I'm going to China tomorrow and have already prepared a laptop and phone which I plan to keep just for work trips abroad. I'm the owner of a small hardware startup (less than $1m revenue per year but not an insignificant amount, no employees on the books so it looks like a one man band to anyone looking, and we are not in the security sector so it's nothing sensitive) and am going to China on a business visa in order to carry out assembly operations as well as find a logistics partner, which the government is aware of as it's written in my visa application.

A lot of manufacturing I'm doing already takes place in China, so they have a lot of the designs for products I make. However they don't have access to my financial records for example, emails, etc. and I am anonymous to a lot of my suppliers, some of whom are my direct competitors, to prevent them knowing what the component they are making actually is/what it's being used in.

At the moment, I am making do with a burner email account that has all my emails redirected to it for the trip, which will only be accessed through a phone with GrapheneOS. I have a linux machine which will be used just for hardware and software development. All important files are stored on an encrypted USB (could change this to cloud storage but not sure what's better, also I have passport scans on the USB which I don't really want to upload to the cloud ideally).

However, ideally I want to access my Shopify account and I need to submit my invoices to my accountant every month. I also want access to my email archive, and also access to the company VPN (we have our ticket system and management software on it). I will be in China for longer than a month for sure. I can forego the above but it will make my life way harder and I will be relying on employees for one time codes, showing me the Shopify, etc. Also the servers on the VPN are self hosted, and it's all through tailscale, I set the VPSes up myself so they are not hardened at all and I wouldn't trust myself to do it properly either.

My questions is, given my profile, what threats should I be worried about? Suppliers/government actors trying to get physical access to my machine, or am I being paranoid? Is my current set up overkill? What risks do I face in terms hacking over the network, what data is potentially at risk? I am also traveling the majority of the year, so if I can make concessions, I would be grateful, as this will be my set up for a lot of it.

Thanks for reading if you got this far!

When searching for a free VOIP, I gave mic permissions to a website that appears Russian (russian text at footer of webpage).

I settled on TextNow, which shared all my Google account data to the app.

How can I undo any security threats I've just posed for myself? Can I just clear my cookies and cache? And how do I revoke the Google data shared with TextNow ?

I'm looking at my router data and it says it's blocking two things I'm unfamiliar with.

Client.openweb.bid and cdn.bullwhip.cloud

Google pulls up nothing about them. How can I find out what these are

Is this secure? Or does the off-line computer have to be directly connected to printer for security?

I'm a millennial and have grown up with a laptop, but still I feel like a danger to myself.

As an average layperson / noobie I follow only the rules you're bombarded with. I heard that a vpn is vital, you should have a different password for each website, and not accept cookies.

What key tips am I missing?

Passkeys are the new best-practices technology - or so everyone wants me to believe. While I approve of the concept of automated security, I have some reservations about passkeys, and I haven't yet seen anyone raise or discuss them. I'd like to solicit your feedback to see if my concerns can be alleviated.

1. Collapse of multifactor authentication

Since brute-force password-guessing has become achievable thanks to plentiful computing, the hedge against it is multi-factor authentication: a successful login requires as password and another factor, such as a security code sent to a secure user-controlled address (SMS or email), an authenticator code, a device ID from a device associated with the user, etc.

Passkeys seem to collapse multi-factor authentication down to a single factor: the passkey. If the attacker has it, they can authenticate... The End.

I've seen "single-device passkeys" mentioned, which implicitly uses the device as the second factor. But single-device passkeys are a bad idea for the same reason that single-device passwords would be a bad idea: nobody wants to manage each device individually. And advocates of passkeys seem to acknowledge this, since most of the sales pitches for passkeys emphasize that they're synced across devices. So I presume that synced passkeys are the default, which eliminates device identity as the second factor.

In general, I presume that passkeys can implemented alongside a second factor. But from what I've read, passkeys are being pitched as a convenience factor that does not require a second factor. That seems like a terrible idea.

2. No fallback mechanism

I've been a 1Password user for a long time, and I use it a hundred times a day with unique per-site passwords. But, like all password managers, 1Password sometimes fails. Sometimes it can't find and populate the authentication fields. Sometimes my 1Password vault is available on one device, but not another. Sometimes I need 1Password to use the credentials for URL / website #1 on URL / website #2, and it can't. On very rare occasions, I need to share a password with somebody else, like when my wife wants to watch Netflix and her iPad dumped its cached credentials. Etc.

In all of those cases, the fallback mechanism is easy: I look up the password in 1Password, and I do something with it. With passkeys, that's absolutely not available. Either it works automatically, or it doesn't and you're screwed.

What are the security risks for win 10 ltsc iot version on a setup for gaming? Should I just upgrade to win 11 instead? I have a preference for win 10

It wasn't packaged with something else I installed because I didn't install anything on my Windows 10 PC today.

I only found it because MS installed an AI app called "Copilot" on my PC yesterday and when I went to uninstall it I saw "Vivaldi" had been installed today. I know MS is force installing "Copilot" on some PCs but "Vivaldi" is not an MS app as far as I can tell so I don't know how it got on my machine ...

Any ideas as to how or why this might have happened?

I analysed a recent security breach for my team so they know the kind of stuff to watch out for.

Since rent in my apartment complex in Berlin includes internet access, the complex seems to be set up with a shared central router. Each apartment has its own access point with unique Wi-Fi credentials, using an Edimax Pro CAP 1750.

Today, I received a security warning from my firewall indicating that it had blocked an attempted port scan from another device. However, as far as I know, only my devices are connected to my apartment's Wi-Fi. When I checked the firewall's network settings, I found that I could see dozens of other devices on the network—phones, printers, computers, and more—along with their internal IP addresses. The IP that triggered the warning had the label "TP-Link," but I couldn’t see any additional details.

So even though each tenant logs into their Wi-Fi with their own password, the set up of this complex allows visibility of other users' devices and internal IP addresses.

Out of curiosity, I accessed 192.168.0.1 and the page name suggests that the landlord might be using a Hitron CGNV4 router. However, this doesn't quite align with what I'd expect, as each apartment has very stable gigabit internet with very high upload speeds, and that router model seems insufficient for managing such heavy traffic across dozens of apartments.

If I can see other tenants' devices on the network and received a port scan alert, does this mean there are potential security vulnerabilities? My understanding was that each apartment’s Wi-Fi should be isolated since each Wi-Fi has a different name and password. I wouldn't expect to be able to see a device that is logged into a separate Wi-Fi whose password I don't even know.

Could this configuration expose my devices to unauthorised access or risks from other users on the same network? Also, is there anything I should do on my end to better secure my connection or minimise potential risks? I already use a VPN on all my devices (I got the security warning when I briefly disconnected my PC from the VPN), disabled local network sharing in the VPN, and configured my devices to use randomised MAC addresses on the network. And in Windows I configured it as a public network.

Any opinions or advice appreciated!

Years ago I used Mint which I recently found out was a security nightmare at the time. I would like to begin using a new budgeting app and they all link to bank accounts using software such as Plaid. Are systems like this considered safe today? I would be linking credit cards, bank accounts, and investment accounts which makes me pause...

HI all, I was talking to my colleague today about our company's Win11 upgrades and when Microsoft ends security updates for Win10, and he mentioned he had a rig at home that was on Windows 7 and he'd been using it since 2015ish until June 2024 when he finally got a Win11 machine instead. He had a Kaspersky AV subscription on it (at least he says he did), but the computer was also very slow (old machine, not really surprising).

He was asking me if that mattered (using Win7 in 2024 online). I said it probably did but like... I'm not sure - have there been major Win7 security vulnerabilities that, even using an AV, he could've been hit by just by being connected to the internet? I'm not super knowledgeable on the subject.

Thanks

I keep seeing these posts pop up of nightmare situations where someone hacks their Gmail and changes their TFA. Google doesn’t have live support, so they’re just fucked.

I’m sure in some cases, they’re just not paying attention to the security of where they’re accessing their email/etc. But on the off-chance that their password is just too easy: What makes the ultimate password? I use Apple’s keychain and let it create all my passwords. I’m fine to create an even crazier long ass password because I won’t be the one remembering it. But I don’t know enough to know whether making it longer even matters.

Advice?

With all these "AI" tools able to give answers based on "repository context", I started to think how much data it's exfiltrating from my computer to train itself...

But then, it's not just these AI tools but pretty much any software I install can read/modify any file owned by the same user which is everything except for the OS files if I oversimplify a bit, plus the environment variables

That's a lot of access that shouldn't be given. For example, it's possible some random Golang utility I install can crawl known secret directories (e.g. .aws/) and exfiltrate data

Am I just being paranoid right now?

I used to work at a large corp (public, double-digit billion-dollar company), and there was no guidance at all on what libraries a dev could import, so anyone imported anything they found on Github, but strictly speaking, those dependencies can exfiltrate env vars from the program if I'm not wrong.

My parents have just contacted me about weird behaviour on their Windows PC. The desktop has a large black rectangle in the middle that spells out ADMIN in red and all caps. I have no access to the notebook at the moment and there is no way I'm going to walk my mum through system settings via phone. Does anyone have any idea what this could be? I've never seen anything like it and the issue is really hard to google.

https://preview.redd.it/gy0a87e1c3yd1.jpg?width=828&format=pjpg&auto=webp&s=fb4c166e36602938b8df3cfc5dec0beae462a111

My son forgot the password to his dell latitude laptop. Is there any way I can reset the password or bypass it?

Purpose: Seeking proposals for an integrated security solution that enhances workplace safety and efficiency.

Overview The US Army Corps of Engineers is looking to implement a layered security approach that combines personnel, processes, and technology to create a safer and more enjoyable work environment. The ideal system should support seamless operations while ensuring effective threat detection and response.

I know this is a dumb question and I’m not great with tech but I have to mail in just laptop to be looked at. I have to give them the general password to get into the computer….but is there a way to make sure they can’t access sites that have my passwords saved in my browser? I fortunately don’t have anything like bank passwords in there but I’m just a bit uncomfortable with it. Open to all suggestions but you will probably have to spell it out for me. Thanks in advance.

I use to bank online but stopped last year when I learned about the relative easy of hacking, man-in-the-middle attacks, session/cookie hijacking, and key loggers. It sounds as though once a bad actor has your bank card number, they can empty your account, and if it "appears" as though you "signed in", even though it was actually a hacker; you will unlikely be reimbursed.

I am not a tech person, so my assumptions may be off. I am curious, on a scale of 1 to 10, (where 1 is not confident at all and 10 is 100% confident); how confident are you in online banking?

I am a cybersecurity analyst and for one of our clients we have seen massive block requests on Firewall from endpoints trying to connect with malicious domains i.e. xmr-eu2.nanopool[.]org , sjjjv[.]xyz , xmr-us-west1.nanopool[.]org etc.

The malware has spread to 1300 systems.

On sentinel One it is showing that the process is initiated by svchost.exe.

The malware has formed persistence and tries to connect with the crypto domains as soon as the Windows OS boots.

We have gathered the memory dump of some infected system.

Not able to get anything.. Can anyone help me guide to get to the root cause of it and how is the crypto malware (most probably worm) laterally spread in the network?

I have to get Network+ certified for my work. I have a ton of experience but lack confidence. I have already made it though the training material. I really need some time in practice tests and would like to do them on my phone. There are a ton on the app store but no easy way to tell whats crap and what's worth it. Does anyone have an app they have used and liked?

I have heard some say that if your computer is using a hardwired ethernet connection for internet, a hacker would need to have physical access to your computer in order to compromise it. I have heard others say any device connected to the internet, no matter how the are connected, can be compromised. Is one of these not accurate?

If you have a computer connected to the internet by ethernet, and don't click on any emails, attachments, or visit questionable sites, can it still be compromised? If so, how do hackers actually fine your computer?

Is it a security concern for them for them? If so, why do most of them allow it?

How the ThinkPad-lmi Kernel Module Could Be Exploited as a Backdoor

The thinkpad-lmi kernel module, which is part of the Linux kernel's platform support for Lenovo ThinkPads, interfaces with the firmware to expose certain low-level hardware features. Specifically, it allows for control over fan speeds, battery thresholds, and other system management features through the sysfs interface. While these features provide useful control over hardware, they can also introduce a potential attack surface when misused or left exposed.

1. Overview of ThinkPad-lmi Module

The thinkpad-lmi kernel module provides an interface for interacting with the ThinkPad's Embedded Controller (EC) or other system management components. It is designed to give the user control over various hardware functions that would typically only be accessible through firmware-level settings.

Some of the key features include:

Fan speed control

Battery charge thresholds

Power settings adjustments

BIOS version querying

The module exposes these settings through the /sys/class/ or /proc/acpi/ibm/ interface, which allows users or scripts to read and modify system-level information directly.

2. Potential for Backdoor Exploitation

The nature of the thinkpad-lmi module's access to low-level system components makes it a potentially attractive target for malicious actors if security vulnerabilities or misconfigurations exist. Here’s how it could theoretically be exploited as a backdoor:

a) Privilege Escalation via Sysfs Interface

The thinkpad-lmi module operates at the kernel level, and while it should only be accessible by root, misconfigurations in user permissions or sysfs exposure could allow unprivileged users to manipulate the system's behavior.

For example, if an attacker gains access to the sysfs interface, they could modify critical parameters like fan control, causing hardware damage, overheating, or even throttling performance. More dangerously, they could attempt to control power-related settings or modify BIOS-related configurations. Depending on the specific setup, it might be possible to disable certain security features or tamper with the boot process.

b) Malicious Kernel Module Injection

In systems where module loading is not tightly controlled, an attacker could potentially replace or modify the thinkpad-lmi module with a malicious version. A backdoored version of this module could hide its activities, intercept kernel calls, or provide attackers with covert control over hardware functions. Since the module interfaces with hardware management, an attacker could stealthily disable fans, tamper with power management, or even influence battery behavior to create more significant hardware issues.

c) Remote Access via Firmware Manipulation

Some configurations exposed by thinkpad-lmi could allow control over firmware updates or hardware settings, particularly if the ThinkPad's firmware allows remote management. A malicious actor with control over the kernel module might manipulate these settings to execute arbitrary firmware updates or exploit known vulnerabilities in Lenovo's embedded firmware. This could open up a remote access channel to the system, bypassing traditional software-based security controls like firewalls or antivirus tools.

d) Persistence Across Reboots

The fact that thinkpad-lmi interacts with system firmware means that it could be used to create persistence for a backdoor. By manipulating settings like BIOS boot order or Secure Boot settings, an attacker could create conditions where their malware or rootkit is reloaded on every boot. In addition, altering fan or power settings could allow the attacker to control when the system overheats or throttles, potentially avoiding detection by monitoring tools that don't expect such behavior.

3. Securing Against Exploitation

To mitigate the risks of thinkpad-lmi being exploited as a backdoor, several best practices should be followed:

a) Limit Access to Sysfs Interface

Ensure that only the root user or trusted processes have access to the sysfs interface exposed by the thinkpad-lmi module. This can be done by tightening file permissions and using tools like AppArmor or SELinux to enforce strict access controls on kernel modules and hardware interfaces.

b) Monitor Module Loading

Disable or restrict kernel module loading unless it is strictly necessary. If possible, use modprobe.d configurations to blacklist potentially dangerous or unnecessary modules. Furthermore, monitoring the integrity of modules like thinkpad-lmi should be part of a regular security audit to detect any unauthorized changes or tampering.

c) BIOS and Firmware Updates

Regularly update your ThinkPad's BIOS and firmware to patch known vulnerabilities that could be exploited through the thinkpad-lmi interface. Additionally, disable remote BIOS management unless explicitly needed, and always enforce BIOS passwords and Secure Boot features to prevent unauthorized modifications.

d) Kernel Hardening

Use kernel-level hardening techniques such as Kernel Address Space Layout Randomization (KASLR) and restrict direct memory access (DMA) from untrusted sources. Applying these security features can help mitigate the impact of any successful exploitation of thinkpad-lmi by making it harder to escalate privileges or maintain persistence in the system.

e) Monitor for Anomalies

Monitoring system logs for unexpected fan speed changes, power settings modifications, or BIOS update attempts could provide an early indication that something is amiss. Regularly audit access to the /sys/class/ or /proc/acpi/ibm/ directories to ensure no unauthorized processes are attempting to interact with low-level system management components.

4. Conclusion

While the thinkpad-lmi kernel module provides useful functionality for ThinkPad users, it also opens up a potential avenue for exploitation if not properly secured. By exposing hardware management features through the sysfs interface, attackers may find ways to escalate privileges, inject malicious code, or persist through reboots by manipulating firmware and BIOS settings. Therefore, it’s crucial to implement strong access controls, keep firmware updated, and monitor for unusual activity to reduce the risk of this module being used as a backdoor.

If you’re running Linux on a ThinkPad, it’s worth reviewing how the thinkpad-lmi module interacts with your system and applying appropriate security measures.

I posted this in r/sysadmins but I wanted to spread it around more. Essentially Ive seen a lot of GitHub's spun up that have varying levels of versions of several different security standard models most of them seem to burn out and die or the people running them get busy. Im trying to keep mine laser-focused on just Windows devices or just CIS standards in hopes that I can try and stay on top of updating things. Im new to using Github and pretty new to scripting so it's very crude but it works. The reports are pretty stable now. https://github.com/TheTechBeast8/HardeningAudit

I feel that SMS based OTPs open you up to sim-swap attacks.

If I set up TOTP on something like Google or Github, there are no exchange happening on sign-in and sim-swaps are useless. Why do companies, especially banks, still use SMS for the second factor?

What is the downside of TOTP?

Someone stated the following, with regards to replacing a compromised computer with a new one: "The really good stuff uses cloud services to maintain persistence. As soon as you log into Google or Apple account on your new device you're compromised again." Can someone explain how it works, and are there ways around it?
What part of the cloud service and stored files will compromise a new computer? Is it code attached to cloud saved documents, and photos, or something else?

How can you be very secure on the internet if let's say you live in a bad country?

What are some steps I can take to be more secure? I'm not doing anything immoral, but I want to watch a certain content on youtube and read certain books and that's dangerous in my situation. And everything is connected to your phone number these days. How can I be more secure? And is it possible to watch youtube videos without using your phone number? Because you need a phone number to make a google account and a google account to go on youtube.