#cybersec

[utopicwork]

GitHub - pi-hole/pi-hole: A black hole for Internet advertisements

A black hole for Internet advertisements. Contribute to pi-hole/pi-hole development by creating an account on GitHub.

Pi-hole is invaluable for more lightweight and safer browsing by blocking ads at the dns level. It also gives you some utilities for assigning domains to ips which can make a home network easier to handle.

[cyber-sec]

OysterLoader Revealed as Multi-Stage Malware Loader

OysterLoader, also known as Broomstick or CleanUp, delivers Rhysida ransomware and Vidar malware through multi-stage obfuscation and advanced command-and-control infrastructure.

Source: Sekoia

Read more: CyberSecBrief

[mutter-official]

calling all coders and cybersec peeps!

I'm giving a talk to my school's coding club soon about secure coding practices, and I'm looking for resources to help me write the talk!

so, what are your favorite resources that talk about secure coding practices? cybersec people, what do you send to coders when they do something insecure? coders, what are some things that have helped you become a more secure coder?

[dessiexyz]

Me: Hell yeah! I’m the Linux coach for my school’s CyberPatriot team! :3

New Member: Can I use HTML for scripting?

Me: I’m the Linux coach for my school’s CyberPatriot team….

[frog-kisser]

my cybersecurity courses in uni are like 15 years out of date and it drives me insane. and i dont mean in the "haha im so smart, i already know what a buffer overflow is thanks 2 tomert scotwald", i mean in the "they made this lab for android so long ago that when i follow the directions to the letter the app crashes since package naming schemes have changed and this attribute doesn't exist anymore" kinda way and it makes me want to beat powerful people with very heavy hammers

[internum--urbes]

[porgthespacepenguin]

1. How to setup 2FA on your accounts

As some of you may know, my friend @why-its-kai's Discord account was taken over this morning by a scammer.

The scam they used was this one, or close enough; but anyway, the exact specifics don't matter.

What matters is, it can happen to you. It can happen to anyone.

The good news is, you can learn how to protect yourself. Making some small changes can already improve your online security by leaps and bounds.

I made a series of 3 posts covering the basics:

How to setup 2FA on your accounts (you are here!)

How to spot a scam

How to set up a password manager.

Protect yourself with 2FA

Two-factor authentication, or 2FA, isn't a silver bullet -- but it exponentially increases your online safety by adding an extra step to the login process that a hacker/scammer does not have access to.

Every account that you care about (and even those you don't) should have some form of 2FA enabled.

Especially email -- should your email become compromised, this can become a catastrophe.

(For websites that don't support 2FA, use a burner email!)

What 2FA should I use?

2FA can take many forms, from the highly convenient (SMS, email) to the highly secure (security keys), but one thing is certain:

Any form of 2FA is better than nothing.

The simplest forms of 2FA are phone number or email. While these are very easy to use, they are unfortunately not very secure.

Still, I repeat: despite their flaws, these forms of 2FA are absolutely, 100% better than not having any 2FA at all.

On the other end of the spectrum, security keys (like for example a Yubikey) are extremely secure, but they cost money and are a bit of a hassle at time. I use them, but for most people, it's overkill.

What you want is an authenticator app.

Important

A note, before we go on…

If you enable multiple forms of 2FA, how secure your account is will depend on your weakest link.

For example, if you enable SMS authentication AND register a security key, your account will only be as safe as the SMS authentication. The security key is essentially useless.

In other words, the least secure form of 2FA you add determines the overall security of your account.

Sometimes, less is more!

Authenticator Apps

First, choose a free, reputable authenticator. Google Authenticator is a good choice. So are Aegis Authenticator or Microsoft Authenticator.

For simplicity, we'll go with Google Authenticator; the process is rather similar for most authenticators.

First, download the app from your app store and install it on your phone.

Enrolling Gmail into GA

Securing your email should be your number 1 priority, so let's enroll a Google account to Google Authenticator.

Let's enable two-step verification first.

Phone number is better than nothing, but not very safe (SMS verification can be spoofed), so let's click on "Add authenticator app".

Click on "Set up authenticator". Google will generate a QR-code.

Next, go back to your phone and click on the little multicolored cross. It will bring up a menu; click on "scan a QR code".

Go ahead and scan the QR code.

Congratulations, you have enrolled your Google account!

Now, whenever you are asked for a 2FA code, just open the app and copy/paste it.

Note: the codes are stored locally on your phone.

Enabling 2FA on Discord

The process is fairly similar. Go to Settings > My Account:

Click on "Enable Authenticator App". You will be prompted for your password. Enter it.

Download Google Authenticator if you haven't already. Scan the QR code as described above.

Do take the time to download your backup codes as well!

As explained above, I personally do not recommend setting up SMS authentication here, since authenticator apps are supported, as this weakens the overall security of your account for little benefit.

Stay tuned for parts 2 and 3!

If you have any questions, feel free to PM me.

[cypheroxide]

The Hacker's Guidebook:

Aspiring hackers! I’ve created a guide covering core cybersecurity concepts new hackers should master before tools. I break down networking, OS internals, & hacking tactics. Recognize hacking as lifelong journey—arm yourself with the basics!

Core Concepts for Budding Cybersecurity Enthusiasts The Building Blocks of Ethical Hacking So you want to become an ethical hacker and enter the exciting world of cybersecurity. That’s awesome! However, before you dive headfirst into firing up Kali Linux and hacking everything in sight, it’s vital to build up your foundational knowledge across several InfoSec domains. Mastering the fundamentals…

View On WordPress