hacking: security in practice
Anyone else worried about Spellcheckers selling your data?

Hi there,

was just thinking about the amount of information that spellcheckers gather. As soon as they see how much money google is making, how could they resist?

Are there any open source spellcheckers on the market?

cheers

LB

submitted by /u/Larriesbrother
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hackers Stole $625 million worth of cryptocurrency from famous NFT game Axie Infinity

https://external-preview.redd.it/DD7OhoRGJtCKYUhwpXOfLJd6S3ZPA1NRM8XORWB1Xw4.jpg?width=640&crop=smart&auto=webp&s=4d537b0c46fb8a6b8659aa5252c0a687699f2b2c submitted by /u/bradcpx
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

CVE-2022-27254 - PoC For Vulnerability In Honda's Remote Keyless System
http://www.kitploit.com/2022/03/cve-2022-27254-poc-for-vulnerability-in.html

___________________________
@hacking_Attack
@Hacking_Video

PoC for vulnerability (https://www.kitploit.com/search/label/Vulnerability) in Honda's Remote Keyless System(CVE-2022-27254) Disclaimer: For educational purposes only. Kindly note that the discoverers for this vulnerability are Ayyappan Rajesh (https://www.linkedin.com/in/ayyappan-rajesh/), a student at UMass Dartmouth and HackingIntoYourHeart (https://github.com/HackingIntoYourHeart/). Others mentioned in this repository are credited for the support that they have provided but have played no active role in any research (https://www.kitploit.com/search/label/Research) conducted related to this finding. If looking to publish these findings elsewhere, please refrain from associating this with any other persons, companies or institutions without any explicit approval. Summary: This is a proof of concept (https://www.kitploit.com/search/label/Proof%20Of%20Concept) for CVE-2022-27254 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27254), wherein the remote keyless system on various Honda vehicles send the same, unencrypted RF signal for each door-open, door-close, boot-open and remote start(if applicable). This allows for an attacker to eavesdrop (https://www.kitploit.com/search/label/Eavesdrop) on the request and conduct a replay attack.
POC videos (https://github.com/nonamecoder/CVE-2022-27254#poc-videos) Vehicles Affected: • 2016-2020 Honda Civic(LX, EX, EX-L, Touring, Si, Type R) Important Notes: •Key fob FCC ID: KR5V2X

•Key fob frequency: 433.215MHz

•Key fob modulation: FSK
Tools used: •FCCID.io
•HackRF One
•Gqrx
•GNURadio
Prevention: Manufacturers: Manufacturers must implement Rolling Codes, otherwise known as hopping code. It is a security technology commonly used to provide a fresh code for each authentication (https://www.kitploit.com/search/label/Authentication) of a remote keyless entry (RKE) or passive keyless entry (PKE) system. Consumers: Utilize a Faraday Pouch for the key fob. Use the PKE as opposed to the RKE, this would make it significantly harder for an attacker to clone/read the signal due to the proximity they would need to be at to do so. The precautions mentioned above ARE NOT foolproofIf you believe that you are a victim of this attack, the only current mitigation is to reset your key fob at the dealership. Credits: •Ayyappan Rajesh(nonamecoder) (https://www.linkedin.com/in/ayyappan-rajesh/) •HackingIntoYourHeart (https://github.com/HackingIntoYourHeart/) Special thanks to: • My professor :Prof. Hong Liu (https://www.umassd.edu/directory/hliu/) • My mentor:Sam Curry (https://www.linkedin.com/in/currysam) •My professor :Prof. Ruolin Zhou (https://www.umassd.edu/directory/rzhou1/) References: •https://www.youtube.com/watch?v=1RipwqJG50c •https://attack.mitre.org/techniques/T1040/

Download CVE-2022-27254 (https://github.com/nonamecoder/CVE-2022-27254)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
CISA, DOE Warn of Attacks on Uninterruptible Power Supply (UPS) Devices

Take UPS management interfaces off the Internet "immediately," agencies say.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
El mayor hackeo de criptomonedas de la historia acaba con el robo de 600 millones y es difícil…

https://cdn-images-1.medium.com/max/1654/0*DmfI7G3hYl6qAFJR
PUBLICADO EN 30 MARZO, 2022 POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacker101 Micro-CMS v1 CTF Walkthrough

https://cdn-images-1.medium.com/max/1400/1*_kMQQSns6ua8kROTgFyxrQ.jpeg
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
CVE-2022-27254 - PoC For Vulnerability In Honda's Remote Keyless System

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiCXFYec5Q2ebxFWm-Yo494Ag7n0XJZz-7pV-6hdgf5Lm8KWzhB1kWvT7sp9_fJyPgyaG-6B-JufZnkf3NThbM37mILf3YJB5nJCyPE3RD7tOf7OS-u7BRzhMrn2IaZVV_wSqjIz4INlgJ9w-kEIVBTFsq6sCMoWa0dxIaI0EiZ_hdZrHrDz4FlhFjw/w400-h320/CVE-2022-27254.png PoC for vulnerability in Honda's Remote Keyless System(CVE-2022-27254) Disclaimer:For educational purposes only. Kindly note that the discoverers for this vulnerability are Ayyappan Rajesh, a student at UMass Dartmouth and HackingIntoYourHeart.

Others mentioned in this repository are credited for the support that they have provided but have played no active role in any research conducted related to this finding. If looking to publish these findings elsewhere, please refrain from associating this with any other persons, companies or institutions without any explicit approval. Summary:This is a proof of concept for CVE-2022-27254, wherein the remote keyless system on various Honda vehicles send the same, unencrypted RF signal for each door-open, door-close, boot-open and remote start(if applicable). This allows for an attacker to eavesdrop on the request and conduct a replay attack. POC videosVehicles Affected:• 2016-2020 Honda Civic(LX, EX, EX-L, Touring, Si, Type R) Important Notes:•Key fob FCC ID: KR5V2X

•Key fob frequency: 433.215MHz

•Key fob modulation: FSK Tools used:•FCCID.io
•HackRF One
•Gqrx
•GNURadio Prevention:*
Manufacturers:

1. Manufacturers must implement Rolling Codes, otherwise known as hopping code. It is a security technology commonly used to provide a fresh code for each authentication of a remote keyless entry (RKE) or passive keyless entry (PKE) system.

*
Consumers:

1. Utilize a Faraday Pouch for the key fob.
2. Use the PKE as opposed to the RKE, this would make it significantly harder for an attacker to clone/read the signal due to the proximity they would need to be at to do so.
The precautions mentioned above ARE NOT foolproof

If you believe that you are a victim of this attack, the only current mitigation is to reset your key fob at the dealership. Credits:•Ayyappan Rajesh(nonamecoder)

•HackingIntoYourHeart Special thanks to:• My professor :Prof. Hong Liu

• My mentor:Sam Curry

•My professor :Prof. Ruolin Zhou References:•https://www.youtube.com/watch?v=1RipwqJG50c

•https://attack.mitre.org/techniques/T1040/ Download CVE-2022-27254

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
work relation

Has anyone gotten through bitlocker before? A customer brought in their laptop to be reset and have a fresh win10 installation but they stupidly put it through bitlocker and have no idea on what the code is to unlock it

submitted by /u/Djmii5tik4200
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Zero-Day Vulnerability Discovered in Java Spring Framework

A proof-of-concept exploit allows remote compromises of Spring Web applications.

SpringShell: Spring Core RCE 0-day Vulnerability
https://www.reddit.com/r/redteamsec/comments/tsnmkh/springshell_spring_core_rce_0day_vulnerability/

submitted by /u/Gorkha56 (https://www.reddit.com/user/Gorkha56)
[link] (https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html) [comments] (https://www.reddit.com/r/redteamsec/comments/tsnmkh/springshell_spring_core_rce_0day_vulnerability/)

___________________________
@hacking_Attack
@Hacking_Video

just scanning my network traffic and this just looked kinda odd i need a second opinion?
https://www.reddit.com/r/Pentesting/comments/tsoo41/just_scanning_my_network_traffic_and_this_just/

___________________________
@hacking_Attack
@Hacking_Video

submitted by /u/Bashnanotechp (https://www.reddit.com/user/Bashnanotechp)
[link] (https://i.redd.it/pzh3vsa4imq81.jpg) [comments] (https://www.reddit.com/r/Pentesting/comments/tsoo41/just_scanning_my_network_traffic_and_this_just/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Biggest Crypto Heist In History Just Went Down (Also, Is Wells Fargo Racist?)

https://cdn-images-1.medium.com/max/2600/0*hndVtCTnDeNuZ0Ji
This is crazy. About $600 million was stolen in crypto assets and it’s apparently one of the biggest crypto heists ever. Of course, with…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackme — VulnNet: Roasted

https://cdn-images-1.medium.com/max/600/1*vr1iNNSEdxteuODeHzdT4w.png
Hai pada tulisan kali ini saya akan membagikan beberapa tulisan yang akan terbagi menjadi bagian antara lain Active directory attack and…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
using Bettercap/or similar monitor tools, breaks wifi until reboot!

I'm on Mac but had similar issues in the past on Linux. Basically tools like bettercap, which seems to have trouble working to be honest at first. It only seems my single network. Then it starts working and I can see my wifi is in monitoring mode thanks to the "eye" icon on my status bar on macos.

So I gather the info I need in monitoring mode, like using wifi.recon, and then type wifi.recon off. What I assume should happen is the interface goes back to normal.

I exit bettercap.

Unfortunately although I can see the networks around me, I cannot connect to any at all, no matter what.

Here's what I've tried:

ifconfig en0(/1) down/up

I've removed the interface from system pref -> network and readded it.

Nothing works, the only thing that allows me to connect back to wifi is rebooting.

I hope my explanation was okay, what do you guys think?

In ifconfig, the status is pretty much always inactive, sometimes after multiple commands, it may switch to active for seconds, then it goes back to inactive. It's rather annoying, I can't be rebooting after every single attempt st using Bettercap

Edit 2

Okay so I disconnected from my network as bettercap says and used en0 as said as well. The issue is when I do wifi.recon on, no networks pop up no matter how long I wait.

But if I switch to en1, it finds tons. But then of course I won't be able to connect anymore until I reboot 🤦‍♂️

submitted by /u/HealingWithNature
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video