Swanson On Security

I VALUE MY PRIVACY

[Swanson On Security @SwansOnSec]

@Mimiiben1 63

[Swanson On Security @SwansOnSec]

@MPRed_37 @JulianMaciasT No se ha perdido nada, ha tenido una idea, se lo ha preparado, y mientras todos miraban de forma pasiva, se ha currado la sincronización y la localización, afortunadamente le ha salido bien, y ha conseguido una foto de la que se habla en todo el mundo.
Igual el tonto no es él.

[Swanson On Security @SwansOnSec]

@oskar1up @NoMansSky Si lo es. Y el eclipse cae en miéscoles de update.

[Swanson On Security @SwansOnSec]

@NoMansSky I CAN IMAGINE: select A.system_ID,A.planet_ID, A.discovered_by_ID, B.player_name from Planets as A where planet_name like "%rambe%" inner join Players as B on discovered_by_ID = player_ID;

[Swanson On Security @SwansOnSec]

@oskar1up @NoMansSky @hellogames Festejemos todos oh mamadísimo líder!

[Swanson On Security @SwansOnSec]

@NoMansSky Mister @Oskar1up from the Royal Space Society, largest spanish/latin federation, has been playing 1.0 and 1.1 for several weeks as commemoration, with great success.

[Swanson On Security @SwansOnSec]

EUROPE

[Paul Moore - Security Consultant  @Paul_Reviews]

Bypassing #EU #AgeVerification using their own infrastructure.

I've ported the Android app logic to a Chrome extension - stripping out the pesky step of handing over biometric data which they can leak... and pass verification instantly.

Step 1: Install the extension
Step 2: Register an identity (just once)
Step 3: Continue using the web as normal

The extension detects the QR code, generates a cryptographically identical payload and tells the verifier I'm over 18, which it "fully trusts".

This isn't a bug... it's a fundamental design flaw they can't solve without irrevocably tying a key to you personally; which then allows tracking/monitoring.

Of course, I could skip the enrolment process entirely and hard-code the credentials into the extension... and the verifier would never know.

[Swanson On Security @SwansOnSec]

EUROPE, THE ANCIENT CONTINENT

[International Cyber Digest @IntCyberDigest]

‼️🇪🇺 The EU's new Age Verification app was hacked with little to no effort.

When you set it up, the app asks you to create a PIN. But that PIN isn't actually tied to the identity data it's supposed to protect. An attacker can delete a couple of entries from a file on the phone, restart the app, pick a new PIN, and the app happily hands over the original user's verified identity credentials as if nothing happened.

It gets worse. The app's "too many attempts" lockout is just a counter in a text file. Reset it to 0 and keep guessing. The biometric check (face/fingerprint) is a simple on/off switch in the same file. Flip it to off and the app skips it entirely.

[🕳 @sekurlsa_pw]

You used to get a sticker with a serial for Windows on new hardware, these days it's digital and you have an embedded key stored in EUFI.

To extract your Windows 11 product key on Linux:
sudo strings /sys/firmware/acpi/tables/MSDM | grep -E '[A-Z0-9]{5}(-[A-Z0-9]{5}){4}'

[Swanson On Security @SwansOnSec]

MY 32'' CRT TV DEVOIDS OF THAT CAPACITY

[Nav Toor @heynavtoor]

Your smart TV is taking screenshots of your screen every 15 seconds.

Not a guess. Not a theory.

A peer-reviewed study by researchers at UC Davis, UCL, and UC3M tested it.

Samsung TVs: every minute.
LG TVs: every 15 seconds.

Even when you're just using it as a monitor.

Here's how to turn it off for every brand:

[Swanson On Security @SwansOnSec]

Hola @Ahorramas_com, que sepáis que la información nutricional de las cortezas de cerdo indica que contienen 106,5 gramos de ingredientes por cada 100 gramos de producto. Qué poderío!

De nada!

[Swanson On Security @SwansOnSec]

Y no miro a nadie, @elcorteingles

[Swanson On Security @SwansOnSec]

Hola @EROSKI cuándo vais a asumir que habéis tenido unas exfiltracion de datos de clientes? Tenéis más respeto a la multa de la @o_lgpd que a los clientes? @INCIBE @policia
Este email única y exclusivamente se ha usado para vosotros, y lleva muchos intentos de phising.

[Swanson On Security @SwansOnSec]

Lo del RGPD también va por vosotros, @EROSKI

[Swanson On Security @SwansOnSec]

Hola @elcorteingles, creo que la gente está recibiendo unos emails muy raros. Nos podéis comentar lo que pasa, o vamos preguntando por el RGPD?

[Swanson On Security @SwansOnSec]

Hola @eroski, cómo va eso de avisar de la exfiltración de datos. Por un comportamiento responsable con vuestros clientes, y tal.

El otro día recibí un intento de phising de una dirección que uso exclusívamente para vosotros, así que s��lo ha podido salir de vuestro servidores.

[Swanson On Security @SwansOnSec]

Hola @EROSKI todavía no os habéis dado cuenta pero parece que alguien ha exfiltrado datos de vuestros clientes.

Yo intentaría cubrir esa plaza de técnico de ciber que tenéis en Linkedin cuanto antes.

Por si acaso preguntad a los proveedores, son el eslabón más débil.

Chau!

[Swanson On Security @SwansOnSec]

PLEASE. AND THANK YOU

https://t.co/1yprK4zfzz

[Swanson On Security @SwansOnSec]

SORRY FOR THE DELAY, I WAS FIXING THAT "AWS" THING.

"AWS" STANDS FOR "IT'S 𝗔L𝗪AY𝗦 DNS".

[Swanson On Security @SwansOnSec]

THAT IS NOT HOW KEY VAULT SHOULD BE DEVELOPED

https://t.co/vU0nEqR2s2