This massive DDoS attack took large sections of a country's internet offline

More than 200 organisations across Belgium including the government and parliament were affected by a DDoS attack that overwhelmed them with bad traffic.

A massive distributed denial of service (DDoS) attack took down the websites of more than 200 organisations across Belgium, including government, parliament, universities and research institutes.

The DDoS attack started at 11am on Tuesday 4 May and overwhelmed the web sites with traffic, rendering their public-facing sites unusable for visitors, while the attack overwhelmed internal systems, cutting them off from the internet.

The attack targeted Belnet, the government-funded ISP provider for the county's educational institutions, research centres, scientific institutes and government services – including government ministries and the Belgian parliament. Some debates and committee meetings had to be postponed as users couldn't access the virtual services required to take part.

https://www.zdnet.com/article/this-massive-ddos-attack-took-large-sections-of-a-countrys-internet-offline/

#ddos #attack #belgium
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv
📡@NoGoolag

Peloton’s leaky API let anyone grab riders’ private account data

But the company won't say if it has evidence of malicious exploitation

Halfway through my Monday afternoon workout last week, I got a message from a security researcher with a screenshot of my Peloton account data.

My Peloton profile is set to private and my friend’s list is deliberately zero, so nobody can view my profile, age, city, or workout history. But a bug allowed anyone to pull users’ private account data directly from Peloton’s servers, even with their profile set to private.

Peloton, the at-home fitness brand synonymous with its indoor stationary bike and beleaguered treadmills, has more than three million subscribers. Even President Biden is said to own one. The exercise bike alone costs upwards of $1,800, but anyone can sign up for a monthly subscription to join a broad variety of classes.

As Biden was inaugurated (and his Peloton moved to the White House — assuming the Secret Service let him), Jan Masters, a security researcher at Pen Test Partners, found he could make unauthenticated requests to Peloton’s API for user account data without it checking to make sure the person was allowed to request it. (An API allows two things to talk to each other over the internet, like a Peloton bike and the company’s servers storing user data.)

But the exposed API let him — and anyone else on the internet — access a Peloton user’s age, gender, city, weight, workout statistics and, if it was the user’s birthday, details that are hidden when users’ profile pages are set to private.

Masters reported the leaky API to Peloton on January 20 with a 90-day deadline to fix the bug, the standard window time that security researchers give to companies to fix bugs before details are made public.

https://techcrunch.com/2021/05/05/peloton-bug-account-data-leak

#peloton #leak #api #private #account #data #exploitation
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv
📡@NoGoolag

Report on University of Minnesota Breach-of-Trust Incident

On April 20, 2021, in response to the perception that a group of University of Minnesota (UMN) researchers had resumed sending compromised code submissions to the Linux kernel, Greg Kroah-Hartman asked the community to stop accepting patches from UMN and began a re-review of all submissions previously accepted from the University.

This report summarizes the events that led to this point, reviews the "Hypocrite Commits" paper that had been submitted for publication, and reviews all known prior kernel commits from UMN paper authors that had been accepted into our source repository.

https://lwn.net/ml/linux-kernel/202105051005.49BFABCE@keescook/

#linux #kernel #university #minnesota #breach #trust
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv
📡@NoGoolag

This morning, I was locked out of my Google account

I chatted with Google support to see if they could help me. This is a genuine live chat with Google support:

https://nitter.pussthecat.org/RaveofRavendale/status/1389507928269393921/

#google #DeleteGoogle
📡 @nogoolag 📡 @blackbox_archiv

How to Build an Egalitarian, Decentralized Search Engine Part 1: The Principles

Search is dead. So how do we revive it, without billions of dollars in funding and massive computing resources? We leverage the crowd.

We need a functioning search engine if the open web is to prevail. Google and its competitors do not care to make a decent product. It counters their business goals. So we have to build it ourselves.

https://chapra.blog/how-to-build-a-search-engine-part-1-374/

#search #engine #build #howto #decentralized
📡 @nogoolag 📡 @blackbox_archiv

Active BGP-based Traceback for Amplification DDoS Attacks

This is talk about reflective DDoS which lets attackers hide behind IP spoofing and explore how BGP poisoning can help to trace back these attacks.

Errata: Contrary to the statement on slide 30, the resulting graphs are only rooted and directed, but not necessarily acyclical. Yet they still provide all required properties.

https://media.ccc.de/v/vnog-11-bgpeek-a-boo-active-bgp-based-tr

#ccc #vnog #bgp #traceback #ddos #attack #video
📽@cRyPtHoN_INFOSEC_FR
📽@cRyPtHoN_INFOSEC_EN
📽@cRyPtHoN_INFOSEC_DE
📽@BlackBox_Archiv
📽@NoGoolag

White House launches new artificial intelligence website

The White House has launched a new website, AI.gov, to make artificial intelligence research more accessible across the nation, Axios has learned.

Why it matters: The U.S. once led significantly in the global artificial intelligence race, but now risks being overtaken by China. This is one step the White House is taking to drum up excitement for AI and broaden educational opportunities in the field.

What’s on the site: The website's target audience is the general public, and its purpose is to make public information available on AI more visible to someone like a teacher or student interested in science.

https://www.axios.com/white-house-artificial-intelligence-website-61609ea0-f4ce-4fa4-af48-d60c85bc9519.html

https://telegra.ph/The-National-Artificial-Intelligence-Initiative-NAII-National-Artificial-Intelligence-Initiative-05-06

via www.ai.gov

#usa #wh #artificial #intelligence #website
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv
📡@NoGoolag

Scammer Used Fake Court Order to Take Over Dark Web Drug Market Directory

Dark.fail includes links to dark web markets. A scammer tricked a domain registrar into transferring ownership of the domain with a fake document.

A scammer used a fake court order to convince a domain registrar to transfer ownership of a domain that lists dark web drug markets, and then used that to point the sites to their own copies of the markets designed to steal peoples' bitcoin.

Hackers often make lookalike sites of dark web markets, but the use of a fake court order is unusual. It bears some similarity to how scammers use fake trademarks to convince Instagram to transfer ownership of valuable usernames.

"I had 2FA and PGP enabled on that account. I am not an idiot when it comes to security," Dark Fail, the pseudonymous admin of the site dark.fail which was a victim of the hijacking, told Motherboard during the account takeover late last week.

https://www.vice.com/en/article/qj8833/dark-fail-fake-court-order-dark-web-markets

#scammer #darkfail #phishing #darknet
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv
📡@NoGoolag

I'm seeing a lot of people FOMO quit their jobs to join "crypto", probably out of some over-romanticized view of what goes on in these projects. Let me illuminate you about what actually happens:

https://nitter.pussthecat.org/jonsyu/status/1389635626698297344

via Twitter

#bitcoin #thinkabout
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv
📡@NoGoolag

Attorney General James Issues Report Detailing Millions of Fake Comments, Revealing Secret Campaign to Influence FCC’s 2017 Repeal of Net Neutrality Rules

Multi-Year Investigation Into 2017 Net Neutrality Rulemaking Finds 18 Million Fake Comments Filed with FCC, Half a Million Fake Letters Sent to Congress

Broadband Industry Funded Six Companies That Engaged in Illegal Activity and Impersonated Millions of Americans

NEW YORK – New York Attorney General Letitia James today released a report detailing the results of her office’s wide-ranging investigation into fake, public comments submitted to the Federal Communications Commission (FCC) in a 2017 proceeding to repeal net neutrality rules. Net neutrality prohibits broadband providers from blocking, slowing down, or charging companies to prioritize certain content on the internet. Attorney General James’ investigation uncovered widespread fraud, as well as abusive practices used to sway government policy — using masses of comments and messages to create the false impression of popular support. Additionally, Attorney General James today resolved investigations into three companies that contributed to the millions of fake comments submitted in the 2017 net neutrality proceeding.

“Americans voices are being drowned out by masses of fake comments and messages being submitted to the government to sway decision-making,” said Attorney General James. “Instead of actually looking for real responses from the American people, marketing companies are luring vulnerable individuals to their websites with freebies, co-opting their identities, and fabricating responses that giant corporations are then using to influence the polices and laws that govern our lives. But, today, we are taking action to root out this fraud and the impersonation that has been corrupting the process for far too long.

https://telegra.ph/Attorney-General-James-Issues-Report-Detailing-Millions-of-Fake-Comments-Revealing-Secret-Campaign-to-Influence-FCCs-2017-Repeal-05-06

via ag.ny.gov

#report #fake #comments #influence #campaign #net #neutrality
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv
📡@NoGoolag

IRS Now Seeks Identities of American Cryptocurrency Traders

IRS wants to tax owners of cryptocurrency.

A federal court in the Northern District of California have authorized the United States Internal Revenue Service (IRS) to identify taxpayers that have used a cryptocurrency exchange. In particular, the IRS wants to know about taxpayers who conducted at least $20,000 in crypto transactions from 2016 to 2020.

Cryptocurrencies were originally designed to be an anonymous payment method that could not be regulated by governments. But as they have become a widespread payment instrument as well as an investment asset for those who want to protect their savings and/or make some additional money, they quickly emerged on the radar of tax collecting agencies, such as the IRS. Although crypto transactions are still anonymous, the process or buying or selling cryptocurrencies is not. To that end, it is not surprising that the IRS want to know about U.S. taxpayers who used cryptocurrencies in the past few years.

For now, the court in California authorized the IRS to identify Americans who have used the services of Payward Ventures Inc. and its subsidiaries, such as Kraken, a digital currency exchange headquartered in San Francisco, California. The IRS is seeking information about taxpayers who conducted at least the equivalent of $20,000 in transactions. Meanwhile, on April 1, 2021, a federal court in the District of Massachusetts granted an order for the IRS to serve a similar John Doe summons on Circle, an exchange from Boston. In the future, the IRS may be authorized to identify customers of other crypto exchanges.

https://www.tomshardware.com/news/irs-now-seeks-identities-of-american-cryptocurrency-traders

https://telegra.ph/Court-Authorizes-Service-of-John-Doe-Summons-Seeking-Identities-of-US-Taxpayers-Who-Have-Used-Cryptocurrency-05-06

via www.justice.gov

#irs #usa #cryptocurrency #traders #taxes #taxpayers
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv
📡@NoGoolag

Profil3r

Profil3r is an OSINT tool that allows you to find potential profiles of a person on social networks, as well as their email addresses. This program also alerts you to the presence of a data leak for the found emails.

‼️ For educational purposes only

https://github.com/Rog3rSm1th/Profil3r

#educational #profil3r #osint #tool #social #networks #email
📡 @nogoolag 📡 @blackbox_archiv

Answering Europe’s Call: Storing and Processing EU Data in the EU

Today we are announcing a new pledge for the European Union. If you are a commercial or public sector customer in the EU, we will go beyond our existing data storage commitments and enable you to process and store all your data in the EU. In other words, we will not need to move your data outside the EU. This commitment will apply across all of Microsoft’s core cloud services – Azure, Microsoft 365, and Dynamics 365. We are beginning work immediately on this added step, and we will complete by the end of next year the implementation of all engineering work needed to execute on it. We’re calling this plan the EU Data Boundary for the Microsoft Cloud.

The new step we’re taking builds on our already strong portfolio of solutions and commitments that protect our customers’ data, and we hope today’s update is another step toward responding to customers that want even greater data residency commitments. We will continue to consult with customers and regulators about this plan in the coming months, including adjustments that are needed in unique circumstances like cybersecurity, and we will move forward in a way that is responsive to their feedback.

Microsoft cloud services already comply with or exceed EU guidelines even before the plan we’re announcing today. We already provide commercial and public sector customers the choice to have data stored in the EU, and many Azure cloud services can already be configured to process data in the EU as well. In addition, we use world-class encryption and robust lockbox solutions that meet current regulatory guidance. Many of our services put control of customer data encryption in customers’ hands through the use of customer-managed keys, and we defend our customers’ data from improper access by any government in the world.

https://blogs.microsoft.com/eupolicy/2021/05/06/eu-data-boundary/

#microsoft #eu #data #boundary
📡 @nogoolag 📡 @blackbox_archiv

Epic exposes Apple's efforts to persuade Netflix to keep in-app subscriptions

In brief: Epic Games presented documents in its lawsuit against Apple showing that the Cupertino tech giant went to great lengths to prevent Netflix from dropping in-app payment (IAP) subscriptions from its iOS app. Efforts included special favors and the consideration of punitive measures. Epic hopes to portray Apple as "anything goes" when it comes to retaining its App Store commissions.

In 2018, Netflix was debating whether it should remove in-app subscriptions for new customers in its iPhone app. It planned to run tests that summer in select markets to see its effect on subscription numbers. When Apple learned this, it called all-hands-on-deck to prevent the streaming service from going through with it.

In an email thread (Exhibit A below), several Apple execs, including Vice President of the App Store Matt Fischer, Vice President of Marketing Pete Distad, Vice President of Service Peter Stern, and others, expressed their concerns over Netflix conducting the tests and the possibility of it removing IAPs from its app. Apple did not want Netflix to eliminate subscription options from the software for obvious reasons, but it also didn't like the company even conducting its own tests.

https://www.techspot.com/news/89580-epic-exposes-apple-efforts-persuade-netflix-keep-app.html

#apple #epic #netflix
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv
📡@NoGoolag

Don’t Try to Pirate Movies On Elon Musk’s Starlink

The Starlink team announced that if people try to openly pirate movies on SpaceX’s satellite internet service Starlink, then one has to be prepared to receive a warning from the company demanding that you stop. Starlink is an initiative by SpaceX with the objective of providing Internet From Space. Recently they have launched the first 60 production satellites of nearly 12,000 planned spacecraft into a low orbit above Earth.

Last weekend, a curious Starlink subscriber tested if SpaceX enforces its policy against downloading copyrighted content. The subscriber, “substrate-97,” indeed received the piracy warning notice and he posted the same from SpaceX on Reddit. “We must insist that you and/or others using your Starlink service refrains from illegal downloads of copyrighted content,” the notice says. “Downloading copyrighted materials without a license may lead to suspension or termination of your service, and put you at risk of legal action by the content owner,” the statement read.

Moreover, Starlink may also try to stop piracy if the ISP detects a download for a bootleg movie. The company will immediately send an automated warning to the offending subscriber. If the ISP recognises a download for a copyrighted movie, the provider can automatically issue a warning notification to the subscriber committing the offence.

https://www.gulte.com/trends/85497/dont-try-to-pirate-movies-on-elon-musks-starlink

#starlink #musk #movies #pirate
📡 @nogoolag 📡 @blackbox_archiv

RocketReach and the creepy world of data harvesting

You’ve probably never heard of RocketReach. But I think you should, as it’s got me properly riled up.

I just want people to leave me alone. My job is hard enough as it is, without people sliding into my inbox 24/7.

- Hey, got time for a quick 15 minute chat about this random tool you’ll never use? NO

- Hi, I’d love to chat with you about a potential partnership with-GO AWAY.

- We really think your organisation could benefit from- JUST LEAVE ME ALONE.

- I noticed you haven’t replied to our previous emails; just checking you didn’t miss this. I DIDN’T MISS IT I’M DELIBERATELY IGNORING YOU.

It’s constant, and it’s draining. I don’t know who out there is telling people that spamming folks with cold emails is the way to grow your business, but I’m begging them to stop.

I mean, it must be working, or they wouldn’t do it. But it’s just incredibly frustrating. Especially if you’re someone like me that doesn’t like to be mean to people. My deeply-instilled British values of politeness mean it pains me to ignore these people.

But I have to, or I wouldn’t be able to function. Just replying to these people would be a full-time job.

So imagine my dismay when I discovered there are websites out there specialising in making it even easier to contact me. And one of the worst offenders out there is RocketReach.

https://cookywook.co.uk/blog/rocketreach-and-the-creepy-world-of-data-harvesting/

#data #harvesting #BigData #privacy #rocketreach #thinkabout
📡 @nogoolag 📡 @blackbox_archiv

Building a supply chain attack with .NET, NuGet, DNS, source generators, and more!

For a couple of months now, I’ve been pondering about what tools are at your disposal in .NET to help build and execute a supply chain attack. My goal was to see what is available out there, and what we, as .NET developers, should be aware of. Prepare for a long read!

Now, forget that short introduction, and let’s start anew…

‼️ For educational purposes only

https://blog.maartenballiauw.be/post/2021/05/05/building-a-supply-chain-attack-with-dotnet-nuget-dns-source-generators-and-more.html

#supply #chain #attack #dotnet #nuget #dns #educational
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv
📡@NoGoolag

Privacy activist Max Schrems on Microsoft's EU data move: It won't keep the NSA away

Software giant vows data processing of EU cloud services to stay in EU, which means that currently...

Microsoft has announced plans to ensure data processing of EU cloud services within the borders of the political bloc in a move that expert observers claim reveals problems with the firm's existing setup.

Those problems extend to UK public sector organisations seeking to stick within government guidance as well as a longstanding issue where personal data held in the EU can potentially be accessed via US security laws.

In a blog, Brad Smith, Microsoft’s president and chief legal officer, said the software and cloud services gaint would, by the end 2022, enable EU customers of Azure, Microsoft 365, and Dynamics 365 to have all their data processed physically within the EU.

https://www.theregister.com/2021/05/07/schrems_slams_microsoft_eu_data/

💡 read as well:
Answering Europe’s Call: Storing and Processing EU Data in the EU
https://t.iss.one/BlackBox_Archiv/2163

#microsoft #eu #data #boundary #nsa #schrems
📡 @nogoolag 📡 @blackbox_archiv

a MESSAGE to Anonymous #NewBlood from a Old Anonymous Coot #CyberWar #OpDeleteTheElite #Killuminati

https://www.youtube.com/watch?v=0Knb8HsSurs

#breakingnews #Cyberattack #columbia #OffCircuitSec #OCSec #AnonymousPhilippines #Anonymous #FreeGho57 #Arrested #OpColumbia #Columbian #Government #NWO #hostile #Rothschild #UN #LineInTheSand #GameOver #WorldWar #An0NiX #GhostSec #GhostSecurity #video
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv
📡@NoGoolag

Democracy in Telegram groups

Many of us spend time in specialized telegram groups. The power over communication here belongs to random people with their own shortcomings. Conflict and abuse occurs regularly. Is there another way to keep order so that scam spam doesn't flourish and no one has total control over group members?
In my case, these thoughts led to the development and testing of a system that can be connected to your Telegram today.

First of all, you need to determine what is the key aspect, the currency of the system. Not karma and not points, not likes and not a rating. Time itself became it. What follows from this?

https://habr.com/en/post/556474/

#telegram #democracy #whatUthink
📡 @nogoolag 📡 @blackbox_archiv