Jonathan Colon

I am new to programming and writing code. I love it and this is a place where we can share thoughts or give advice. I will also retweet tech related news.

[The Hacker News @TheHackersNews]

🐍 Python developers beware! A malicious package named "crytic-compilers" was discovered on PyPI, designed to deliver the Lumma info stealer.

Learn more: https://t.co/yvPXkmwgGX

#cybersecurity #technews #malware

[Zed A. Shaw, Writer @lzsthw]

I run this thing called Portmaster which blocks all outgoing network requests until I allow them. The reason?

Microsoft Edge _WEBVIEW_ as in, the component that's in everything in Windows, is now trying to phone home to ChatGPT:

[The Hacker News @TheHackersNews]

A malicious Python package, pytoileur, has been found in PyPI, aiming at #cryptocurrency theft. Downloaded 316 times and re-uploaded after removal, this highlights significant risks in open-source ecosystems.

Learn more: https://t.co/EqbHyIJ8hJ

#cybersecurity

[Matt Johansen @mattjay]

The DoJ just busted a massive scam involving North Korean IT workers infiltrating major US companies.

They had some help in the US and were posing as remote freelancers to siphon off money and sensitive info.

Holy crap, here's what we know:

[blackorbird @blackorbird]

Microsoft has identified a new North Korean threat actor, now tracked as Moonstone Sleet (formerly Storm-1789) #Lazarus
https://t.co/uZvWIrcNMP

[vx-underground @vxunderground]

tl;dr Microsoft introduces 24/7 surveillance functionality for the NSA and/or CIA but markets it as a feature that you'll like

[The Hacker News @TheHackersNews]

Foxit PDF Reader users, beware! A design flaw is being weaponized to deliver malware including Agent Tesla, AsyncRAT, DCRat, NanoCore RAT, NjRAT, Pony, Remcos RAT, and XWorm.

Learn more: https://t.co/LdsYX0gpsN

#infosec #hacking #cybersecurity

[vx-underground @vxunderground]

Microsoft May 3rd, 2024: We must prioritize security above all else

Microsoft May 19th, 2024:

[Florian Roth ⚡️ @cyb3rops]

😐

[0xor0ne @0xor0ne]

Exploiting an authenticated root command execution vulnerability in Hive camera HCI002UK
Credits @boredpentester

https://t.co/fsiYUB33wk

#iot #infosec

[vx-underground @vxunderground]

Today has been a whirling wind of chaos.

tl;dr we don't know anything. We need solid proof.

First, earlier this morning the current owner of Doxbin, Operator, was allegedly beaten and kidnapped. Footage released by the would-be kidnappers shows, presumably Operator, tied to a pole and being punched and kicked. However, many viewers immediately expressed doubt on the footage and some said it's a 'detrace' operation — essentially an exit strategy for Operator.

We do not know the truth. We can only speculate. It is strange.

Secondly, BreachForum was seized today. Following the takedown there were lots of rumors floating around about Breach being a honey-pot, that key members have been arrested, etc. While this may certainly be true, there is no confirmation from law enforcement agencies on arrests or indictments. ShinyHunter, the other administrator of the website, has stated the other administrator, Baphomet, has been arrested. While we don't doubt this (ShinyHunter of all people would probably know), we would like an official Department of Justice announcement or court document confirming these statements.

What we can say though is that although Breach is gone, we are certain another forum will appear (eventually) to fill the power vacuum. It's only a matter of time.

Anyway, looking forward to Breach and/or Raid rebrand number 4!

[Nicolas Krassas @Dinosn]

Encrypted mail service Proton confirmed handing PII to cops again https://t.co/84U2M892eC

[blackorbird @blackorbird]

Analysing a NSO iOS Spyware Sample(#blastpass)
CVE-2023-41064 + CVE-2023-41061 + WebP Vulnerability CVE-2023-4863
https://t.co/BXKmQ2k3yt
REF:
https://t.co/Sh5LijD98h

[Nicolas Krassas @Dinosn]

HardeningMeter - Open-Source Python Tool Carefully Designed To Comprehensively Assess The Security Hardening Of Binaries And Systems https://t.co/gpqJp3lpoI

[nixCraft 🐧 @nixcraft]

( ͡° ͜ʖ ͡°)

[vx-underground @vxunderground]

Yesterday The New York Times unveiled that General Motor's had accidentally enrolled millions of people into its "OnStar Smart Driver+" program. If consumers chose to not enroll through the phone app – it would do it anyways.

Unenrolling requires consumers to contact OnStar customer support line. However, some people do not trust them and have turned to stripping the electronic devices from their car.

The OnStar Smart Driver+ data was being sold to LexisNexis, and insurance companies, to modify insurance rates. The data sold was invasive and logged:

- Number of trips
- Miles driven
- Minutes driven
- Hard-brake vents
- Rapid accelerates
- Speeding events

The reporter from the New York Times requested a copy of their data and received it. See attached image.

[BleepingComputer @BleepinComputer]

Delta Dental says data breach exposed info of 7 million people - @billtoulas
https://t.co/hlUc8dpIp5

https://t.co/hlUc8dpIp5

[Unit 42 @Unit42_Intel]

2023-12-15 (Friday): #TA577 pushing #Pikabot again this week. Here are IOCs from an infection run we generated today: https://t.co/XCCRyFaVyg

#TimelyThreatIntel #Unit42ThreatIntel #Wireshark #MalwareTraffic #IndicatorsOfCompromise

[blackorbird @blackorbird]

Supply Chain Poisoning of 7ZIP on the Microsoft App Store
#APT
https://t.co/yPFlXbZPzu