Security-Portal.cz je internetový portál zaměřený na počítačovou bezpečnost, hacking, anonymitu, počítačové sítě, programování, šifrování, exploity, Linux a BSD systémy. Provozuje spoustu zajímavých služeb a podporuje příznivce v zajímavých projektech.

Kategorie

Types of user accounts in Windows 10 (local, domain, Microsoft)

InfoSec Institute Resources - 20 Únor, 2020 - 16:28

Introduction Years ago, I was just starting out in tech. I was located at a remote facility compared to the rest of the company, and we had someone that was demanding domain administrator credentials. I kept telling them no and pointing them over to the people that controlled that access, but it was obvious that […]

The post Types of user accounts in Windows 10 (local, domain, Microsoft) appeared first on Infosec Resources.

Types of user accounts in Windows 10 (local, domain, Microsoft) was first posted on February 20, 2020 at 9:28 am.
©2017 "InfoSec Resources". Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at darren.dalasta@infosecinstitute.com
Kategorie: Hacking & Security

Tisíce webů na WordPressu v ohrožení: hackeři zneužívají kritickou bezpečnostní díru

Zive.cz - bezpečnost - 20 Únor, 2020 - 15:45
Pokud provozujete webové stránky postavené na redakčním systému WordPress, určitě byste měli zkontrolovat dostupnost aktualizací. Hackeři totiž začali ve velké míře zneužívat bezpečnostní díru v jednom z pluginů, která jim dovoluje vymazat všechny databáze a v některých případech i získat úplnou ...
Kategorie: Hacking & Security

How to use Windows Recovery Environment

InfoSec Institute Resources - 20 Únor, 2020 - 15:44

Introduction It’s frustrating when a Windows operating system fails to boot or restarts unexpectedly. Maybe the problem is a corrupted disk or missing files, or maybe you just can’t be sure.  Regardless, the option to use Windows Recovery Environment (also known as WinER or Windows RE) is always available. WinRE executes commands that may resolve […]

The post How to use Windows Recovery Environment appeared first on Infosec Resources.

How to use Windows Recovery Environment was first posted on February 20, 2020 at 8:44 am.
©2017 "InfoSec Resources". Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at darren.dalasta@infosecinstitute.com
Kategorie: Hacking & Security

Ransomware attack forces 2-day shutdown of natural gas pipeline

Sophos Naked Security - 20 Únor, 2020 - 15:35
The attacker(s) infected both IT and operational networks with an unspecified ransomware strain, though the facility never lost control.

Hack the Box (HTB) machines walkthrough series — Heist

InfoSec Institute Resources - 20 Únor, 2020 - 15:01

Today we will be continuing with our exploration of Hack the Box (HTB) machines, as seen in previous articles. This walkthrough is of an HTB machine named Heist. HTB is an excellent platform that hosts machines belonging to multiple OSes. It also has some other challenges as well. Individuals have to solve the puzzle (simple […]

The post Hack the Box (HTB) machines walkthrough series — Heist appeared first on Infosec Resources.

Hack the Box (HTB) machines walkthrough series — Heist was first posted on February 20, 2020 at 8:01 am.
©2017 "InfoSec Resources". Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at darren.dalasta@infosecinstitute.com
Kategorie: Hacking & Security

Phishing techniques: Asking for sensitive information via email

InfoSec Institute Resources - 20 Únor, 2020 - 15:00

Introduction Email has been a critical part of our everyday communications since the 1990s. Thanks to its affordability and ease of use, email allows users to conduct business deals, stay in touch with their family and friends, and receive promotional materials from their favorite brands. However, the use of this messaging medium isn’t risk-free. Phishers […]

The post Phishing techniques: Asking for sensitive information via email appeared first on Infosec Resources.

Phishing techniques: Asking for sensitive information via email was first posted on February 20, 2020 at 8:00 am.
©2017 "InfoSec Resources". Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at darren.dalasta@infosecinstitute.com
Kategorie: Hacking & Security

Nearly half of hospital Windows systems still vulnerable to RDP bugs

Sophos Naked Security - 20 Únor, 2020 - 14:58
Almost half of connected hospital devices are still exposed to the wormable BlueKeep Windows flaw nearly a year after it was announced, according to a report released this week.

Firefox 73.0.1 fixes crashes, blank web pages and DRM niggles>

LinuxSecurity.com - 20 Únor, 2020 - 14:33
Firefox version 73 has only been out for a week but already Mozilla has had to update it to version 73.0.1 to fix a range of browser problems and crashes, including when running on Linux machines.
Kategorie: Hacking & Security

Critical Adobe Flaws Fixed in Out-of-Band Update

Threatpost - 20 Únor, 2020 - 14:26
Two critical Adobe vulnerabilities have been fixed in Adobe After Effects and Adobe Media Encoder.
Kategorie: Hacking & Security

Lindsey Graham’s new bill would end the internet as we know it>

LinuxSecurity.com - 20 Únor, 2020 - 14:25
If Sen. Lindsey Graham gets his way, the federal government will launch another attack on online privacy. The South Carolina Republican will ask lawmakers to give Attorney General William Barr and the Department of Justice unchecked access to all of your messaging, file-sharing, and video-sharing tools. That is bad news for just about everyone and a nightmare for those who value digital privacy.
Kategorie: Hacking & Security

Scam Alert: You've Been Selected for 'Like of the Year 2020' Cash Prizes

The Hacker News - 20 Únor, 2020 - 13:40
Cybersecurity researchers have discovered a large-scale ongoing fraud scheme that lures unsuspecting Russian Internet users with promises of financial rewards to steal their payment card information. According to researchers at Group-IB, the multi-stage phishing attack exploited the credibility of Russian Internet portal Rambler to trick users into participating in a fictitious "Like of the
Kategorie: Hacking & Security

MGM Grand Breach Leaked Details of 10.6 Million Guests Last Summer

Threatpost - 20 Únor, 2020 - 12:48
This week a hacking forum posted data from the breach—which included personal and contact details for celebrities, tech CEOs, government officials and employees at large tech companies.
Kategorie: Hacking & Security

Firefox 73.0.1 fixes crashes, blank web pages and DRM niggles

Sophos Naked Security - 20 Únor, 2020 - 12:20
Firefox version 73 has only been out for a week but already Mozilla has had to update it to v73.0.1 to fix a range of browser problems.

Deal: Cloud And Networking Certification Training ~ Get 97% OFF

The Hacker News - 20 Únor, 2020 - 12:08
Cloud computing and networking are two of the most significant areas of growth in the IT business. Companies need engineers who can maintain distributed software and keep the company connected. If you want to work in either niche, the Essential Cloud & Networking Certification Training Bundle offers 93 hours of essential knowledge. You can pick up all 5 courses now for only $39.99 via the THN
Kategorie: Hacking & Security

Cybersecurity Research During the Coronavirus Outbreak and After

Kaspersky Securelist - 20 Únor, 2020 - 12:03

Virus outbreaks are always gruesome: people, animals or computer systems get infected within a short time. Of course, viruses spreading across our physical world always take priority over the virtual world. Nevertheless, everyone should keep doing their job, which includes all kinds of malware researchers, digital forensics experts and incident responders. At times like this, we all realize how important it is to be able to work remotely. However, the duties of a security researcher or a digital forensics expert pushes them to travel, visit victims or collect digital evidence in an ongoing hunt for malware artefacts. What can we do to reduce the need for travel? Of course, keep looking for replacement of our physical routines with remote ones.

It is about two and half years since we first open-sourced a tool for remote digital forensics called Bitscout. Born while I was with Digital Forensics Lab at INTERPOL, the tool has evolved and helped us in many cyberinvestigations. Based on the widely popular Ubuntu Linux distribution, it is packed with forensics and malware analysis tools created by a large number of excellent developers around the world.

What can it do? Well, we have tried to identify what it is that it *cannot* do and other expensive commercial tools used in digital forensics can. We have not really been able to find anything! Moreover, we have built so many new interesting techniques that are not available in commercial tools that it has every chance to replace commercial solutions in your organization if it gets into the right hands.

Let me just remind you about the approach we use in Bitscout:

  1. Bitscout is completely FREE, which helps reducing your forensics budget! Yay!
  2. It is designed to be remote, which also saves your time and money spent for travelling. And of course you can use the same techniques locally! To be frank, in light of the powers of all those forensic tools that are part of the toolkit, Bitscout itself is the least important element: the true value is in the knowledge of the underlying tools that you get access to by using Bitscout, not the product they ship with.
  3. Mastering Bitscout follows a steep curve, which, in the end, reinforces your experts’ technical foundations.
  4. Bitscout records remote forensics sessions internally, which makes it perfect for replaying and learning from more experienced users or using as evidential proof of discovery.
  5. It is fully open source, so you need not wait for the vendor to implement a patch or feature for you: you are free to reverse-engineer and modify any part of it.

Today, I am happy to announce that we are releasing a new version of Bitscout, based on the upcoming release of Ubuntu 20.04, scheduled for April 2020.

So, what is new in Bitscout 20.04 other than extended hardware support leveraging new OS and updated forensics tools from Canonical Ltd official repositories?

First of all, we have launched a project website at bitscout-forensics.info.

The website should become the go-to destination for those looking for tips and tricks on remote forensics using Bitscout and whatnot. In reality, Bitscout had been our internal tool for a long time and had been used only by a limited number of highly skilled researchers, who knew exactly how to use it. Yes, like many researchers, we lacked proper documentation and manuals which we will address with our new website. We have already linked several presentation videos and slides with live demos seen by security conferences and meetups. It is true that some of those commands we used in our demos are crazy long one-liners. So, to make it easy for you to copy them and try them out, we have started recording terminal sessions in ASCII video casts. Kudos to the awesome folks at asciinema.org! This way, should you want to try some of our black magic recipes, you can copy and paste them from a browser or a terminal into your own session.

Second, to address a popular request, we have released demo versions of three flavors of pre-built Bitscout images: minimal, balanced and full. This way, newcomers can easily try Bitscout without going through the whole build process. The download URLs for the ISO image files are available on the project website. However, please note they must not be used in a production environment.

Third, our little community of contributors keeps growing. I am happy to highlight some of the features contributed by others. Kudos to Xavier Mertens aka @xme!

  1. The following new tools from the security community are now part of Bitscout (full build) by default:
    • RegRipper,
    • Bulk Extractor,
    • Loki.

    It is great to have modern scanners such as Loki with an updated rich collection of Yara rules that comes with it.

  2. Optional logging of bash commands to a remote syslog server. This is particularly useful for environments where a Bitscout instance may be unexpectedly powered off or disconnected for a long time due to a network failure. It is also a great way to remember which commands you have run to find the clues.

And, if it feels hard for you to start using Bitscout, then join our training session on April 5-6 in the beautiful city of Barcelona, Spain. We will be demonstrating how to build your own Bitscout and customize it with your own tools, and of course walking you through the standard forensics procedure. Some of our advanced tasks include hypervisor debugging to overcome just about any type of proprietary full disk encryption. Our exercises will focus on the most popular platforms, covering Windows, Linux and macOS forensics challenges, along with some real malware. Stay safe and we hope to see some of you in Barcelona! Join us there!

Tým z MIT představil novou strategii obrany proti potenciálně nebezpečným asteroidům

Zive.cz - bezpečnost - 20 Únor, 2020 - 11:55
Tým z MIT přišel s novou obrannou strategií proti potenciálně nebezpečným asteroidům. Ta vychází z myšlenky, že potřebné kroky by bylo dobré podniknout v dostatečném časovém předstihu – nikoliv až na poslední chvíli. „Pokud se k nám bude přibližovat asteroid, kosmické agentury by ho mohly ...
Kategorie: Hacking & Security

Adobe Patches Critical Bugs Affecting Media Encoder and After Effects

The Hacker News - 20 Únor, 2020 - 11:09
Adobe today released out-of-band software updates for After Effects and Media Encoder applications that patch a total of two new critical vulnerabilities. Both critical vulnerabilities exist due to out-of-bounds write memory corruption issues and can be exploited to execute arbitrary code on targeted systems by tricking victims into opening a specially crafted file using the affected software.
Kategorie: Hacking & Security

Ring makes 2FA mandatory to keep hackers out of your doorbell account

Sophos Naked Security - 20 Únor, 2020 - 11:03
Amazon is following Google's lead by forcing all users to use two-factor authentication when logging into their Ring accounts.

US Govt Warns Critical Industries After Ransomware Hits Gas Pipeline Facility

The Hacker News - 20 Únor, 2020 - 10:58
The U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) earlier today issued a warning to all industries operating critical infrastructures about a new ransomware threat that if left unaddressed could have severe consequences. The advisory comes in response to a cyberattack targeting an unnamed natural gas compression facility that employed
Kategorie: Hacking & Security

U.S. Pipeline Disrupted by Ransomware Attack

Threatpost - 19 Únor, 2020 - 23:17
The attack took a gas compression facility offline for two days, disrupting the supply chain.
Kategorie: Hacking & Security
Syndikovat obsah