#Cyber and data security

[scipunk]

Hackers (1995)

[destielmemenews]

"In their statement on Friday, NPD warned that the “the information that was suspected of being breached contained name, email address, phone number, social security number, and mailing address(es).” It recommended the public to take a number of steps to safeguard their identities, including freezing their credit and putting fraud alerts on their files at big credit bureaus.

The breach came to public awareness after a class-action lawsuit was filed August 1 in U.S. District Court in Florida, which was first reported by Bloomberg Law.

National Public Data did not share how many people were at risk, but hackers, who have been identified as part of the hacking group USDoD, have been offering, for sale, what they claimed were billions of NPD records since April, though the Washington Post reported that “security researchers who looked at the trove said some of the claims were exaggerated.”"

source 1

source 2

source 3

free database created by Pentester to see if your information has been leaked

[allthecanadianpolitics]

All Calgary Public Library locations closed early on Friday after a cybersecurity breach compromised some systems, according to a spokesperson. All locations were shut down as of 5 p.m. The library says the closures are a proactive measure to mitigate the potential impact. All servers and computer access will also be shut off in addition to the closure of library locations. "Data security is a key priority for the library and our security team is working diligently to determine the scope of the breach," a library spokesperson said in a release. 

Continue Reading

Tagging: @newsfromstolenland, @abpoli

[fly-the-pattern]

[alyfoxxxen]

IRS Lawyer Ousted as Elon Musk’s DOGE Plans Even More Cuts | The New Republic

[disease]

a relatively concise explanation for any of those confused about decentralized social platforms. [ie: Mastodon, diaspora*, Friendica, Pixelfed, PeerTube, Lemmy, Bluesky, etc.]

[bynux]

Be Careful Putting Your Phone Down At Panera Bread Locations

I noticed my phone buzzing repeatedly when I'd have it open on the table at Panera, and on further review I realized that my phone was repeatedly scanning an NFC tag on the underside of the table. I'm assuming the servers use these as a shorthand way of confirming that food has been delivered to the correct table.

This is all well and good; this is a prime use case for NFC tags, and using an NFC reader app I was able to see that they're just basic numeric codes. As long as the tags aren't rewritable by anyone, they're not a security risk.

The NFC tags at Panera Bread are rewritable. Like, easily. Using a simple app you can get from the Google Play Store.

What this means is that someone can rewrite the NFC tags to redirect to a download link for malware, or a phishing website, or any number of other attack vectors.

I have more information about this issue on my personal website, as well as a video demonstrating the effect. My recommendation is to keep NFC turned off on your phone unless and until you're actively using it (for touchless payments, bus tickets, etc.).

[bisquid]

Change your passwords for... basically everywhere

It includes Tumblr Twitter Adobe Dropbox Telegram and others

[scipunk]

Hackers (1995)

[gwydionmisha]

IRS blocks Musk aide from accessing taxpayer data

Like the IRS, Social Security is labour intensive and essential.

[nando161mando]

Chrome/Google is blocking HSTS encrypted content sites like Wikipedia because this encryption blocks their plagiarist data/info crawler.

Google is NOT protecting "your" security.

[fly-the-pattern]

[alyfoxxxen]

Subaru Security Flaws Exposed Its System for Tracking Millions of Cars | WIRED

[pentesttestingcorp]

Symfony Clickjacking Prevention Guide

Clickjacking is a deceptive technique where attackers trick users into clicking on hidden elements, potentially leading to unauthorized actions. As a Symfony developer, it's crucial to implement measures to prevent such vulnerabilities.

🔍 Understanding Clickjacking

Clickjacking involves embedding a transparent iframe over a legitimate webpage, deceiving users into interacting with hidden content. This can lead to unauthorized actions, such as changing account settings or initiating transactions.

🛠️ Implementing X-Frame-Options in Symfony

The X-Frame-Options HTTP header is a primary defense against clickjacking. It controls whether a browser should be allowed to render a page in a <frame>, <iframe>, <embed>, or <object> tag.

Method 1: Using an Event Subscriber

Create an event subscriber to add the X-Frame-Options header to all responses:

// src/EventSubscriber/ClickjackingProtectionSubscriber.php namespace App\EventSubscriber; use Symfony\Component\EventDispatcher\EventSubscriberInterface; use Symfony\Component\HttpKernel\Event\ResponseEvent; use Symfony\Component\HttpKernel\KernelEvents; class ClickjackingProtectionSubscriber implements EventSubscriberInterface { public static function getSubscribedEvents() { return [ KernelEvents::RESPONSE => 'onKernelResponse', ]; } public function onKernelResponse(ResponseEvent $event) { $response = $event->getResponse(); $response->headers->set('X-Frame-Options', 'DENY'); } }

This approach ensures that all responses include the X-Frame-Options header, preventing the page from being embedded in frames or iframes.

Method 2: Using NelmioSecurityBundle

The NelmioSecurityBundle provides additional security features for Symfony applications, including clickjacking protection.

Install the bundle:

composer require nelmio/security-bundle

Configure the bundle in config/packages/nelmio_security.yaml:

nelmio_security: clickjacking: paths: '^/.*': DENY

This configuration adds the X-Frame-Options: DENY header to all responses, preventing the site from being embedded in frames or iframes.

🧪 Testing Your Application

To ensure your application is protected against clickjacking, use our Website Vulnerability Scanner. This tool scans your website for common vulnerabilities, including missing or misconfigured X-Frame-Options headers.

Screenshot of the free tools webpage where you can access security assessment tools.

After scanning for a Website Security check, you'll receive a detailed report highlighting any security issues:

An Example of a vulnerability assessment report generated with our free tool, providing insights into possible vulnerabilities.

🔒 Enhancing Security with Content Security Policy (CSP)

While X-Frame-Options is effective, modern browsers support the more flexible Content-Security-Policy (CSP) header, which provides granular control over framing.

Add the following header to your responses:

$response->headers->set('Content-Security-Policy', "frame-ancestors 'none';");

This directive prevents any domain from embedding your content, offering robust protection against clickjacking.

🧰 Additional Security Measures

CSRF Protection: Ensure that all forms include CSRF tokens to prevent cross-site request forgery attacks.

Regular Updates: Keep Symfony and all dependencies up to date to patch known vulnerabilities.

Security Audits: Conduct regular security audits to identify and address potential vulnerabilities.

📢 Explore More on Our Blog

For more insights into securing your Symfony applications, visit our Pentest Testing Blog. We cover a range of topics, including:

Preventing clickjacking in Laravel

Securing API endpoints

Mitigating SQL injection attacks

🛡️ Our Web Application Penetration Testing Services

Looking for a comprehensive security assessment? Our Web Application Penetration Testing Services offer:

Manual Testing: In-depth analysis by security experts.

Affordable Pricing: Services starting at $25/hr.

Detailed Reports: Actionable insights with remediation steps.

Contact us today for a free consultation and enhance your application's security posture.

[shumw4y]

🤖👽💀