We Are Motherboard's Infosec Reporters: Let's Talk Journalism and "Cyber." Ask Us Anything!
We are Lorenzo Franceschi-Bicchierai and Joseph Cox. We cover infosec and hacking for Motherboard, VICE Media's tech and science website. Over the years, we have written about government hacking, consumer spyware, surveillance technology, cybercrime, and a loooooot of data breaches.Recently, we've been digging into SIM swapping scams, the iPhone zero-day market, the mysterious group doxing Chinese government hackers, and Facebook's impossible problem: content moderation.Today we will stand on the other side and take questions about how we pick stories, how we report articles, how we verify hacked or leaked data, and anything in between.Proof: https://i.redd.it/ojzd8pgcivi11.jpg
Submitted August 29, 2018 at 08:33PM by motherboard
via reddit https://ift.tt/2omeJrI
We are Lorenzo Franceschi-Bicchierai and Joseph Cox. We cover infosec and hacking for Motherboard, VICE Media's tech and science website. Over the years, we have written about government hacking, consumer spyware, surveillance technology, cybercrime, and a loooooot of data breaches.Recently, we've been digging into SIM swapping scams, the iPhone zero-day market, the mysterious group doxing Chinese government hackers, and Facebook's impossible problem: content moderation.Today we will stand on the other side and take questions about how we pick stories, how we report articles, how we verify hacked or leaked data, and anything in between.Proof: https://i.redd.it/ojzd8pgcivi11.jpg
Submitted August 29, 2018 at 08:33PM by motherboard
via reddit https://ift.tt/2omeJrI
Twitter
Lorenzo Franceschi-Bicchierai (he/him) (@lorenzofb) | Twitter
The latest Tweets from Lorenzo Franceschi-Bicchierai (he/him) (@lorenzofb). Real-time historian of the late cyber capitalist era @motherboard. Tweets about infosec, surveillance by day. 🍕, ⚽️, 🎸, 🎮 by night. ☎️ +1 917 257 1382. 🏳️🌈 lorenzofb@vice
BYOB (Build Your Own Botnet)
https://ift.tt/2o2lJKj
Submitted August 29, 2018 at 09:28PM by PoonSafari
via reddit https://ift.tt/2wnLqcI
https://ift.tt/2o2lJKj
Submitted August 29, 2018 at 09:28PM by PoonSafari
via reddit https://ift.tt/2wnLqcI
GitHub
GitHub - malwaredllc/byob: An open-source post-exploitation framework for students, researchers and developers.
An open-source post-exploitation framework for students, researchers and developers. - GitHub - malwaredllc/byob: An open-source post-exploitation framework for students, researchers and developers.
Assume the Worst: Enumerating AWS Roles through ‘AssumeRole’
https://ift.tt/2NxZt5R
Submitted August 30, 2018 at 12:24AM by hackers_and_builders
via reddit https://ift.tt/2LDTavO
https://ift.tt/2NxZt5R
Submitted August 30, 2018 at 12:24AM by hackers_and_builders
via reddit https://ift.tt/2LDTavO
reddit
r/netsec - Assume the Worst: Enumerating AWS Roles through ‘AssumeRole’
1 vote and 0 comments so far on Reddit
Why ‘She Hacks PURPLE’? – SheHacksPurple – Medium
https://ift.tt/2Nw9P6n
Submitted August 30, 2018 at 04:10AM by shehackspurple
via reddit https://ift.tt/2NvTL4E
https://ift.tt/2Nw9P6n
Submitted August 30, 2018 at 04:10AM by shehackspurple
via reddit https://ift.tt/2NvTL4E
Medium
Why ‘She Hacks PURPLE’?
The story of my handle: SheHacksPurple.
Sensitive Data Exposure via WiFi Broadcasts in Android OS [CVE-2018-9489]
https://ift.tt/2PNqKTr
Submitted August 30, 2018 at 05:50AM by nightwatchcyber
via reddit https://ift.tt/2PJE3o5
https://ift.tt/2PNqKTr
Submitted August 30, 2018 at 05:50AM by nightwatchcyber
via reddit https://ift.tt/2PJE3o5
Nightwatch Cybersecurity
Sensitive Data Exposure via WiFi Broadcasts in Android OS [CVE-2018-9489]
Summary System broadcasts by Android OS expose information about the user’s device to all applications running on the device. This includes the WiFi network name, BSSID, local IP addresses, D…
Air Canada says mobile app breach may affect up to 20,000 customers
https://ift.tt/2wtXXeF
Submitted August 30, 2018 at 12:39PM by rsossl
via reddit https://ift.tt/2wxsFTs
https://ift.tt/2wtXXeF
Submitted August 30, 2018 at 12:39PM by rsossl
via reddit https://ift.tt/2wxsFTs
www.ctvnews.ca
Air Canada says mobile app breach may affect up to 20,000 customers
MONTREAL -- Some 20,000 Air Canada customers woke up Wednesday to learn their personal information may have been compromised after a breach in the airline's mobile app that prompted a lockdown on all 1.7 million accounts until their passwords could be changed.
NoDDOS: open-source OpenWRT + Linux system for network device profiling
https://www.noddos.io/
Submitted August 30, 2018 at 03:22PM by unquietwiki
via reddit https://ift.tt/2LEuXpp
https://www.noddos.io/
Submitted August 30, 2018 at 03:22PM by unquietwiki
via reddit https://ift.tt/2LEuXpp
www.noddos.io
No DDoS attacks
Help stop DDOS attacks.
How To Setup an Automated Sub-domain Takeover Scanner for All Bug Bounty Programs in 5 Minutes
https://ift.tt/2o2odIo
Submitted August 30, 2018 at 01:45PM by hakluke
via reddit https://ift.tt/2NzDdsm
https://ift.tt/2o2odIo
Submitted August 30, 2018 at 01:45PM by hakluke
via reddit https://ift.tt/2NzDdsm
Medium
How To Setup an Automated Sub-domain Takeover Scanner for All Bug Bounty Programs in 5 Minutes
Sub-domain takeovers are all the rage in the bug bounty scene at the moment. You’ve probably heard about some bug bounty legends who are…
LAteral Movement Encryption technique (a.k.a. The "LAME" technique)
https://ift.tt/2onCJLd
Submitted August 30, 2018 at 08:22PM by ivoluti0n
via reddit https://ift.tt/2LDU23G
https://ift.tt/2onCJLd
Submitted August 30, 2018 at 08:22PM by ivoluti0n
via reddit https://ift.tt/2LDU23G
.elite_GR
The "LAME" technique
Dotelite_GR introduces a new red teaming lateral movement technique, using trusted SSL Certificates within internal networks. #redteaming #lateralmovement
Firework - Leveraging Microsoft Workspaces in a Penetration Test
https://ift.tt/2PmbnR2
Submitted August 30, 2018 at 08:58PM by greenwolf247
via reddit https://ift.tt/2MCTYGW
https://ift.tt/2PmbnR2
Submitted August 30, 2018 at 08:58PM by greenwolf247
via reddit https://ift.tt/2MCTYGW
Trustwave
Firework: Leveraging Microsoft Workspaces in a Penetration Test
Overview WCX files can be used to configure a Microsoft Workplace on a system with a couple of clicks. The enrollment process could disclose credentials in the form of a NetNTLM hash. Authentication will either take place automatically on older...
Building the security operations center of tomorrow—harnessing the law of data gravity
https://ift.tt/2LFhDBa
Submitted August 30, 2018 at 09:46PM by myinnerbanjo
via reddit https://ift.tt/2PPfHcz
https://ift.tt/2LFhDBa
Submitted August 30, 2018 at 09:46PM by myinnerbanjo
via reddit https://ift.tt/2PPfHcz
Microsoft Security Blog
Building the security operations center of tomorrow—harnessing the law of data gravity | Microsoft Security Blog
How can we build the SOC of tomorrow? By respecting the law of data gravity. If we can perform security analytics close to where the data already is, we can increase the speed of response.
0patch beats Microsoft to patching Windows 10 task scheduler 0-day vulnerability
https://ift.tt/2PkBLum
Submitted August 30, 2018 at 09:27PM by wehavetogobackmorty
via reddit https://ift.tt/2okGBwq
https://ift.tt/2PkBLum
Submitted August 30, 2018 at 09:27PM by wehavetogobackmorty
via reddit https://ift.tt/2okGBwq
BetaNews
0patch beats Microsoft to patching Windows 10 task scheduler 0-day vulnerability
Just 24 hours after a zero-day bug in Windows task scheduler was revealed by @SandboxExplorer on Twitter, the vulnerability has been patched. While Microsoft said it would “proactively update…
Vulnhub - Lampiao walkthrough
https://ift.tt/2PiFdWE
Submitted August 30, 2018 at 10:21PM by nishaanthguna
via reddit https://ift.tt/2NagxlP
https://ift.tt/2PiFdWE
Submitted August 30, 2018 at 10:21PM by nishaanthguna
via reddit https://ift.tt/2NagxlP
GitHub
gameFace22/vulnhub-walkthrough
Contribute to gameFace22/vulnhub-walkthrough development by creating an account on GitHub.
CVE-2018-8284: Bypassing Workflows Protection Mechanisms - Remote Code Execution on SharePoint
https://ift.tt/2LCBcdi
Submitted August 31, 2018 at 12:28AM by digicat
via reddit https://ift.tt/2ooGxvq
https://ift.tt/2LCBcdi
Submitted August 31, 2018 at 12:28AM by digicat
via reddit https://ift.tt/2ooGxvq
reddit
r/netsec - CVE-2018-8284: Bypassing Workflows Protection Mechanisms - Remote Code Execution on SharePoint
2 votes and 0 comments so far on Reddit
So Google starts to support The FIDO U2F 2FA, but only after offering their own branded Dongle. It is made in China Too.
https://ift.tt/2BZWW3l
Submitted August 31, 2018 at 02:38AM by LinearFluid
via reddit https://ift.tt/2MGtCn6
https://ift.tt/2BZWW3l
Submitted August 31, 2018 at 02:38AM by LinearFluid
via reddit https://ift.tt/2MGtCn6
reddit
r/sysadmin - So Google starts to support The FIDO U2F 2FA, but only after offering their own branded Dongle. It is made in China…
3 votes and 0 comments so far on Reddit
Differential Malware Analysis: An Example | NVISO Labs
https://ift.tt/2LIQInL
Submitted August 31, 2018 at 01:59PM by daanraman
via reddit https://ift.tt/2wAndyX
https://ift.tt/2LIQInL
Submitted August 31, 2018 at 01:59PM by daanraman
via reddit https://ift.tt/2wAndyX
NVISO Labs
Differential Malware Analysis: An Example
There are many ways to analyze malware. In this blog post, we illustrate a typical analysis method: comparing an unknown sample with a known sample, to determine if the unknown sample is malicious …
SonarSnoop: Active Acoustic Side-Channel Attacks
https://ift.tt/2Ca3LPA
Submitted August 31, 2018 at 03:09PM by Natanael_L
via reddit https://ift.tt/2NAPFs1
https://ift.tt/2Ca3LPA
Submitted August 31, 2018 at 03:09PM by Natanael_L
via reddit https://ift.tt/2NAPFs1
How We Micropatched a Publicly Dropped 0day in Task Scheduler (CVE-UNKNOWN)
https://ift.tt/2wuffIy
Submitted August 31, 2018 at 07:01PM by 0patch
via reddit https://ift.tt/2PnQFjB
https://ift.tt/2wuffIy
Submitted August 31, 2018 at 07:01PM by 0patch
via reddit https://ift.tt/2PnQFjB
0Patch
How We Micropatched a Publicly Dropped 0day in Task Scheduler (CVE-UNKNOWN)
Being Who You Are Can be a Bad Thing if You're a System Service by Mitja Kolsek, the 0patch Team Earlier this week security researc...
How We Micropatched a Publicly Dropped 0day in Task Scheduler (CVE-UNKNOWN)
https://ift.tt/2wuffIy
Submitted August 31, 2018 at 07:01PM by 0patch
via reddit https://ift.tt/2PnQFjB
https://ift.tt/2wuffIy
Submitted August 31, 2018 at 07:01PM by 0patch
via reddit https://ift.tt/2PnQFjB
0Patch
How We Micropatched a Publicly Dropped 0day in Task Scheduler (CVE-UNKNOWN)
Being Who You Are Can be a Bad Thing if You're a System Service by Mitja Kolsek, the 0patch Team Earlier this week security researc...
JSON Deserialization Memory Corruption Vulnerabilities on Android
https://ift.tt/2NyDonN
Submitted September 01, 2018 at 12:48AM by marketingversprite
via reddit https://ift.tt/2PRQgHg
https://ift.tt/2NyDonN
Submitted September 01, 2018 at 12:48AM by marketingversprite
via reddit https://ift.tt/2PRQgHg
VerSprite | Integrated Security Services and Consulting
JSON Deserialization Memory Corruption Vulnerabilities on Android
VerSprite's cybersecurity research team analyzes JSON Deserialization Memory Corruption Vulnerabilities on Android. Stay tuned for the rest of the series.
Playing With the New Burp Suite REST API
https://ift.tt/2wvXsAR
Submitted September 01, 2018 at 01:15AM by powershelltutorials
via reddit https://ift.tt/2N5YPiZ
https://ift.tt/2wvXsAR
Submitted September 01, 2018 at 01:15AM by powershelltutorials
via reddit https://ift.tt/2N5YPiZ
Pentest Geek
Playing With the New Burp Suite REST API - Pentest Geek
One of the coolest new features released in the recent beta version of Burp Suite is the introduction of a REST API. I blogged about the UI and some other feature enhancements earlier this week. Today I want to talk a little bit about a command-line Ruby…