https://www.youtube.com/watch?v=-evIyrrjTTY what can we do to stop all the wars?
YouTube
This Land is Mine
Reference and original, including an explanation about each character in this video: http://blog.ninapaley.com/2012/10/01/this-land-is-mine/
It tells the story of the wars in the land called Israel/Palestine/Canaan/the Levant, since the cavemen until today…
It tells the story of the wars in the land called Israel/Palestine/Canaan/the Levant, since the cavemen until today…
😢2
Hi, my dear 😊 !
New day, new attack on web3 developers and artists.
At this time, the scam link is
Attackers send this link in comments (for example, in our group, too) (pic)
This site is looks like free-mint landing (do you like free minting?).
But instead, the site asked users to send their liquidity to a target address. 0x02b73dcA543Adf4061CA45ec118CD13ee37Bf2db (debank)
After, the site sends report to a telegram chat group using a special bot.
The bot credentials is
The invite link to the telegram chat group is https://t.me/+AHq8y1C9GWMxMjg0 (pic)
The chat group created on 27 September 2023.
The report chat has two telegram users:
- @nothingnessssssssss (tg id 5549919234)
- @mutuNFTs (tg id 6444639769)
Another users:
- @bothfs (tg id 6437252778) — owner of pandra tg chat group
- @LUNPEP (tg id 6236128085) — invited into log report chat by owner
All sites that are used to deceive visitors:
-
-
-
- nftboxes.co
-
-
Found scaminessman's addresses:
-
-
-
-
-
Log reports endpoint is:
Update: I think they are Armenian
Update2: add
Update3: decryptor https://gist.github.com/kalloc/c81e8c63fbb56d42d3df93803d8ed006, add few domains, the scammers still continue their attack
--
Stay safe my friends!
New day, new attack on web3 developers and artists.
At this time, the scam link is
https://fluffmania.com/.Attackers send this link in comments (for example, in our group, too) (pic)
This site is looks like free-mint landing (do you like free minting?).
But instead, the site asked users to send their liquidity to a target address. 0x02b73dcA543Adf4061CA45ec118CD13ee37Bf2db (debank)
After, the site sends report to a telegram chat group using a special bot.
The bot credentials is
bot6522192634:AAHy8NqRdYBBaoTJSH5N5K2HQRktKMqegSU (pic) (getMe, getUpdates)The invite link to the telegram chat group is https://t.me/+AHq8y1C9GWMxMjg0 (pic)
The chat group created on 27 September 2023.
The report chat has two telegram users:
- @nothingnessssssssss (tg id 5549919234)
- @mutuNFTs (tg id 6444639769)
Another users:
- @bothfs (tg id 6437252778) — owner of pandra tg chat group
- @LUNPEP (tg id 6236128085) — invited into log report chat by owner
All sites that are used to deceive visitors:
-
fluffmania.com-
pandra.io
- cyberconnect.fi
-
bigtime.wtf- nftboxes.co
-
fewos.io-
layerzero.catFound scaminessman's addresses:
-
0x3D684317b03BC4248A0EeE8C2Ed0B3b0c3a7F58d-
0x375Fa8d7a500aBEfb0eB18B2Cb9f4e68db01F398-
0x02b73dca543adf4061ca45ec118cd13ee37bf2db-
0x00005C99BA69Ca6a18be16234F95850F2C100000-
0x00002020429F161E2B3c3f5845a836f06E550000Log reports endpoint is:
moralis-api.zipUpdate: I think they are Armenian
Update2: add
layerzero.cat and fewos.ioUpdate3: decryptor https://gist.github.com/kalloc/c81e8c63fbb56d42d3df93803d8ed006, add few domains, the scammers still continue their attack
--
Stay safe my friends!
Please open Telegram to view this post
VIEW IN TELEGRAM
Please open Telegram to view this post
VIEW IN TELEGRAM
👍5
Just got achievement — ban from @farm42. The debt is paid.
👍5
Encrypted traffic interception on Hetzner and Linode targeting the largest Russian XMPP (Jabber) messaging service
TL;DR: Researchers have discovered XMPP (Jabber) instant messaging protocol encrypted TLS connection wiretapping (Man-in-the-Middle attack) of jabber.ru (aka xmpp.ru) service’s servers on Hetzner and Linode hosting providers in Germany.
The attacker has issued several new TLS certificates using Let’s Encrypt service which were used to hijack encrypted STARTTLS connections on port 5222 using transparent MiTM proxy. The attack was discovered due to expiration of one of the MiTM certificates, which haven’t been reissued.
There are no indications of the server breach or spoofing attacks on the network segment, quite the contrary: the traffic redirection has been configured on the hosting provider network.
The wiretapping may have lasted for up to 6 months overall (90 days confirmed). Researchers believe this is lawful interception Hetzner and Linode were forced to setup.
(source)
TL;DR: Researchers have discovered XMPP (Jabber) instant messaging protocol encrypted TLS connection wiretapping (Man-in-the-Middle attack) of jabber.ru (aka xmpp.ru) service’s servers on Hetzner and Linode hosting providers in Germany.
The attacker has issued several new TLS certificates using Let’s Encrypt service which were used to hijack encrypted STARTTLS connections on port 5222 using transparent MiTM proxy. The attack was discovered due to expiration of one of the MiTM certificates, which haven’t been reissued.
There are no indications of the server breach or spoofing attacks on the network segment, quite the contrary: the traffic redirection has been configured on the hosting provider network.
The wiretapping may have lasted for up to 6 months overall (90 days confirmed). Researchers believe this is lawful interception Hetzner and Linode were forced to setup.
(source)
🤯1
Critical vulnerability in AHash: complete key recovery of AES-based hash through side-channels
AHash is the fastest, DOS resistant hash currently available in Rust. AHash is intended exclusively for use in in-memory hashmaps.
The AES version of aHash only performs a single round of AES between inputs. This is not sufficient, a single-bit difference only gets amplified once in the SubBytes step, leading to one of 256 possibilities, but nothing further. An attacker can guess this to recover the key byte-by-byte, leading to a complete key recovery in ~4000 tests. Note that the only thing an attacker has to see is whether two inputs collide, nothing else. The attack can thus be done entirely through side-channels.
(source)
AHash is the fastest, DOS resistant hash currently available in Rust. AHash is intended exclusively for use in in-memory hashmaps.
The AES version of aHash only performs a single round of AES between inputs. This is not sufficient, a single-bit difference only gets amplified once in the SubBytes step, leading to one of 256 possibilities, but nothing further. An attacker can guess this to recover the key byte-by-byte, leading to a complete key recovery in ~4000 tests. Note that the only thing an attacker has to see is whether two inputs collide, nothing else. The attack can thus be done entirely through side-channels.
(source)
Forwarded from Brickspacer
Каждый день вы обязаны уделять хотя бы по одному часу своей мечте, от которой вы не можете отказаться.
Кто бы что не говорил, какие бы оправдания вы не находили.
Дисциплина. Дисциплина бьет талант.
Кто бы что не говорил, какие бы оправдания вы не находили.
Дисциплина. Дисциплина бьет талант.
👍5❤2🔥2
This media is not supported in your browser
VIEW IN TELEGRAM
All users with Safari running on iPhones, iPads and MacBooks are vulnerable
------
iLeakage: Browser-based Timerless Speculative Execution Attacks on Apple Devices
iLeakage, a transient execution side channel targeting the Safari web browser present on Macs, iPads and iPhones. iLeakage shows that the Spectre attack is still relevant and exploitable, even after nearly 6 years of effort to mitigate it since its discovery.
Researchers show how an attacker can induce Safari to render an arbitrary webpage, subsequently recovering sensitive information present within it using speculative execution. In particular, we demonstrate how Safari allows a malicious webpage to recover secrets from popular high-value targets, such as Gmail inbox content.
Finally, researchers demonstrate the recovery of passwords, in case these are autofilled by credential managers.
(source)
------
iLeakage: Browser-based Timerless Speculative Execution Attacks on Apple Devices
iLeakage, a transient execution side channel targeting the Safari web browser present on Macs, iPads and iPhones. iLeakage shows that the Spectre attack is still relevant and exploitable, even after nearly 6 years of effort to mitigate it since its discovery.
Researchers show how an attacker can induce Safari to render an arbitrary webpage, subsequently recovering sensitive information present within it using speculative execution. In particular, we demonstrate how Safari allows a malicious webpage to recover secrets from popular high-value targets, such as Gmail inbox content.
Finally, researchers demonstrate the recovery of passwords, in case these are autofilled by credential managers.
(source)
🤯1🌚1