Shakedown Social

Kevin Karhan :verified:<a href="https://cyberplace.social/@GossiTheDog" class="u-url mention" rel="nofollow noopener" target="_blank">@GossiTheDog</a> <a href="https://mastodon.world/@signalapp" class="u-url mention" rel="nofollow noopener" target="_blank">@signalapp</a> it merely prevents <a href="https://infosec.space/tags/Screenshots" class="mention hashtag" rel="nofollow noopener" target="_blank">#Screenshots</a> by claiming it's <a href="https://infosec.space/tags/DRM" class="mention hashtag" rel="nofollow noopener" target="_blank">#DRM</a>'d content.<ul><li>It's a mere ask and <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#Microsoft</a> could specifically close that <a href="https://infosec.space/tags/API" class="mention hashtag" rel="nofollow noopener" target="_blank">#API</a> and make it subject to contractual agreements (as they did with their <a href="https://infosec.space/tags/Antivirus" class="mention hashtag" rel="nofollow noopener" target="_blank">#Antivirus</a> API calls to disable <a href="https://infosec.space/tags/WindowsDefender" class="mention hashtag" rel="nofollow noopener" target="_blank">#WindowsDefender</a>!) if they decide this is against their wishes.</li><li>It also doesn't prevent the <a href="https://infosec.space/tags/Keylogger" class="mention hashtag" rel="nofollow noopener" target="_blank">#Keylogger</a> nor works against the <a href="http://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener" target="_blank">known</a> <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoAPI</a> <a href="https://infosec.space/tags/backdoor" class="mention hashtag" rel="nofollow noopener" target="_blank">#backdoor</a> affecting all <a href="https://infosec.space/tags/Browsers" class="mention hashtag" rel="nofollow noopener" target="_blank">#Browsers</a> (except <a href="https://infosec.space/tags/Firefox" class="mention hashtag" rel="nofollow noopener" target="_blank">#Firefox</a> and <a href="https://mastodon.social/@torproject" class="u-url mention" rel="nofollow noopener" target="_blank">@torproject</a> / <a href="https://infosec.space/tags/TorBrowser" class="mention hashtag" rel="nofollow noopener" target="_blank">#TorBrowser</a>) which can be triggered by a single <a href="https://infosec.space/tags/HTTPS" class="mention hashtag" rel="nofollow noopener" target="_blank">#HTTPS</a> request.</li></ul>The correct solution for <a href="https://infosec.space/tags/Signal" class="mention hashtag" rel="nofollow noopener" target="_blank">#Signal</a> would be to alert all their users and specifically block <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows</a> in general or at least <a href="https://infosec.space/tags/Windows11" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows11</a> simply because it is a <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Govware</a> and empirically cannot be made private or secure.But that would require them to actually give a shit, which thed don't, cuz otherwise they would've stopped demanding <a href="https://infosec.space/tags/PII" class="mention hashtag" rel="nofollow noopener" target="_blank">#PII</a> like a <a href="https://infosec.space/tags/PhoneNumber" class="mention hashtag" rel="nofollow noopener" target="_blank">#PhoneNumber</a> and moved out of juristiction of <a href="https://infosec.space/tags/CloudAct" class="mention hashtag" rel="nofollow noopener" target="_blank">#CloudAct</a>.<ul><li>I mean, what's gonna prevent the <a href="https://infosec.space/tags/Trump" class="mention hashtag" rel="nofollow noopener" target="_blank">#Trump</a>-Regime from threatening <a href="https://mastodon.world/@Mer__edith" class="u-url mention" rel="nofollow noopener" target="_blank">@Mer__edith</a> et. al. with lifetime in jail for not kicking the <a href="https://infosec.space/tags/ICC" class="mention hashtag" rel="nofollow noopener" target="_blank">#ICC</a> (or anyone else he and his fans dislike) from <a href="https://infosec.space/tags/Signal" class="mention hashtag" rel="nofollow noopener" target="_blank">#Signal</a>'s infrastructure?</li></ul>Since they are highly centralized.they certainly are capable to comply with "<a href="https://infosec.space/tags/Sanctions" class="mention hashtag" rel="nofollow noopener" target="_blank">#Sanctions</a>" (or whatever bs he'll claim!)...

Kevin Karhan :verified:<a href="https://mastodon.world/@signalapp" class="u-url mention" rel="nofollow noopener" target="_blank">@signalapp</a> Personally, I think warning people against using <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows</a> - espechally <a href="https://infosec.space/tags/Windows11" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows11</a> - at all would be more effective.<a href="https://infosec.space/tags/Espechally" class="mention hashtag" rel="nofollow noopener" target="_blank">#Espechally</a> since that <a href="https://infosec.space/tags/DRM" class="mention hashtag" rel="nofollow noopener" target="_blank">#DRM</a> <a href="https://infosec.space/tags/hack" class="mention hashtag" rel="nofollow noopener" target="_blank">#hack</a> is an <a href="https://infosec.space/tags/ask" class="mention hashtag" rel="nofollow noopener" target="_blank">#ask</a> and doesn't undo the <a href="https://infosec.space/tags/Keylogger" class="mention hashtag" rel="nofollow noopener" target="_blank">#Keylogger</a> that <a href="https://infosec.space/tags/MicrosoftRecall" class="mention hashtag" rel="nofollow noopener" target="_blank">#MicrosoftRecall</a> includes! But hey, feel free to shill <a href="https://infosec.space/tags/TechIlliterates" class="mention hashtag" rel="nofollow noopener" target="_blank">#TechIlliterates</a> a false sense of <a href="https://infosec.space/tags/PseudoSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#PseudoSecurity</a> instead of making your <a href="https://infosec.space/tags/App" class="mention hashtag" rel="nofollow noopener" target="_blank">#App</a> actually secure!

not Evander SinqueEs gibt nichts zu sehen, bitte gehen Sie weiter. <a href="https://mastodon.social/tags/microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#microsoft</a> <a href="https://mastodon.social/tags/keylogger" class="mention hashtag" rel="nofollow noopener" target="_blank">#keylogger</a> <a href="https://mastodon.social/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a>

Dissent Doe :cupofcoffee:Today's reminder of the insider threat involves a pharmacist in Maryland who over a period of 8 years or more, used keyloggers and installed spyware on about 400 computers at the University of Maryland Medical System so he could spy on female co-workers in private moments at work (such as changing clothes, breastfeeding their babies), and in their homes. He was reportedly fired in October 2024, and was able to get another job in another healthcare facility in Maryland because there has been no criminal charges filed against him yet and UMMS apparently didn't alert his new employer. If Maryland law is like my state's laws, the hospital may be barred legally from revealing what happened if asked for a recommendation by the new employer. And it seems the Maryland state pharmacy board can't just suspend a license unless there's been a conviction, so the failure to have criminal charges filed already seems to have put more potential victims at risk. Unsurprisingly, a potential class action lawsuit has already been filed against UMMS with six plaintiffs so far. There are estimates that there are more than 80 victims of the now-former employee. Some of the media coverage on the case: <a href="https://thedailyrecord.com/2025/04/04/six-women-sue-umms-claiming-staffer-spied-on-them-after-security-breach/" rel="nofollow noopener" translate="no" target="_blank">https://thedailyrecord.com/2025/04/04/six-women-sue-umms-claiming-staffer-spied-on-them-after-security-breach/</a><a href="https://infosec.exchange/tags/InsiderThreat" class="mention hashtag" rel="nofollow noopener" target="_blank">#InsiderThreat</a> <a href="https://infosec.exchange/tags/keylogger" class="mention hashtag" rel="nofollow noopener" target="_blank">#keylogger</a> <a href="https://infosec.exchange/tags/workplace" class="mention hashtag" rel="nofollow noopener" target="_blank">#workplace</a> <a href="https://infosec.exchange/tags/privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#privacy</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a>

BradSocial media post I authored for my employer at <a href="https://www.linkedin.com/posts/unit42_malspam-guloader-remcos-ugcPost-7234210583800135680-3F6J/" rel="nofollow noopener" translate="no" target="_blank">https://www.linkedin.com/posts/unit42_malspam-guloader-remcos-ugcPost-7234210583800135680-3F6J/</a> and <a href="https://x.com/Unit42_Intel/status/1828444963001995599" rel="nofollow noopener" translate="no" target="_blank">https://x.com/Unit42_Intel/status/1828444963001995599</a>2024-08-26 (Monday): <a href="https://infosec.exchange/tags/malspam" class="mention hashtag" rel="nofollow noopener" target="_blank">#malspam</a> pushing <a href="https://infosec.exchange/tags/GuLoader" class="mention hashtag" rel="nofollow noopener" target="_blank">#GuLoader</a> for <a href="https://infosec.exchange/tags/Remcos" class="mention hashtag" rel="nofollow noopener" target="_blank">#Remcos</a> <a href="https://infosec.exchange/tags/RAT" class="mention hashtag" rel="nofollow noopener" target="_blank">#RAT</a> (<a href="https://infosec.exchange/tags/RemcosRAT" class="mention hashtag" rel="nofollow noopener" target="_blank">#RemcosRAT</a>). Steals login credentials and runs <a href="https://infosec.exchange/tags/keylogger" class="mention hashtag" rel="nofollow noopener" target="_blank">#keylogger</a>. Indicators available at <a href="https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2024-08-26-GuLoader-for-Remcos-RAT-IOCs.txt" rel="nofollow noopener" translate="no" target="_blank">https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2024-08-26-GuLoader-for-Remcos-RAT-IOCs.txt</a>A <a href="https://infosec.exchange/tags/pcap" class="mention hashtag" rel="nofollow noopener" target="_blank">#pcap</a> of the GuLoader/Remcos RAT infection traffic and the associated <a href="https://infosec.exchange/tags/malspam" class="mention hashtag" rel="nofollow noopener" target="_blank">#malspam</a>, <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> and artifacts are available at <a href="https://malware-traffic-analysis.net/2024/08/26/index.html" rel="nofollow noopener" translate="no" target="_blank">https://malware-traffic-analysis.net/2024/08/26/index.html</a>

Kevin Karhan :verified:<a href="https://awscommunity.social/@Quinnypig" class="u-url mention" rel="nofollow noopener" target="_blank">@Quinnypig</a> the sheer fact that <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#Microsoft</a> and <a href="https://infosec.space/tags/Windows11" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows11</a> ain't banned across the <a href="https://infosec.space/tags/EU" class="mention hashtag" rel="nofollow noopener" target="_blank">#EU</a> to this day is an indictment to the <a href="https://infosec.space/tags/TechIlliteracy" class="mention hashtag" rel="nofollow noopener" target="_blank">#TechIlliteracy</a> of politicans in the <a href="https://ec.social-network.europa.eu/@EUCommission" class="u-url mention" rel="nofollow noopener" target="_blank">@EUCommission</a> & <a href="https://respublicae.eu/@europarl_en" class="u-url mention" rel="nofollow noopener" target="_blank">@europarl_en</a> despite<ul><li><a href="https://infosec.space/tags/PRISM" class="mention hashtag" rel="nofollow noopener" target="_blank">#PRISM</a></li><li><a href="https://infosec.space/tags/GoldenKeyBoot" class="mention hashtag" rel="nofollow noopener" target="_blank">#GoldenKeyBoot</a> (aka. <a href="https://infosec.space/tags/CensorBoot" class="mention hashtag" rel="nofollow noopener" target="_blank">#CensorBoot</a> got owned!)</li><li><a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoAPI</a> <a href="https://infosec.space/tags/backdoors" class="mention hashtag" rel="nofollow noopener" target="_blank">#backdoors</a> <a href="https://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener" target="_blank">they refuse to acknowledge or fix at all</a>!</li><li><a href="https://infosec.space/tags/CloudAct" class="mention hashtag" rel="nofollow noopener" target="_blank">#CloudAct</a></li><li>Unwillingness to comply with <a href="https://infosec.space/tags/GDPR" class="mention hashtag" rel="nofollow noopener" target="_blank">#GDPR</a> out if the box</li></ul>and now<ul><li><a href="https://infosec.space/tags/Recall" class="mention hashtag" rel="nofollow noopener" target="_blank">#Recall</a> aka. the worst disguised <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Govware</a> / <a href="https://infosec.space/tags/Spyware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Spyware</a> in existance that allows anyone to <a href="https://github.com/xaitax/TotalRecall" rel="nofollow noopener" target="_blank">simply extract credentials</a> without the need to install a <a href="https://infosec.space/tags/Keylogger" class="mention hashtag" rel="nofollow noopener" target="_blank">#Keylogger</a>, <a href="https://infosec.space/tags/ScreenRecorder" class="mention hashtag" rel="nofollow noopener" target="_blank">#ScreenRecorder</a> and/or commit <a href="https://infosec.space/tags/ProvilegueEscalatiom" class="mention hashtag" rel="nofollow noopener" target="_blank">#ProvilegueEscalatiom</a> successfully at all...</li></ul>And since <a href="https://cyberplace.social/@GossiTheDog" class="u-url mention" rel="nofollow noopener" target="_blank">@GossiTheDog</a> managed to get it running on a system w/o "<a href="https://infosec.space/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#AI</a>" acceleration aka. "<a href="https://infosec.space/tags/NPU" class="mention hashtag" rel="nofollow noopener" target="_blank">#NPU</a>" it's safe to assume that it'll be perfectly possible to retroactively shove it down everyones' throats without recourse!<ul><li>Actually there are options for recourse besides "<a href="https://infosec.space/tags/ThoughtsAndPrayers" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThoughtsAndPrayers</a>" that regulators like <a href="https://social.bund.de/@bsi" class="u-url mention" rel="nofollow noopener" target="_blank">@bsi</a> would actually take this seriously: </li></ul>Like: Stop using <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows</a> and <a href="https://www.youtube.com/watch?v=PkKfV0ATrH4" rel="nofollow noopener" target="_blank">get some help</a> migrating away from it to a good <a href="https://infosec.space/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#Linux</a> distro!<a href="https://infosec.space/tags/WhatYouAllowIsWhatWillContinue" class="mention hashtag" rel="nofollow noopener" target="_blank">#WhatYouAllowIsWhatWillContinue</a>

Linux MagazineIs someone listening in on your typing? Chris Binnie shows you how acoustic keyloggers work <a href="https://www.linux-magazine.com/Issues/2024/278/Acoustic-Keyloggers" rel="nofollow noopener" translate="no" target="_blank">https://www.linux-magazine.com/Issues/2024/278/Acoustic-Keyloggers</a> <a href="https://fosstodon.org/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> <a href="https://fosstodon.org/tags/keylogger" class="mention hashtag" rel="nofollow noopener" target="_blank">#keylogger</a> <a href="https://fosstodon.org/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#AI</a> <a href="https://fosstodon.org/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> <a href="https://fosstodon.org/tags/EDR" class="mention hashtag" rel="nofollow noopener" target="_blank">#EDR</a> <a href="https://fosstodon.org/tags/privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#privacy</a> <a href="https://fosstodon.org/tags/attack" class="mention hashtag" rel="nofollow noopener" target="_blank">#attack</a>

Recent searches

Search options

Administered by:

Server stats:

#keylogger