uk.finance.yahoo.com
- 28% increase in phishing emails sent between April 1st – June 30th vs January 1st – March 31st, 2024 - 82% of phishing toolkits mentioned deepfakes and 74.8% referenced AI - During a commodity attack, on average organisations experience a 2,700% increase in phishing attacks compared to the normal baseline - 72.3% of commodity attacks used a hyperlink as its payload, followed by QR codes at 14.0% - 52.5% of advanced persistent threat (APT) campaigns were classified as zero-day attacks, while only 35.4% contained a previously identified payload - 89% of phishing emails involve impersonation; Adobe was the most impersonated brand, followed by Microsoft - 14.9% of impersonation emails were classed as ‘payloadless’, relying solely on social engineering tactics - 44% of phishing emails were sent from compromised accounts, helping them bypass authentication protocols
Akamai researchers have confirmed a new attack vector using CUPS that could be leveraged to stage distributed denial-of-service (DDoS) attacks. Research shows that, to begin the attack, the attacking system only needs to send a single packet to a vulnerable and exposed CUPS service with internet connectivity. The Akamai Security Intelligence and Response Team (SIRT) found that more than 198,000 devices are vulnerable to this attack vector and are accessible on the public internet; roughly 34% of those could be used for DDoS abuse (58,000+). Of the 58,000+ vulnerable devices, hundreds exhibited an “infinite loop” of requests. The limited resources required to initiate a successful attack highlights the danger: It would take an attacker mere seconds to co-opt every vulnerable CUPS service currently exposed on the internet and cost the attacker less than a single US cent on modern hyperscaler platforms.
gbhackers.com
The vulnerabilities have been identified in D-Link, DrayTek, Motion Spell, and SAP products.
kid Now • 100%
Update: Israel Planted Explosives in Pagers Sold to Hezbollah, Officials Say (https://www.nytimes.com/2024/09/17/world/middleeast/israel-hezbollah-pagers-explosives.html)
kid Now • 100%
You can use https://tails.net/ booting from another flash drive in memory only.
kid Now • 100%
Take that with a grain of salt.
kid Now • 100%
Agreed
kid Now • 100%
I like to use the 2013 Target breach case. They lost $1 billion due to the attack, their stocks dropped significantly after the attack, had several lawsuits, they closed a few stores, and changed the CEO and CIO. But a few months later, all was forgiven, their stocks recovered, and life went on.
Don't get me wrong, the risks of a cyber attack have to be taken seriously. But I feel that I have overestimated the impacts of reputational damage my whole life, as an infosec professional. My thinking was always like this: if you get reputational damage, you are done, no chance to recover, it is the end of it.
I'm following the Crowdstrike case, but I would bet that they will lose some market share (mostly prospects), perhaps some layoffs, but stocks will come up eventually.
kid Now • 100%
Not as much as if it contained passwords, for sure. Bu it gives a nice mailing list for phishing and so on.
kid Now • 100%
Depends of the country. Disrupt with Internet/communications may be a crime in some countries.
kid Now • 100%
Kudos to SOC team.
kid Now • 100%
CrowdStrike report of the incident: https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/
kid Now • 100%
Well, depends. If the user go to a captive portal to "authenticate" before the VPN could closes, than no. But, if the VPN can "pierce" through it (without any intervention from the AP), than yes. Anyways, If the user is willing to provide authentication data (like social media accounts, etc), nothing matters.
kid Now • 100%
kid Now • 100%
Interesting. I didn't know that syncthing does hole punching.
From a defense perspective, how would this work with an enterprise firewall, with UDP/TCP only allowed to specific destinations or specific sources. Example: only the internal DNS relay server can access 53/UDP and only the internal proxy server can access 80/443. What I mean is in a network with a very closed firewall, how would Syncthing be able to connect with peers?
kid Now • 100%
Not necessarily. Torrent is a way to find a peer for direct connection or via a relay (of course that is more than that). Syncthing, even using a relay server, requires some ports available for at least outbound connection (22000 TCP/UDP or whatever port the relay is using). This should not be possible in a medium security network, let alone a defense network. I don't know if syncthing works without a direct connection (to the peer or relay, something like transport via http proxy).
kid Now • 100%
Honestly, I didn't think about vulnerability in SyncThing when I read the article. But I wondered why defense forces would have p2p open on their networks.
kid Now • 100%
By the messages that they are sending to customers, looks like is related to recent updates to the services, but nothing clear.
kid Now • 100%
related to: https://sh.itjust.works/post/19619469
kid Now • 95%
Please note that the attack can only be carried out if the local network itself is compromised.
