#Cybersecurity Importance

[itcsssolutionandstaffing]

Organizations and businesses value cyber security now more than ever. Did you know data breaches in the US cost twice as much as the global average? According to an IBM report, $9.44 million is the average data breach cost in the United States. Below are the reasons you should prioritize cyber security.

[river-taxbird]

SCAM ALERT: Cryptocurrency related but can affect trans people buying HRT. I was probably 10 seconds away from having money stolen and I know what I'm doing. (Crypto Clipper)

Today I was helping a trans friend order some DIY HRT. A lot of DIY HRT places only accept cryptocurrency for security reasons. I am not looking to promote cryptocurrency or anything associated with it, but if you may be forced to use it for HRT or other reasons, you need to know this.

In general if you are forced to use crypto, you should use the cheapest coin your supplier will accept. If it is cheap, that means there is not a lot of activity on the chain and energy use will be less. I used one called Zcash as it was the cheapest one the site accepted but that's not really relevant.

I used an old coinbase account I had used for similar situations in the past. I was doing it on her PC. I got the instructions to pay on the HRT site, and I pasted the wallet address into Coinbase and just before I hit send I noticed the wallet address I had pasted didn't match the wallet address I had copied.

I looked it up and found this is from a form of malware called a Crypto Clipper, that detects when you have copied a crypto address, and makes you paste a different one so it can steal your money. I am lucky I noticed. To remedy it, I installed the free trial of Malwarebytes on her PC to remove malware, and completed the crypto transaction on my PC, and confirmed that the wallet address matched what the HRT site had given me.

I managed to avoid falling for it but it's such an easy thing to fall for, especially if you have avoided crypto thus far for extremely understandable reasons. Be careful out there! It could happen to anyone.

[wandering-wolf23]

Security PSA

Look, this is real talk. I’m going to put aside my opinions about fiction for a moment and talk about something that has been bothering me for awhile.

Antis, if you are going to call proshippers out on apps like TikTok or Instagram (hell, even Tumblr or Twitter!), do not put your real face in the video. Do not use your name, birth date, or anything else that might identify you. Proshippers, if you are going to call out antis, the above applies to you.

Why? Because if you do, that video is going to follow you around. Videos are downloaded, posted to other sites, and otherwise preserved in ways that you can’t destroy just by deleting the video. It also becomes blackmail material and can bar you from jobs that require a background check or a security clearance.

Please be careful. I see so many young people on this site and many others who do not know basic internet safety/cyber security. It’s scary. It makes minors far more vulnerable to predators than they might be otherwise.

There are predators on the internet and in every community. You are never truly safe on the web. There are very bad people hiding under the guise of being a “safe” adult who want to hurt you for some sick thrill.

Please be careful, both for your safety now and your life later on down the road.

[concretdandelion]

dans rant about being jealous of other people having had a better education than you is literally so valid. nothing grinds my gears more than someone not being able to comprehend that some of us didn't get nice compsci classes in high school some of us got hour of code and the earth science teacher.

[nyanofilter]

The EFF, the Electronic Frontier Foundation, came in clutch this year with a nice intro to cybersecurity and best practices for queer folks online and on our own devices. The article also has links for safety for activists, and other helpful articles about general "surveillance self-defense," as they aptly name it.

Highly recommend sharing this around. Stay safe, folks!

[daniel-nerd]

if you use linux, UPDATE YOU SYSTEM NOW

XZ got backdoored, specifically the release tarballs of version 5.6.0-1 and 5.6.1-1.

for more information on the status in your specific distro go to their website.

for more information on the backdoor itself its CVE-2024-3094

[undedkat]

Hey FYI - lastpass got hacked. Make sure you recycle all of your passwords and be sure to add 2FA to any government or financial accounts.

[amethystsoda]

Part 2 of the “tiktok ban” bill info — what you can do as a US resident to help fight the bill

[tales-of-magic-and-chaos]

A supermassive data leak has been discovered (the biggest ever in fact.) : what does it mean and what to do?

(This is a small amateur post by someone interested in privacy and safety online and that wants to encourage good habits. And this with this new leak, it is a good time to remind people of a few basic habits to have online. This is meant to be accessible as much as possible and the list of tips is non-exhaustive.) (+See the end for a few of the sources used)

A new data leak of 12 terabytes of information, some compiled from previous data breaches, has been publicly posted and exposed. A lot of big websites are concerned, such as : weibo, tencent, twitter, Adobe, Wattpad, MySpace, Deezer, LinkedIn, Canva, Dropbox, Telegram.... So yeah. You are very likely to be concerned.

How to know if you are concerned?

The website Cybernews propose a tool to easily search If you're concerned by the data leak and there is also the classic Have I Been Pwned. You can also check the leaked data yourself.

In any case, don't panic. If you're concerned start by changing your passwords (your email's password too. Especially this one.) and maybe look into improving your habits online.

Some tips to improve your safety online

Whether you're concerned or not by the data breach, there are some easy tips and habit you can use to improve your security.

- DO NOT USE THE SAME PASSWORD ON EVERY WEBSITE.

- DO NOT use a SIMILAR password with only slight differences and the same method to create it either !!!!

- DO use a strong password: long (like at least 10 characters), complex with several letters (lower and upper case), several numbers and others characters in a random/complex order. You can also use a sentence as a password (complexified ofc) for example.

- Enable two-factor authentification when you can.

- I advise to use a password manager if you can and want. Choose wisely but there are some great options, with free and premiums possibilities such as Dashline, Bitwarden, 1Password or the recent ProtonPass. Be careful to choose a very strong master password that you'll be able to memorize!

- Bonus: use aliases for you emails (for example via SimpleLogin)

To learn more + ressources that I personally like :

- Cybernews' article on this data leak

- Forbes' article

- NBTV : a YouTube channel, they're also on other platforms, that educates on the subjects of privacy and safety online.

- Proton: a Swiss-based society that proposes several privacy-based services such as ProtonMail, ProtonPass, Proton Drive, ProtonVPN... The free options are already quite interesting imo but you can also upgrade to a paid plan for additional storage and more options (they are often on sales and if you use them they are worth it). (There are other options if you prefer)

- SimpleLogin: allows you to create multiple aliases for the same mail address (there are other options)

[asalescommunity]

Can a cybersecurity service verify who does a fraud?

Yes, 30 people a day.

For a verification in a correct manner go to SEO.

[lyxthen]

Hey! Gentle reminder to change your passwords if you haven't done so in a while. Be safe :)

[wandering-wolf23]

Cybersecurity PSA 2

Hi there! It’s your friendly neighborhood cybersecurity wolf back with another helpful guide!

Today’s topic is what to do if you find nasty, possibly illegal shit online. (Yeah, I know it sucks, but I’m trying to combat misinformation and keep people safe). This is going to be a heavy topic, so feel free to block, scroll past, or otherwise ignore. Just don’t be a dick, okay?

There are lots of nasty people on the internet who probably do not have your best interests at heart. If you see something, say something... by reporting it to the site in question or, if necessary, the FBI Cyber Tip Line. Report things that break TOS to the site in question (example: report porn bots to Tumblr as spam, but don’t send that to the FBI. That can be seen as making a false report, which leaves you liable for fines and/or jail time).

If you find actual, real CSAM, whatever you do... DON’T SHARE IT! Not even to make a report! Do not link other people to the site. Do not take screenshots. Fill out a report on the Cyber Tip Line (linked here and in the third hyperlink), report it to the site, and exit out. Don’t take screenshots and try to make a callout post. This counts as distribution and can get you in a shit load of trouble.

Do not tell anyone what you found except the FBI or the site admins. Links to the predator in question are definitely illegal, as are callouts using screenshots of CSAM the predator had on their profile no matter if you censor it. That’s still distribution and you’re looking at a nasty penalty. The FBI takes a very dim view of this, no matter how good your intentions are.

Nasty fan art is, unfortunately, a grey area. If it’s a photo-realistic drawing/3D render, that’s illegal and goes to the FBI. It does not get shared around on a callout. It gets reported to the FBI and the site admins. They will take care of it.

If it’s not realistic or a 3D render, that is reported to the site admins while you block and get the fuck out of there. This also does not get flashed around on a callout because minors might be exposed to some very fucked up porn. Harassment of the person in question can get you in hot water, legally, and you never know who you are talking to. I’m not sure how many people have been sued for harassment on Tumblr/Twitter/Tiktok/Instagram, but it was really suck to be the first.

You don’t want to make history that way. Trust me.

I hope this little cybersecurity lesson helps! Thank you to anyone who has read this far. Have a great day/night/morning/evening/whatever time it is out there and stay safe on the internet!

[koukles]

Hey so for real 29k TikTok accounts got breached as of November 27 2022. I made a site containing a file which has ONLY the USERNAMES of affected users, for the purpose of you can search for your name to see if you’ve been affected.

I know I’m posting this on my doll blog, but it could be one of you which are hacked. If you have been affected, change your password and turn on 2FA. Change your password on other sites as well and don’t re-use passwords.

[luetta]

idk if people on tumblr know about this but a cybersecurity software called crowdstrike just did what is probably the single biggest fuck up in any sector in the past 10 years. it's monumentally bad. literally the most horror-inducing nightmare scenario for a tech company.

some info, crowdstrike is essentially an antivirus software for enterprises. which means normal laypeople cant really get it, they're for businesses and organisations and important stuff.

so, on a friday evening (it of course wasnt friday everywhere but it was friday evening in oceania which is where it first started causing damage due to europe and na being asleep), crowdstrike pushed out an update to their windows users that caused a bug.

before i get into what the bug is, know that friday evening is the worst possible time to do this because people are going home. the weekend is starting. offices dont have people in them. this is just one of many perfectly placed failures in the rube goldburg machine of crowdstrike. there's a reason friday is called 'dont push to live friday' or more to the point 'dont fuck it up friday'

so, at 3pm at friday, an update comes rolling into crowdstrike users which is automatically implemented. this update immediately causes the computer to blue screen of death. very very bad. but it's not simply a 'you need to restart' crash, because the computer then gets stuck into a boot loop.

this is the worst possible thing because, in a boot loop state, a computer is never really able to get to a point where it can do anything. like download a fix. so there is nothing crowdstrike can do to remedy this death update anymore. it is now left to the end users.

it was pretty quickly identified what the problem was. you had to boot it in safe mode, and a very small file needed to be deleted. or you could just rename crowdstrike to something else so windows never attempts to use it.

it's a fairly easy fix in the grand scheme of things, but the issue is that it is effecting enterprises. which can have a looooot of computers. in many different locations. so an IT person would need to manually fix hundreds of computers, sometimes in whole other cities and perhaps even other countries if theyre big enough.

another fuck up crowdstrike did was they did not stagger the update, so they could catch any mistakes before they wrecked havoc. (and also how how HOW do you not catch this before deploying it. this isn't a code oopsie this is a complete failure of quality ensurance that probably permeates the whole company to not realise their update was an instant kill). they rolled it out to everyone of their clients in the world at the same time.

and this seems pretty hilarious on the surface. i was havin a good chuckle as eftpos went down in the store i was working at, chaos was definitely ensuring lmao. im in aus, and banking was literally down nationwide.

but then you start hearing about the entire country's planes being grounded because the airport's computers are bricked. and hospitals having no computers anymore. emergency call centres crashing. and you realised that, wow. crowdstrike just killed people probably. this is literally the worst thing possible for a company like this to do.

crowdstrike was kinda on the come up too, they were starting to become a big name in the tech world as a new face. but that has definitely vanished now. to fuck up at this many places, is almost extremely impressive. its hard to even think of a comparable fuckup.

a friday evening simultaneous rollout boot loop is a phrase that haunts IT people in their darkest hours. it's the monster that drags people down into the swamp. it's the big bag in the horror movie. it's the end of the road. and for crowdstrike, that reaper of souls just knocked on their doorstep.

[kids-worldfun]

The Ongoing Need for Cybersecurity Education in Families

Our homes are no longer physical spaces but extended into cyberspace. Every gadget we introduce into our homes-whether smartphone, tablet, or smart refrigerator-opens an entry point to a perilous world. This is not new, but what needs emphasis is that digital threats are not just technological but psychological and emotional, especially as far as families are concerned. The Digital Realm: A…

[technijianravi]

Critical Windows Update: Apply Patch Now to Prevent Black Basta Ransomware