Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
det.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
Mastodon Server des Unterhaltungsfernsehen Ehrenfeld zum dezentralen Diskurs.

Administered by:

Server stats:

2.1K
active users

det.social: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.2

#infosec

417 posts168 participants24 posts today
Public
drs1969 (David Smith) 🇬🇧

I HATE this wretched #Passkey nonsense. Every browser, OS, Website is trying to get me to create the things with NO explanation of how they work or what consequences are AND when I'm actually in the middle of signing in using a password manager.

As near I can tell, I've just had Windows, Chrome and maybe Amazon all have go.

And talk about anti patterns! Major sign in changes are NOT what you try to force on people in the middle of login task completion. What's WRONG with you?
#InfoSec

Public
OTX Bot

The "free money" trap: How scammers exploit financial anxiety

This analysis explores how scammers capitalize on financial stress by promising 'free money' through fake subsidy programs, government grants, or relief cards. Common tactics include using urgency, exclusivity, and fabricated social proof to manipulate victims. Scammers employ various techniques such as phishing, impersonation, fake customer support, QR code scams, and malware-laden attachments to collect personal data for identity theft or future scams. The article provides red flags to watch for, including vague claims, lack of contact information, and unrealistic promises. To protect against these scams, individuals should verify sources, avoid sharing personal information on unverified websites, report suspicious sites, and educate others about these fraudulent schemes.

Pulse ID: 6802cb9dcd152b0f855adc5b
Pulse Link: otx.alienvault.com/pulse/6802c
Pulse Author: AlienVault
Created: 2025-04-18 22:01:01

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

LevelBlue Open Threat ExchangeLevelBlue - Open Threat ExchangeLearn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.
#CyberSecurity#Government#ICS
Public
Tom

Been reading about this malware China is using written for Linux:

sysdig.com/blog/unc5174-chines

and it struck me: Why mount /tmp and /var/tmp without noexec, nodev, nosuid? Seems crazy to allow a directory anyone can write to, to run executables.

While we're at it, get rid of wget and curl and anything else that would allow them to even get a "dropper" on the system?

Isn't this common sense stuff?!

Sysdig · UNC5174’s evolution in China’s ongoing cyber warfare: From SNOWLIGHT to VShellAfter a year under the radar, the Sysdig Threat Research Team identified a new campaign from Chinese state-sponsored threat actor UNC5174.
#infosec#opsec#malware
Public
Xavier «X» Santolaria :verified_paw: :donor:

📨 Latest issue of my curated #cybersecurity and #infosec list of resources for week #16/2025 is out!

It includes the following and much more:

🇪🇺 🇺🇸 The European Commission is providing staff with burner phones and laptops for trips to the U.S.;

🇨🇳 🇺🇸 China is pursuing three alleged U.S. operatives for #cyberattacks on its infrastructure;

🇺🇸 A whistleblower revealed that DOGE may have accessed sensitive labor data from the National Labor Relations Board (NLRB);

💰 A new #ransomware called "DOGE BIG BALLS";

🇺🇸 💸 The U.S. government is ending funding for the Common Vulnerabilities and Exposures (CVE) program... and reverses course, extends MITRE CVE contract;

Subscribe to the #infosecMASHUP newsletter to have it piping hot in your inbox every week-end ⬇️

infosec-mashup.santolaria.net/

The European Commission is providing staff with burner phones and laptops for trips to the US; China is pursuing three alleged U.S. operatives for cyberattacks on its infrastructure; A whistleblower revealed that DOGE may have accessed sensitive labor data from the National Labor Relations Board (NLRB); A new ransomware called "DOGE BIG BALLS"; The U.S. government is ending funding for the Common Vulnerabilities and Exposures (CVE) program... and reverses course, extends MITRE CVE contract;
X’s InfoSec Newsletter🕵🏻‍♂️ [InfoSec MASHUP] 16/2025The European Commission is providing staff with burner phones and laptops for trips to the US; China is pursuing three alleged U.S. operatives for cyberattacks on its infrastructure; A whistleblower revealed that DOGE may have accessed sensitive labor data from the National Labor Relations Board (NLRB); A new ransomware called "DOGE BIG BALLS"; The U.S. government is ending funding for the Common Vulnerabilities and Exposures (CVE) program... and reverses course, extends MITRE CVE contract;
Public
Aljoscha Rittner (beandev)

"The Rise of Slopsquatting: How #AI Hallucinations Are Fueling a New Class of Supply Chain Attacks"

socket.dev/blog/slopsquatting-

> [...] One such risk is slopsquatting, a new term for a surprisingly effective type of software supply chain attack that emerges when LLMs “hallucinate” package names that don’t actually exist. If you’ve ever seen an AI recommend a package and thought, “Wait, is that real?”—you’ve already encountered the foundation of the problem.

SocketThe Rise of Slopsquatting: How AI Hallucinations Are Fueling...Slopsquatting is a new supply chain threat where AI-assisted code generators recommend hallucinated packages that attackers register and weaponize.
#InfoSec
Public
seism0saurus

Guten Morgen liebe*r Leser*in,

Nach wie vor schützen bei vielen Geräten und Diensten Passwörter den Zugang zu deinem Account oder deinen Daten. Doch Passwörter sind eigentlich denkbar ungeeignet. Computer sind viel besser darin, komplizierte Passwörter zu erraten, als Menschen darin, sie sich zu merken. Das geht mittels Brute-Force oder Wörterbuch Angriffen und steigender Rechenleistung immer schneller. Auch bei Phishing oder Einbrüchen in Server können deine Zugangsdaten gestohlen werden.
Mit Passkeys steht ein Nachfolger für Passwörter bereit, der die Zugänge nicht nur komfortable ermöglichen soll, sondern auch vor Man-in-the-Middle Angriffen und Phishing schützen. Der Clou an Passkeys ist, dass in den Passkeys die Domain des Dienstes mit integriert ist. D.h. wenn du einen Account bei example.com hast und eine Phishingmail dich auf axemple.com leiter, wird dein Passkey gar nicht übermittelt. Denn er passt nicht zu der Domain, für die er erstellt wurde.
Die großen Betriebssystemhersteller haben Passkeys integriert und wollen sie über ihre Cloud synchronisieren. Das ist je nach Konzept ein Problem. Sind die Passkeys nicht Ende-zu-Ende verschlüsselt, könnte Google oder Microsoft diese mitlesen bzw. würden Angreifer*innen in die Hände fallen, falls Lücken in diesen Diensten gefunden werden. Daher kann es je nach Misstrauen gegenüber den großen Technikkonzernen sinnvoll sein auf eine offene alternative wie KeePassXC zu setzen. Seit einigen Versionen unterstützt das OpenSource Programm auch Passkeys und kann diese über das Browserplugin zur Anmeldung an Webdiensten bereitstellen. Ganz sicher sind Passkeys auch auf Hardwaretokens. Von denen kann man aber kein Backup machen.
Wie bei 2FA solltest du prüfen, ob zwei Passkeys bei einem Dienst hinterlegt werden können oder wie der Prozess zur Wiederherstellung aussieht, wenn du deinen Passkey verlierst.
Nimm den heutigen Tag als Anlass und konfiguriere bei deinen Accounts Passkeys.

Habt einen guten Tag!

Eine Postkarte mit dem Logo von seism0saurus auf der linken Seite. Ein gezeichneter Seismosaurus im Comicstil. Neben seinem langen Hals steht nicht ganz ernst gemeint "Shake up it-security" und seine Homepage seism0saurus.de Rechts daneben der Spruch des Tages: "Hast du Passkeys aktiviert? Schütze deine Accounts mit der modernen Passwort-alternative."
#infosec#itsecurity#goodmorning
Public
Dumb Password Rules

This dumb password rule is from Banque de Tahiti.

You have to enter your password using this *very* Frenchy keypad. You don't have lowercase letters, the blanks are not spaces but just non-clickable gaps, but as a compensation you have some weird symbols that your keyboard does not have a key for (e.g. `µ`).

No accessible version available.

dumbpasswordrules.com/sites/ba

dumbpasswordrules.comBanque de Tahiti - Dumb Password RulesYou have to enter your password using this *very* Frenchy keypad. You don't have lowercase letters, the blanks are not spaces but just non-clickable gaps, but as a compensation you have some weird symbols that your keyboard does not have a key for (e.g. `µ`). No accessible version available.
#password#passwords#infosec
ExploreLive feeds
About