Scott Mortimer @ScottMortimer@infosec.exchange

ShellCheck finds bugs in your shell scripts

https://www.shellcheck.net

~Open Source Security Tool of the Day~

#osstotd

Terrier is a Image and Container analysis tool that can be used to scan Images and Containers to identify and verify the presence of specific files according to their hashes

https://github.com/heroku/terrier

Cloudfare has a nifty tool to check if DoH, DNSSEC, TLS 1.3, and ESNI are working at

https://www.cloudflare.com/ssl/encrypted-sni/

https://www.kb.cert.org/vuls/id/849224/

It seems to me, in a pedagogical sense, that the only means normal folks have to protect their digital communications cryptographically are at the Session or Application layers. Everything else is completely at the mercy of some downstream provider who probably can't be trusted.

If you can't trust the the hardware and firmware your hypervisors are running on, you can't trust your virtualized environments, no matter who is providing them.

"Additionally, much of the network is virtualized, meaning that it will rely on software running on dynamically configurable hardware. This design dramatically increases the points vulnerable to attack, as does the expected massive increase in both things connected to the network and the data flying about it."

https://www.schneier.com/blog/archives/2020/01/china_isnt_the_.html

Pay close attention to this MS Patch Tuesday cycle and make sure you update ASAP.

Cryptic Rumblings Ahead of First 2020 Patch Tuesday

https://krebsonsecurity.com/2020/01/cryptic-rumblings-ahead-of-first-2020-patch-tuesday/

NoPasswordLogin | The First Passwordless As A Service (PWAAS)

https://nopasswordlogin.com/

~Open Source Security Tool of the Day~

#osstotd

The RouterSploit Framework is an open-source exploitation framework dedicated to embedded devices.

https://github.com/threat9/routersploit/blob/master/README.md

Hackers Are Breaking Directly Into Telecom Companies to Take Over Customer Phone Numbers

https://www.vice.com/en_us/article/5dmbjx/how-hackers-are-breaking-into-att-tmobile-sprint-to-sim-swap-yeh

Is SMS 2FA Secure? NO!

https://www.issms2fasecure.com/

Hey Bruv, don't do the crime if you can't do the time.

What OPSEC? Member of “thedarkoverlord” allegedly used his personal details to set up hacking and extortion-related accounts.

https://www.databreaches.net/what-opsec-member-of-thedarkoverlord-allegedly-used-his-personal-details-to-set-up-hacking-and-extortion-related-accounts/

~Open Source Security Tool of the Day~

#osstotd

BLAKE3 is a cryptographic hash function that is:

Much faster than MD5, SHA-1, SHA-2, SHA-3, and BLAKE2.

Secure, unlike MD5 and SHA-1. And secure against length extension, unlike SHA-2.

Highly parallelizable across any number of threads and SIMD lanes, because it's a Merkle tree on the inside.

https://github.com/BLAKE3-team/BLAKE3/blob/master/README.md

Prince Harry and Meghan are my new privacy heroes for early 2020. #screwthemediamachine

Seeing through the Sea

Why do all the pictures you take underwater look blandly blue-green? The answer has to do with how light travels through water. Derya Akkaynak , an oceangoing engineer, has figured out a way to recover the colorful brilliance of the deep.

https://www.scientificamerican.com/video/seeing-through-the-sea/