This is an example of a revolutionary new document
format called "Plain Text". Some of the features of this format are:
* supported by every editor!
* requires no internet connection!
* editable on any device, from your phone to your TV!
* simple to backup and restore!
* compare documents with "diff"!
* search documents with "grep"!
* can be modified programaticaly using "sed" and "awk"!
* Plain-text supports every version control system out there!
Try plain-text today!
There's only so much space in your brain - save it for the "useful" information and reference the rest.
Never memorize anything you can look up in under 2 minutes. This is why I hated history class (idea > date/names) and why I love documentation.
Don't need employer specific, special snowflake crap filling my brain.
Someone needs to create an SMTP for the 21st century. Something that forces servers to:
- Refuse to relay a message without end-to-end encryption and a digital signature
- Require unknown senders to solve a cryptographic hash problem per message
- Require a TLS certificate from a CA on both sides of any connection
- Use 8-bit attachments (no Base64)
- Drop HTML in favor of Markdown
- Not support external embedding
Telefonica released a script to restore files WannaCry hasn't finished encrypting yet. It finds the files that have had their names changed but aren't encrypted, reads their headers, and restores the filename. Probably not super useful at this point, but still, neat. Combining this with the tool that pulls the key from memory could save a lot of work.
Not that patching appropriately wouldn't have saved more...
Brad Smith, Microsoft President and Chief Legal Officer, urges the government not to stockpile exploits, but report vulnerabilities to software firms. #ransomware
It’s Not Over, WannaCry 2.0 Ransomware Just Arrived With No 'Kill-Switch' http://thehackernews.com/2017/05/wannacry-ransomware-cyber-attack.html?m=1 #infosec #ransomware #wannacry
@jerry Are you experiencing any issues with OAuth on infosec.exchange? I can't toot with Amaroq or sign in with other oauth clients like tootstream and I'm wondering if I'm doing something wrong.
Alrighty, #infosec folks -
Looking into the NHS worm issue, this looks to be Eternalblue - a derivative of the shadow brokers "lost in translation" dump from 14-APR.
This spreads via SMB [windows shares] on, usually, port 445, and is neutered by windows patch MS17-010.
If you have that patch installed, there is nothing to worry about.
This is a photo of a crashed kiosk advertising the menu and offers at a popular Norwegian pizza restaurant chain. It shows that the kiosk was running facial recognition and basic sentiment analysis on the people looking at it.
Based on the number of people who sent me this on Twitter, it’s clear that people care and are unhappy with corporate surveillance.
The worst bit? Compared to what Google and Facebook do daily and at scale, this is a toy.
Scans for Intel ME in April: 4
Scans for Intel ME in May so far: 123
About half of them are in a huge spike May 2nd/3rd which quickly leveled off. The April probes are from a few days before the public disclosure. Neat!
New Kali release. More info here:
Support for RTL8812AU Wireless Card Injection
Streamlined Support for CUDA GPU Cracking
Amazon AWS and Microsoft Azure Availability (GPU Support)
OpenVAS 9 Packaged in Kali Repositories