hacking: security in practice
Signs of tampering?

I've been told that one of the signs that you might have been compromised is that the default apps to open certain files have changed.

I go to open up a pdf this morning and while it should have automatically opened up with firefox, it prompted me on what app I should use to open the pdf.

Yesterday I noticed that firefox has been updated and in the window prompt it did say "New" under firefox, implying that it's a new app?

I don't remember having to pick out default apps for opening files after each update. Maybe I'm being paranoid.

If I am possibly compromised, what are some other things I can look into to find out if I've been computer poisoned?

Thanks in advance for any advice.

submitted by /u/lostlikeyou
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HackTheBox | Backdoor Çözümü (Walkthrough)

https://cdn-images-1.medium.com/max/600/0*4JGn2OxjHPZp12Bq.png
HackTheBox(HTB) platformundaki Backdoor isimli zafiyetli makinanın çözüm yolunu aşağıda bulabilirsiniz.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How Your Phone Spies On You (Update 2022)

CYBERSECURITY UPDATE 1

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe | ColddBox: Easy Çözümü (Walkthrough)

https://cdn-images-1.medium.com/max/600/0*vem3s085WlGCtoLN.png
TryHackMe üzerinde bulunan “ColddBox” adlı zafiyetli makinenin çözümünü aşağıda detaylı bir şekilde bulabilirsiniz.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe | Bounty Hacker Çözümü (Walkthrough)

https://cdn-images-1.medium.com/max/600/0*b9_sbpFRY-vEct3_.jpeg
TryHackMe üzerinde bulunan “Bounty Hacker” adlı zafiyetli makinenin çözümünü aşağıda detaylı bir şekilde bulabilirsiniz.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
NahamCon 2022 CTF Write-up: “No Space Between Us” Challenge

https://cdn-images-1.medium.com/max/600/0*9RwN2WvoeHwJVRy3.jpg
My approach and learnings from solving the NahamCon 2022 CTF ‘No Space Between Us’ challenge (solved by 62 teams out of over 4000).

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Alfred | TryHackMe

https://cdn-images-1.medium.com/max/1920/1*8Uaxsmh5stTo4ieMN30_Tw.png
Alfred is a Batman themed linux machine. We have to get two flags user and root in order to complete this box. Concept of enumeration…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Pourquoi CoinEx n’a connu aucun accident alors que les scandales liés à la sécurité des…

https://cdn-images-1.medium.com/max/1014/1*UKOUGmDTAgrQxcUNOs3-PA.png
En 2019, Binance, une plateforme d’échange de cryptomonnaies de renommée mondiale, a été piratée, entraînant le vol de plus de 7,000 BTC…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
LDAPFragger - Command And Control Tool That Enables Attackers To Route Cobalt Strike Beacon Data Over LDAP

https://blogger.googleusercontent.com/img/a/AVvXsEjHrAomxQoFfAWxL_cY1NWNCHYRCT-7yoWZ7O_1U1hvQ4TELfGHCoHbUjGGlypfmauB82kv6HWnpC3cNlOduLCej-QxDXBwTTu17gSholsH6C-0DiSfTlXD7fWADQhz0Yj6UemY0Eo1H9mnjh9N0L3Kq8YoJXBRNKta-j8jt5bMG5n-lyicxcVSCr7H=s16000

LDAPFragger is a Command and Control tool that enables attackers to route Cobalt Strike beacon data over LDAP using user attributes.

For background information, read the release blog: http://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes
Dependencies and installation

* Compiled with .NET 4.0, but may work with older and newer .NET frameworks as well

Usage

Active Directory domain --ldaps: Use LDAPS instead of LDAP -v: Verbose output -h: Display this message If no AD credentials are provided, integrated AD authentication will be used.">_ _ __ | | | | / _| | | __| | __ _ _ __ | |_ _ __ __ _ __ _ __ _ ___ _ __ | |/ _` |/ _` | '_ \| _| '__/ _` |/ _` |/ _` |/ _ \ '__| | | (_| | (_| | |_) | | | | | (_| | (_| | (_| | __/ | |_|\__,_|\__,_| .__/|_| |_| \__,_|\__, |\__, |\___|_| | | __/ | __/ | |_| |___/ |___/ Fox-IT - Rindert Kramer Usage: --cshost: IP address or hostname of the Cobalt Strike instance --csport: Port of the external C2 interface on the Cobalt Strike server -u: Username to connect to Active Directory -p: Password to connect to Active Directory -d: FQDN of the Active Directory domain --ldaps: Use LDAPS instead of LDAP -v: Verbose output -h: Display this message If no AD credentials are provided, integrated AD authentication will be used.

Example usage:

https://blogger.googleusercontent.com/img/a/AVvXsEjHrAomxQoFfAWxL_cY1NWNCHYRCT-7yoWZ7O_1U1hvQ4TELfGHCoHbUjGGlypfmauB82kv6HWnpC3cNlOduLCej-QxDXBwTTu17gSholsH6C-0DiSfTlXD7fWADQhz0Yj6UemY0Eo1H9mnjh9N0L3Kq8YoJXBRNKta-j8jt5bMG5n-lyicxcVSCr7H=s16000

From network segment A, run

LDAPFragger --cshost

From network segment B, run

LDAPFragger LDAPFragger -u

LDAPS can be used with the --LDAPSflag, however, regular LDAP traffic is encrypted as well. Please do note that the default Cobalt Strike payload will get caught by most AVs.
Download LDAPFragger

___________________________
@hacking_Attack
@Hacking_Video

Cyberwar In Ukraine Hackers Are Hacking Russia
https://www.reddit.com/r/redteamsec/comments/uia0ng/cyberwar_in_ukraine_hackers_are_hacking_russia/

submitted by /u/cybersocdm (https://www.reddit.com/user/cybersocdm)
[link] (https://youtube.com/watch?v=FnJXUpn5tcg&feature=share) [comments] (https://www.reddit.com/r/redteamsec/comments/uia0ng/cyberwar_in_ukraine_hackers_are_hacking_russia/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
AI for Cybersecurity Shimmers With Promise, but Challenges Abound

Companies see AI-powered cybersecurity tools and systems as the future, but at present nearly 90% of them say they face significant hurdles in making use of them.

Dark Reading: Attacks/Breaches
Security Stuff Happens: What Will the Public Hear When You Say You've Been Breached?

A company's response to a breach is more important than almost anything else. But what constitutes a "good" response following a security incident? (Part 2 of a series.)

Dark Reading: Attacks/Breaches
New Ransomware Variant Linked to North Korean Cyber Army

Researchers use code, Bitcoin transactions to link ransomware attacks on banks to DPRK-sponsored actors.

___________________________
@hacking_Attack
@Hacking_Video