PC Ekspert Forum
Stranica 19 od 21 « Prva 915161718 19 2021
Show 40 post(s) from this thread on one page

PC Ekspert Forum (https://forum.pcekspert.com/index.php)
-   Razno (https://forum.pcekspert.com/forumdisplay.php?f=13)
-   -   Privatnost i sigurnost podataka i korisnika (https://forum.pcekspert.com/showthread.php?t=322402)

Neo-ST 14.10.2025. 15:37
Citiraj:
Autor Ivo_Strojnica (Post 3825653)
ajd kupi si stari mobitel. :D
Pa sad imam stari mobitel, S23 Ultra. To je po današnjim standardima staro. Nego šta sam s time onda dobio, opet sam podložan hackiranju 😅

Ivo_Strojnica 14.10.2025. 16:07
nisi.
Uzmeš stari mobitel, neki tanki, tipa pixel 6a, instaliraš na njega authentificator i to je to.
Taj mobitel nije nikad na netu niti može biti (osim ako nisi dovoljno inteligentan pa ga spojiš malo na wifi da vidiš jel na njemu još uvik dobro radi browser).

Eto ga, riješen problem.

Neo-ST 14.10.2025. 16:18
Citiraj:
Autor Ivo_Strojnica (Post 3825663)
tanki
Najbitniji detalj...
:roller:

Nego malo mi se čini overkill uzimat mobitel samo za 2fa? I onda ga stalno palit-gasit samo kad mi treba pristup nekom siteu...
Da nema neki hardware key koji može skenirat QR codove?

xlr 14.10.2025. 16:50
Citiraj:
Autor Neo-ST (Post 3825666)

Da nema neki hardware key koji može skenirat QR codove?
Mogu i hw kljucevi imati TOTP, ali ti onda treba companion app. Primjer:
https://www.token2.com/shop/product/...pin-complexity

Companion app:
https://www.token2.com/site/page/tok...app-user-guide

Ne znam imaju li Yubico i ostali bolje/lakse rjesen ovaj korak citanja TOTP-a iz kljuca. Ali vjerojatno je i ovaj scenario podlozan prijeopisanom napadu

Ivo_Strojnica 14.10.2025. 16:57
Citiraj:
Autor Neo-ST (Post 3825666)
Najbitniji detalj...
:roller:

Nego malo mi se čini overkill uzimat mobitel samo za 2fa? I onda ga stalno palit-gasit samo kad mi treba pristup nekom siteu...
Da nema neki hardware key koji može skenirat QR codove?
Istina, katastrofa. Radije kupi neki specificirani uređaj koji radi na način koji ti nije intuitivan i vrlo vjerojatno je skuplji.

Čisto da se osjećaš kul. :D

Čemu jednostavno, jel tako? :D

tomek@vz 14.10.2025. 17:02
Citiraj:
Autor Neo-ST (Post 3825666)
Najbitniji detalj...
:roller:

Nego malo mi se čini overkill uzimat mobitel samo za 2fa? I onda ga stalno palit-gasit samo kad mi treba pristup nekom siteu...
Da nema neki hardware key koji može skenirat QR codove?

Ideja iza zasebnog moba samo za TOTP je dedicirani uredaj koji koristis samo za to. Dakle ne mora biti biti onlajn, striktno instaliras TOTP aplikaciju i izbacis sve ostalo, kompletni lockdown tako da su gore opisani vektori napada - nemoguci. Night-ovo rijesenje je bolje jer je dovoljno jeftino iskreno i dovoljno glupo (bez ikakavih smart/phone home funkcija).

xlr 14.10.2025. 17:17
E sad, koliko je jeftino, ne znam... Kazu da baterija traje 4-5 godina ako svaki dan 10 puta citas TOTP i jednom mjesecno upisujes seed preko NFC-a. Bummer je sto kad ode baterija, moras uzeti novi uredjaj i prebaciti seedove

"Will I lose access to the TOTP profiles when the battery is dead?
A. Yes, but you will have enough time to prepare. Molto-1 will have a battery indicator on the display. You should replace your token (and migrate the TOTP tokens by resetting the second factor on each respective service) when the indicator shows the battery level as "empty" - you will still have a couple of months to do this."

Ako zbilja traje po 5 godina, ajde de.

Ali ako stalno pored sebe imas neki stari fon koji samo sjedi u ladici i realno ti ne predstavlja trosak jer si ga vec amortizirao lol, alternativa s Aegisom i prebacivanjem seedova je skroz na mjestu.

Ivo_Strojnica 14.10.2025. 17:18
ili još bolje, napraviš da ti se ne može otvoriti authentifikator bez da upišeš password/biometriju.
Aegis authentificator, naprimjer.
Čim ga minimiziraš, nema pomoći.

Neo-ST 14.10.2025. 17:39
Našao sam idealan uređaj: https://www.reiner-sct.com/en/produkt/tanjack-deluxe/

Night 15.10.2025. 08:31
Citiraj:
Autor Neo-ST (Post 3825652)
Ovo mi izgleda iznimno nepraktično.
Npr. u trenutnom 2fa appu u mobitelu imam 30+ 2fa pinova za razne siteove.
Kad mi treba 2fa za neki site, moram u search početi upisivati ime tog sitea da mi izbaci 2fa za njega.
Ovaj uređaj može spremiti samo 10 accountova? To je prvi problem.
Imaš drugi model na koji ide 100 accounta, baterija od sata ima 8g trajanje, a ova glavna se puni preko USBa i ima par mjeseci trajanja :

https://www.token2.eu/shop/product/m...hardware-token

Ako treba i QR onda što ekipa tu već napisa, stariji mobitel, instalirati sve što treba i pogasiti mu mrežu.


Citiraj:
Autor Neo-ST (Post 3825682)
Ovo izgleda cool. Samo što kad umjesto cijene piše "Business customer request" čini mi se da bi moglo biti iznenađenja :)

Bono 15.10.2025. 09:10
Microsoft is adding AI powered facial recognition to OneDrive.

And it can be disabled, but get this:

“You can only turn off this setting 3 times a year.”

https://fxtwitter.com/LundukeJournal...29065421750316

Sent from my SM-S931B using Tapatalk

Libertus 15.10.2025. 09:24
Majko mila...

kopija 15.10.2025. 11:14
Pa zamisli kolko resursa je potrebno da bi se obradilo npr 15GB slika.
I onda ti to iz fore uključiš pa isključiš, sve ode u vjetar.
Normalno da hoće ljude demotivirat da drkaju po tom switchu.


This guy gets it:
Citiraj:
It probably has to run a pretty heavy workload each time it goes through your gallery so they probably mean you can't just turn it off and on and off and on forever. But that doesn't get as many clicks
https://www.brax.io/hs-fs/hubfs/clic...everywhere.jpg

Neo-ST 15.10.2025. 11:33
Citiraj:
Autor Night (Post 3825761)
Ovo izgleda cool. Samo što kad umjesto cijene piše "Business customer request" čini mi se da bi moglo biti iznenađenja :)
Moraš otvoriti stranicu na desktopu pa ti se otvori opcija da dodaš u cart i možeš naručiti kao fizička osoba. Ovaj "Business customer request" je samo ako želiš naručiti kao biznis.
Ne znam zašto na mobilnoj stranici nema "add to cart" botuna.

Također imaju i jeftiniji model sa kamerom, koji doduše nema search opciju (ako ti je potrebna kad npr. imaš puno 2fa accountova).

tomek@vz 15.10.2025. 12:01
Citiraj:
Roughly 200,000 Linux-based Framework laptops shipped with a signed UEFI shell command (mm) that can be abused to bypass Secure Boot protections -- allowing attackers to load persistent bootkits like BlackLotus or HybridPetya. Framework has begun patching affected models, though some fixes and DBX updates are still pending. BleepingComputer reports: According to firmware security company Eclypsium, the problem stems from including a 'memory modify' (mm) command in legitimately signed UEFI shells that Framework shipped with its systems. The command provides direct read/write access to system memory and is intended for low-level diagnostics and firmware debugging. However, it can also be leveraged to break the Secure Boot trust chain by targeting the gSecurity2 variable, a critical component in the process of verifying the signatures of UEFI modules.

The mm command can be abused to overwrite gSecurity2 with NULL, effectively disabling signature verification. "This command writes zeros to the memory location containing the security handler pointer, effectively disabling signature verification for all subsequent module loads." The researchers also note that the attack can be automated via startup scripts to persist across reboots.

---


Citiraj:
Bruce Schneier and Barath Raghavan say agentic AI is already broken at the core. In their IEEE Security & Privacy essay, they argue that AI agents run on untrusted data, use unverified tools, and make decisions in hostile environments. Every part of the OODA loop (observe, orient, decide, act) is open to attack. Prompt injection, data poisoning, and tool misuse corrupt the system from the inside. The model's strength, treating all input as equal, also makes it exploitable. They call this the AI security trilemma: fast, smart, or secure. Pick two. Integrity isn't a feature you bolt on later. It has to be built in from the start. "Computer security has evolved over the decades," the authors wrote. "We addressed availability despite failures through replication and decentralization. We addressed confidentiality despite breaches using authenticated encryption. Now we need to address integrity despite corruption."

"Trustworthy AI agents require integrity because we can't build reliable systems on unreliable foundations. The question isn't whether we can add integrity to AI but whether the architecture permits integrity at all."

Bono 15.10.2025. 12:56
Citiraj:
Autor kopija (Post 3825786)
Pa zamisli kolko resursa je potrebno da bi se obradilo npr 15GB slika.
I onda ti to iz fore uključiš pa isključiš, sve ode u vjetar.
Normalno da hoće ljude demotivirat da drkaju po tom switchu.


This guy gets it:

https://www.brax.io/hs-fs/hubfs/clic...everywhere.jpg
Jadni ne mogu limitirati resurse, imas pravo 3 puta ugasiti, a oni ce ti 4x godisnje resetirati postavke. Tipicna indijska posla...

Sent from my SM-S931B using Tapatalk

Neo-ST 15.10.2025. 13:55
Mislim da bi ovo moglo spadati pod ovu temu ali nisam 100%, pa premjestite ako nije:

GrapheneOS is finally ready to break free from Pixels, and it may never look back

kopija 15.10.2025. 14:53
Citiraj:
Roughly 200,000 Linux-based Framework laptops shipped with a signed UEFI shell command (mm) that can be abused to bypass Secure Boot protections -- allowing attackers to load persistent bootkits like BlackLotus or HybridPetya.
Vidi vraga, ja mislio da je SecureBoot nekakva urota zlog Microsofta protivu linuxaša, kad ono ispada da je u biti security feature.
Ko što je Tin rekao "krhko je znanje, možda je pao trag istine u me, a možda su sanje".

tomek@vz 15.10.2025. 14:58
Citiraj:
Autor kopija (Post 3825838)
Vidi vraga, ja mislio da je SecureBoot nekakva urota zlog Microsofta protivu linuxaša, kad ono ispada da je u biti security feature.
Ko što je Tin rekao "krhko je znanje, možda je pao trag istine u me, a možda su sanje".

Moze li malo vise cinjenica bez sarkazma? Grazie :goood:


I da - that sucks:
Citiraj:

Roughly 200,000 Linux-based Framework laptops shipped with a signed UEFI shell command (mm) that can be abused to bypass Secure Boot protections -- allowing attackers to load persistent bootkits like BlackLotus or HybridPetya. Framework has begun patching affected models, though some fixes and DBX updates are still pending. BleepingComputer reports: According to firmware security company Eclypsium, the problem stems from including a 'memory modify' (mm) command in legitimately signed UEFI shells that Framework shipped with its systems. The command provides direct read/write access to system memory and is intended for low-level diagnostics and firmware debugging. However, it can also be leveraged to break the Secure Boot trust chain by targeting the gSecurity2 variable, a critical component in the process of verifying the signatures of UEFI modules.

The mm command can be abused to overwrite gSecurity2 with NULL, effectively disabling signature verification. "This command writes zeros to the memory location containing the security handler pointer, effectively disabling signature verification for all subsequent module loads." The researchers also note that the attack can be automated via startup scripts to persist across reboots.
Dakle - vise je Framework problem nego Linux problem. Mozes imati najsigurniji sigurnosni koncept na svijetu ali ako je lose implementiran imas doslovce ovakvo sranje.

OuttaControl 15.10.2025. 16:48
Citiraj:
Autor Bono (Post 3825812)
Jadni ne mogu limitirati resurse, imas pravo 3 puta ugasiti, a oni ce ti 4x godisnje resetirati postavke. Tipicna indijska posla...
ja bi reka i ne godisneje nego nakon svakog updatea :D

jbt prije nekih 15 godina, it firme/korporacije su bile good guys, apple je bio najgori od svih, sad mi se cini da je apple najbolji po korisnike :lol2:

Bono 15.10.2025. 18:37
Citiraj:
Autor OuttaControl (Post 3825848)
ja bi reka i ne godisneje nego nakon svakog updatea :D

jbt prije nekih 15 godina, it firme/korporacije su bile good guys, apple je bio najgori od svih, sad mi se cini da je apple najbolji po korisnike :lol2:
Ko da se natjecu tko ce vise zeznuti korisnike, Do no evil sad zvuci kao neslana sala ili kasnije do the right thing.

mkey 15.10.2025. 22:40
Citiraj:
Autor Neo-ST (Post 3825825)
Mislim da bi ovo moglo spadati pod ovu temu ali nisam 100%, pa premjestite ako nije:

GrapheneOS is finally ready to break free from Pixels, and it may never look back
Bude to po meni dodatni premium za GrapheneOS.

Bono 15.10.2025. 23:18
Moguce da se radi o Nothing phonu.

Sent from my SM-S931B using Tapatalk

Sinac 16.10.2025. 10:46
Vidim da je rasprava tu još uvijek aktualna. No, da skratim svoju priču, ponovit ću ono što mi se desilo prije kojih dvadesetak godina dok sam imao svoj obrt i održavao računala.
Epizoda 1 - pošalje mene kolega u računovodstvo jednog poduzeća jer u računovodstvu jedno računalo izgleda ima virus. I ulazim ja u sobu računovodstva, nisam ni zatvorio vrata za sobom kad kaže meni voditeljica računovodstva da joj ne praznim "mapu Recycle Bin na desktopu" jer si je tamo pospremila važne dokumente. OK, pokušavam ja spojiti sliku i zvuk te rečenice, sjednem za računalo i u Recycle Binu hrpa Excel datoteka. Meni pada mrak na oči, napravim novu mapu, prebacim sve datoteke i objasnim teti Biserki da je mogla ostati bez tih dokumenata kao od šale, pogotovo kod uklanjanja virusa. Ona to poprati osmjehom i kaže: "Nisam znala kako napraviti drugu mapu na desktopu pa sam tu pospremala."
Zemljo, otvori se.
Epizoda 2 istog poduzeća nakon nekih 2-3 mjeseca - isto računalo opet s problemima, dođem, pregledavam računalo i skužim da HDD klikće i da je na putu u vječna lovišta. Kažem ja teti Biserki da disk odlazi i da ima još najviše mjesec dana do tri mjeseca da sve prebace na novi disk. Još ja javim kolegi koji me prvi puta poslao tamo o čemu se radi, kažem disk će crknuti za mjesec dana i kaže on da će javiti šefu jer se zna s njim. Još kolega šalje ponudu za novi disk i prebacivanje podataka, cifra nije bila veća od 1.000 kn s PDV-om, ali nije dobio nikakav odgovor.
Epizoda 3 istog poduzeća nakon 30 dana od zadnje intervencije - šalje opet mene kolega jer isto računalo "nešto ne radi". Naravno da je krepao disk za koji sam rekao da crkava i koji sam tada izvadio, predao kolegi da odnese na spašavanje podataka koje je koštalo cca 3.500 kn, a poduzeće je moralo kupiti i novi disk.

Sve u svemu, ušteda koju je poduzeće htjelo na silu provesti pokazala se kao najveći trošak, pogubili su par Excel datoteka, ali je teti Biserki bilo drago da "ima samo 3 dana posla" da opet složi tablice jer bi se inače godinu dana zabavljala slažući tablice iz daleke prošlosti i sadašnjosti, ne računajući da joj dolaze i nove tablice.

Eto, toliko o sigurnosti podataka i korisnicima... :lol2:

tomek@vz 16.10.2025. 10:58
Citiraj:
Autor Sinac (Post 3825950)
Vidim da je rasprava tu još uvijek aktualna. No, da skratim svoju priču, ponovit ću ono što mi se desilo prije kojih dvadesetak godina dok sam imao svoj obrt i održavao računala.
Epizoda 1 - pošalje mene kolega u računovodstvo jednog poduzeća jer u računovodstvu jedno računalo izgleda ima virus. I ulazim ja u sobu računovodstva, nisam ni zatvorio vrata za sobom kad kaže meni voditeljica računovodstva da joj ne praznim "mapu Recycle Bin na desktopu" jer si je tamo pospremila važne dokumente. OK, pokušavam ja spojiti sliku i zvuk te rečenice, sjednem za računalo i u Recycle Binu hrpa Excel datoteka. Meni pada mrak na oči, napravim novu mapu, prebacim sve datoteke i objasnim teti Biserki da je mogla ostati bez tih dokumenata kao od šale, pogotovo kod uklanjanja virusa. Ona to poprati osmjehom i kaže: "Nisam znala kako napraviti drugu mapu na desktopu pa sam tu pospremala."
Zemljo, otvori se.
Epizoda 2 istog poduzeća nakon nekih 2-3 mjeseca - isto računalo opet s problemima, dođem, pregledavam računalo i skužim da HDD klikće i da je na putu u vječna lovišta. Kažem ja teti Biserki da disk odlazi i da ima još najviše mjesec dana do tri mjeseca da sve prebace na novi disk. Još ja javim kolegi koji me prvi puta poslao tamo o čemu se radi, kažem disk će crknuti za mjesec dana i kaže on da će javiti šefu jer se zna s njim. Još kolega šalje ponudu za novi disk i prebacivanje podataka, cifra nije bila veća od 1.000 kn s PDV-om, ali nije dobio nikakav odgovor.
Epizoda 3 istog poduzeća nakon 30 dana od zadnje intervencije - šalje opet mene kolega jer isto računalo "nešto ne radi". Naravno da je krepao disk za koji sam rekao da crkava i koji sam tada izvadio, predao kolegi da odnese na spašavanje podataka koje je koštalo cca 3.500 kn, a poduzeće je moralo kupiti i novi disk.

Sve u svemu, ušteda koju je poduzeće htjelo na silu provesti pokazala se kao najveći trošak, pogubili su par Excel datoteka, ali je teti Biserki bilo drago da "ima samo 3 dana posla" da opet složi tablice jer bi se inače godinu dana zabavljala slažući tablice iz daleke prošlosti i sadašnjosti, ne računajući da joj dolaze i nove tablice.

Eto, toliko o sigurnosti podataka i korisnicima... :lol2:
Uf...izronile stare misli koje sam pokopao duboko...imao sam nazalost slicnih iskustava. Mnogi djelatnici/djelatnice u firme pogotovo u drzavnim firmama bas na ovaj nacin funkcioniraju nazalost. Hovewer. Oni najcesce nisu na ovom forumu. Ima i neukih koji neznaju drugacije i kad ih se informira promjene nacin ophodenja sa svakodnevnim problemima. Zbog takvih se isplati uzet vremena i opisat bas ovakve stvari. Drugo kaj za nas admine to znaci da smo ko jedna velika zajednica koja se lijeci od psiholoskih posljedica dnevne interakcije sa takvim osobama :D

geronimo_2 16.10.2025. 11:13
ovakvima gore navedenima bi trebalo zakonom zabranit pric bilo kakvoj IT opremi koja je javna/drzavna...
boze sacuvaj.
nagledao sam se i ja svacega.
i onda nam prodaju pricice da ce biti sve safe loooool

domy_os 16.10.2025. 12:19
Microsoft Online Services Subprocessor Disclosure

Citiraj:
This notice is to inform you of an update regarding the Microsoft Online Services Subprocessors List.

Microsoft may use non-Microsoft organizations to help provide Online Services. As a function of their role for Microsoft, a small set of these organizations may process your customer data or personal data, only to deliver the services Microsoft has retained them to provide; they are prohibited from using your data for any other purpose. In accordance with GDPR, we disclose these subprocessors to you in advance of their first engagement and provide notification of any changes over time.

To obtain Microsoft’s disclosure of Online Services Subprocessors, you may locate it within the Microsoft Trust Center located here.

Please see the “Summary of changes since the last disclosure” in the disclosure of Online Services Subprocessors available at the link above for details on the intended changes concerning the addition or replacement of other processors.

tomek@vz 16.10.2025. 20:09
Hebeno :P


Citiraj:
New research shows that threats to privacy and security don't always travel by wire. Increasingly, they come from above – hidden in satellite signals few had ever thought to inspect. Most organizations notified about these vulnerabilities have since moved to encrypt sensitive satellite links. Yet with so many technologies dependent on orbital infrastructure, countless transmissions remain exposed to exploitation.
A new academic investigation has exposed a widespread and largely overlooked vulnerability in global satellite communications. Researchers from the University of California, San Diego, and the University of Maryland found that a significant share of geostationary satellite signals – responsible for transmitting vast amounts of sensitive data every day – remain unencrypted.

> Techspot

tomek@vz 17.10.2025. 18:21
Citiraj:
Trend Micro researchers disclosed details of a new campaign, tracked as Operation Zero Disco, that exploited a recently disclosed security flaw impacting Cisco IOS Software and IOS XE Software to deploy Linux rootkits on older, unprotected systems.
The vulnerability, tracked as CVE-2025-20352 (CVSS score: 7.7), impacts Cisco IOS and IOS XE Software. The high-severity vulnerability resides in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and IOS XE Software.
The flaw allows remote authenticated attackers to trigger a DoS condition with low privileges or achieve root code execution with high privileges. An attacker could exploit the flaw by sending a crafted SNMP packet to a vulnerable device over IPv4 or IPv6 networks. The root cause of this vulnerability is a stack overflow condition in the SNMP subsystem of the affected software. The vulnerability impacts all devices with SNMP enabled.

> securityaffairs


Citiraj:
A newly uncovered Linux rootkit, dubbed LinkPro, leverages extended Berkeley Packet Filter (eBPF) technology to conceal its presence and maintain persistence on compromised systems.
The Synacktiv CSIRT discovered the malware during an investigation of a breached AWS infrastructure. LinkPro operated as a stealthy backdoor across Elastic Kubernetes Service (EKS) clusters following the exploitation of a public-facing Jenkins server (CVE-2024-238976).​

> cyberpress

tomek@vz 18.10.2025. 08:08
Citiraj:
By embedding malicious code into the cryptographic backbone of blockchain networks, hackers are effectively turning one of the most tamper-resistant technologies into a resilient delivery system for cyberattacks. For cybersecurity teams, the findings highlight a growing challenge: the same decentralization that secures digital currencies is now being exploited to hide and distribute malware beyond the reach of any central authority.
Hackers aligned with North Korea are using public cryptocurrency blockchains to conceal and distribute malicious code, adopting a technique researchers describe as a new form of untouchable online hosting.
The approach reuses the design of blockchain smart contracts, a system intended for transparency and trust, to store and deliver malware in ways that are nearly impossible to disrupt.

> Techspot

strikoo 18.10.2025. 12:03
Citiraj:
Autor tomek@vz (Post 3825183)
Signal?
https://matrix.org/ecosystem/hosting/

Neo-ST 18.10.2025. 13:09
Citiraj:
Autor strikoo (Post 3826285)
I šta se desi ako zatvore matrix.org domenu ?

kopija 18.10.2025. 14:16
Citiraj:
Autor Neo-ST (Post 3826288)
I šta se desi ako zatvore matrix.org domenu ?

Onda pređeš na Session i zaboraviš na sve ostale gluposti, uključujući Signal.

The Exiled 18.10.2025. 14:23
Session se bazira na Signal protokolu, dok se Matrix/Element može koristiti i kroz self-hosting.

mkey 18.10.2025. 14:27
Ajde da ne potrošim pet sati uludo, mogu li s matrixom zamijeniti whatsapp, viber i slične aplikacije? U smisla da eliminiram to sranje s telefona ali da i dalje mogu komunicirati s ekipom koja ih koristi?

The Exiled 18.10.2025. 14:35
Izgleda da se može, a i Element kao aplikacija koja se bazira na Matrix protokolu, podržava slične funkcionalnosti.
Citiraj:
Matrix supports bridging messages from different chat applications into Matrix rooms. These bridges are programs that run on the server and communicate with the non-Matrix servers.

Bridges for the following notable applications are maintained by the community:
  • Apple iMessage
  • Discord
  • Email
  • Facebook Messenger/Instagram
  • Google Chat
  • GroupMe
  • Mastodon
  • RSS/Twitter feeds
  • Signal
  • Skype
  • Telegram
  • SMS
  • WeChat
  • WhatsApp
  • LinkedIn

mkey 18.10.2025. 14:52
Hmeh, ima tu tona raznih ograničenja. Lakše je samo šutnut to sranje, WA naročito.
https://ems-docs.element.io/books/el...hatsapp-bridge

tomek@vz 18.10.2025. 20:15
Citiraj:
Cybercriminals are exploiting weak email authentication settings in Zendesk, using the platform's customer support systems to bombard targets with thousands of spam and harassing messages that appear to come from legitimate companies like The Washington Post, Discord, and NordVPN. KrebsOnSecurity reports:
Citiraj:
Zendesk is an automated help desk service designed to make it simple for people to contact companies for customer support issues. Earlier this week, KrebsOnSecurity started receiving thousands of ticket creation notification messages through Zendesk in rapid succession, each bearing the name of different Zendesk customers, such as CapCom, CompTIA, Discord, GMAC, NordVPN, The Washington Post, and Tinder.

The abusive missives sent via Zendesk's platform can include any subject line chosen by the abusers. In my case, the messages variously warned about a supposed law enforcement investigation involving KrebsOnSecurity.com, or else contained personal insults. Moreover, the automated messages that are sent out from this type of abuse all come from customer domain names -- not from Zendesk. [...]

In all of the cases above, the messaging abuse would not have been possible if Zendesk customers validated support request email addresses prior to sending responses. Failing to do so may make it easier for Zendesk clients to handle customer support requests, but it also allows ne'er-do-wells to sully the sender's brand in service of disruptive and malicious email floods.
"We recognize that our systems were leveraged against you in a distributed, many-against-one manner," said Carolyn Camoens, communications director at Zendesk. "We are actively investigating additional preventive measures. We are also advising customers experiencing this type of activity to follow our general security best practices and configure an authenticated ticket creation workflow."

tomek@vz 20.10.2025. 06:48
Citiraj:
A high-severity vulnerability in the Pluggable Authentication Modules (PAM) framework was assigned the identifier CVE-2025-8941.
This vulnerability stems from the heart of Linux operating systems, enabling attackers with local access to exploit symlink attacks and race conditions for full root privilege escalation.
Root access, the ideal of control in Unix-like environments, could open doors to widespread system compromise and data breaches, underscoring the risks in even the most trusted open-source tools.
Security researchers warn that this issue demands immediate attention, especially for servers and desktops relying on Linux-PAM for user authentication.
Local users might become superusers, raising concerns for both corporate networks and personal devices. The disclosure of this flaw shows the ongoing difficulties in securing authentication systems as threats continue to change.
> cybersecuritynews


------
Citiraj:

"Eleven days ago, the nonprofit entity that develops the protocol, Signal Messenger LLC, published a 5,900-word write-up describing its latest updates that bring Signal a significant step toward being fully quantum-resistant," writes Ars Technica:
Citiraj:
The mechanism that has made this constant key evolution possible over the past decade is what protocol developers call a "double ratchet." Just as a traditional ratchet allows a gear to rotate in one direction but not in the other, the Signal ratchets allow messaging parties to create new keys based on a combination of preceding and newly agreed-upon secrets. The ratchets work in a single direction, the sending and receiving of future messages. Even if an adversary compromises a newly created secret, messages encrypted using older secrets can't be decrypted... [Signal developers describe a "ping-pong" behavior as parties take turns replacing ratchet key pairs one at a time.] Even though the ping-ponging keys are vulnerable to future quantum attacks, they are broadly believed to be secure against today's attacks from classical computers.

The Signal Protocol developers didn't want to remove them or the battle-tested code that produces them. That led to their decision to add quantum resistance by adding a third ratchet. This one uses a quantum-safe Key-Encapsulation Mechanism (KEM) to produce new secrets much like the Diffie-Hellman ratchet did before, ensuring quantum-safe, post-compromise security... The technical challenges were anything but easy. Elliptic curve keys generated in the X25519 implementation are about 32 bytes long, small enough to be added to each message without creating a burden on already constrained bandwidths or computing resources. A ML-KEM 768 key, by contrast, is 1,000 bytes. Additionally, Signal's design requires sending both an encryption key and a ciphertext, making the total size 2,272 bytes... To manage the asynchrony challenges, the developers turned to "erasure codes," a method of breaking up larger data into smaller pieces such that the original can be reconstructed using any sufficiently sized subset of chunks...

The Signal engineers have given this third ratchet the formal name: Sparse Post Quantum Ratchet, or SPQR for short. The third ratchet was designed in collaboration with PQShield, AIST, and New York University. The developers presented the erasure-code-based chunking and the high-level Triple Ratchet design at the Eurocrypt 2025 conference. Outside researchers are applauding the work. "If the normal encrypted messages we use are cats, then post-quantum ciphertexts are elephants," Matt Green, a cryptography expert at Johns Hopkins University, wrote in an interview. "So the problem here is to sneak an elephant through a tunnel designed for cats. And that's an amazing engineering achievement. But it also makes me wish we didn't have to deal with elephants."

tomek@vz 20.10.2025. 06:53
Citiraj:
Microsoft said in a blog post this week that "over half of cyberattacks with known motives were driven by extortion or ransomware... while attacks focused solely on espionage made up just 4%."

And Microsoft's annual digital threats report found operations expanding even more through AI, with cybercriminals "accelerating malware development and creating more realistic synthetic content, enhancing the efficiency of activities such as phishing and ransomware attacks." [L]egacy security measures are no longer enough; we need modern defenses leveraging AI and strong collaboration across industries and governments to keep pace with the threat...

Over the past year, both attackers and defenders harnessed the power of generative AI. Threat actors are using AI to boost their attacks by automating phishing, scaling social engineering, creating synthetic media, finding vulnerabilities faster, and creating malware that can adapt itself... For defenders, AI is also proving to be a valuable tool. Microsoft, for example, uses AI to spot threats, close detection gaps, catch phishing attempts, and protect vulnerable users. As both the risks and opportunities of AI rapidly evolve, organizations must prioritize securing their AI tools and training their teams...

Amid the growing sophistication of cyber threats, one statistic stands out: more than 97% of identity attacks are password attacks. In the first half of 2025 alone, identity-based attacks surged by 32%. That means the vast majority of malicious sign-in attempts an organization might receive are via large-scale password guessing attempts. Attackers get usernames and passwords ("credentials") for these bulk attacks largely from credential leaks. However, credential leaks aren't the only place where attackers can obtain credentials. This year, we saw a surge in the use of infostealer malware by cybercriminals...

Luckily, the solution to identity compromise is simple. The implementation of phishing-resistant multifactor authentication (MFA) can stop over 99% of this type of attack even if the attacker has the correct username and password combination.
"Security is not only a technical challenge but a governance imperative..." Microsoft adds in their blog post. "Governments must build frameworks that signal credible and proportionate consequences for malicious activity that violates international rules." (The report also found that America is the #1 most-targeted country — and that many U.S. companies have outdated cyber defenses.)

But while "most of the immediate attacks organizations face today come from opportunistic criminals looking to make a profit," Microsoft writes that nation-state threats "remain a serious and persistent threat." More details from the Associated Press: Russia, China, Iran and North Korea have sharply increased their use of artificial intelligence to deceive people online and mount cyberattacks against the United States, according to new research from Microsoft. This July, the company identified more than 200 instances of foreign adversaries using AI to create fake content online, more than double the number from July 2024 and more than ten times the number seen in 2023.
Examples of foreign espionage cited by the article:
  • China is continuing its broad push across industries to conduct espionage and steal sensitive data...
  • Iran is going after a wider range of targets than ever before, from the Middle East to North America, as part of broadening espionage operations..
  • "[O]utside of Ukraine, the top ten countries most affected by Russian cyber activity all belong to the North Atlantic Treaty Organization (NATO) — a 25% increase compared to last year."
  • North Korea remains focused on revenue generation and espionage...
There was one especially worrying finding. The report found that critical public services are often targeted, partly because their tight budgets limit their incident response capabilities, "often resulting in outdated software.... Ransomware actors in particular focus on these critical sectors because of the targets' limited options. For example, a hospital must quickly resolve its encrypted systems, or patients could die, potentially leaving no other recourse but to pay."


Sva vremena su GMT +2. Sada je 14:09.
Stranica 19 od 21 « Prva 915161718 19 2021
Show 40 post(s) from this thread on one page

Powered by vBulletin®
Copyright ©2000 - 2025, Jelsoft Enterprises Ltd.
© 1999-2024 PC Ekspert - Sva prava pridržana ISSN 1334-2940
Ad Management by RedTyger