Leaderboard

Eu am avut probleme cu enel, care imi "pierduse" niste documente cu caracter personal (copie ci, copie contract casa samd). Desi le dadusem unui agent enel, cand ii tot sunam sa clarific ma puneau sa retrimit. De fiecare data imi comunica robotul ca telefonul este inregistrat. Dupa ce 7 operatori s-au facut ca ploua, am facut plangere la autoritatea care se ocupa cu datele cu caracter personal, le-am dat ora si minutul apelului. In 2 zile m-a sunat enel, cerandu-si scuze ca au ratacit actele si mi-au mai spus ca nu au salvat inregistrarile apelurilor, sac. Din ce stiu, pentru a inregistra apeluri trebuie sa fii operator de date cu caracter personal. 1.trebuie sa fii defapt de acord ca ei sa stocheze inregistrarea telefonica. 2.iti cer ceva care nu e atat de periculos de scurs ca cnpul. Cum ar fi data nasterii sau mail sau adresa. O alta problema mai veche e ca banca (raiff...) vindea datele catre firme de asigurari si m-am trezit sunat de defuncta alico sa imi prezinte o asigurare de viata/sanatate/accident fara sa fiu informat de banca in prealabil ca vor impartasi datele mele personale cu terti. (Aceasta intamplare a fost cu ceva timp inainte de gdpr).

Am fost sunat de catre cineva de la compania de telecomunicatii si am patit acest lucru, dar asta se intampla de fiecare data, indiferent ca e vorba de un serviciu, o banca si mai stiu eu ce. Mi se par doua lucruri idioate: 1. Ma pune sa fiu de acord ca apelul sa fie inregistrat cand eu sunt cel apelat 2. Imi cere o data personala (sigur, nu CNP, lucruri mai marunte gen data nasterii) dar nu mi se pare normal sa le dau unei persoane la intamplare care ma suna Eu de obicei ii intreb si pe ei daca sunt de acord ca apelul sa fie inregistrat (desi nu fac asta) si sa imi confirme ca sunt de la serviciul respectiv si ca au anumite date despre mine. Uneori a mers. Problema e urmatoarea: majoritatea inchid (si se mai si supara pe mine ) si e posibil sa nu aflu lucruri utile. Am patit asta la banca, dar am avut noroc ca am primit si SMS. Voi ce parere aveti despre asta? Sunt prea paranoic? Voi ce faceti? Cum e din punct de vedere legal? Pe de-o parte inteleg ca imi protejeaza datele personale, pe de alta parte nu prea.

La noi in corporatie e cu NPA user si cand ai un task pe productie primesti o parola temporara (gen cateva ore) cu acord de la 2 superiori si strict pe resursa de care ai nevoie. Se stie in permanenta cine, unde si de ce s-a logat pe productie.

Si-a pus leo ca e zodia leu 😄😄😄😄 Si cyber ca e in saibar speis. Cred.

Nu s-a spart nici un cont, cel mai probabil au facut auth bypass. Era un post interesant pe linkedin care zicea diferenta dintre a raporta un bug printr-un program bug bounty si a profita in acest fel. Diferenta era undeva la cateva sute de mii de euro. (pe oauth bypass twitter da 7700 dolari, ceea ce si mie sincer mi se pare extrem de putin) Anyway, ma bucur ca au muscat-o, poate poate vor lua securitatea mai in serios (nu doar twitter).

pwncat pwncat is a raw bind and reverse shell handler. It streamlines common red team operations and all staging code is from your own attacker machine, not the target. After receiving a connection, pwncat will setup some common configurations when working with remote shells. Unset the HISTFILE environment variable to disable command history Normalize shell prompt Locate useful binaries (using which) Attempt to spawn a pseudoterminal (pty) for a full interactive session pwncat knows how to spawn pty's with a few different methods and will cross-reference the methods with the executables previously enumerated. After spawning a pty, it will setup the controlling terminal in raw mode, so you can interact in a similar fashion to ssh. pwncat will also synchronize the remote pty settings (such as rows, columns, TERM environment variable) with your local settings to ensure the shell behaves correctly. Features and Functionality pwncat provides two main features. At it's core, it's goal is to automatically setup a remote PseudoTerminal (pty) which allows interaction with the remote host much like a full SSH session. When operating in a pty, you can use common features of your remote shell such as history, line editing, and graphical terminal applications. The other half of pwncat is a framework which utilizes your remote shell to perform automated enumeration, persistence and privilege escalation tasks. The local pwncat prompt provides a number of useful features for standard penetration tests including: File upload and download Automated privilege escalation enumeration Automated privilege escalation execution Automated persistence installation/removal Automated tracking of modified/created files pwncat also offers the ability to revert these remote "tampers" automatically The underlying framework for interacting with the remote host aims to abstract away the underlying shell and connection method as much as possible, allowing commands and plugins to interact seamlessly with the remote host. You can learn more about interacting with pwncat and about the underlying framework in the documentation. If you have an idea for a new privilege escalation method or persistence method, please take a look at the API documentation specifically. Pull requests are welcome! Github Introducing Pwncat

Adica angajatii puteau sa faca ce voiau in mediu de PRD? Ahahahahahahahahaha. Zici ca e reclama la FNI.

Man of culture as well

Hackers Convinced Twitter Employee to Help Them Hijack Accounts After a wave of account takeovers, screenshots of an internal Twitter user administration tool are being shared in the hacking underground. By Joseph Cox July 16, 2020, 2:14a IMAGE: CHRIS RATCLIFFE/BLOOMBERG VIA GETTY IMAGES A Twitter insider was responsible for a wave of high profile account takeovers on Wednesday, according to leaked screenshots obtained by Motherboard and two sources who took over accounts. On Wednesday, a spike of high profile accounts including those of Joe Biden, Elon Musk, Bill Gates, Barack Obama, Uber, and Apple tweeted cryptocurrency scams in an apparent hack. "We used a rep that literally done all the work for us," one of the sources told Motherboard. The second source added they paid the Twitter insider. Motherboard granted the sources anonymity to speak candidly about a security incident. A Twitter spokesperson told Motherboard that the company is still investigating whether the employee hijacked the accounts themselves or gave hackers access to the tool. The accounts were taken over using an internal tool at Twitter, according to the sources, as well as screenshots of the tool obtained by Motherboard. One of the screenshots shows the panel and the account of Binance; Binance is one of the accounts that hackers took over today. According to screenshots seen by Motherboard, at least some of the accounts appear to have been compromised by changing the email address associated with them using the tool. In all, four sources close to or inside the underground hacking community provided Motherboard with screenshots of the user tool. Two sources said the Twitter panel was also used to change ownership of some so-called OG accounts—accounts that have a handle consisting of only one or two characters—as well as facilitating the tweeting of the cryptocurrency scams from the high profile accounts. Twitter has been deleting some screenshots of the panel and has suspended users who have tweeted them, claiming that the tweets violate its rules. Do you know anything else about these account hijackings, or insider data abuse at other companies? We'd love to hear from you. Using a non-work phone or computer, you can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, OTR chat on jfcox@jabber.ccc.de, or email joseph.cox@vice.com. The panel is a stark example of the issue of insider data access at tech companies. Whereas in other cases hackers have bribed workers to leverage tools over individual users, in this case the access has led to takeovers of some of the biggest accounts on the social media platform and tweeted bitcoin related scams in an effort to generate income. The screenshots show details about the target user's account, such as whether it has been suspended, is permanently suspended, or has protected status. One of the screenshots is a Twitter user posting images of the panel themselves. At the time of writing that account has been suspended. ONE OF THE SCREENSHOTS OF THE PANEL. ADDITIONAL REDACTIONS BY MOTHERBOARD. Data breach monitoring and prevention service Under The Breach obtained a similar screenshot and tweeted it as the worker hijacked several accounts. The person in control of the Under The Breach account told Motherboard Twitter then removed the tweet with the screenshot and suspended them for 12 hours. A message replacing the tweet now says it violated the Twitter rules. A SCREENSHOT SHOWING THE PANEL'S ACCESS TO BINANCE, ONE OF THE HACKED ACCOUNTS. IMAGE: MOTHERBOARD. A Twitter spokesperson told Motherboard in an email that, "As per our rules, we're taking action on any private, personal information shared in Tweets." After the publication of this piece, Twitter said in a tweet that "We detected what we believe to be a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools." Other hijacked accounts include Mike Bloomberg, and cryptocurrency platforms Coinbase and Gemini. The accounts falsely announced they had partnered up with an organization called CryptoForHealth which claims it was going to provide people with bitcoin as long as they sent some to an address first. Shortly after the spike of takeovers, Twitter itself tweeted that users may be unable to reset their passwords or tweet while the company addresses the issue. Within an hour of the breach, Republican Sen. Josh Hawley wrote a letter to Twitter CEO Jack Dorsey asking for more information about the hack, including how the hack occurred, how many users were compromised, and whether the hack affected President Trump's account. Hawley said "please reach out immediately to the Department of Justice and the Federal Bureau of Investigation and take any necessary measures to secure the site before this breach expands." In 2017, a Twitter worker briefly deleted President Donald Trump's account before it was quickly reinstated. Two former Twitter employees previously abused their access to spy on users for the Saudi regime, according to the Justice Department. All tech companies face the issue of malicious insiders. Motherboard has previously revealed how Facebook employees used their privilege access to user data to stalk women; how Snapchat workers had a tool called Snaplion that provides information on users; and how MySpace employees abused a tool called "Overlord" to spy on users during the site's hayday. Update: This piece has been updated to include a response from Twitter and more information from a SIM swapping source. Sursa: https://www.vice.com/en_us/article/jgxd3d/twitter-insider-access-panel-account-hacks-biden-uber-bezos