Pulse of Truth

This magazine is not receiving updates (last activity 0 day(s) ago). Subscribe to start receiving updates.

homesweethomeMrL , in Cisco warns of large-scale brute-force attacks against VPN and SSH services

Below is a list of known affected services: 

  • Cisco Secure Firewall VPN 
  • Checkpoint VPN  
  • Fortinet VPN  
  • SonicWall VPN  
  • RD Web Services 
  • Miktrotik 
  • Draytek 
  • Ubiquiti
timewarp , in Cisco warns of large-scale brute-force attacks against VPN and SSH services
@timewarp@lemmy.world avatar

Cisco warns about large scale attacks, recommends government sign multi-year exclusive contracts on Cisco hardware to stop them...

SuckMyWang ,

So lucky that they can help

TCB13 , in 31% of women in tech consider switching roles over the next year
@TCB13@lemmy.world avatar

This is a bullshit study. If this was for all people (not only women) the results would be even worse. Nobody is currently happy in IT and the reasons are management, compensation and training.

orphiebaby , in DeepMind CEO Says Google Will Spend More Than $100 Billion on AI

Imagine having such a mind-boggling, unfathomable amount of money to waste, and using it to exploit work instead of making sure people aren't starving or one foot in homelessness.

cornshark ,

Perhaps we can spend $100bln on AI and then ask that AI to solve it?

orphiebaby ,

...We have all the answers, resources, and manpower. That's crazy-obvious. The problem is we aren't implementing them because that's spending money on people who won't get people (or at least, the individuals) a profit in return. AI can tell you stuff all you want, but if you're too greedy to implement it, then, well...

EmperorHenry , in FTC Bans Online Mental Health Firm From Sharing Certain Data
@EmperorHenry@infosec.pub avatar

"Certain" data, but not all data.

Our data privacy laws need to be like Switzerland. Corporations shouldn't be allowed to collect information about us the way they do.

If they want to collect information for surveys, they should have to pay us and inform us about what they'll do with that data. It needs to be genuine informed consent.

EmperorHenry , in Microsoft will limit Exchange Online bulk emails to fight spam
@EmperorHenry@infosec.pub avatar

anything at all except what would be effective.

Someone said elsewhere in this thread that bulk emails are usually sent through other services anyway. The scammers are just going to change the service they use to spam

CyberSeeker , in Microsoft will limit Exchange Online bulk emails to fight spam

Probably a good change. Most legitimate bulk email messaging probably goes through a third party service already in your SPF record; surveymonkey, listserv, etc.

Sludgehammer , in MGM Resorts Sues US FTC to Stop Investigation of Casino Hack
@Sludgehammer@lemmy.world avatar

Agency chair Lina Khan was visiting resort during cyber attack

Oof.

JJROKCZ , in MGM Resorts Sues US FTC to Stop Investigation of Casino Hack

Hope the feds tear them appart with fines and dissolve mgm

800XL , in MGM Resorts Sues US FTC to Stop Investigation of Casino Hack

Oh fuck off, MGM.

Hobbes_Dent , in MGM Resorts Sues US FTC to Stop Investigation of Casino Hack

Some more options:

Las Vegas Review

Reuters article

Renegade , (edited ) in UK flooded with forged stamps despite using barcodes — to prevent just that

Kinda buried the headline

A Royal Mail executive does admit that its "overly sensitive" machines can sometimes wrongly flag genuine stamps as fake

They are charging £5 (to the recipient) for these false positives!

When asked why the machine might be wrongly flagging a legitimate stamp, the executive replied: “I mean who knows ..."

Richard Trinder, the chairman of a campaign group that represents those wrongly convicted in the Horizon IT scandal, said: “It goes without saying that postmasters do not want to have to deal with false accusations about something else.”

ryannathans , in New Spectre v2 attack impacts Linux systems on Intel CPUs

Is anyone able to define a "gadget" better in this context?

henfredemars ,

I am not sure if this is detailed enough to be helpful, but this gadget is just a small code snippet usually just a few instructions long that can be hijacked into doing something useful for attacker.

ryannathans ,

Is it specific to the BPF?

henfredemars ,

In the general sense, no. In this case, the researchers were using BPF for part of the work because it’s an easy way to get code running in kernel space, possibly as an unprivileged user if the system is configured to allow this. Many popular distributions restrict this.

The general concept however is still sound. A big contribution of this work is showing that there isn’t necessarily a dependence on access to BPF. Under some circumstances, it’s still possible to inject branch target history leading to information leaks.

I apologize if this is a little vague. This is my best understanding.

CubitOom , in How Google’s 90-day TLS certificate validity proposal will affect enterprises

I didn't read the article.

Will this only affect sites that use Google as their CA or is this an issue when a site is viewed through chrome but has a cert that expires after 90 days?

resetbypeer , in How Google’s 90-day TLS certificate validity proposal will affect enterprises

Lets encrypt has this already by default. Managing this means automation but with that you may shift the problem. When automation is done poorly (esp when least privileged access is not done correctly). Hence that IAM is one of the cornerstone's of zero trust.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • random
  • pulse_of_truth@infosec.pub
  • test
  • worldmews
  • mews
  • All magazines