms like Twitter and Facebook.
But nope. Just more of the same, with very slightly different flavoring.
And now we see their true colors! :blobsweats:

2023-06-21 16:31:01

Google Threatens to Kill #opensource #youtube Front-End Invidious for Letting You Watch Videos without Tracking or Ads
Not a conspiracy theorist... but now all of a sudden, after years (or rather, the "rise of #ai "), Big Tech wants to change/enforce API rules/pricing/you name it. Hmmm...
#privacy #privacymatters #opsec
https://tutanota.com/blog/google-youtube-invidious-privacy-alternative

2023-06-21 13:25:01

Asus Patches Highly Critical #WiFi #Router Flaws
Not patching could lead to malicious actors carrying out code execution (telling your device what to do), denial of service (making it unavailable for routine use), information disclosure and authentication bypass.
#cybersecurity #security #patch #opsec
https://www.securityweek.com/asus-patches-highly-critical-wifi-router-flaws/

2023-06-21 12:09:01

Millions of Americans’ personal #data exposed in global hack
People's with state ID's (like driver's licenses) in Oregon and Louisiana data has been leaked/breached.
MOVEit (CVE-2023-34362) SQL injection (and privilege escalation - CVE-2023-35708) continue to be exploited. There will be more high profile victims, almost certainly.
(OPM is also affected.)
#cybersecurity #infosec #security #ransomware #databreach
https://www.cnn.com/2023/06/16/politics/cyberattack-us-government/index.html

2023-06-20 12:28:00

What #Reddit Got Wrong
Should've kept it people over profits, when the people are doing the bulk of the work for your entire platform.
#privacy #privacymatters
https://www.eff.org/deeplinks/2023/06/what-reddit-got-wrong

2023-06-17 13:32:01

#Android GravityRAT #malware now steals your WhatsApp backups
Be careful of what apps you download - whether from the Google Play store, a third-party repo, or an apk from a website.
#cybersecurity #infosec #security #opsec
https://www.bleepingcomputer.com/news/security/android-gravityrat-malware-now-steals-your-whatsapp-backups/

2023-06-15 22:39:00

New ‘Shampoo’ Chromeloader malware pushed via fake warez sites
> pirate sites
> hosting #malware ChromeLoader (Shampoo)
> force installs extensions
> user cannot uninstall extensions
> searches hijacked, points to sketch results
User beware.
#cybersecurity #infosec #security #adware #opsec
https://www.bleepingcomputer.com/news/security/new-shampoo-chromeloader-malware-pushed-via-fake-warez-sites/

2023-06-15 17:03:06

Fake zero-day PoC exploits on GitHub push #Windows, #Linux #malware
"Hackers are impersonating cybersecurity researchers on Twitter and GitHub to publish fake proof-of-concept exploits for zero-day vulnerabilities that infect Windows and Linux with malware."
Careful what you find, download, and execute from GitHub on your machine.
#cybersecurity #infosec #security #opsec
https://www.bleepingcomputer.com/news/security/fake-zero-day-poc-exploits-on-github-push-windows-linux-malware/

2023-06-15 14:55:01

Suicide Hotlines Promise Anonymity. Dozens of Their Websites Send Sensitive #Data to Facebook
HIPAA does not apply like one think it would here.
Data, such as the contents of filled out contact forms, is transmitted with the Meta Pixel, which ends up in the hands of advertisers.
#privacy #privacymatters
https://themarkup.org/pixel-hunt/2023/06/13/suicide-hotlines-promise-anonymity-dozens-of-their-websites-send-sensitive-data-to-facebook

2023-06-14 18:46:01

Massive #phishing campaign uses 6,000 sites to impersonate 100 brands
Many of these make it to the top of #Google search "results" by being sponsored - or paid - ads.
Using an adblocker and a more private search alternative, such as Whoogle or SearXING, is ideal.
If not feasible, avoid clicking links in the sponsored section. It's usually best to visit the domain directly, versus using a search engine for it.
#cybersecurity #infosec #security
https://www.bleepingcomputer.com/news/security/massive-phishing-campaign-uses-6-000-sites-to-impersonate-100-brands/

2023-06-14 16:35:01

Another cluster of potentially malicious #Chrome extensions
Another post showing that not everything found in the Chrome Web Store is safe.
Many of these malicious extensions found by @npub1q94…tm7y have wide privileges in the browser - and then proceed to abuse them - such as becoming #spyware by having access to your browsing history.
#cybersecurity #infosec #security #malware
https://palant.info/2023/06/08/another-cluster-of-potentially-malicious-chrome-extensions/

2023-06-14 15:08:41

- reply

@npub1mcg…zdpy Thanks for the notification + the hard work!

2023-06-14 12:43:00

CISA Adds One Known Exploited #Vulnerability to Catalog
CVE-2023-27997 Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
Another zero-day possibly exploited in the wild.
#cybersecurity #infosec #security #update
https://www.cisa.gov/news-events/alerts/2023/06/13/cisa-adds-one-known-exploited-vulnerability-catalog

2023-06-13 15:34:32

Today is another Patch Tuesday - where a lot of big name vendors like Microsoft and #Apple roll out updates for software.
#cybersecurity #security #update
https://mastodon.social/@avoidthehack/110492812520870302

2023-06-13 15:08:51

- reply

@npub1hrf…9afe A good chunk of people have been signing up and using Lemmy, which is another part of the fediverse. I'm hearing good things about it from ex-Redditors.
There are alternatives to Youtube like Odysee and PeerTube. PeerTube is federated and Odysee is based on blockchain.
There are also private YouTube front ends like Invidious

2023-06-13 15:06:44

- reply

@npub12kh…77wz had no idea, thanks for the invite. 😀

2023-06-13 14:49:01

Intellihartx Informs 490k Patients of GoAnywhere-Related Data Breach
Affected data includes names, addresses, insurance data, medical billing, health data, birth dates, and social security numbers.
Allegedly leaked by Cl0p on their leak site.
#databreach #cybersecurity #security #infosec #leaks
https://www.securityweek.com/intellihartx-informs-490k-patients-of-goanywhere-related-data-breach/

2023-06-13 12:28:01

Have I Been Pwned warns of new Zacks #databreach impacting 8 million
This is not the same data breach that occured between NOV 2021 and AUG 2022.
New database containing 8.8 million unque records from a supposedly older breach circulating around leaks/hacking forums.
Contains... email addresses, usernames, unsalt SHA256 passwords, addresses, phone numbers, first and last names and other data.
#cybersecurity #infosec

2023-06-13 00:03:25

#API pricing protests caused #Reddit to crash for 3 hours
Looks like there's a Reddit to Lemmy (and the rest of the fediverse) going on!
(As some of you may know, the tanking of Apollo has officially made me quit Reddit.)
#fediverse #lemmy #technology
https://arstechnica.com/gadgets/2023/06/api-pricing-protests-caused-reddit-to-crash-for-3-hours/

2023-06-12 12:55:01

From Tutanota: #Vulnerability disclosure
@npub1a76…3kkt acts fast to fix a recent vulnerability.
#cybersecurity #infosec #security #opensource
https://tutanota.com/blog/fixed-vulnerability

2023-06-10 20:24:50

- reply

With #iOS 16.2, #apple introduced Advanced Data Protection (ADP)
Enabling ADP isn’t hard, just requires a few steps:
https://avoidthehack.com/enable-adp
Be sure to securely store your keys!
#privacy #privacymatters #encryption

2023-06-10 14:45:01

#Apple can see everything you store in iCloud
* Unless you enable Advanced Data Protection
Note that ADP does not include contacts, calendar, or icloud mail information. But that's a perfect excuse to use Proton Calendar/Email 😗 @npub1wjw…ue5t @npub1x7r…9nhr
(You can also use @npub1a76…3kkt and Skiff Privacy)
#privacy #privacymatters
https://proton.me/blog/apple-icloud-privacy

2023-06-09 18:17:01

Dozens of popular Minecraft mods found infected with Fracturiser #malware
Drops in stages, stealing credentials from browsers and apps (like Discord) and other sensitive information.
#Gamers beware.
#gaming #cybersecurity #infosec #security
https://arstechnica.com/information-technology/2023/06/dozens-of-popular-minecraft-mods-found-infected-with-fracturiser-malware/

2023-06-08 16:42:00

What #data are you exposing to the web?
Fingerprinting uses many different methods to pull unique characteristics about your device/browser - especially since browsers tend to be "leaky."
So, what is your device/browser sharing? This page gives you an idea.
#privacy #privacymatters #opsec #browser
https://personaldata.info/

2023-06-08 13:01:50

CISA Adds One Known #Exploited Vulnerability to Catalog
CVE-2023-3079 Google Chromium V8 Type Confusion Vulnerability
Be sure to update your browsers.
#cybersecurity #infosec #security
https://www.cisa.gov/news-events/alerts/2023/06/07/cisa-adds-one-known-exploited-vulnerability-catalog

2023-06-08 12:01:09

OWASP Top 10 API #Security Risks – 2023
Broken authentication is number 2.
APIs have been the source of many more recent data leaks - like the Twitter leak that could de anonymize pseudonymous Twitter users.
#cybersecurity #infosec
https://owasp.org/API-Security/editions/2023/en/0x11-t10/

2023-06-07 19:24:01

Over 60,000 #Android apps secretly installed #adware for past six months
Fake security software - to include (not limited to) #VPN, game cheats, Netflix, and other utility apps. These in particular not directly found in the Google Play store.
Be wary when installing new apps - whether from the Google Play store or manually via APK.
#cybersecurity #infosec #security #opsec
https://www.bleepingcomputer.com/news/security/over-60-000-android-apps-secretly-installed-adware-for-past-six-months/

2023-06-07 16:15:53

- reply

@npub1a76…3kkt Congrats! :D thank you for providing such a great privacy-respecting email service.
Cheers to another 10 mil, for 20 million? :blobwizard:

2023-06-07 16:12:01

Using #Google Analytics on a #privacy site should be called something like "privacy on privacy" crime. Geez.

2023-06-07 15:52:46

- reply

@npub1xrw…ymuh @npub1wf4…94wn :blobsweats: well, that hurts.

2023-06-07 15:37:31

- reply

@npub17cv…9p2q @npub1syw…m4fs @npub1s5q…4t4w
I think we're still just scratching the surface... :blobsweats:

2023-06-07 15:30:14

- reply

@npub17cv…9p2q @npub1syw…m4fs @npub1s5q…4t4w
Who is surprised? If it gets engagement, they push it. Nothing else matters - well asides from harvesting vast amounts of data and advertising revenue...
WSJ has a similar report describing how Instagram/Meta knew content pushed on Instagram was harmful for young users.
https://www.wsj.com/articles/facebook-knows-instagram-is-toxic-for-teen-girls-company-documents-show-11631620739

2023-06-07 13:18:01

Ask Fitis, the Bear: Real Crooks Sign Their #Malware
Default thinking (and the intention of digital signing) should, in theory, "guarantee" the identity of developers/vendors of #software
Threat actors can use code signing certs to bypass common #windows detection mechanisms - AKA your #antivirus.
So, if it's signed, is it safe? Depends.
#cybersecurity #infosec #security #opsec
https://krebsonsecurity.com/2023/06/ask-fitis-the-bear-real-crooks-sign-their-malware/

2023-06-07 12:18:01

New Tutanota Plans
@npub1a76…3kkt announces new pricing plans.
Some users will have access to the old plans.
#privacy #privacymatters
https://tutanota.com/blog/announcement-new-prices

2023-06-06 23:11:00

SpinOk #Android #malware found in more apps with 30 million installs
Supply chain attacks continue to affect downstream. On the "surface" is a daily mini-game, but can snoop/slurp clipboard and steal files.
Not everything in the Google Play store is safe. Vet your #apps as much as possible prior to install.
#cybersecurity #infosec #security
https://www.bleepingcomputer.com/news/security/spinok-android-malware-found-in-more-apps-with-30-million-installs/

2023-06-06 17:30:24

New tool scans iPhones for 'Triangulation' #malware infection
Alledgedly, this malware is part of targeted espionage campaigns, spying on users and potentially harvesting sensitive data. Threat actor(s) use an undisclosed 0 day in iMessage for initial access.
Would likely attribute this to nation-state threat actors, if I had to guess.
(This tool for detection was released by kaspersky)
#cybersecurity #infosec #security #opsec #apple #iphone
https://www.bleepingcomputer.com/news/security/new-tool-scans-iphones-for-triangulation-malware-infection/

2023-06-06 15:03:29

Introducing PCVARK and their malicious ad blockers
Research by @npub1q94…tm7y showing that 1) not everything found in the #Google Web Store is "safe" 2) not all adblockers are created equal. These "adblockers" injects JavaScript into visited web pages and attempts to phone home user browsing history.
Generally, stick to using #opensource adblockers widely trusted by the #privacy community, such as uBlock Origin and Adguard.
#cybersecurity #infosec #security
https://palant.info/2023/06/05/introducing-pcvark-and-their-malicious-ad-blockers/

2023-06-06 12:02:28

CISA Adds Two Known Exploited Vulnerabilities to Catalog
CVE-2023-33009 and CVE-2023-33010 Zyxel Multiple Firewalls Buffer Overflow
#cybersecurity #infosec #security
https://www.cisa.gov/news-events/alerts/2023/06/05/cisa-adds-two-known-exploited-vulnerabilities-catalog

2023-06-05 17:35:20

- reply

Software/firmware updates can also address bugs and deliver quality of life improvements for the user.
In some cases, software bugs can also be #security bugs (like race conditions) or become vulnerabilities of their own.
In any case, you as the user can’t take advantage of addressed bugs without updating.
Timely (security) updates improve your security posture, addressing known bugs and security vulnerabilities that could be exploited.
#exploit #cybersecurity #infosec #software

2023-06-05 17:35:19

- reply

Malicious actors or “hackers” are exploiting discovered and/or disclosed vulnerabilities quicker than ever.
Actors often rely on the lag between vulnerability disclosure (which can be in the patch notes of an update) and users updating to the latest #security patch to exploit vulnerabilities.
Exploits can range from telling your device what to do (code execution or command injection) to crashing the device so it’s unusable (denial of service).
#cybersecurity #infosec #privacy

2023-06-05 17:35:19

‼️Keep your devices and #software updated!
Software/Firmware updates frequently contain security updates. Those that do should be applied ASAP.
Security updates fix known vulnerabilities in software or firmware. Sometimes, malicious actors (“hackers”) exploit these, often installing #malware or otherwise comprising your #security and #privacy.
#cybersecurity #infosec #opsec
https://avoidthehack.com/installing-updates

2023-06-05 15:29:00

Microsoft is killing Cortana on #Windows starting late 2023
Finally. I had to go into the registry to disable it permanently on my Windows machine.
Being replaced with Windows Copilot.
#technology #privacy #privacymatters #tech
https://www.bleepingcomputer.com/news/microsoft/microsoft-is-killing-cortana-on-windows-starting-late-2023/

2023-06-05 13:40:20

- reply

@npub1q94…tm7y :D you know what… you bring up a good point. Malicious extensions are a privacy and security problem… time to put together another post on my end on top updating others.
Thanks for the idea/inspiration. 😝