HI all, I was talking to my colleague today about our company's Win11 upgrades and when Microsoft ends security updates for Win10, and he mentioned he had a rig at home that was on Windows 7 and he'd been using it since 2015ish until June 2024 when he finally got a Win11 machine instead. He had a Kaspersky AV subscription on it (at least he says he did), but the computer was also very slow (old machine, not really surprising).

He was asking me if that mattered (using Win7 in 2024 online). I said it probably did but like... I'm not sure - have there been major Win7 security vulnerabilities that, even using an AV, he could've been hit by just by being connected to the internet? I'm not super knowledgeable on the subject.

Thanks

I keep seeing these posts pop up of nightmare situations where someone hacks their Gmail and changes their TFA. Google doesn’t have live support, so they’re just fucked.

I’m sure in some cases, they’re just not paying attention to the security of where they’re accessing their email/etc. But on the off-chance that their password is just too easy: What makes the ultimate password? I use Apple’s keychain and let it create all my passwords. I’m fine to create an even crazier long ass password because I won’t be the one remembering it. But I don’t know enough to know whether making it longer even matters.

Advice?

With all these "AI" tools able to give answers based on "repository context", I started to think how much data it's exfiltrating from my computer to train itself...

But then, it's not just these AI tools but pretty much any software I install can read/modify any file owned by the same user which is everything except for the OS files if I oversimplify a bit, plus the environment variables

That's a lot of access that shouldn't be given. For example, it's possible some random Golang utility I install can crawl known secret directories (e.g. .aws/) and exfiltrate data

Am I just being paranoid right now?

I used to work at a large corp (public, double-digit billion-dollar company), and there was no guidance at all on what libraries a dev could import, so anyone imported anything they found on Github, but strictly speaking, those dependencies can exfiltrate env vars from the program if I'm not wrong.

My parents have just contacted me about weird behaviour on their Windows PC. The desktop has a large black rectangle in the middle that spells out ADMIN in red and all caps. I have no access to the notebook at the moment and there is no way I'm going to walk my mum through system settings via phone. Does anyone have any idea what this could be? I've never seen anything like it and the issue is really hard to google.

https://preview.redd.it/gy0a87e1c3yd1.jpg?width=828&format=pjpg&auto=webp&s=fb4c166e36602938b8df3cfc5dec0beae462a111

Thinking of buying a Lenovo (fixed spelling) Thinkpad but I've read some government agencies have forbidden them due to Chinese ownership and security concerns. And more articles seem to be appearing about the general issue, such as

https://arstechnica.com/cars/2024/10/ban-on-chinese-tech-so-broad-us-made-cars-would-be-blocked-polestar-says/

I'm tiring of issues with Dell, but unsure whether Lenovo (fixed) is a safe PC.

edit: Spelling error

My son forgot the password to his dell latitude laptop. Is there any way I can reset the password or bypass it?

Purpose: Seeking proposals for an integrated security solution that enhances workplace safety and efficiency.

Overview The US Army Corps of Engineers is looking to implement a layered security approach that combines personnel, processes, and technology to create a safer and more enjoyable work environment. The ideal system should support seamless operations while ensuring effective threat detection and response.

I know this is a dumb question and I’m not great with tech but I have to mail in just laptop to be looked at. I have to give them the general password to get into the computer….but is there a way to make sure they can’t access sites that have my passwords saved in my browser? I fortunately don’t have anything like bank passwords in there but I’m just a bit uncomfortable with it. Open to all suggestions but you will probably have to spell it out for me. Thanks in advance.

I use to bank online but stopped last year when I learned about the relative easy of hacking, man-in-the-middle attacks, session/cookie hijacking, and key loggers. It sounds as though once a bad actor has your bank card number, they can empty your account, and if it "appears" as though you "signed in", even though it was actually a hacker; you will unlikely be reimbursed.

I am not a tech person, so my assumptions may be off. I am curious, on a scale of 1 to 10, (where 1 is not confident at all and 10 is 100% confident); how confident are you in online banking?

I am a cybersecurity analyst and for one of our clients we have seen massive block requests on Firewall from endpoints trying to connect with malicious domains i.e. xmr-eu2.nanopool[.]org , sjjjv[.]xyz , xmr-us-west1.nanopool[.]org etc.

The malware has spread to 1300 systems.

On sentinel One it is showing that the process is initiated by svchost.exe.

The malware has formed persistence and tries to connect with the crypto domains as soon as the Windows OS boots.

We have gathered the memory dump of some infected system.

Not able to get anything.. Can anyone help me guide to get to the root cause of it and how is the crypto malware (most probably worm) laterally spread in the network?

I have to get Network+ certified for my work. I have a ton of experience but lack confidence. I have already made it though the training material. I really need some time in practice tests and would like to do them on my phone. There are a ton on the app store but no easy way to tell whats crap and what's worth it. Does anyone have an app they have used and liked?

I have heard some say that if your computer is using a hardwired ethernet connection for internet, a hacker would need to have physical access to your computer in order to compromise it. I have heard others say any device connected to the internet, no matter how the are connected, can be compromised. Is one of these not accurate?

If you have a computer connected to the internet by ethernet, and don't click on any emails, attachments, or visit questionable sites, can it still be compromised? If so, how do hackers actually fine your computer?

Is it a security concern for them for them? If so, why do most of them allow it?

How the ThinkPad-lmi Kernel Module Could Be Exploited as a Backdoor

The thinkpad-lmi kernel module, which is part of the Linux kernel's platform support for Lenovo ThinkPads, interfaces with the firmware to expose certain low-level hardware features. Specifically, it allows for control over fan speeds, battery thresholds, and other system management features through the sysfs interface. While these features provide useful control over hardware, they can also introduce a potential attack surface when misused or left exposed.

1. Overview of ThinkPad-lmi Module

The thinkpad-lmi kernel module provides an interface for interacting with the ThinkPad's Embedded Controller (EC) or other system management components. It is designed to give the user control over various hardware functions that would typically only be accessible through firmware-level settings.

Some of the key features include:

Fan speed control

Battery charge thresholds

Power settings adjustments

BIOS version querying

The module exposes these settings through the /sys/class/ or /proc/acpi/ibm/ interface, which allows users or scripts to read and modify system-level information directly.

2. Potential for Backdoor Exploitation

The nature of the thinkpad-lmi module's access to low-level system components makes it a potentially attractive target for malicious actors if security vulnerabilities or misconfigurations exist. Here’s how it could theoretically be exploited as a backdoor:

a) Privilege Escalation via Sysfs Interface

The thinkpad-lmi module operates at the kernel level, and while it should only be accessible by root, misconfigurations in user permissions or sysfs exposure could allow unprivileged users to manipulate the system's behavior.

For example, if an attacker gains access to the sysfs interface, they could modify critical parameters like fan control, causing hardware damage, overheating, or even throttling performance. More dangerously, they could attempt to control power-related settings or modify BIOS-related configurations. Depending on the specific setup, it might be possible to disable certain security features or tamper with the boot process.

b) Malicious Kernel Module Injection

In systems where module loading is not tightly controlled, an attacker could potentially replace or modify the thinkpad-lmi module with a malicious version. A backdoored version of this module could hide its activities, intercept kernel calls, or provide attackers with covert control over hardware functions. Since the module interfaces with hardware management, an attacker could stealthily disable fans, tamper with power management, or even influence battery behavior to create more significant hardware issues.

c) Remote Access via Firmware Manipulation

Some configurations exposed by thinkpad-lmi could allow control over firmware updates or hardware settings, particularly if the ThinkPad's firmware allows remote management. A malicious actor with control over the kernel module might manipulate these settings to execute arbitrary firmware updates or exploit known vulnerabilities in Lenovo's embedded firmware. This could open up a remote access channel to the system, bypassing traditional software-based security controls like firewalls or antivirus tools.

d) Persistence Across Reboots

The fact that thinkpad-lmi interacts with system firmware means that it could be used to create persistence for a backdoor. By manipulating settings like BIOS boot order or Secure Boot settings, an attacker could create conditions where their malware or rootkit is reloaded on every boot. In addition, altering fan or power settings could allow the attacker to control when the system overheats or throttles, potentially avoiding detection by monitoring tools that don't expect such behavior.

3. Securing Against Exploitation

To mitigate the risks of thinkpad-lmi being exploited as a backdoor, several best practices should be followed:

a) Limit Access to Sysfs Interface

Ensure that only the root user or trusted processes have access to the sysfs interface exposed by the thinkpad-lmi module. This can be done by tightening file permissions and using tools like AppArmor or SELinux to enforce strict access controls on kernel modules and hardware interfaces.

b) Monitor Module Loading

Disable or restrict kernel module loading unless it is strictly necessary. If possible, use modprobe.d configurations to blacklist potentially dangerous or unnecessary modules. Furthermore, monitoring the integrity of modules like thinkpad-lmi should be part of a regular security audit to detect any unauthorized changes or tampering.

c) BIOS and Firmware Updates

Regularly update your ThinkPad's BIOS and firmware to patch known vulnerabilities that could be exploited through the thinkpad-lmi interface. Additionally, disable remote BIOS management unless explicitly needed, and always enforce BIOS passwords and Secure Boot features to prevent unauthorized modifications.

d) Kernel Hardening

Use kernel-level hardening techniques such as Kernel Address Space Layout Randomization (KASLR) and restrict direct memory access (DMA) from untrusted sources. Applying these security features can help mitigate the impact of any successful exploitation of thinkpad-lmi by making it harder to escalate privileges or maintain persistence in the system.

e) Monitor for Anomalies

Monitoring system logs for unexpected fan speed changes, power settings modifications, or BIOS update attempts could provide an early indication that something is amiss. Regularly audit access to the /sys/class/ or /proc/acpi/ibm/ directories to ensure no unauthorized processes are attempting to interact with low-level system management components.

4. Conclusion

While the thinkpad-lmi kernel module provides useful functionality for ThinkPad users, it also opens up a potential avenue for exploitation if not properly secured. By exposing hardware management features through the sysfs interface, attackers may find ways to escalate privileges, inject malicious code, or persist through reboots by manipulating firmware and BIOS settings. Therefore, it’s crucial to implement strong access controls, keep firmware updated, and monitor for unusual activity to reduce the risk of this module being used as a backdoor.

If you’re running Linux on a ThinkPad, it’s worth reviewing how the thinkpad-lmi module interacts with your system and applying appropriate security measures.

I posted this in r/sysadmins but I wanted to spread it around more. Essentially Ive seen a lot of GitHub's spun up that have varying levels of versions of several different security standard models most of them seem to burn out and die or the people running them get busy. Im trying to keep mine laser-focused on just Windows devices or just CIS standards in hopes that I can try and stay on top of updating things. Im new to using Github and pretty new to scripting so it's very crude but it works. The reports are pretty stable now. https://github.com/TheTechBeast8/HardeningAudit

I feel that SMS based OTPs open you up to sim-swap attacks.

If I set up TOTP on something like Google or Github, there are no exchange happening on sign-in and sim-swaps are useless. Why do companies, especially banks, still use SMS for the second factor?

What is the downside of TOTP?

Someone stated the following, with regards to replacing a compromised computer with a new one: "The really good stuff uses cloud services to maintain persistence. As soon as you log into Google or Apple account on your new device you're compromised again." Can someone explain how it works, and are there ways around it?
What part of the cloud service and stored files will compromise a new computer? Is it code attached to cloud saved documents, and photos, or something else?

How can you be very secure on the internet if let's say you live in a bad country?

What are some steps I can take to be more secure? I'm not doing anything immoral, but I want to watch a certain content on youtube and read certain books and that's dangerous in my situation. And everything is connected to your phone number these days. How can I be more secure? And is it possible to watch youtube videos without using your phone number? Because you need a phone number to make a google account and a google account to go on youtube.

My school IT blocked my account after using NordVPN to connect. They say that "by using a VPN, you transmit your usernames/passwords through infrastructures managed by strangers, which represents a major security risk. The few American, Chinese, Israeli groups, etc., who actually own these solutions are primarily seeking financial profitability and do not protect their clients' accounts". But I use a VPN because I am on my student residency public network, which I think is worst without a VPN. I need advice from a computer security professional. Should I continue using VPN or not ? Is there something better to do ?

There was no link or anything threatening or overly suspicious. Perhaps it was a scam or maybe it was my bank sending me a code for something about DocuSign because 30mins later, I also got an email from my bank

https://github.com/patternknife/spring-security-oauth2-password-jpa-implementation

I work on a military installation.

Looking for a tool to scan my Windows systems for vulnerabilities (CVE type). Network not connected to anything outside of the room it is in, so download and burn to disk all monthly updates.

I used the SCAP tool regularly to scan my systems. MITRE used to have a website that had OVAL files for all types of systems and updated it at least monthly. I could add that file to the SCAP scan and get my info, but they do not update that site anymore and need something new.

I have RHEL and Windows system (3 pc's and two server 2016).

Red Hat updates their oval files all the time, so have that covered but need something for my Windows systems. Government seems to like ACAS/Nessus for scans, but inspectors said that is overkill for networks our size, and, honestly, I am having a hard time figuring out how to get it running. They recommended OpenVAS.

I went to their (OpenVas)site, asked some questions and they said they I'd need a hardware device to work with their stuff because we are not connected to the internet - weird that DCSA would say use it, and that it is free (site seems to make it seem like it is only free for 14 days).

Anyway, I am looking for recommendations on what to use to scan my windows systems for vulnerabilities.

I don’t mind doing manual updates, not too many systems, but need to find something.

Being the government, especially this time of year, free would be best.

Does anyone have any recommendations?

Thank you

Hello everyone. I'm currently trying to research what the best possible way of looking for WMI entries in an offline VM.

Full Scenario: System attacked with ransomeware. Kill the machine and restore from backup, but the ransomware installed a WMI downloader to re-deploy the ransomware.

Looking for best way to automate looking for WMI entries in offline VM's to build a process to remove those WMI entries to clean the backup before booting it back up.

Everything I seem to be looking at requires either a physical machine or presumes that you're booting into Windows and can boot into WinRE and can utilize the sysinternals suite of tools to perform the scanning. Looking to do this fully offline to prevent any option to have any hidden boot executables. I have tested using Autoruns with the -m option specifically to look for WMI, but cannot find the known WMI entry in this case.

Goal is to be able to do this in an automated way to discover such entries in the future, not just search for the known entry in this infected VM.

Thanks in advance.

Park’N Fly Breached Exposing Personal Info

Park’N Fly, a leading Canadian airport parking service, has reported a major data breach affecting approximately 1 million customers. The breach, which occurred between July 11 and July 13, 2024, involved unauthorized access through a remote VPN, exposing names, email addresses, and other personal details, but no financial information was compromised. The company detected the breach on August 1 and has since restored its systems, enhanced cybersecurity measures, and begun working with external experts.

Hi,

I was thinking of buying a fingerprint reader because it was cheap for added security but I'm not sure about the safety of the device since it's from a country that isnt mine.

Example is from a website called alis express chose the first one that popped up on the site.

https://preview.redd.it/s0dfrkztlwkd1.png?width=1018&format=png&auto=webp&s=8965531c4db05f290934effda269761320bc581d

Anyone who knows shit about pc security know about whether this sorta device could compromise my pc/network.

On a side note, been looking at robot vacuum cleaners that cost like $10 on that site. Going into paranoid territory but arent the makers just getting free floor plans to your house?

I am a web developer so I have some understanding about how computers work. I ask this to be sure if what I think is true.

Can you get any type of virus doing these actions listed below?(Assuming no zero day exploit is available and latest versions of popular OS's used like macOS 14 or Windows 11)

1. You get a download link or an mail attachment.
2. You download the file but you don't execute it or interact with it in any way.

If not would it be possible under these conditions:

1. You interact with the file like checking it in an hex editor but don't execute
2. You use a past version of an operating system like windows 7(My question here is are there vulnerabilities in old OS versions that would allow a sitting file to get executed If there are where I can check them)
3. Do phones work differently? Would using iOS or Android change the outcome?(again latest versions)