CypherCosmo / CypherCosmo is on Nostr

Last Notes

2025-01-07 11:44:29 UTC

Build your own 'AirTags' 🏷 today!
https://github.com/seemoo-lab/openhaystack
> OpenHaystack is a framework for tracking personal Bluetooth devices via Apple's massive Find My network. Use it to create your own tracking tags that you can append to physical objects (keyrings, backpacks, ...) or integrate it into other Bluetooth-capable devices such as notebooks.
originally posted at https://stacker.news/items/840441

2025-01-04 14:47:27 UTC

Over 3 million mail servers without encryption exposed to sniffing attacks
https://www.bleepingcomputer.com/news/security/over-3-million-mail-servers-without-encryption-exposed-to-sniffing-attacks
# Over 3 Million Mail Servers Exposed to Critical Security Risks Due to Lack of Encryption
## Widespread Security Vulnerability
More than **3.3 million mail servers** using **POP3** and **IMAP** protocols are currently vulnerable to **network sniffing attacks** due to the absence of **TLS encryption**. This critical oversight exposes sensitive user data, including login credentials, to potential interception.
## How POP3 and IMAP Work
- **IMAP (Internet Message Access Protocol)**: Designed for accessing emails from multiple devices, IMAP keeps messages stored on the server and synchronizes them across devices.
- **POP3 (Post Office Protocol version 3)**: Downloads emails to a single device and removes them from the server, limiting accessibility to the original device.
Despite their widespread use, many mail servers leave these services running **unencrypted**, transmitting sensitive data in **plain text**, making it susceptible to eavesdropping and credential theft.
## Why TLS Encryption Matters
**Transport Layer Security (TLS)** is a cryptographic protocol designed to secure communications over the internet by encrypting data in transit. When **TLS encryption** is not enabled:
- **Usernames and passwords** are transmitted in **plain text**, easily intercepted by attackers.
- Servers become vulnerable to **password-guessing attacks**, further compromising security.
The **Shadowserver Foundation**, a cybersecurity monitoring platform, recently identified and reported these vulnerabilities, urging server operators to enable encryption and disable unnecessary services.
## Recommended Actions to Secure Mail Servers
To mitigate these risks, mail server operators should:
- **Enable TLS encryption** for both IMAP and POP3 services.
- **Deactivate unused services** or move them behind a **VPN** to limit exposure.
- Implement **up-to-date TLS configurations** to prevent attacks relying on outdated security standards.
## The Evolution of TLS and Industry Action
The **TLS protocol** has evolved significantly over the years:
- **TLS 1.0 (1999)** and **TLS 1.1 (2006)** have become obsolete.
- **TLS 1.3 (2018)** offers significant improvements in security and efficiency.
In **2020**, major tech companies, including **Microsoft, Google, Apple, and Mozilla**, phased out support for **TLS 1.0 and 1.1** due to their vulnerabilities.
The **NSA** also issued guidance in **2021**, warning against outdated TLS configurations, citing the risk of:
- **Passive decryption** of sensitive data.
- **Man-in-the-middle (MITM)** attacks that can modify traffic.
## Conclusion
The presence of millions of unencrypted mail servers underscores a significant **cybersecurity gap** that requires immediate attention. Enabling **TLS encryption** and following modern security standards is essential to safeguard sensitive user data, prevent unauthorized access, and maintain trust in email communication systems.
originally posted at https://stacker.news/items/836520

2025-01-04 14:05:26 UTC

The biggest cybersecurity and cyberattack stories of 2024
https://www.bleepingcomputer.com/news/security/the-biggest-cybersecurity-and-cyberattack-stories-of-2024
# 2024 Cybersecurity Incidents Summary
## Notable Data Breaches
* **Internet Archive**: 33M users affected through exposed GitLab credentials that allowed access to source code and user database
* **Microsoft**: Corporate emails breached by Russian state actors (Midnight Blizzard/APT29), leading to subsequent source code theft and federal agency exposure
* **National Public Data**: 2.7B records leaked, including SSNs and addresses, initially offered for $3.5M before being leaked for free
* **AT&T**: 109M customer call logs exposed via compromised Snowflake account credentials
## Major System Disruptions
* **CrowdStrike Update Incident**
* Faulty kernel driver update crashed 8.5M Windows devices
* Led to widespread organizational disruptions affecting financial firms, airlines, and hospitals
* Criminals exploited recovery efforts with fake repair tools distributing malware
* **Change Healthcare Ransomware Attack**
* BlackCat/ALPHV gang demanded $22M ransom
* Severely disrupted US healthcare operations, affecting prescriptions and claims
* Exploited Citrix service lacking MFA, resulting in 6TB of stolen data
## Regulatory Actions
* **Kaspersky Ban**
* Forced to cease US operations by September 2024
* Customer base sold to Point Wild
* Automatic migration to UltraAV software, causing customer backlash
## Emerging Threats
* **Edge Device Attacks**: Widespread compromises of Fortinet, TP-Link, Ivanti, and Cisco networking devices
* **North Korean IT Workers**: Systematic infiltration of US companies for espionage and revenue generation
* **SnowFlake Campaign**: Major data theft operation targeting companies through compromised credentials, affecting Ticketmaster, AT&T, and others
*Note: This summary covers major incidents through October 2024*
originally posted at https://stacker.news/items/836454

2025-01-04 11:50:12 UTC

Customer data from 800,000 electric cars and owners exposed online
https://www.bleepingcomputer.com/news/security/customer-data-from-800-000-electric-cars-and-owners-exposed-online
originally posted at https://stacker.news/items/836301

2024-12-26 12:40:13 UTC

⛏️ A collection of resources to make your BitAxe Gamma even more awesome
https://github.com/cyphercosmo/awesome-bitaxe-gamma
I recently got my BitAxe Gamma 🔥⛏️ and started searching for resources, so I checked and didn't find many of these resources indexed.
Hence, welcome to [awesome-bitaxe-gamma](https://github.com/cyphercosmo/awesome-bitaxe-gamma) ✨
Feel free to contribute or request something added.
originally posted at https://stacker.news/items/824688

2024-12-23 10:33:03 UTC

Bitcoin and Lightning Protocol Development Education - Due on 12/31
https://learning.chaincode.com/#BOSS
originally posted at https://stacker.news/items/821304

2024-12-22 22:56:50 UTC

Some laid back #AI #art to finish Sunday with some sci-fi / daft punk vibes with my freedom frens 💕
https://image.nostr.build/0c31e85a4d6f275953a21cfcd0f32ccd32833bcf9bd321404e05e7e5592862f5.jpg
https://image.nostr.build/98e56df820509329508e3d13bdddbed180e79c2ffc71de5a930183845603aa28.jpg

2024-12-21 18:17:00 UTC

They are not prepared for us #nostr #bitcoin #freedomtech
https://image.nostr.build/6476b57473cd52e631e5a15118d8ae2cb60f07b361577ff7bd48e7e96dd8d56d.gif

2024-12-11 14:40:51 UTC

Hey #nostr 👋 I'm a software engineer and I want to build freedom tech. So if you know some #Bitcoin, #Lightning, Nostr, or some other initiative that could help me learn more while contributing to the community, I'm open! #introductions