Author: J.C. Cross

A happy ending by a smart person

Hacked! How finding my dream home almost led me to a financial nightmare

This article speaks how vulnerable we are to determined actors. Some things can just not be defended against. But we can still learn good practices to mitigate many of these attacks.

1. Text messages and email do remain the vulnerabilities on phones/tablets.
2. WhatsApp asked this reporter to a protest
3. I also keep my personal data off my phone
4. But photos and contacts and texts are still on it
5. Zero click is scary. You don’t have to even click for this kind of infection, so there’s not much defense if you’re on someone’s list. Nearly impossible to definitively identify the bad guys.

Three very cool search engines. Use them 1-2-3 bang all together.

IoT devices are horribly insecure nowadays. You can search for information in your passive footprinting.  Stuff like webcams by manufacturer or version. Continue reading “Vulnerable IoT Devices! (Using Publicly-available Information To Learn More About A Target pt. 2)”

No that is not a typo. The original theZoo is a github repo with commodity malware samples.  Everyone has access to malware that is off-the-shelf and it’s the most common type.  No Advanced Persistent Threats here. But your anti-malware software will probably flag you.

It’s neat because you can use it to study this code. Alternatively, you could do some things that are not recommended. You could create a phishing email that could be sent to a million users, not targeting anyone in particular like the APTs do.  The APTs and other lone hackers or groups create more sophisticated malware. Instead, these users–sometimes called script kiddies–can download say WannaCry ransomware and send it out through your phishing email (or through a “stager” email malware that will load other modules). No reconnaissance needed here.

Think about it, if only one percent of a million users open the email, you end up with 10,000 compromises. Not a bad pay day.