wicked.design

We did it - our second OSINT course for students at University of Zurich and ETH Zürich. This time we went for a bit more tech. 🔥 The goal was not only to teach hands-on OSINT techniques but also to build digital litracy, providing an understanding of the digital world around us. What happens when you click a link? 🔗 🐾 What information can be gathered and how does data flow on the internet? Can this be used to track the location of someones smartphone?📱🗺️📍 From there we ventured to the command line, looked 🔍 at hash values to "fingerprint" data and verify evidence. We analyzed metadata in images 🌆, worked with GPS coordinates 🛰️ and used various sources like OpenStreetMap and Google satellite images to verify and recognize manipulations 🕵️♀️🕵️♂️. And we even manipulated some metadata ourselves. 👩💻👨💻 A big shoutout to Markus Christen, Melanie Knieps and Leyla Ciragan from University of Zurich 💪 You did an amazing job to bring digital literacy, OSINT, information security and privacy to the curriculum. I am very excited to bring this hands on part and I am looking forward to what is about to come 😎 #OSINT #Academia #Curriculum #DigitalLiteracy #InformationSecurity #Research #DigitalSkills #Education #HigherEducation #Privacy #OPSEC #Teaching #Lecturing #Hacking #CyberSecurity #Metadat #University

The cloud is more secure? "[T]he Board identified a series of Microsoft operational and strategic decisions that collectively point to a corporate culture that deprioritized both enterprise security investments and rigorous risk management." [01] The Cybersecurity and Infrastructure Security Agency recently published their review of the Summer 2023 Microsoft Exchange Online breach by 🇨🇳 Storm-0558. 💢Microsoft was unable to detect neither the 2021 compromised laptop nor the breach itself. 💢It required a client to detect and inform Microsoft while it failed security practices that other cloud service providers deployed. To me even worse is the failed communication by Microsoft towards their customers: 💢"decision not to correct, in a timely manner, its inaccurate public statements about this incident, including a corporate statement that Microsoft believed it had determined the likely root cause of the intrusion when in fact, it still has not;" Three important learnings: 1️⃣ The challenge of visibility, or lack thereof. Yes, Microsoft offers a lot of logging and security solutions. But they come at a price tag. Something David Kennedy also mentioned. [02] Remember, it took public pressure for Microsoft to provide their clients with the necessary data for free. [03] [04] If you haven't been at MS premium logging tier, you would not have any chance to identify the malicious activity. 2️⃣ Have BCM plan that acknolwedges the failure of your CSP and a lack of communication and support from them. 3️⃣ Rethink your security practice. Is "cloud only / first" really the only option? And if it is, do you have the necessary budget for all licensing? Sometimes on-premise or the cooperation with a local service provider is more effective. PS: Deputy Chair of the board is Dmitri Alperovitch, cofounder of CrowdStrike - a cyber-security company selling competing solutions to MS. People might see a certain conflict of interest here. Even though he apparently is an expert on the topic. [01] https://lnkd.in/eaddfPhA [02] https://lnkd.in/eHAf7Ct4 [03] https://lnkd.in/eHah5Put [04] https://lnkd.in/evHDN9gk #Microsoft #Azure #Cloud #CloudSecurity #CISA #Breach #China #Storm0558 #Exchange #InformationSecurity #CloudSecurity #Crowdstrike #NationState #Government #SIEM

Over the last few days a millions of records from U.S. military, intelligence and other federal agencies were leaked on an infamous forum. Today's spies no longer have to hack, they can simply purchase intel from various forums. The threat actors are credible, based on their past activities. 🔥 A breach of Acuity Inc., working for the five eyes intelligence group Australia, Canada, New Zealand, the United Kingdom, and the United States, leaked: - full names, - emails, - office numbers, - personal cell numbers - email addresses (Government, Military & Pentagon) - classified information and communications between the 5 eyes, 14 eyes and the US's allies. 🔥 The second breach affects US Air Force and the US Navy. The leak includes: - root cert - p12 file - jar files - information about various cloud buckets. 🔥 From the US's Department of Defense they leaked information about communications between the Pentagon and the US Army's CIO / G-6 (however most appear to be unclassified) 🔥 The fourth breach is about the United States Citizenship and Immigration Services and the U.S. Immigration and Customs Enforcement. Threat actors stole about 100.000 records, including: - Full name, - Passport, - Address, - Email, - Physical attributes, - Phone numbers & - date of birth. 🔥 The fith breach is the United States Department of Education database. The incident apparently happened already in August 2023. The leak contains 8.9 million people's - phone numbers - User IDs. #Breach #PII #Privacy #InformationSecurity #Military #Intelligence #Espionage #DataPrivacy #Navy #DoD #Army #5Eyes #USA #ICE

👋 Meet us at the Tech Show in Frankfurt at the Cloud & Cyber Security Expo! From May 22 to 23, 2024, you have the chance to talk with our business-messaging experts Elisabeth Rötsch and Miguel Rodriguez about secure messaging in companies. 📍 You can find us in hall 8, booth number J065. To arrange an appointment and find more information, please follow this link: https://lnkd.in/dD8vDj5H #TechShowFrankfurt #TSF24 #CCSEF24 #ThreemaWork #BusinessMessaging #Cybersecurity

Nation State Actor Midnight Blizzard / NOBELIUM breached Microsoft, again. The Russian state actors used credentials stolen in their November 2023 attack to regain foothold. They successfullfy accessed MS source code repositories and internal systems. Apparently they also try to exploit credentials / secret shared between MS and its clients. This might also endanger client systems.     - https://lnkd.in/ezBM4yfH - https://lnkd.in/etCxbexH #Microsoft #Russia #NationState #Cybersecurity #Hacking #Breach #SocialEngineering #Microsoft #midnightblizzard #nobelium

Was bedeutete der Xplain Hack für die Schweizer Regierung?  Das National Cyber Security Centre NCSC (NCSC_CH) hat heute seine Untersuchung in einem Bericht veröffentlicht. Der Leak enthielt knapp 1.3 Mio. Objekte, davon 9’040 der Bundesverwaltung.  Ist ja gar nicht so viel, könnte man meinen. Allerdings enthielten die veröffentlichen Daten sensitive Daten: 🔸 4’779 Objekte, Personendaten wie Name, E-Mail, Telefonnummer, Adresse, usw.  🔸 278 Objekte fallen in die Kategorie der technischen Informationen wie Dokumentationen von IT-Systemen, Anforderungsdokumente zu Applikationen oder Architekturbeschreibungen.  🔸 121 Objekte sind gemäss Informationsschutzverordnung klassifiziert.  🔸 4 Objekte enthalten lesbare Passwörter! Wer war betroffen? 🔸 95% der Objekte sind dem Eidgenössischen Generalsekretariat GS-EJPD – dem Bundesamt für Justiz BJ, State Secretariat for Migration SEM, Switzerland, Informatik Service Center ISC-EJPD – zuzuordnen.  🔸 Daten des General Secretariat GS-DDPS machten 3% (271 Objekte) aus. Bei solch brisanten Inhalten und der Kritikalität der betroffenen Bereiche ist davon auszugehen das die geleakten Daten bei kriminellen und staatlichen Akteuren von grossem Interesse sind.  Sicherlich werden die Passwörter mittlerweile geändert worden sein. Wie oft haben wir jedoch gesehen das Passwörter mehrfach genutzt worden? Informationen zu Architekturen und Anforderungen können wertvolle Informationen preisgeben. Diese lassen sich selten mittelfristig ändern sondern müssen durch erweiterte Massnahmen adressiert werden.  Zusätzlich ist es möglich das die Daten für Social Engineering missbraucht werden, entweder via eMail, über SMS oder auch über die Profile auf sozialen Medien. Cyber-security ist ein ernstzunehmendes Thema, wir müssen endlich weg von reaktiven Tätigkeiten hin zu einem proaktiven Schutz.  Und nein, damit meine ich nicht noch mehr Dokumente und Papier von Schutzbedarfsfeststellungen, Konzepte und Risikolisten. Wir müssen Massnahmen umsetzen! Statement: https://lnkd.in/eygYZWCg Report: https://lnkd.in/eFUDsCua Watson: https://lnkd.in/e6kHFZ4b #Xplain #Cybersecurity #Cybercrime #Nationstate #Hacking #Hacer #Criminals #Switzerland #Interpol #Ransomware #Informationsecurity