#plexfiltration update - and it's been a while, I probably only check the mailboxes once a week these days

I just informed a customer of a SaaS platform (whose security team I'd already reached out too about 6 months ago - and not heard anything from) that the SaaS product had happily started sending deleteduser.com detailed AI transcription notes of all company meetings, financial KPIs, metrics and summaries - including of the leadership team weekly meeting.

I informed them that thanks to the plexfiltration issue, I had passively been provided with their full product roadmap - notes about vendors and suppliers, cash in hand and financial runway information.

Had I been a malicious sausage, I would've been able to use this information in a myriad of ways. Probably the worst example of confidential information I've seen so far.

#infosec

#Shitpost #Shitposting #infosec #ShamelesslyStolenFromReddit

Alt...

The image is a dark, graphic poster with text overlaying a portrait of a man. The title "THINGS TO SAY TO A HACKER" is prominently displayed at the top, with "THINGS TO SAY" in white and "TO A HACKER" in bright yellow. Below the title, a bulleted list of phrases appears on the left side of the image. These phrases are designed to be provocative or humorous in the context of hacking. Each bullet point starts with a white text phrase, followed by a colored phrase that stands out. The colored phrases include "KALI LINUX TOOL?" in blue, "RANSOMWARE GROUP" in orange, "INTENTIONS WITH MY SOFTWARE?" in green, "FACEBOOK ACCOUNT" in red, "IP ADDRESS" in cyan, "ONE PASSWORD IS JUST EASIER TO MEMORIZE" in purple, "PHISHING ATTEMPT" in orange, and "RARE ZERO DAY COLLECTION" in bright pink. The background is a solid, dark black, which makes the text and the person in the image stand out. On the right side of the image, a man is depicted from the chest up, looking directly at the viewer with an intense, neutral expression. He is wearing a dark hooded jacket, with the hood up and framing his face. The jacket is dark grey or black, with a red lining visible around the collar and zipper. On the right side of his chest, there is a patch with the text "MR. ROBOT" and an emblem, indicating a connection to the TV show of the same name, which often features themes of hacking. The lighting on the man's face is somewhat dim, with subtle shadows that accentuate his features, particularly his eyes. The overall composition places the text on the left and the subject on the right, creating a balanced yet dynamic visual. The color palette is dominated by black, white, and the vibrant accent colors of the text, contrasted with the muted tones of the man's clothing.

This dumb password rule is from Comcast.

Your password should be difficult to guess as long as it's not over 16
characters long.

https://dumbpasswordrules.com/sites/comcast/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Onleihe.

Password is your birthday in format ddmmyyyy. Users are not allowed to change their passwords

https://dumbpasswordrules.com/sites/onleihe/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from State Bank of India (Foreign Travel Card).

State Bank of India is the largest government operated bank in India.
They offer "travel" prepaid cards for foreign currencies, this is for
their portal for the prepaid card users to manage their account.

Your password must:
- Be between 8 and 9 characters long
- Contain at least 1 lowercase c...

https://dumbpasswordrules.com/sites/state-bank-of-india-foreign-travel-card/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Copart.

Copart: "The security of our members is extremely important to us."
Also Copart: "We're gonna need you to keep your password between 5-10 characters."

https://dumbpasswordrules.com/sites/copart/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Charles Sturt University.

Prevents spaces and a set list of characters, limits to 30 characters and can only change your password twice per day.

https://dumbpasswordrules.com/sites/charles-sturt-university/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Costco.com.

Due to Costco's short max password length of 16 characters, I strongly recommend using a password manager to make a random password to satisfy all of these conditions below:
* Use between 8 and 16 characters
* Include at least one lowercase (a-z) and one uppercase letter (A-Z)
* Include at least ...

https://dumbpasswordrules.com/sites/costco-com/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

Remember a few months ago when I told you that installing layers of ad blocking was basic #opsec at this point because #zeroday exploits were coming through the ad pipeline?

#CitizenLab brings the receipts.

#DiscoverTech, an #Israeli company that presents itself as a legitimate advertising company, but which we found operates as a facilitator for multiple mercenary spyware partners.

Discover-Tech operates a platform called #Controlium that enables its mercenary partners to de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered.

Follow researcher Wolfie Christl https://mastodon.social/@wchr/117444965522636234

Ht: @KimPerales who surfaced the report.

#ads #malware #infosec
https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

This dumb password rule is from Sampath Bank.

So many rules!

https://dumbpasswordrules.com/sites/sampath-bank/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from BMW ConnectedDrive.

Although the prompt suggests good things, after many failed attempts to
set a new password, it turns out you can ONLY use the special characters
shown in the prompt

https://dumbpasswordrules.com/sites/bmw-connecteddrive/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

🚀 Defguard 2.2.0-beta1 is out!

🆕 Test now:
- Multi-step MFA flows per location
- FIDO2 hardware keys as MFA factor
- MFA setup in the desktop client
- Firewall bulk actions
- Redesigned mobile client

Not for production yet, great for testing.

👉 https://defguard.net/releases/2.2.0-beta-1/notes/

#vpn #sysadmin #devops #selfhosted #SelfHosting #wireguard #OpenSource #release #security #privacy #homeLab #anonymity #floss #docker #CyberSecurity #InfoSec #OnlinePrivacy #DataProtection #InternetSecurity #NetworkSecurity

Alt...

WireGuard Hardware Keys/FIDO2 MFA/2FA

This dumb password rule is from Fidelity Germany.

Between 8 and 15 characters.
Only letters and digits, no special characters and no umlauts!
An uppercase and lowercase mix is enforced.
It must not contain your email, alias or account number.

Why the upper limit of 15? Are you using decades-old mainframes and cleartext storage with 15 bytes plu...

https://dumbpasswordrules.com/sites/fidelity-germany/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from SunTrust.

At least there are a variety of special characters to choose from.

https://dumbpasswordrules.com/sites/suntrust/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Onleihe.

Password is your birthday in format ddmmyyyy. Users are not allowed to change their passwords

https://dumbpasswordrules.com/sites/onleihe/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Red Hat.

Symbols. You keep using that word. I don't think it means what you think
it means.

https://dumbpasswordrules.com/sites/red-hat/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from United States Department of State MyTravel.State.Gov.

- Must be between 12 and 24 characters.
- Must contain at least one uppercase and one lowercase letter.
- Must contain at least one number.
- Must contain at least one of the following special characters:
~ ` ! @ # $ % ^ & * ( ) _ - . ? { } [ ] | : ; " ' = + / ,
- Password must not match or conta...

https://dumbpasswordrules.com/sites/united-states-department-of-state-mytravel-state-gov/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Netflix.

[The help page](https://help.netflix.com/de/node/54078)
and the [password reset page](https://www.netflix.com/password) say:

Ihr Passwort muss zwischen 4 und 60 Zeichen lang sein und darf keine Tilde (~) enthalten.

https://dumbpasswordrules.com/sites/netflix/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Commsec.

Another financial institution with short password requirements. They also block pasting in to the field, making it a pain to use a password manager.

https://dumbpasswordrules.com/sites/commsec/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

New.

Socket: arXiv Is Rate Limiting Authors Following a Flood of AI Slop Submissions https://socket.dev/blog/arxiv-rate-limiting-slop @SocketSecurity #slop #infosec

This dumb password rule is from Mindware.

You "*may use special characters*", but only some of them - and we won't
necessarily tell you which ones.

https://dumbpasswordrules.com/sites/mindware/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from UniSuper.

Passwords need:
- a lower case letter
- a number
- a capital letter
- at least 8 characters

In the 'Change password' form,
passwords are now restricted to a `maxlength` of 18.

If your current password is longer than 18 characters,
you won't be able to change your password.
When I contacted them...

https://dumbpasswordrules.com/sites/unisuper/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from MobileIron MDM.

You can't make this up - no dictionary words, no more than 2 repeating
characters, no alphabetic sequences, no whitespace, 3 character sets,
maximum of 32 characters.

https://dumbpasswordrules.com/sites/mobileiron-mdm/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

How you, as an #InfoSec engineer, can make your Sales team love you forever and take your side in any dispute:

Step 1: “Hey, salesperson! Anything I can do to help you close your sales contracts more quickly?”

There, done. Now you have a whole team of ride or die extroverts championing you in every situation.

This dumb password rule is from GameFly.

Password is 6-12 characters with no other restrictions. You can easily do 6 numbers, 6 lowercase letters, etc.

https://dumbpasswordrules.com/sites/gamefly/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from NASA Earth Data.

Username must:
- Be a Minimum of 4 characters
- Be a Maximum of 30 characters
- Use letters, numbers, periods, and underscores
- Not contain any blank spaces
- Not begin, end or contain two consecutive special characters(._)

Password must contain:
- Minimum of 8 characters
- One Uppercase letter...

https://dumbpasswordrules.com/sites/nasa-earth-data/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

New.

Socket: TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack https://socket.dev/blog/tensorlake-compromise @SocketSecurity #infosec #npm

This dumb password rule is from FedEx.

- Password cannot be longer than 25 characters

https://dumbpasswordrules.com/sites/fedex/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from WeatherBug.

Maximum 16 characters.

https://dumbpasswordrules.com/sites/weatherbug/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from ADP.

Forced to change the password during the first login. At least they
could use proper grammar in their rule list.

https://dumbpasswordrules.com/sites/adp/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Microsoft (e company store).

Max of 16 character oh and please don't use any characters we don'y know how to escape properly
also if it starts with ? you may break our wonderful website. What out with your password generator
duplicated characters is far too insecure to allow here.

https://dumbpasswordrules.com/sites/microsoft-e-company-store/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Munich Foerdermittel Portal.

You register on their funding portal and receive an email with an activation link to set a password.
The email further informs you about their password policy:
- At least 8, but no more than 20 characters
- At least one lowercase and uppercase letter
- At least two digits (1,2,3,4,5,6,7,8,9,0) or...

https://dumbpasswordrules.com/sites/munich-foerdermittel-portal/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

The two types of #infosec product sales experiences.

1) getting called daily for something you have no intention of buying ever.

2) finding something you really need and trying to buy it, only to be told “great, we only sell through the channel - who is your preferred reseller?”

NO ONE. SELL ME YOUR SHIT, COWARDS!

This dumb password rule is from Rushmore Loan Management Services.

Hmmm.. why are they afraid of double and single quotes in my passwords?

https://dumbpasswordrules.com/sites/rushmore-loan-management-services/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from MTS Serbia.

MTS is a national mobile and internet provider in Serbia and they have bad password rules.
Translation: The password must have more than 6 character, less than 17 characters and one
of the following combinations: upper case or lower case letter and a number, upper case or
lower case letter and a ...

https://dumbpasswordrules.com/sites/mts-serbia/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from MetLife.

Max length of 20 characters, no special characters allowed.
Pasting into the second password field is disabled even with
the Chrome extension Don't Fuck With Paste.

https://dumbpasswordrules.com/sites/metlife/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from PCPartPicker.

There are no rules for passwords. Passwords can be any length (including one character)
of any complexity. No password change confirmation emails are sent.

https://dumbpasswordrules.com/sites/pcpartpicker/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Sears.

"cAsE sensitive, no spaces, ! or ?
8 characters min - 1 letter, 1 number
Can't repeat same character more than 3 times in a row
Cannot be or contain your username or email address"

https://dumbpasswordrules.com/sites/sears/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from amaysim.

Passwords must be 6-15 characters. If you enter more than 15 characters at signup, there is no error,
but the system apparently silently truncates to 15 characters. So of course, logging in subsequently
fails if you enter the untruncated password. How convenient.

https://dumbpasswordrules.com/sites/amaysim/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

New.

Socket: Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX https://socket.dev/blog/glassworm-vscode-themes @SocketSecurity #infosec #threatresearch #JavaScript #Git

This dumb password rule is from myezyaccess.com patient portal system.

12-character maximum password length. This is not a single website but a patient portal system used by hundreds of medical facilities via subdomains, with password policy apparently being consistent for all sites.

https://dumbpasswordrules.com/sites/myezyaccess-com-patient-portal-system/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Eurocircuits.

Minimum 4 and maximum 30 chars. Use only letters (a-z), numbers (0-9) and underscore (_)

https://dumbpasswordrules.com/sites/eurocircuits/

#password #passwords #infosec #cybersecurity #dumbpasswordrules