Dark Reading: Attacks/Breaches
Having Trouble Finding Cybersecurity Talent? You Might Be the Problem

Hiring managers must rethink old-school practices to find the right candidates and be ready to engage in meaningful conversations about their company's values. Here are three ways to start.

hacking: security in practice
Writing AppArmor Profile from Scratch

Get a detailed walkthrough about writing the profile for a custom binary from scratch using AppArmor utilities like aa-genprof and aa-autodep

https://tbhaxor.com/writing-apparmor-profile-from-scratch/

submitted by /u/tbhaxor
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
My package is at custom clearance, does this mean I'm not getting it anymore

Package was on his way and reached the location, the second day I checked up my tracking and it changed to package is at custom clearance.

This never happened before, will this be a bad call?

submitted by /u/PeacefulInhaler
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Profit Hacking

Vous avez probablement beaucoup entendu parler du “profit hacking” ces derniers temps, mais de quoi s’agit-il ? Le “profit hacking” est un…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
GitLab Unauthenticated Remote ExifTool Command Injection

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Opencart 3 Extension TMD Vendor System SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Appsian Security Announces Acquisition of Q Software, a Leader in JD Edwards Security and Compliance

The acquisition provides customers of JD Edwards, along with Oracle EBS and Oracle Cloud, with expanded capabilities for data masking, threat detection and response, and real-time analytics across multiple ERP applications.

___________________________
@hacking_Attack
@Hacking_Video

Androidqf - (Android Quick Forensics) Helps Quickly Gathering Forensic Evidence From Android Devices, In Order To Identify Potential Traces Of Compromise
http://www.kitploit.com/2021/11/androidqf-android-quick-forensics-helps.html

___________________________
@hacking_Attack
@Hacking_Video

Build
Executable binaries for Linux, Windows and Mac should be available in the latest release (https://github.com/botherder/androidqf/releases/latest). In case you have issues running the binary you might want to build it by yourself. In order to build androidqf you will need Go 1.15+ installed. You will also need to install make. When ready you can clone the repository and run any of the following commands, for your platform of choice: make linux
make darwin
make windows
These commands will generate binaries in a build/ folder.
How to use
Before launching androidqf you need to have the target Android device connected to your computer via USB, and you will need to have enabled USB debugging. Please refer to the official documentation (https://developer.android.com/studio/debug/dev-options#enable) on how to do this, but also be mindful that Android phones from different manufacturers might require different navigation steps than the defaults. Once USB debugging (https://www.kitploit.com/search/label/Debugging) is enabled, you can proceed launching androidqf. It will first attempt to connect to the device over the USB bridge, which should result in the Android phone to prompt you to manually authorize the host keys. Make sure to authorize them, ideally permanently so that the prompt wouldn't appear again. Now androidqf should be executing and creating an acquisition folder at the same path you have placed your androidqf binary. At some point in the execution, androidqf will prompt you some choices: these prompts will pause the acquisition until you provide a selection, so pay attention. The following data can be extracted: A list of all packages installed and related distribution files. (Optional) Copy of all installed APKs or of only those not marked as system apps. The output of the dumpsys shell command, providing diagnostic information about the device. The output of the getprop shell command, providing build information and configuration parameters. The output of the ps shell command, providing a list of all running processes. (Optional) A backup of SMS and MMS messages.
Encryption & Potential Threats
Carrying the androidqf acquisitions on an unencrypted drive might expose yourself, and even more so those you acquired data from, to significant risk. For example, you might be stopped at a problematic border and your androidqf drive could be seized. The raw data might not only expose the purpose of your trip, but it will also likely contain very sensitive data (for example list of applications installed, or even SMS messages). Ideally you should have the drive fully encrypted, but that might not always be possible. You could also consider placing androidqf inside a VeraCrypt (https://www.veracrypt.fr/) container (https://www.kitploit.com/search/label/Container) and carry with it a copy of VeraCrypt to mount it. However, VeraCrypt containers (https://www.kitploit.com/search/label/Containers) are typically protected only by a password, which you might be forced to provide. Alternatively, androidqf allows to encrypt each acquisition with a provided age (https://age-encryption.org/) public key. Preferably, this public key belongs to a keypair for which the end-user does not possess, or at least carry, the private key. In this way, the end-user would not be able to decrypt the acquired data even under duress. If you place a file called key.txt in the same folder as the androidqf executable, androidqf will automatically attempt to compress and encrypt each acquisition and delete the original unencrypted copies. Once you have retrieved an encrypted acquisition file, you can decrypt it with age like so: .zip .zip.age ">$ age --decrypt -i ~/path/to/privatekey.txt -o .zip .zip.age

___________________________
@hacking_Attack
@Hacking_Video

Bear in mind, it is always possible that at least some portion of the unencrypted data could be recovered through advanced forensics (https://www.kitploit.com/search/label/Forensics) techniques - although we're working to mitigate that.
License
The purpose of androidqf is to facilitate the consensual forensic analysis of devices of those who might be targets of sophisticated mobile spyware attacks, especially members of civil society and marginalized communities. We do not want androidqf to enable privacy violations of non-consenting individuals. Therefore, the goal of this license is to prohibit the use of androidqf (and any other software licensed the same) for the purpose of adversarial forensics. In order to achieve this androidqf is released under MVT License 1.1 (https://license.mvt.re/1.1/), an adaptation of Mozilla Public License v2.0 (https://www.mozilla.org/MPL). This modified license includes a new clause 3.0, "Consensual Use Restriction" which permits the use of the licensed software (and any "Larger Work" derived from it) exclusively with the explicit consent of the person/s whose data is being extracted and/or analysed ("Data Owner").

Download Androidqf (https://github.com/botherder/androidqf)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Dead inside stuff

submitted by /u/KonaiDev
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Women In Cyber & Gender Equality: How to Create Diversity

https://cdn-images-1.medium.com/max/2600/1*ljKXCVTT7z0-Ckgh_7MSHQ.jpeg
In 1970, 5% of women were part of performing musicians in the top 5 orchestras in the United States.

Continue reading on Women on Cyber Singapore »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Library2 VM Walkthrough

https://cdn-images-1.medium.com/max/785/0*vaJiQQnIxGXRGkim.png
Merhabalar,

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video