Leaderboard

Salut a todos, Am un proiect pe partea de CyberSecurity, la care lucrez de ceva timp impreuna cu un fost coleg de munca si pe care as vrea sa vi-l prezit si voua cu speranta in a veni si a-l testa. Am fost si la Defcamp unde am avut un stand (multumim @Andrei cu aceasta ocazie) si am rulat un program de BugBounty (care inca e valid - cine gaseste un bug valid il raporteaza si in functie de severitate vom premia cu vouchere Emag) Pe scurt, este vorba de https://razdon.com , un website care va ofera posibilitatea de a "onboardui" si a veda traficul vostru LIVE cu un extra context de securitate la fiecare request. Aceasta parte de live este prezentata sub forma unui dashboard unde poti vedea harta lumii si toate request-urile venind spre locatia serverului tau. Aveti un screenshot atasat mai jos: Dupa cum vedeti proiectul a fost dezvoltat pe RST si aici puteti vedea un window de aproximativ 8 ore cu toate statisticiile legate de RST in aceste 8 ore + traficul live, bineinteles. Pe langa partea de dashboard live, care necesita interactiune minima (practic este doar selectia site-ului in scop - in cazul in care aveti mai multe), avem si partea de analiza de trafic. In partea de analiza de trafic ai optiunea de a cauta in toate request-urile pe o anumita perioada de timp dupa ceva anume (ex. toate requesturile cu status code 4XX or 3XX). In partea de analiza este prezenta si un scurt istoric al atacurilor recente (cu tot cu tipul lor) Puteti vedea o bucata din acesta pagina mai jos: Un alt meniu destul de interesat este cel cu partea de certificate SSL, unde va puteti verifica data de expirare a certificatului (iar pe viitor vom implementa si sistem de alerte - atat la certificate cat si la atacuri). Un screenshot cu partea de certificate mai jos: Putem implementa si partea de WAF, dar momentan avem 0 focus in aceasta directie. Foarte curand vom face release si la un beta pe partea de artificial intelligence / machine learning, cu ajutorul carora vom maximiza eficienta detectarii atacurilor. Acestea fiind spuse, daca cineva este interesat de un asemenea produs, inregistrariile sunt deschise si puteti urma pasii necesari pentru a viziona traficul. Pentru a evita intrebariile de tipul cum faceti asta, va informez de pe acum ca singurul lucru care e necesar pentru aceste actiun sunt logurile de apache, respectiv nginx cu traficul website-ului. Momentan preluam aceste loguri cu un binar scris in GO (pentru eficienta) dar voi pune si varianta (raw) cea de a trimite catre API-ul nostru log-urile fara a rula un binar (safety reasons). O mica schema pentru a intelege mai bine cum sta treaba aveti jos. Mersi si o seara faina! P.S. In caz ca vrea sa ne cumpere careva cu vreo 2-3 mil de euro sa-mi dea un MP, dupaia e mai scump.

Momentan nu am definit retention period pe data. Cel mai probabil 1-3 luni maximum. Dupa 3 luni logurile de securitate nu mai devin relevante. Cu toate astea cu siguranta vor exista clienti care vor cere un retention period de 1-2 ani pentru audit de securitate (cel mai probabil ca un backup la solutia lor). Cat de curant vor exista rapoarte definite pe anumite intervale de timp si anumite scopuri (gen management). Da, bruteforce este suportat. Abuse se refera la un CTI community driven si anume abuseipdb.com Ai dreptate, momental il poti doar crea via register si adauga in organizatia ta. Vom face acel Send Invitation sa functioneze (momentan nu trimite nici un email). E o idee foarte buna pentru organizatiile care au 1-2 site-uri dar daca ai 50 nu prea mai are sens. Vom avea o chestie numita favourite host/site si by default vom afisa chestiile specifice acelui site. Mersi de sugestie, ne vom gandi cum putem sa facem sa se vada mai facil partea aceasta de site-uri (inafara de a da click pe Hosts). Legat de cloud, cel mai important e modul in care aplicatia ta web ruleaza. Noi in spate avem un API si putem sa acceptam inputul de la orice metoda de a capta datele si a le trimite catre un API. Cu siguranta vom avea integrare directa cu cloud-urile mari prin chestiile lor native. Avem partea de Message Queue si scalam prin K8s.

Customers of US bank Silvergate, which provides cryptocurrency services, have withdrawn over $8bn (£6.7bn) of their crypto-linked deposits. Around two-thirds of the bank's customers pulled their deposits in the final three months of 2022. The bank has sold $5.2bn in assets to cover the cost and remain liquid. It came as three US regulators warned banks that issuing or holding crypto was "highly likely to be inconsistent with safe and sound banking practices". Silvergate is a bank listed on the New York Stock Exchange, and is therefore regulated within the financial sector. It is one of a small handful of businesses within this sector that provides cryptocurrency services. The withdrawals followed the collapse of the FTX crypto exchange, which was once valued at $32bn before its bankruptcy filing in November. Former FTX boss Sam Bankman-Fried has pleaded not guilty to charges that he defrauded customers and investors. Prosecutors say as many as one million creditors may have lost their money. The case has shaken the entire crypto industry, sparking bankruptcy filings at other firms and declines in crypto values. Alan Lane, chief executive of Silvergate, said the bank was selling assets to cover the withdrawals by customers "in response to the rapid changes in the digital asset industry". Silvergate is the latest victim of the chilling "crypto winter" that's been whipping through the industry since last spring. The so-called crypto bank occupied a fairly unique position in the market acting as a bank for cryptocurrency companies which struggled to get banking services from traditional sources. One of its customers was the now bankrupt Alameda Research - owned by Sam Bankman-Fried who awaits trial in the US accused of fraud. That in itself is a blow for Silvergate but Bankman-Fried's downfall has delivered a bigger blow to the company - market confidence. Since Bankman-Fried's empire collapsed, investors large and small have been pulling their money out of crypto companies with billions transferred from companies that store crypto funds. So far the biggest companies in the space like Binance and Coinbase have survived the unprecedented withdrawals and it appears as though Silvergate is weathering the storm too for now but at a huge cost to its balance sheet. Silvergate was a small US bank before it entered the world of cryptocurrency, and went public in November 2019. At the market's peak in 2021, its shares had grown by more than 1,500%, in no small part due to the massive growth of crypto in this period. During this time it tried to launch its own stablecoin - a form of cryptocurrency which is directly tied to an asset such as gold, the US dollar or other cryptocurrencies. And in January 2022, Silvergate spent $182m to acquire the technology behind Meta's proposed Diem (formerly Libra) stablecoin that never saw the light of day. In a filing to the US Securities and Exchange Commission, the bank said it had sold debt to cover the withdrawals and had written off the Diem purchase, meaning it is no longer counted as an asset. It has also reduced its staff by 40% - around 200 people - and altogether the withdrawals have caused the bank to lose $718m, a total higher than its profit since 2013. Via bbc.com

Pentru protv cateva exemple ar fi: yoda.ro foodstory.ro procinema.ro incont.ro protv.ro acasatv.ro pro2.ro doctordebine.ro acasagold.ro crimetime.ro internetprotv.ro fiicurios.ro depici.ro proxtv.ro ilike-it.ro supravietuitorul.ro debarbati.ro perfecte.ro progoldtv.ro Multe din ele nu sunt prezentate pe site-ul oficial / parteneri, alea sunt cele mai triviale de gasit.