With people often copy-pasting command lines from the internet without thoroughly reading them, it's already possible to have them paste something they don't fully understand.
But what if the font you were using on the website that contains the command had some of its characters swapped in a clever way, so that it looked like a certain command, but when copied, contained a slightly different, malicious command?
My interpretation of this article is that hospitals, clinics, insurance companies, etc. need to get links and repost icons for Facebook, Twitter, etc. OFF their websites. If you work for a big institution -- talk to your marketing team as they are used to doing this routinely. If you are a small provider, look at your website -- especially if you created it years ago back when no one thought of the problems and you just wanted some traffic.
TITLE: FTC, HHS warn health providers not to use tracking tech in websites, apps
The Federal Trade Commission (FTC) and Department of Health and Human Services (HHS) sent a joint letter to about 130 hospital systems and telehealth providers Thursday, warning of security risks posed by tracking technologies such as the Meta/Facebook Pixel and Google Analytics.
<https://therecord.media/apps-website-tracking-healthcare-ftc-hhs-warning>
#security #healthcare #doctors #itsecurity #hacking #doxxing #psychotherapy #securitynews #psychotherapist #mentalhealth #psychiatry #hospital #socialwork #datasecurity #webbeacons #cookies #HIPAA #privacy #datanalytics #healthcaresecurity #healthitsecurity #patientrecords #infosec @infosec@a.gup.pe #telehealth #netneutrality #socialengineering #marketing #seo #therapy
#psychology #counseling #socialwork #psychotherapy @psychotherapist@a.gup.pe @psychotherapists@a.gup.pe @psychology@a.gup.pe @socialpsych@a.gup.pe @socialwork@a.gup.pe @psychiatry@a.gup.pe
@infosec@a.gup.pe #mentalhealth #psychiatry #healthcare
Ihr habt den neusten Kinofilm kostenlos online gefunden und schaut gleich rein? Stopp! Mit illegalem #Streaming macht ihr euch strafbar! Im Video erfahrt ihr, von welchen Streaming-Angeboten ihr besser die Finger lasst.
IT security question. I’ve always thought that using hotel WiFi was “Unsafe at Any Speed”.
Even if you have a VPN, there’s some sort of open portal you need to access to get online, and my understanding is a lot of the WiFi is not encrypted at all and depends on sites and apps using SSL/TLS. And there are ways to do “HTTPS inspection” to crack into the data.
Or someone using rogue DNS to reroute and steal login credentials.
Ich würd gern #Pentester werden. Die Suchmaske vom Arbeitsamt ist nicht besonders benutzungsfreundlich, über Instagram-Werbung find ich eher was brauchbares als dort.
Habt Ihr zufällig ne Empfehlung für n Remotekurs (möglichst in Teilzeit absolvierbar), der mehr als nur oberflächlichen Einstieg ermöglicht und mich tatsächlich zum Pentester ausbildet? Muss azav-zertifiziert sein, damit das Arbeitsamt es genehmigt.
Der Verlust von Daten ist meist sehr ärgerlich. Habt ihr schon einmal eine Datei verloren, der ihr heute noch nachtrauert? Oder konnte euch eine Sicherung schon vor einer persönlichen Katastrophe „retten“? Wir sind gespannt auf eure Kommentare!
Im Internet müssen wir uns oft erinnern, dass nicht alles echt ist, was wir sehen. Insbesondere bei sogenannten Deepfakes werden wir leicht getäuscht. In unserem Beitrag stellen wir euch eine Methode namens Face Swapping vor.
🥳 Celebrate the Nitrokey 3 milestone with us and get Nitrokeys at a reduced price: For one week you will receive a 5% discount on all Nitrokeys!
➡️ Details about the Nitrokey 3 milestone can be found here: https://www.nitrokey.com/.../nitrokey-3-milestone-se050...
Jobsuche aufgrund Umzug: Wo möchte Mensch denn im Raum Karlsruhe im Bereich IT Security oder IT Infrastruktur arbeiten? Nicht-offensichtliche Geheimtipps, dringendes Abraten…?
First screenshot is the real PIN prompt, second one is a JavaScript prompt() with a custom prompt text.
The only differences are:
• PIN dialog is at the top of the window, prompt() centered.
• PIN dialog says "Sign In" on the button, prompt() says "OK" (which is not customizable).
• PIN dialog has "https://", prompt() just the domain.
I'd say that makes it pretty trivial to phish for Passkey PINs … 🤦♂️
I saw a parking fare payment device today that had its Internet-facing IPV4 address (maybe for the cellar modem?) displayed on the front panel. It was at the bottom of the screen along with some other stuff.
Is that a security problem? I probably wouldn’t have designed it to show that IP address. But maybe depending on how security is set up that might not be all that useful to an attacker? (Not an IT security export here.)
Normally I post something about a threat intel report but I have been reading the Microsoft Digital Defense Report for 2023 and there is just too much to post. That being said, I am going to share some of the numbers Microsoft presented and my thoughts on them. Let's start with ransomware:
📊 80-90% of all successful ransomware compromises originate from unmanaged devices.
📊 70% of organizations encountering human-operated ransomware had fewer than 500 employees.
📊 13% of human-operated ransomware attacks that moved into the ransom phase included some form of data exfiltration.
📈 Human-operated ransomware attacks are up more than 200%
Old customer infrastructure based on #Proxmox 5 and an ancient #Dell server running an outdated #pfSense.
They asked me to update everything because the ERP provider (a small software house) accessing via #VPN claims the pfSense version is too old. I agree and decide to upgrade Proxmox.
On the old Dell, I install #OpenBSD and, in agreement with the ERP provider, a #Wireguard VPN.
After a few days, they 'recall' me because, for their internal compliance and following their '#security manual,' they need to enter the password manually every time they connect, and Wireguard doesn't support user/password concept.
They ask for the possibility to change the PSK with each access to ensure that the one in their configuration files is not the current one - an absurd operation. I don't have a maintenance contract and can't take this responsibility, as it doesn't make sense. Clearly, they agreed on Wireguard without even knowing what it was.
To avoid issues, I ask them what to install instead. They suggest #OpenVPN might be acceptable. I proceed accordingly. They contact me again: 'The version of OpenVPN is not suitable, and OpenBSD is not certified according to our security procedures.' I ask them to tell me what is certified. They respond: '#Debian 7, #Wheezy - and the version of OpenVPN from Debian 7.'
I politely point out that Debian 7 reached its End of Life in 2016, and even the extended LTS has been unsupported for 3 years. They don't care, they must abide by their manual - it's safe for them.
The customer asks me to accommodate them anyway, but I reflect on the fact that when they inevitably get compromised, it will be my fault for installing something so outdated today.
I declined the job - limiting myself to updating Proxmox.
I'm not sure if I'm more offended by the bureaucracy of certain 'internal manuals' or by the closed-mindedness of certain colleagues who can't stand up against such dynamics.
The BlackBerry research team reports on a financially motivated threat actor that is targeting banks and cryptocurrency trading entities. The malware seen in these attacks is the #AllaKore RAT (remote access trojan) that contains a suite of capabilities and the targets were organizations that had a large revenue.
Through the analysis, the team was able to identify some PowerShell scripts, the user-agent used by the malware, and the ability to capture input text and screen captures. You can find more technical analysis in this report that I haven't mentioned! Enjoy and Happy Hunting!
Ich wünsche mir für mein Smartphone ein Feature, das bei einem Anruf von einer Nummer, die nicht im Adressbuch ist, meine Stimme verstellt. Für den Fall eines Phishing-Anrufs kann der Angreifer dann nicht ein Sample meiner Stimme mitschneiden. #itsecurity
Wenn ich ehrlich bin, habe ich darüber zu wenig Ahnung. Ist dies so anzuwenden und zu empfehlen oder wie seht ihr dies?
»Systemd-Alternative zu sudo soll Linux sicherer machen:
run0 lässt reguläre Benutzer Programme mit root-Rechten ausführen. Es ähnelt sudo, nutzt aber andere Mechanismen zur Privilegienerhöhung und soll sicherer sein.«
Habe gerade Unterstützung beim Einreichen vom Beihilfeanträgen beim #LBVBW geleistet…
…und jetzt möchte ich irgendwas mit Pflanzen oder Holz machen.
Die Tatsache, dass gewisse Zeichen in hochgeladenen Dokumenten nicht erlaubt sind sagt mir, dass diese wohl 1:1 im Filesystem des Zielsystems gespeichert werden.
Der Rest des Prozesses sieht genauso aus, wie man es vermuten könnte.