slightingslot

security

# Update your stuff!
The most important factor to not get hacked is to update. You might say "windows updater sucks", or "I don't like waiting" but you most definitely don't want to get hacked. What is more troubling is that 3rd party smartphone vendors (xiaomi, samsung etc.) have to modify the security updates that come from google to make it run on their version of the OS, thus creating a delay. Please, take a minute to skim through the latest (March 2024) [monthly android security bulletin](https://source.android.com/docs/security/bulletin/2024-03-01). There are 3 critical vulnerabilities and a bunch of high severity. If you don't update in a timely manner you *will* eventually get hacked.

# Hacking events
I don't know who needs to hear this but people are gathering in events to demonstrate their new 0-days and get paid for it. This month was the Pwn2Own Vancouver. Hackers demoed [29 0-days](https://www.bleepingcomputer.com/news/security/hackers-earn-1-132-500-for-29-zero-days-at-pwn2own-vancouver/). Let me say this more clearly. **These people showed 29 different ways to get full access to *your* devices.** All modern operating systems are affected like windows, macOS, linux, even virtualization software like VirtualBox, VMware and Docker, and even Tesla cars! You cannot escape this unsafe digital world, these vulnerabilities affect you.  For desktop take extra care to update your browsers because they are the frontier of anything you do online. In Pwn2Own Vancouver 2024 there was 4 chrome/edge 0-days, 1 safari and 1 firefox. If you don't update you will get hacked just by by visiting a website. About mobile just read the [2023 Pwn2Own in Toronto](https://www.bleepingcomputer.com/news/security/hackers-earn-over-1-million-for-58-zero-days-at-pwn2own-toronto/):
>The Pwn2Own Toronto 2023 hacking competition has ended with security researchers earning **$1,038,500 for 58 zero-day exploits** (and multiple bug collisions) targeting consumer products between October 24 and October 27.

>The complete list includes mobile phones (i.e., the Apple iPhone 14, Google Pixel 7, Samsung Galaxy S23, and Xiaomi 13 Pro), printers, wireless routers, network-attached storage (NAS) devices, home automation hubs, surveillance systems, smart speakers, and Google's Pixel Watch and Chromecast devices, all in their default configuration and running the latest security updates.

>While no team signed up to hack the Apple iPhone 14 and Google Pixel 7 smartphones, the contestants **hacked a fully patched Samsung Galaxy S23 four times.**

>The security researchers have **successfully demoed exploits targeting 58 zero-days** in devices from multiple vendors, including Xiaomi, Western Digital, Synology, Canon, Lexmark, Sonos, TP-Link, QNAP, Wyze, Lexmark, and HP.

# Conclusion
By now you know. Updating can be a simple but important task. It can be the difference between losing all your files (and money) or continuing zapping on stacker news. But if you have noticed something is that you update your software today just to update it again next week. Protecting yourself from all vulnerabilities is an endless cause. I'll leave some sources below in case you want to look around.

- [Chrome CVEs](https://www.cvedetails.com/product/15031/Google-Chrome.html)
- [Firefox Security Advisories](https://www.mozilla.org/en-US/security/advisories/)
- [Android Security Bulletins](https://source.android.com/docs/security/bulletin/asb-overview)
- [Apple Security Releases](https://support.apple.com/en-us/HT201222)
- [Windows 11 CVEs](https://www.cvedetails.com/product/102217/Microsoft-Windows-11.html)
- [Windows 10 CVEs](https://www.cvedetails.com/product/32238/Microsoft-Windows-10.html)
- [Latest Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

Update your devices or get hacked by 0-days

Have you seen any websites with phishy links lately? Remember to **be reluctant to blindly input your account credentials to websites. Lots of bitcoin is lost this way.**

>A massive malware campaign dubbed Sign1 has compromised over 39,000 WordPress sites in the last six months, using malicious JavaScript injections to redirect users to scam sites.

>The attacks entail injecting rogue JavaScript into legitimate HTML widgets and plugins that allow for arbitrary JavaScript and other code to be inserted, providing attackers with an opportunity to add their malicious code.

>What's more, the malware uses time-based randomization to fetch dynamic URLs that change every 10 minutes to get around blocklists. These domains are registered a few days prior to their use in attacks.

>"One of the most noteworthy things about this code is that it is specifically looking to see if the visitor has come from any major websites such as Google, Facebook, Yahoo, Instagram etc.," security researcher Ben Martin said. "If the referrer does not match to these major sites, then the malware will not execute."

>"Many of the injections are found inside WordPress custom HTML widgets that the attackers add to compromised websites," Martin said. "Quite often, the attackers install a legitimate Simple Custom CSS and JS plugin and inject the malicious code using this plugin."
>
>This approach of not placing any malicious code into server files allows the malware to stay undetected for extended periods of time, Sucuri said.

Massive Sign1 Campaign Infects 39,000+ WordPress Sites with Scam Redirects

>The luxury fashion shopping platform Editorialist has been leaking user data for months.
>
>Editorialist.com, formerly Project YX, is an e-commerce platform for luxury fashion that also features personal styling advice to boost sales.
>
>On September 26th, 2023, the Cybernews research team discovered an exposed cloud storage (namely, an Amazon S3 bucket) that, considering the sensitive data it contained, most likely wasn’t meant to be accessible to the public.
>
>The storage, seemingly left open accidentally via a misconfiguration, belongs to Editorialist.com and contains over 7,000 client invoices with Editorialist.com clients’ names, addresses, and descriptions of shopping items.
>
>It also contains 316 spreadsheets (XLSX/CSV files) under the “credit card sheets” folder and exposes the following information:
>
>-    User ID
>
>-    First and last name
>
>-    Card name and type
>
>-    The last four payment card digits
>
>-    Card expiration date
>
>-    Cardholder’s email
>
>-    And local amount, among other information.

Data leak at Editorialist affects thousands of shoppers

> The hacktivists claimed to have stolen and published 7GB of documents, including thousands of PDF documents, emails, MS Excel and MS Word files, 28 zip archives, and PowerPoint presentations from the Shimon Peres Negev Nuclear Research Center.

Anonymous claims hack on Israeli nuclear facility

*"a technique they discovered that would allow an intruder to open any of millions of hotel rooms worldwide in seconds, with just two taps."*

> Today, Ian Carroll, Lennert Wouters, and a team of other security researchers are revealing a hotel keycard hacking technique they call Unsaflok. The technique is a collection of security vulnerabilities that would allow a hacker to almost instantly open several models of Saflok-brand RFID-based keycard locks sold by the Swiss lock maker Dormakaba. The Saflok systems are installed on 3 million doors worldwide, inside 13,000 properties in 131 countries.
>
> By exploiting weaknesses in both Dormakaba's encryption and the underlying RFID system Dormakaba uses, known as MIFARE Classic, Carroll and Wouters have demonstrated just how easily they can open a Saflok keycard lock. Their technique starts with obtaining any keycard from a target hotel—say, by booking a room there or grabbing a keycard out of a box of used ones—then reading a certain code from that card with a $300 RFID read-write device, and finally writing two keycards of their own. When they merely tap those two cards on a lock, the first rewrites a certain piece of the lock's data, and the second opens it.

I can post more physical (door) penetration testing methods if stackers are interested.

Hackers Found a Way to Open Any of 3 Million Hotel Keycard Locks in Seconds

> The Word document, upon opening, instructs the victim to enter a password provided in the email body and enable editing, followed by double-clicking a printer icon embedded in the doc to view the salary graph.
>
> Doing so opens a ZIP archive file ("Chart20072007.zip") containing one Windows shortcut file, which functions as a PowerShell dropper to retrieve and execute a NetSupport RAT binary from a remote server.
>
> "By using encrypted .docs to deliver the NetSupport RAT via OLE template and template injection, PhantomBlu marks a departure from the conventional TTPs commonly associated with NetSupport RAT deployments," Davidpur said, adding the updated technique "showcases PhantomBlu's innovation in blending sophisticated evasion tactics with social engineering."

New Phishing Attack Uses Clever Microsoft Office Trick to Deploy NetSupport RAT

## Academic researchers describe a new application-layer loop DoS attack affecting Broadcom, Honeywell, Microsoft and MikroTik.

The experts have demonstrated a loop DoS attack where an attacker uses IP spoofing to get two servers to communicate with each other indefinitely over a protocol they both use.

The new CVE identifiers CVE-2024-1309 and CVE-2024-2169 have been assigned to the vulnerabilities involved in the new loop DoS attack.

300,000 Systems Vulnerable to New Loop DoS Attack

Personal_Finance

# Don't store your gold or priced possessions in safe deposit boxes even if they say they are "trusted"

Same goes for hardware keys, cold wallets, paper wallets, seed passphrases, anything valuable. They can be seized for "criminal search" at any time and in bulk.

- In January 2024 a [story](https://theintercept.com/2024/01/24/fbi-raid-fourth-amendment/) broke (highlighted the interesting parts):
> The FBI overstepped its constitutional authority when **agents searched hundreds of safe deposit boxes without warrants** in 2021, a federal appeals court ruled. The court compared the FBI’s tactics to the kind of indiscriminate searches that led to the enactment of the Bill of Rights in the first place.
>
> In March 2021, the FBI raided U.S. Private Vaults, a safe deposit box company in Beverly Hills, California. The company marketed its services around client anonymity and privacy, which appealed to gambling rings and drug operations, but also customers who were unable to get a deposit box at their bank or simply mistrusted banks and preferred to store their valuables elsewhere.
>
> **The FBI seized millions of dollars in cash from the deposit boxes, plus a mix of jewelry, personal effects, and documents such as wills and prenuptial agreements.**

> The 9th U.S. Circuit Court of Appeals unanimously reversed the lower court’s decision on Tuesday. **The court ruled that the FBI exceeded the bounds of a warrant obtained prior to the raid, which explicitly did not authorize any “criminal search or seizure” of the boxes’ actual contents.**
>
> The FBI’s warrant application omitted key details of the raid plan, including that **the special agent in charge had directed agents to open every box, preserve fingerprint evidence, inventory the contents**, and have drug dogs sniff all cash.

***[...] one of the three judges [...] called the FBI’s search of each safe deposit box without probable cause “egregious” and “outrageous.”***

***The court found it “particularly troubling” that the government “failed to explain” why [...]***

- In March 2024 the story [continued](https://theintercept.com/2024/03/16/safe-deposit-boxes-fbi-warrantless-raid-fourth-amendment/):
>Two lawsuits will move forward against the federal government over the FBI’s warrantless search of hundreds of safe deposit boxes, a court ruled this week. Last year, in a related case, a federal appellate judge called the FBI’s raid “egregious” and “outrageous.”

> Some of the former U.S. Private Vaults **customers say their property was never returned**, giving rise to some of the claims in the lawsuits.

> In one suit, Jeni Pearsons and Michael Storc, a married couple, claim **the FBI seized $2,000 in cash and $20,000 worth of silver during the raid, but the cash was never returned**. In another suit, Donald Mellein, a retiree, alleges **the FBI seized 110 gold coins but never returned 63 of them that, combined, were worth more than $100,000.**

> “The first case shows **the government never should have opened the safe deposit boxes to begin with**,” Gay [the plaintiffs’ attorney] said. “This case shows that, once they did, they had an obligation to keep the property safe.”

This is just one example of how the govt "overstepped" and conducted bulk searches without proper warrants. There are also stories of improper/warrantless seizures of house possessions as well.

This makes me think, where could you safely store your money? I think the best option is to put a good amount of money in a digital cold wallet and memorize the seed phrase (optionally destroy the wallet and only temporarily restore it in tails.) Even if the feds got all your computers or your house caught fire you would still have your money in your mind. What do you think?

Safe deposit boxes cannot be trusted! FBI stole millions in raid

The #1 crime which results in the biggest financial loss is BEC fraud. The #2 crime is pig butchering. Ronnie Tokazowski walks us through this wild world.

This is what happens when scammers take it to the extreme. Wild.

Darknet Diaries – The Pig Butcher: #2 biggest financial loss

food

Paying some food and coffee with USDT in venezuela

Malos10_

That's cool but did you find any that accept bitcoin (or lightning)?

Infosys ransomware attack: A wake-up call for the IT services sector

ch0k1

> specializing in retirement and investment management services.

I read an article about a man who lost his retirement money and committed suicide. It's wild

How to verify a data breach | TechCrunch

Real or not, it is always a good time to change your passwords.
Use a password manager like Bitwarden and stay safe.

Photography

10 amazing images of galaxies captured by NASA

The Social Media Share Buttons plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.0 via deserialization of untrusted input through the attachmentUrl parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

CVE-2024-1685 with score 8.8

It was disclosed in March 15, 2024 but it is still unpatched as of March 17, 2024, making it a 2-day vulnerability.