Dark Reading: Attacks/Breaches
Russia-Ukraine Conflict Holds Cyberwar Lessons

Initial attacks used damaging wiper malware and targeted infrastructure, but the most enduring impacts will likely be from disinformation, researchers say. At Black Hat USA, SentinelOne's Juan Andres Guerrero-Saade and Tom Hegel will discuss.

Dark Reading: Attacks/Breaches
US Oil and Gas Sector at Risk of a Cyberbreach, According to BreachBits Study

Study offers a cyber "state of the industry" analysis from a hacker's perspective to help companies anticipate attacks.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Domino's Takes a Methodical Approach to IoT

The success of Domino's Flex IoT project can be attributed in large part to the security best practices it followed.

Dark Reading: Attacks/Breaches
Abusing Kerberos for Local Privilege Escalation

Upcoming Black Hat USA presentation will examine the implications of Kerberos weaknesses for security on the local machine.

Dark Reading: Attacks/Breaches
Researchers Debut Fresh RCE Vector for Common Google API Tool

The finding exposes the danger of older, unpatched bugs, which plague at least 4.5 million devices.

Dark Reading: Attacks/Breaches
Halo Security Emerges From Stealth With Full Attack Surface Management Platform

The latest startup to enter the attack surface management space also has a free scanning service to audit the contents of any website.

Dark Reading: Attacks/Breaches
Cybrary Unveils Next-Generation Interactive, Hands-On Training Experience to Upskill Cybersecurity Professionals

New SOC Analyst Assessment delivers threat-informed training in a live lab environment to help cybersecurity professionals defend their organizations against the latest adversarial tactics and techniques.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Microsoft Patches Zero-Day Actively Exploited in the Wild

The computing giant issued a massive Patch Tuesday update, including a pair of remote execution flaws in the Microsoft Support Diagnostic Tool (MSDT) after attackers used one of the vulnerabilities in a zero-day exploit.

Hacking on Medium
I Hacked the BBC and All I Got Was This Awesome T-Shirt

https://cdn-images-1.medium.com/max/2600/1*qoBHoxpZvYOxKuyHO7-ScA.jpeg
Besides the incredibly exciting headline, this is simply a re-telling of my first real bug bounty hunting experience and how you can find…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Online Scams: Investigating a Scammer Ring

https://cdn-images-1.medium.com/max/1667/1*f3DO4u9W5Dw3FsHAq7NroQ.png
One my friends reached out to me after they ordered clothes from an online store “https://www.marksparkar.com/”

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
4 Best Linux Distros for Hackers

https://cdn-images-1.medium.com/max/2600/1*B82zjbTxW0UB65aOXLe3Qg.jpeg
We have enlisted Four Best Linux Distributions for Hackers i.e. for Cybersecurity Professionals… 4.BlackArch 3.BackBox 2.Kali Linux 1…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Lost bitcoin wallets. Part one

https://cdn-images-1.medium.com/max/1280/1*u0kiu3ygra274LDwOoZN6g.png
Surely you have heard the story about buying pizza for 10,000 BTC — Laszlo Hanets (the person who did it) is still biting his elbows! But…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Question regarding dns redirect

Quick question for you guys.

Doing some experimentation with JS injection into http websites.

Obviously, most websites use https. The main workaround is to attempt to perform an sslstrip or HSTSHijack to try to downgrade the site to http. From there we can inject a hook and try from there.

However, most large sites have a strong HSTS policy that will not allow this to work.

My question is, would it be easier to just create a DNS redirect that forces users to a predefined http website. Meaning, if I go to https://google.com, it would redirect to http://palms.myspecies.info/

Obviously, this would get noticed by the target host, but that is not important as this is for testing purposes on my own machine.

submitted by /u/whatthe12234
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/u--Pugw0F5elNZSsOqTH_p6epidmBJXpK4QRtlozw6g.jpg submitted by /u/Yechezkel_Kohen
[link] [comments]

hacking: security in practice
Is this still an Open redirect vulnerability?

I failed my security course twice and ironically I’m now tasked to fix security issues on an internal web app for my employer.

They’re cybersecurity 101 type of attacks but I’m still confused, is the following example still an open redirect, or is it a false positive?

the user inputs a URL on browser and the controller/service grabs the Base url of that URL and appends “custom.html” Then passes that to the servlets redirect function.

Pseudo code:

MyController(request, response) {

BaseURL = request.substring()

Response.redirect(BaseURL + “custom.html”)

}

submitted by /u/GuerroCanelo
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to break into old yahoo mail account that I madr 6 years ago

Hello

I made a yahoo email that I used to create a Facebook account and now I need to access it for some security code. The problem is that I only know one of the security questions but not the other one. Can you give me some websites for this type of service?

submitted by /u/AlexPascu007
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is there a way to intervene as user on TikTok collecting personal data?

I'm concerned, as I used TikTok about three months naively not understanding what I signing up for. After reading through and seeing that you they gain notable information past the application in their terms of service. I would like to make sure that I am not having my data used by them.

Is there anyway I can make sure they aren't doing such things at the current moment?

Is there a way to trace what you have available to these apps?

Do these apps continue to monitor even after you have deleted the app?

Appreciate any of the feedback.

submitted by /u/RecipeAwkward
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I Created an Open Source Program for Keystroke Reflection Side Channel Attack using an Arduino Pro Micro

https://external-preview.redd.it/8piG72lLtgDZaKK_BRaupnFgb3jrRL0jNtsvFRC7G-g.png?width=640&crop=smart&auto=webp&s=961d802522e3a8e3f5103c48de6bcf65754cb8cb submitted by /u/zebrazookeeper
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video