Alafolixx

[Alafolixx @_Alafolixx_]

I Live For This S*** | Mr. Robot
Congratulations @whoismrrobot for your @YTCreateurs channel which has reached 100k subscribers ! 💯
Cc @samesmail @esmailcorp @carlychaikin
#MrRobot #RamiMalek
https://t.co/uJBjycQceh via @YouTube

[Simone Margaritelli @evilsocket]

Attacking UNIX Systems via CUPS, Part I

https://t.co/T6SqraB5nh

[Organized Crime and Corruption Reporting Project @OCCRP]

NEW: When undercover reporters engaged with a pro-Russia Telegram account seeking to recruit EU citizens to commit acts of sabotage, they were offered $10,000 to:

👀Spy on a military base
🔥Set fire to NATO vehicles
🗡️Commit murder ⬇️
https://t.co/SrQIJvffZ2

[BlackRoomSec @blackroomsec]

Please share this far and wide. As far and wide as you can. NIST Password Guidelines for 2024 are in the process of being updated.

This is a HUGE pet-peeve of mine (when vendors in particular are still operating like its 2017 and keep changing passwords every 60 days, STOP DOING THIS, it's outdated and has been shown to put you MORE at risk than less -- NIST explains why it does in this document, meticulously outlining user behavior**) so I'm sharing this in the hopes all of you will pass it along to your bosses.

The Special Publication series governing passwords is SP 800-63 "Digital Identity Guidelines".

The 2024 version is 800-63-4.

Here: https://t.co/oX8YEJHxXg

The companion docs are also on that link. They are 800-63A, 800-63B and 800-63C. These are different documents for different scenarios in play at your org.

The previous update was in2020.

The changes in the 2020 version from the 2017 version were numerous but one of them was that the password verification method should NO LONGER require passwords be changed at specific intervals (i.e. every 60 days) but in the following circumstances instead:

1. After a breach/compromise
2. User request

2024 repeats this and adds a bunch more guidlines but here is a screenshot of page 13 of the new 800-63-4 (note the # 4 after it) which outlines how your systems should now and moving forward, be handling passwords.

This goes for Active Directory, too. All your systems which have passwords should align with these guidelines provided there isn't another standard or framework you must adhere to which overrules this.

Most frameworks, however, have moved away from arbitrary password resets and complexity rules.

**We cybersec researchers and hackers use wordlists from breaches in a variety of different ways. Hackers use them in tooling to crack passwords whereas researchers use breach dumps to see the kinds of passwords users are creating and the psychology behind them.

Using complexity rules gets you the user psychology of:

Password1
Password2
and so on

Use phrasing instead and allow for spaces, which is important. Humans type phrases with spaces. They also mention phish-resistant methods and most vendors are on-board with MS going to be turning off all Legacy Auth next month, across all free accounts and tenancies.

I'm so excited for the new changes!

Ok I'm off my soapbox.

Share the love! Thank you!

[SinSinology @SinSinology]

🔥💀 Here is the "Real" writeup and exploit for the
pre-auth deserialization RCE I reported to Ivanti
CVE-2024-29847
Apparently, folks at horizon3 tried to write about my bug before me but they did it wrong
https://t.co/Df8lIDYNRH

[hasherezade @hasherezade]

New #PEbear is out (v0.7.0) - with new icon, Qt6, ARM64 support and more goodies 😊! Check it out: https://t.co/Dm1sVaOqAl

[Alafolixx @_Alafolixx_]

@hasherezade 👏

[Matthew Green @matthew_d_green]

I hope that the arrest of Pavel Durov does not lead to him or Telegram being held up as some hero of privacy. Telegram has consistently acted to collect huge amounts of unnecessary private data on their servers, and their only measure to protect it was “trust us.”

[Robert Graham @robertgraham]

Everyone: Telegram is encrypted.
Experts: Telegram IS NOT an encrypted messaging app
<CEO gets arrested>
News: Telegram is an encrypted messaging app.
Experts: Telegram IS NOT an encrypted messaging app.

[Félix Aimé @felixaime]

Interesting CERT-RU notification to a third party, featuring a PCAP extract of #CloudAtlas's PowerShower communications—offering a glimpse into Russian interception capabilities from a defender's perspective.: https://t.co/kZVYXD9sEx

[cts🌸 @gf_256]

My Phrack article, "Calling All Hackers" is finally out!

It's about what I learned going from a hacker to running a company—and how hackers can make a difference in today's world. And the shitty parts of startup culture no one talks about.

Read here: https://t.co/bkwCtyo9Wg

[Thomas Roccia 🤘 @fr0gger_]

I like this website, it's super handy! It has all the reverse shells you need 👇 #infosec
https://t.co/Gu2zLuQk4Y

[＼Ｏ／ @CharlieBismuth]

🤨🧐🤭😆😂🤣😭

#Hackerzzz 🥳

[Alafolixx @_Alafolixx_]

@CharlieBismuth @EBouliou « Je l'savais, nous aurions dû mettre un filtre de confidentialité » 😅

[ZachXBT @zachxbt]

1/ Recently a team reached out to me for assistance after $1.3M was stolen from the treasury after malicious code had been pushed.

Unbeknownst to the team they had hired multiple DPRK IT workers as devs who were using fake identities.

I then uncovered 25+ crypto projects with related devs that have been active since June 2024.

[National Crime Agency (NCA) @NCA_UK]

An international operation coordinated by the NCA has resulted in the arrest and extradition of a man believed to be one of the world’s most prolific Russian-speaking cybercrime actors.

FULL STORY ➡️ https://t.co/kgPdMAwqPZ

[John Hammond @_JohnHammond]

Luke shared the URL from the original phishing email with me, so I'd like to showcase it a bit.

Planning to record a video to walk through it, but don't have a chance to record for the next few hours... so will roll with a Twitter/X thread for now 🧵

[Dirk-jan @_dirkjan]

At Def Con I presented with @_EthicalChaos_ on new Windows Hello attacks. For ex: how to use the WinHello crypto keys from a low priv session to request a PRT on a different device, bypassing TPM protection of PRTs.

Slides: https://t.co/3oA2grfbO4
Poc: https://t.co/HZlwE0qtNr

[Alafolixx @_Alafolixx_]

@_dirkjan @_EthicalChaos_ 👌

[TRÄW🤟 @thatstraw]

How ssh got port 22 assigned!!

[vx-underground @vxunderground]

Linus Tech Tips has been compromised (again). This is the 3rd time they've been compromised.

Also, Voronezh, Russia is where the FBI states the Lockbit ransomware group administration resides.

🤯🤯🤯was it Lockbit?! (probably not, no).