Dom Glavach

CISO | Cybersecurity Strategist | Board Advisor | Public Speaker

[Dom Glavach @domglavach]

What a great find… Unix v4

https://t.co/j0KQYO3FFU

[Dom Glavach @domglavach]

@HDforum I couldn’t agree stronger or louder to this. Prompt injection and excessive agency

[Dom Glavach @domglavach]

@dotMudge congrats

[Dom Glavach @domglavach]

@troyhunt So so simple to do more than a passwd and I’m not surprised. What we think is natural (2FA) many people with the “inconvenience”

[Mysk 🇨🇦🇩🇪 @mysk_co]

Google has just updated its 2FA Authenticator app and added a much-needed feature: the ability to sync secrets across devices.

TL;DR: Don't turn it on.

The new update allows users to sign in with their Google Account and sync 2FA secrets across their iOS and Android devices.

We analyzed the network traffic when the app syncs the secrets, and it turns out the traffic is not end-to-end encrypted. As shown in the screenshots, this means that Google can see the secrets, likely even while they’re stored on their servers. There is no option to add a passphrase to protect the secrets, to make them accessible only by the user.

Why is this bad?

Every 2FA QR code contains a secret, or a seed, that’s used to generate the one-time codes. If someone else knows the secret, they can generate the same one-time codes and defeat 2FA protections. So, if there’s ever a data breach or if someone obtains access to your Google Account, all of your 2FA secrets would be compromised.

Also, 2FA QR codes typically contain other information such as account name and the name of the service (e.g. Twitter, Amazon, etc). Since Google can see all this data, it knows which online services you use, and could potentially use this information for personalized ads.

Surprisingly, Google data exports do not include the 2FA secrets that are stored in the user's Google Account. We downloaded all the data associated with the Google account we used, and we found no traces of the 2FA secrets.

The bottom line: although syncing 2FA secrets across devices is convenient, it comes at the expense of your privacy. Fortunately, Google Authenticator still offers the option to use the app without signing in or syncing secrets. We recommend using the app without the new syncing feature for now.

#Privacy #Cybersecurity #InfoSec #2FA #Google #Security

[Dom Glavach @domglavach]

@WeldPond Starts with awareness, bolstered by process, assisted by technology. I'm feeling this won't be the last time we see IP tossed(lost) to AI learning. Also bracing for the influx of DLP marketing emails.

[edskoudis @edskoudis]

Hey folks! We are delighted to announce the OFFICIAL LAUNCH of the 2022 SANS #HolidayHack Challenge. Help Santa & the elves recover the 5 Golden Rings and foil a foul plot in this fun FREE series of cyber challenges for ALL skill levels, plus a bunch more. https://t.co/ptqUf0VbVl

[Dom Glavach @domglavach]

//begin

[Dom Glavach @domglavach]

@OpenGarages More telematics for sure

[IUP Ice Hockey @IUPIceHockey]

Would you just look at these fine gentlemen! Congratulations & Thank You for all the hard work and dedication on the ice and in the classroom. Good luck on your future endeavors #HawkeySeniors2020

[Dom Glavach @domglavach]

Metallica Monday

[Dom Glavach @domglavach]

Not my typically music choice and enjoying the acoustic tunes on #iHeartConcertonFOX

[Dom Glavach @domglavach]

Yep. 127.0.0.1

[Rapid7 @rapid7]

Need a social distancing hobby? This blog gives you an intro to embedded hardware hacking. https://t.co/jjWOQvrKFt

[Jerry Gamblin @JGamblin]

Day 8 on Lockdown:

[Evan Kirstel #B2B #TechFluencer @EvanKirstel]

Get ready for RSAC bingo! #RSAC #@Scott_Stanton @dez_blanchfield @Fisher85M @cybersecboardrm @evanderburg @Shirastweet #cybersecurity

[Threatpost @threatpost]

Any cut-and-paste data stored to an #iPhone or iPad’s memory can be accessed by all apps installed on the specific #Apple device – even malicious ones.
https://t.co/eqf6iMvOkx

[Chris Valasek @nudehaberdasher]

Updated the car hacking page (https://t.co/9ChVoJ4DZH) to include our paper on securing self-driving cars. Don't ever say we don't care. As always, content available to everyone for FREE!

[Dom Glavach @domglavach]

@erikligda Wrong account #2minutes

[Car Hacking Village @CarHackVillage]

https://t.co/6xpZLisKF2

So if you have one of these, please bring it by the village at #defcon. We'll help you fix it so it can show the Radio Station your listening to as well as your current speed or.. if you like your social security number for easier reference.