Scott Mortimer @ScottMortimer@infosec.exchange

Infosec Core Competencies

This is an interesting list, and I appreciate that it covers fairly broad areas of knowledge within the IT realm.

I also really appreciate #50. 😉

https://www.netmeister.org/blog/infosec-competencies.html

You're Probably Not Using the Web's Best Browser

With endless new customization options, like new email clients and a feed reader, Vivaldi 4.0 just got better.

https://www.wired.com/story/vivaldi-4-2021/

Enjoy your anonymous crypto-investments.

Hunter Horsley, chief executive of cryptocurrency investment company Bitwise Asset Management, said "The public is slowly being shown, in case after case, that Bitcoin is good for law enforcement and bad for crime — the opposite of what many historically believed."

https://www.seattletimes.com/business/colonial-pipeline-investigation-upends-idea-that-bitcoin-is-untraceable/

~Open Source Security Tool of the Day~

#osstotd

Firefox privacy, security and anti-fingerprinting: a comprehensive user.js template for configuration and hardening.

https://github.com/arkenfox/user.js/

ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. Attackers can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.

https://alpaca-attack.com/

Employers better get used to a permanent hybrid work model.

It's going to be almost impossible to put the toothpaste back in the tube on this issue.

Work from home or a $30K raise? Employees said it wasn't even close.

https://www.bizjournals.com/bizjournals/news/2021/05/13/wfh-work-from-home-raise-salary-google-facebook.html

~Open Source Security Tool of the Day~

#osstotd

page-fetch is a tool for researchers that lets you:

- Fetch web pages using headless Chrome, storing all fetched resources including JavaScript files
- Run arbitrary JavaScript on many web pages and see the returned values

https://github.com/detectify/page-fetch

Link shorteners: the long and short of why you shouldn't use them

The common misconceptions about link-shortening tools and some of the potential risks associated with using them.

https://gcs.civilservice.gov.uk/blog/link-shorteners-the-long-and-short-of-why-you-shouldnt-use-them/

HTTP/3 needs us (and other people) to make firewall changes

https://utcc.utoronto.ca/~cks/space/blog/sysadmin/HTTP3AndOurFirewalls

"Internet-exposed VMware vCenter servers"??? Are you f***ing kidding me? 😳

A multi-platform Python-based malware targeting Windows and Linux devices has now been upgraded to worm its way into Internet-exposed VMware vCenter servers unpatched against a remote code execution vulnerability.

https://www.bleepingcomputer.com/news/security/freakout-malware-worms-its-way-into-vulnerable-vmware-servers/

SeKVM: Securing virtual machines in the cloud

"Nieh and Gu’s work is the first to verify a commodity system, specifically the widely-used KVM hypervisor, which is used to run virtual machines by cloud providers such as Amazon. They proved that SeKVM, which is KVM with some small changes, is secure and guarantees that virtual computers are isolated from one another"

https://www.helpnetsecurity.com/2021/05/31/sekvm-securing-virtual-machines/

A platform that allows you to automatically clean up your old posts from services like Twitter, Reddit, Facebook, Discord and more all in one place.

https://redact.dev

List of Cybersecurity Subreddits

https://hakluke.com/cybersecurity-subreddits/

Mindmaps for bug bounty hunters, pentesters, and security professionals

https://github.com/imran-parray/Mind-Maps

Windows Package Manager 1.0 | Windows Command Line

We started a journey to build a native package manager for Windows 10 when we announced the Windows Package Manager preview at Microsoft Build 2020. We released the project on GitHub as an open-source collaborative effort and the community engagement has been wonderful to experience!

https://devblogs.microsoft.com/commandline/?p=6715

Microsoft Build of OpenJDK

The Microsoft Build of OpenJDK is a new no-cost long-term supported distribution and Microsoft’s new way to collaborate and contribute to the Java ecosystem.

https://www.microsoft.com/openjdk