HAPPENING NOW: @mikalai presents 3NWeb + @privacysafe 😍 Watch @hopeconf #HOPE2025 #hacking #privacy #security https://www.youtube.com/watch?v=zxgoACKKH30
hacking
I think a LOT of people are missing the fact that we got LUCKY with this malicious backdoor.
The backdoor was created by an Insider Threat - by a developer / maintainer of various linux packages. The backdoor was apparently pushed back on March 8th (I believe) and MADE IT PAST all QA checks.
Let me state that again. Any quality assurance, security checks, etc., failed to catch this.
This was so far upstream, it had already gotten into the major Linux distributions. It made it into Debian pre-release, Fedora rolling, OpenSUSE rolling, Kali rolling, etc.
This is an example of Supply Chain Security that CISOs love to talk and freak out about. This is an example of an Insider Threat that is the boogey man of corporate infosec.
A couple more weeks, and it would have been in many major distributions without any of us knowing about it.
The ONLY reason we know about it is because @AndresFreundTec got curious about login issues and some benchmarking checks that had nothing to do with security and ran the issue down and stumbled upon a nasty mess that was trying to remain hidden.
It was luck.
That's it. We got lucky this time.
So this begs the question. Did the malicious insider backdoor anything else? Are they working with anyone else who might have access to other upstream packages? If the QA checks failed to find this specific backdoor by this specific malicious actor, what other intentional backdoors have they missed?
And before anyone goes and blames Linux (as a platform or as a concept), if this had happened (if it HAS happened!!!) in Windows, Apple, iOS, etc.... we would not (or will not) know about it. It was only because all these systems are open source that Andres was able to go back and look through the code himself.
Massive props and kudos and all the thank yours to Andres, those who helped him, to all the Linux teams jumping on this to fix it, and to all the folks on high alert just before this Easter weekend.
I imagine (hope) that once this gets cleaned up, there will be many fruitful discussions around why this passed all checks and what can be changed to prevent it from happening again.
(I also hope they run down any and all packages this person had the signing key for....)
A hacker group has claimed responsibility for a cyberattack that targeted auction house Christie’s earlier this month.
The attack took place just before the start of its high-profile spring sales event involving more than $850 million worth of art. Online bidding was suspended, but the group claims it has accessed sensitive information about wealthy art collectors around the world, and is threatening to release it unless “an agreement” is reached. Digital Trends has more.
#FBI is investigating suspected #hacking attempts by #Iran targeting both a #Trump associate & advisers to the #Biden-#Harris campaign….
3 staffers on the Biden-Harris campaign received spear phishing emails that were designed to appear legitimate but could give an intruder access to the recipients’ comms [but they weren’t dumb enough to fall for it; unlike Trump/Vance apparently].
#HarrisWalz2024 #Intelligence #NationalSecurity
https://www.washingtonpost.com/national-security/2024/08/12/trump-hack-iran-fbi/
Say hello to the hacker hotline--to help you remember the way it was.
(781) OCT-AGON
(781) 628-2466
Call anytime, 24/7/365.
#HackerHotline #Hackers #Hacking #Memes #Phones
@infostorm@a.gup.pe
(781) OCT-AGON
(781) 628-2466
Call anytime, 24/7/365.
#HackerHotline #Hackers #Hacking #Memes #Phones
@infostorm@a.gup.pe
UPDATE!
Shit happens.🙃
We have rescheduled #CryproBarons on the #DCG201 LIVE Stream for Sunday, February 16th at 3pm EST!
We'll be #hacking the #Soneium #blockchain and #web3 ecosystem!
@defcon #fediverse #mastodon #crypto #playstation #stateofplay
SSS 🐂 (The Supreme Sexp System) proudly announces version v3.1.11 of the project.
https://codeberg.org/jjba23/sss
big shoutout to @abcdw who helped improve the dev experience and tests of the project, #hacking on it is now a delight (with #guile #arei #ares on #emacs ).
system is much more modular now, organized, user overrides are easy, and there is a #wip #gruvbox theme support (many more too), added rotating wallpapers
#guix #hyprland #wayland #waybar #gnu #linux #unixporn #scheme #codeberg
Edited 102d ago
Compromised? In this interview, https://www.muellershewrote.com/p/a-fork-in-the-road-is-federal-employee I speak to a systems security specialist who found privacy problems surrounding the HR@opm.gov email servers #IT #security #natsec #nationalsecurity #cybercrime #cybersecurity #hacking #surveillance #malware #email #DOGE #Musk #treasury #OPM #FAA #FEMA #education #privacy #PII
Back on my boring post grind to document my learning.
New #Blog post going through a #TryHackMe challenge. This time detecting two different attack types with snort!
https://ligniform.blog/posts/snort-live-attacks/
💜 🌱
The move from our cozy old hackerspace to the new spot on Limanowskiego Street is still in full swing — and so is our fundraising campaign to cover the costs of the move and renovation.
Even though it’s all being done by dedicated volunteers, the bills keep piling up like a hungry monster.
If you want to support now’s a great time. Every bit helps! 🛠️💸💚
#Hacking & #Hackerspaces picks of the day:
(NOTE: Hacking in sense of learning about tech, not criminal stuff.)
➡️ @2600 - Hackers' magazine founded 1984
➡️ @defcon - Hacker con in Las Vegas
➡️ @OffTheHook - Hacker radio show
➡️ @milliways - Volunteers supplying infrastructure to hacker camps
➡️ @spaceapi - Spec for hackerspace info API
➡️ @rysiek - IT expert, developer, good guy hacker
➡️ @alxd - Programmer, hacker, solarpunk
➡️ @lexknowssystems - Lex from Jurassic Park knows systems
🧵 1/5
🇬🇧 💥 From payload smuggling to stealthy persistence...
This year, hashtag#leHACK 2025 talks are digging deep:
🕵️♂️ Cache me if you can – payloads via browser cache
🎭 The imposter’s guide to Hacking – with live demos
🎯 The Art of Staying In – unconventional backdoors on Windows & Linux
🚀 Explore the full lineup: https://lehack.org/2025/tracks/conferences/
🎟️ Don’t sleep on this : https://www.billetweb.fr/lehack-2025-the-singularity
------------
🇫🇷 💥 Du contournement au maintien d’accès furtif…
Cette année, les talks hashtag#leHACK2025 vont droit au système 😉 :
🕵️♂️ Cache me if you can – des payloads via le cache navigateur
🎭 The imposter’s guide to Hacking – avec démos en live
🎯 The Art of Staying In – backdoors atypiques sur Windows & Linux
🚀 Découvrez le programme complet : https://lehack.org/2025/tracks/conferences/
🎟️ N'oubliez pas vos places : https://www.billetweb.fr/lehack-2025-the-singularity
#Hacking #OffensiveSecurity #leHACK
