Author: HackWatchit

Imagine you’re building your dream home. Just about everything is ready. All that’s left to do is pick out a front door. Since the neighborhood has a low crime rate, you decide you want a door with a standard lock — nothing too fancy, but probably enough to deter 99.9% of would-be burglars. Unfortunately, the local homeowners’ association (HOA) has a rule stating that all front doors in the neighborhood must be bank vault doors. Their reasoning? Bank vault doors are the only doors that have been mathematically proven to be absolutely secure. As far as they’re concerned, any front door below…

Kaspersky’s Securelist exposes the GitVenom campaign involving fake GitHub repositories to distribute malware. Targeting developers with seemingly legitimate open-source projects, GitVenom steals credentials, cryptocurrency, and more. In modern software development, open-source code is crucial as it offers a vast library of projects for developers to avoid redundant work and accelerate project completion. However, this widespread availability has attracted malicious actors, including state-sponsored groups and cybercriminals, who exploit the model to distribute malware. A recent campaign, dubbed GitVenom, targeting GitHub users with deceptive projects exemplifies this trend, as detailed in Kaspersky’s Securelist latest research authored by Georgy Kucherin and Joao Godinho.…

Analyst firm Takepoint Research has released data detailing that Australia’s critical infrastructure is increasingly vulnerable to cyber-physical threats, with significant real-world safety impacts. Insights from over 50 industry leaders and practitioners reveal serious gaps in risk management, including fragmented IT risk management, opaque OT (operational technology) risk management, workforce shortages, supply chain vulnerabilities, and complex infrastructure lifecycles. Despite regulations like the SOCI Act (2018), many organizations remain unprepared.  To build resilience, the whitepaper titled ‘Securing Society: Insights on Cyber-Physical Safety in Australia’s Critical Infrastructure,’ authored by Sam Mackenzie, associate analyst at Takepoint recommends that leaders integrate cyber-physical risks into enterprise…

tl;dr  Implement this ACL using whatever network gear, cloud ACL config, or uncomplicated firewall you use to protect your networks. Our IOT devices are on 10.99.99.0/24 for this example. Also, […] The post The Simplest and Last Internet-Only ACL You’ll Ever Need  appeared first on Black Hills Information Security.

Weak passwords, as various studies have shown, can be cracked in a second, but now AI can crack even stronger ones in the same amount of time. Language models can and will be used to brute force passwords and organize dictionary attacks more often, cybersecurity experts predict. “AI is a breakthrough technology that is beginning to permeate all aspects of life and business, including cybersec. We should be mindful that in 2025, the time it takes to guess, social engineer, or brute force passwords is going to drop dramatically due to AI tools in the hands of cybercriminals”, says Ignas…

​The Have I Been Pwned data breach notification service has added over 284 million accounts stolen by information stealer malware and found on a Telegram channel. HIBP founder Troy Hunt says he found 284,132,969 compromised accounts while analyzing 1.5TB of stealer logs likely collected from numerous sources and shared on a Telegram channel known as “ALIEN TXTBASE.” “They contain 23 billion rows with 493 million unique website and email address pairs, affecting 284M unique email addresses,” Hunt stated in a Tuesday blog. “We’ve also added 244M passwords we’ve never seen before to Pwned Passwords and updated the counts against another 199M that were already…

Authors/Presenters: Yso & Martin Strohmeier Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel. Permalink The post DEF CON 32 – Exploiting Bluetooth: From Your Car To The Bank Account$$ appeared first on Security Boulevard.

Have you ever heard anyone earnestly ask in a business, “Who owns legal?” or “Who sets the financial strategy?” Probably not – it should be obvious, right? Yet, when it comes to cybersecurity, the question of ownership still seems to spark endless debates. That might have been understandable back in the 1990s when key security roles like the CISO were still being ironed out. But these days, it should be a serious red flag. Security has long since ceased to be a niche technical concern – it’s a fundamental business function. That’s why it’s frustrating to still see organizations treating…

LockBit taunts FBI Director Kash Patel with alleged “Classified” leak threat Pierluigi Paganini February 25, 2025 The ransomware gang LockBit sent a strange message to newly appointed FBI Director Kash Patel, they offer alleged “classified information” that could “destroy” this agency if publicly disclosed. The ransomware group published the message on their dark web leak site, specifically referring to the agency’s new director Patel. “Dear Kash Patel! I wish you Happy Birthday! I also congratulate you on your position as the ninth director of the Federal Bureau of investigation and wish you professional success, because it will be not easy…