Zevonix<p>🔐 Zevonix Cybersecurity Tip of the Day: Use browser extensions that block trackers and ads for safer browsing. <a href="https://mastodon.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://mastodon.social/tags/Zevonix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Zevonix</span></a> <a href="https://mastodon.social/tags/MFA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>MFA</span></a> <a href="https://mastodon.social/tags/DataProtection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DataProtection</span></a> <a href="https://mastodon.social/tags/Phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Phishing</span></a> <a href="https://mastodon.social/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>InfoSec</span></a> <a href="https://mastodon.social/tags/CyberAware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberAware</span></a> <a href="https://mastodon.social/tags/ITSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ITSecurity</span></a> <a href="https://mastodon.social/tags/SmallBizSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SmallBizSecurity</span></a> <a href="https://mastodon.social/tags/DigitalSafety" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DigitalSafety</span></a></p>
Recent searches
No recent searches
Search options
Only available when logged in.
mas.to is one of the many independent Mastodon servers you can use to participate in the fediverse.
Hello! mas.to is a fast, up-to-date and fun Mastodon server.
Administered by:
Server stats:
12Kactive users
mas.to: About · Status · Profiles directory · Privacy policy
Mastodon: About · Get the app · Keyboard shortcuts · View source code · v4.3.7
#mfa
12 posts · 12 participants · 0 posts today
ddench who art in infosec exchange :opensuse:<p>Though this one's of more interest personally - esp cos of the occasional Naughty by Nature references</p><p>It takes two: The 2025 Sophos Active Adversary Report <a href="https://news.sophos.com/en-us/2025/04/02/2025-sophos-active-adversary-report/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">news.sophos.com/en-us/2025/04/</span><span class="invisible">02/2025-sophos-active-adversary-report/</span></a> <a href="https://infosec.exchange/tags/ActiveAdversary" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ActiveAdversary</span></a>, <a href="https://infosec.exchange/tags/ActiveAdversaryReport" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ActiveAdversaryReport</span></a>, <a href="https://infosec.exchange/tags/CompromisedCredentials" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CompromisedCredentials</span></a>, <a href="https://infosec.exchange/tags/Detection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Detection</span></a>, <a href="https://infosec.exchange/tags/DwellTime" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DwellTime</span></a>, <a href="https://infosec.exchange/tags/Featured" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Featured</span></a>, <a href="https://infosec.exchange/tags/Impact" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Impact</span></a>, <a href="https://infosec.exchange/tags/IncidentResponse" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>IncidentResponse</span></a>, <a href="https://infosec.exchange/tags/LOLBIN" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>LOLBIN</span></a>, <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>MFA</span></a>, <a href="https://infosec.exchange/tags/Monitoring" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Monitoring</span></a>, <a href="https://infosec.exchange/tags/RDP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>RDP</span></a>, <a href="https://infosec.exchange/tags/RemoteRansomware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>RemoteRansomware</span></a>, <a href="https://infosec.exchange/tags/RootCause" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>RootCause</span></a></p>
Zevonix<p>🔐 Zevonix Cybersecurity Tip of the Day: Turn off Bluetooth when not in use. Prevent unauthorized connections. <a href="https://mastodon.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://mastodon.social/tags/Zevonix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Zevonix</span></a> <a href="https://mastodon.social/tags/MFA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>MFA</span></a> <a href="https://mastodon.social/tags/DataProtection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DataProtection</span></a> <a href="https://mastodon.social/tags/Phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Phishing</span></a> <a href="https://mastodon.social/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>InfoSec</span></a> <a href="https://mastodon.social/tags/CyberAware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberAware</span></a> <a href="https://mastodon.social/tags/ITSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ITSecurity</span></a> <a href="https://mastodon.social/tags/SmallBizSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SmallBizSecurity</span></a> <a href="https://mastodon.social/tags/DigitalSafety" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DigitalSafety</span></a></p>
Terence Eden<p>🆕 blog! “That's Not How A SIM Swap Attack Works”</p><p>There's a disturbing article in The Guardian about a person who was on the receiving end of a successful cybersecurity attack.</p><p>EE texted to say they had processed my sim activation request, and the new sim would be active in 24 hours. I was told to contact them if I hadn’t requested this. I hadn’t, so I did …</p><p>👀 Read more: <a href="https://shkspr.mobi/blog/2025/04/thats-not-how-a-sim-swap-attack-works/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">shkspr.mobi/blog/2025/04/thats</span><span class="invisible">-not-how-a-sim-swap-attack-works/</span></a><br>⸻<br><a href="https://mastodon.social/tags/2fa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>2fa</span></a> <a href="https://mastodon.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://mastodon.social/tags/MFA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>MFA</span></a> <a href="https://mastodon.social/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>security</span></a> <a href="https://mastodon.social/tags/sim" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>sim</span></a></p>
Terence Eden’s Blog<p><strong>That's Not How A SIM Swap Attack Works</strong></p><p><a href="https://shkspr.mobi/blog/2025/04/thats-not-how-a-sim-swap-attack-works/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">shkspr.mobi/blog/2025/04/thats</span><span class="invisible">-not-how-a-sim-swap-attack-works/</span></a></p><p>There's <a href="https://www.theguardian.com/money/2025/apr/15/ee-was-unapologetic-after-i-tried-to-stop-a-sim-swap" rel="nofollow noopener noreferrer" target="_blank">a disturbing article in The Guardian</a> about a person who was on the receiving end of a successful cybersecurity attack.</p><blockquote><p>EE texted to say they had processed my sim activation request, and the new sim would be active in 24 hours. I was told to contact them if I hadn’t requested this. I hadn’t, so I did so immediately. Twenty-four hours later, my mobile stopped working and money was withdrawn from my bank account.</p><p><strong>With their alien sim, the fraudster infiltrated my handset and stole details for every account I had.</strong> Passwords and logins had been changed for my finance, retail and some social media accounts. </p></blockquote><p>(Emphasis added.)</p><p>I realise it is in the consumer rights section of the newspaper, not the technology section, and I dare-say some editorialising has gone on, but that's <em>nonsense</em>.</p><p>Here's how a SIM swap works.</p><ol><li>Attacker convinces your phone company to reassign your telephone number to a new SIM.</li><li>Attacker goes to a website where you have an account, and initiates a password reset.</li><li>Website sends a verification code to your phone number, which is now in the hands of the attacker.</li><li>Attacker supplies verification code and gets into your account.</li></ol><p>Do you notice the missing step there?</p><p>At no point does the attacker "infiltrate" your handset. Your handset is still in your possession. The SIM is dead, but that doesn't give the attacker access to the phone itself. There is simply <strong>no way</strong> for someone to put a new SIM into their phone and automatically get access to your device.</p><p>Try it now. Take your SIM out of your phone and put it into a new one. Do all of your apps suddenly appear? Are your usernames and passwords visible to you? No.</p><p>There are ways to transfer your data from an <a href="https://support.apple.com/en-gb/HT210216" rel="nofollow noopener noreferrer" target="_blank">iPhone</a> or <a href="https://support.google.com/android/answer/13761358?hl=en" rel="nofollow noopener noreferrer" target="_blank">Android</a> - but they require a lot more work than swapping a SIM.</p><p>So how did the attacker know which websites to target and what username to use?</p><p><strong>What (Probably) Happened</strong></p><p>Let's assume the person in the article didn't have malware on their device and hadn't handed over all their details to a cold caller.</p><p>The most obvious answer is that the attacker <em>already</em> knew the victim's email address. Maybe the victim gave out their phone number and email to some dodgy site, or they're listed on their contact page, or something like that.</p><p>The attacker now has two routes.</p><p>First is "hit and hope". They try the email address on hundreds of popular sites' password reset page until they get a match. That's time-consuming given the vast volume of websites.</p><p>Second is targetting your email. If the attacker can get into your email, they can see which sites you use, who your bank is, and where you shop. They can target those specific sites, perform a password reset, and get your details.</p><p>I strongly suspect it is the latter which has happened. The swapped SIM was used to reset the victim's email password. Once in the email, all the accounts were easily found. At no point was the handset broken into.</p><p><strong>What can I do to protect myself?</strong></p><p>It is important to realise that <a href="https://shkspr.mobi/blog/2024/03/theres-nothing-you-can-do-to-prevent-a-sim-swap-attack/" rel="nofollow noopener noreferrer" target="_blank">there's nothing you can do to prevent a SIM-swap attack</a>! Your phone company is probably incompetent and their staff can easily be bribed. You do not control your phone number. If you get hit by a SIM swap, it almost certainly isn't your fault.</p><p>So here are some practical steps anyone can take to reduce the likelihood and effectiveness of this class of attack:</p><ul><li>Remember that <a href="https://shkspr.mobi/blog/2020/03/its-ok-to-lie-to-wifi-providers/" rel="nofollow noopener noreferrer" target="_blank">it's OK to lie to WiFi providers</a> and other people who ask for your details. You don't need to give someone your email for a receipt. You don't need to hand over your real phone number on a survey. This is the most important thing you can do.</li><li>Try to hack yourself. How easy would it be for an attacker who had stolen your phone number to also steal your email address? Open up a private browser window and try to reset your email password. What do you notice? How could you secure yourself better?</li><li>Don't use SMS for two-factor authentication. If you are given a choice of 2FA methods, use a dedicated app. If the only option you're given is SMS - contact the company to complain, or leave for a different provider.</li><li>Don't rely on a <a href="https://bsky.app/profile/scientits.bsky.social/post/3lmz2zaxkf22k" rel="nofollow noopener noreferrer" target="_blank">setting a PIN for your SIM</a>. The PIN only protects the physical SIM from being moved to a new device; it does nothing to stop your number being ported to a new SIM.</li><li>Finally, realise that professional criminals only need to be lucky once but you need to be lucky all the time.</li></ul><p>Stay safe out there.</p><p><a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://shkspr.mobi/blog/tag/2fa/" target="_blank">#2fa</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://shkspr.mobi/blog/tag/cybersecurity/" target="_blank">#CyberSecurity</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://shkspr.mobi/blog/tag/mfa/" target="_blank">#MFA</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://shkspr.mobi/blog/tag/security/" target="_blank">#security</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://shkspr.mobi/blog/tag/sim/" target="_blank">#sim</a></p>
LavX News<p>Surge in Infostealer Attacks: How to Fortify Your Cybersecurity</p><p>In a startling revelation, IBM X-Force reports an 84% rise in infostealer malware, signaling a shift in cybercriminal tactics from ransomware to data theft. This article explores the implications of t...</p><p><a href="https://news.lavx.hu/article/surge-in-infostealer-attacks-how-to-fortify-your-cybersecurity" rel="nofollow noopener noreferrer" target="_blank"><span class="invisible">https://</span><span class="ellipsis">news.lavx.hu/article/surge-in-</span><span class="invisible">infostealer-attacks-how-to-fortify-your-cybersecurity</span></a></p><p><a href="https://mastodon.cloud/tags/news" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>news</span></a> <a href="https://mastodon.cloud/tags/tech" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>tech</span></a> <a href="https://mastodon.cloud/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Cybersecurity</span></a> <a href="https://mastodon.cloud/tags/MFA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>MFA</span></a> <a href="https://mastodon.cloud/tags/Infostealer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Infostealer</span></a></p>
Mr. E. Grey Seale<p>Testing a theory. Did you sign-on with <a href="https://mastodon.ie/tags/microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>microsoft</span></a> <a href="https://mastodon.ie/tags/MicrosoftEntra" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>MicrosoftEntra</span></a> ID today? When prompted for <a href="https://mastodon.ie/tags/mfa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>mfa</span></a> was the code 97 or 99?</p>
Zevonix<p>🔐 Zevonix Cybersecurity Tip of the Day: Avoid using USB drives from unknown sources. They can be loaded with malware. <a href="https://mastodon.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://mastodon.social/tags/Zevonix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Zevonix</span></a> <a href="https://mastodon.social/tags/MFA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>MFA</span></a> <a href="https://mastodon.social/tags/DataProtection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DataProtection</span></a> <a href="https://mastodon.social/tags/Phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Phishing</span></a> <a href="https://mastodon.social/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>InfoSec</span></a> <a href="https://mastodon.social/tags/CyberAware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberAware</span></a> <a href="https://mastodon.social/tags/ITSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ITSecurity</span></a> <a href="https://mastodon.social/tags/SmallBizSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SmallBizSecurity</span></a> <a href="https://mastodon.social/tags/DigitalSafety" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DigitalSafety</span></a></p>
Ben Cardoen<p>For reliable cross-OS/device hardware based MFA, it's hard to beat Yubikey. I rarely openly support a company, but with the trend to move MFA to closed standards (not going to mention the company in question, but not hard to figure out which), Yubikey stays open, and has first-class Linux support. <a href="https://mstdn.science/tags/mfa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>mfa</span></a> <a href="https://mstdn.science/tags/linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>linux</span></a> <a href="https://mstdn.science/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>security</span></a> <a href="https://mstdn.science/tags/fedora" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>fedora</span></a> <a href="https://mstdn.science/tags/ssh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ssh</span></a> (note, I do not have a referral link, nor do I gain from posting this). <a href="https://www.yubico.com/support/download/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="">yubico.com/support/download/</span><span class="invisible"></span></a></p>
Zevonix<p>🔐 Zevonix Cybersecurity Tip of the Day: Set up auto-lock on mobile devices and computers after inactivity. <a href="https://mastodon.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://mastodon.social/tags/Zevonix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Zevonix</span></a> <a href="https://mastodon.social/tags/MFA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>MFA</span></a> <a href="https://mastodon.social/tags/DataProtection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DataProtection</span></a> <a href="https://mastodon.social/tags/Phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Phishing</span></a> <a href="https://mastodon.social/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>InfoSec</span></a> <a href="https://mastodon.social/tags/CyberAware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberAware</span></a> <a href="https://mastodon.social/tags/ITSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ITSecurity</span></a> <a href="https://mastodon.social/tags/SmallBizSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SmallBizSecurity</span></a> <a href="https://mastodon.social/tags/DigitalSafety" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DigitalSafety</span></a></p>
TRANSIENCE<p>New <span class="h-card" translate="no"><a href="https://mastodon.social/@transience_project" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>transience_project</span></a></span> publication!!</p><p>Our colleagues from <span class="h-card" translate="no"><a href="https://xn--baw-joa.social/@FraunhoferISI" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>FraunhoferISI</span></a></span> have integrated <a href="https://mastodon.social/tags/MFA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>MFA</span></a> (Material Flow Analysis) with the industry model <a href="https://mastodon.social/tags/FORECAST" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>FORECAST</span></a> to quantify the impact of broad <a href="https://mastodon.social/tags/CircularEconomy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CircularEconomy</span></a> actions in buildings on the decarbonisation of the EU industry!</p><p>📝Read the paper <a href="https://mastodon.social/tags/open" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>open</span></a> access 👇 <br><a href="https://www.sciencedirect.com/science/article/pii/S0921344925001855?via%3Dihub" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">sciencedirect.com/science/arti</span><span class="invisible">cle/pii/S0921344925001855?via%3Dihub</span></a></p><p>With <span class="h-card" translate="no"><a href="https://respublicae.eu/@EU_HaDEA" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>EU_HaDEA</span></a></span> and <a href="https://mastodon.social/tags/P4Planet" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>P4Planet</span></a></p><p><a href="https://mastodon.social/tags/transience" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>transience</span></a> <a href="https://mastodon.social/tags/industry4netzero" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>industry4netzero</span></a></p>
Zevonix<p>🔐 Zevonix Cybersecurity Tip of the Day: Limit admin rights. Not every employee needs elevated access. <a href="https://mastodon.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://mastodon.social/tags/Zevonix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Zevonix</span></a> <a href="https://mastodon.social/tags/MFA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>MFA</span></a> <a href="https://mastodon.social/tags/DataProtection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DataProtection</span></a> <a href="https://mastodon.social/tags/Phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Phishing</span></a> <a href="https://mastodon.social/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>InfoSec</span></a> <a href="https://mastodon.social/tags/CyberAware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberAware</span></a> <a href="https://mastodon.social/tags/ITSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ITSecurity</span></a> <a href="https://mastodon.social/tags/SmallBizSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SmallBizSecurity</span></a> <a href="https://mastodon.social/tags/DigitalSafety" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DigitalSafety</span></a></p>
The DefendOps Diaries<p>Could your login be at risk? Tycoon2FA is bypassing MFA with sneaky tactics—stealing session cookies and hiding its tracks with invisible tricks. How prepared are you for the next-gen phishing threat?</p><p><a href="https://thedefendopsdiaries.com/understanding-and-mitigating-the-tycoon2fa-phishing-threat/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">thedefendopsdiaries.com/unders</span><span class="invisible">tanding-and-mitigating-the-tycoon2fa-phishing-threat/</span></a></p><p><a href="https://infosec.exchange/tags/tycoon2fa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>tycoon2fa</span></a><br><a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>phishing</span></a><br><a href="https://infosec.exchange/tags/mfa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>mfa</span></a><br><a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a><br><a href="https://infosec.exchange/tags/microsoft365" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>microsoft365</span></a></p>
Bytes Europe<p>Pixalate’s March 2025 Netherlands Publisher Rankings for <a href="https://www.byteseu.com/915151/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="">byteseu.com/915151/</span><span class="invisible"></span></a> <a href="https://pubeurope.com/tags/AdQuality" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>AdQuality</span></a> <a href="https://pubeurope.com/tags/CTV" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CTV</span></a> <a href="https://pubeurope.com/tags/MFA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>MFA</span></a> <a href="https://pubeurope.com/tags/MobileApps" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>MobileApps</span></a> <a href="https://pubeurope.com/tags/Netherlands" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Netherlands</span></a> <a href="https://pubeurope.com/tags/Pixalate" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Pixalate</span></a> <a href="https://pubeurope.com/tags/ProgrammaticAds" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ProgrammaticAds</span></a> <a href="https://pubeurope.com/tags/reports" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>reports</span></a> <a href="https://pubeurope.com/tags/websites" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>websites</span></a></p>
Pyrzout :vm:<p>Russia’s Storm-2372 Hits Orgs with MFA Bypass via Device Code Phishing – Source:hackread.com <a href="https://ciso2ciso.com/russias-storm-2372-hits-orgs-with-mfa-bypass-via-device-code-phishing-sourcehackread-com/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">ciso2ciso.com/russias-storm-23</span><span class="invisible">72-hits-orgs-with-mfa-bypass-via-device-code-phishing-sourcehackread-com/</span></a> <a href="https://social.skynetcloud.site/tags/1CyberSecurityNewsPost" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>1CyberSecurityNewsPost</span></a> <a href="https://social.skynetcloud.site/tags/CyberSecurityNews" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurityNews</span></a> <a href="https://social.skynetcloud.site/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://social.skynetcloud.site/tags/CyberAttacks" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberAttacks</span></a> <a href="https://social.skynetcloud.site/tags/PhishingScam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PhishingScam</span></a> <a href="https://social.skynetcloud.site/tags/CyberAttack" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberAttack</span></a> <a href="https://social.skynetcloud.site/tags/Storm2372" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Storm2372</span></a> <a href="https://social.skynetcloud.site/tags/Hackread" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Hackread</span></a> <a href="https://social.skynetcloud.site/tags/Phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Phishing</span></a> <a href="https://social.skynetcloud.site/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>security</span></a> <a href="https://social.skynetcloud.site/tags/SOCRadar" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SOCRadar</span></a> <a href="https://social.skynetcloud.site/tags/Russia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Russia</span></a> <a href="https://social.skynetcloud.site/tags/Scam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Scam</span></a> <a href="https://social.skynetcloud.site/tags/MFA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>MFA</span></a></p>
0xKaishakunin<p>Finally! 7 Factor Authentication! </p><p><a href="https://mastodon.social/tags/mfa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>mfa</span></a> <a href="https://mastodon.social/tags/passkey" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>passkey</span></a> <a href="https://mastodon.social/tags/iam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>iam</span></a> <a href="https://mastodon.social/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>security</span></a></p>
Hackread.com<p>NEW: 🚨 Russian APT Storm-2372 is using device code phishing to bypass <a href="https://mstdn.social/tags/MFA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>MFA</span></a> in attacks against organisations in Europe and the US.</p><p>Read: <a href="https://hackread.com/russia-storm-2372-hit-mfa-bypass-device-code-phishing/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">hackread.com/russia-storm-2372</span><span class="invisible">-hit-mfa-bypass-device-code-phishing/</span></a></p><p><a href="https://mstdn.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://mstdn.social/tags/CyberAttack" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberAttack</span></a> <a href="https://mstdn.social/tags/Storm2372" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Storm2372</span></a> <a href="https://mstdn.social/tags/Russia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Russia</span></a></p>
Pyrzout :vm:<p>Russia’s Storm-2372 Hits Orgs with MFA Bypass via Device Code Phishing <a href="https://hackread.com/russia-storm-2372-hit-mfa-bypass-device-code-phishing/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">hackread.com/russia-storm-2372</span><span class="invisible">-hit-mfa-bypass-device-code-phishing/</span></a> <a href="https://social.skynetcloud.site/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Cybersecurity</span></a> <a href="https://social.skynetcloud.site/tags/CyberAttacks" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberAttacks</span></a> <a href="https://social.skynetcloud.site/tags/PhishingScam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PhishingScam</span></a> <a href="https://social.skynetcloud.site/tags/CyberAttack" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberAttack</span></a> <a href="https://social.skynetcloud.site/tags/Storm2372" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Storm2372</span></a> <a href="https://social.skynetcloud.site/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Security</span></a> <a href="https://social.skynetcloud.site/tags/Phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Phishing</span></a> <a href="https://social.skynetcloud.site/tags/SOCRadar" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SOCRadar</span></a> <a href="https://social.skynetcloud.site/tags/Russia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Russia</span></a> <a href="https://social.skynetcloud.site/tags/Scam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Scam</span></a> <a href="https://social.skynetcloud.site/tags/MFA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>MFA</span></a></p>
Terence Eden<p>🆕 blog! “FobCam '25 - All my MFA tokens on one page”</p><p>Some ideas are timeless. Back in 2004, an anonymous genius set up "FobCam". Tired of having to carry around an RSA SecurID token everywhere, our hero simply left the fob at home with an early webcam pointing at it. And then left the page open for all to see.</p><p>Security expert Bruce…</p><p>👀 Read more: <a href="https://shkspr.mobi/blog/2025/04/fobcam-25-all-my-mfa-tokens-on-one-page/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">shkspr.mobi/blog/2025/04/fobca</span><span class="invisible">m-25-all-my-mfa-tokens-on-one-page/</span></a><br>⸻<br><a href="https://mastodon.social/tags/2fa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>2fa</span></a> <a href="https://mastodon.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CyberSecurity</span></a> <a href="https://mastodon.social/tags/MFA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>MFA</span></a> <a href="https://mastodon.social/tags/Satire" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Satire</span></a>(Probably) <a href="https://mastodon.social/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>security</span></a></p>
Terence Eden’s Blog<p><strong>FobCam '25 - All my MFA tokens on one page</strong></p><p><a href="https://shkspr.mobi/blog/2025/04/fobcam-25-all-my-mfa-tokens-on-one-page/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">shkspr.mobi/blog/2025/04/fobca</span><span class="invisible">m-25-all-my-mfa-tokens-on-one-page/</span></a></p><p>Some ideas are timeless. Back in 2004, an anonymous genius set up "<a href="https://web.archive.org/web/20060215092922/http://fob.webhop.net/" rel="nofollow noopener noreferrer" target="_blank">FobCam</a>". Tired of having to carry around an RSA SecurID token everywhere, our hero simply left the fob at home with an early webcam pointing at it. And then left the page open for all to see.</p><p></p><p>Security expert Bruce Schneier approved0 of this trade-off between security and usability - saying what we're all thinking:</p><blockquote><p>Here’s a guy who has a webcam pointing at his SecurID token, so he doesn’t have to remember to carry it around. Here’s the strange thing: unless you know who the webpage belongs to, it’s still good security. <a href="https://www.schneier.com/crypto-gram/archives/2004/0815.html#:~:text=webcam" rel="nofollow noopener noreferrer" target="_blank">Crypto-Gram - August 15, 2004</a></p></blockquote><p>Nowadays, we have to carry dozens of these tokens with us. Although, unlike the poor schmucks of 2004, we have an app for that. But I don't always have access to my phone. Sometimes I'm in a secure location where I can't access my electronics. Sometimes my phone gets stolen, and I need to log into Facebook to whinge about it. Sometimes I just can't be bothered to remember which fingerprint unlocks my phone1.</p><p>Using the <a href="https://shkspr.mobi/blog/2025/03/using-the-web-crypto-api-to-generate-totp-codes-in-javascript-without-3rd-party-libraries/" rel="nofollow noopener noreferrer" target="_blank">Web Crypto API, it is easy to Generate TOTP Codes in JavaScript directly in the browser</a>. So here are all my important MFA tokens. If I ever need to log in somewhere, I can just visit this page and grab the code I need2.</p><p><strong>All My Important Codes</strong></p><p><strong>What The Actual Fuck?</strong></p><p>A 2007 paper called <a href="https://cups.cs.cmu.edu/soups/2007/proceedings/p64_bauer.pdf" rel="nofollow noopener noreferrer" target="_blank">Lessons learned from the deployment of a smartphone-based access-control system</a> looked at whether fobs met the needs of their users:</p><blockquote><p> However, we observed that end users tend to be most concerned about how convenient [fobs] are to use. There are many examples of end users of widely used access-control technologies readily sacrificing security for convenience. For example, it is well known that users often write their passwords on post-it notes and stick them to their computer monitors. Other users are more inventive: a good example is the user who pointed a webcam at his fob and published the image online so he would not have to carry the fob around.</p></blockquote><p>As for Schneier's suggestion that anonymity added protection, a contemporary report noted that <a href="https://www.schneier.com/crypto-gram/archives/2004/0915.html#:~:text=Fobcam" rel="nofollow noopener noreferrer" target="_blank">the owner of the FobCam site was trivial to identify</a>3.</p><p>Every security system involves trade-offs. I have a password manager, but with over a thousand passwords in it, the process of navigating and maintaining becomes a burden. <a href="https://shkspr.mobi/blog/2020/08/i-have-4-2fa-coverage/" rel="nofollow noopener noreferrer" target="_blank">The number of 2FA tokens I have is also rising</a>. All of these security factors need backing up. Those back-ups need testing4. It is an endless cycle of drudgery.</p><p>What's a rational user supposed to do5? I suppose I could buy a couple of hardware keys, keep one in an off-site location, but somehow keep both in sync, and hope that a firmware-update doesn't brick them.</p><p>Should I just upload all of my passwords, tokens, secrets, recovery codes, passkeys, and biometrics6 into the cloud?</p><p>The cloud is just someone else's computer. This website is <em>my</em> computer. So I'm going to upload all my factors here. What's the worst that could happen7.</p> <ol start="0"><li><p>🫠 ↩︎</p></li><li><p>🖕 ↩︎</p></li><li><p>🙃 ↩︎</p></li><li><p>The neologism "doxing" hadn't yet been invented. ↩︎</p></li><li><p>As was written by the prophets: "<a href="https://lkml.iu.edu/hypermail/linux/kernel/9607.2/0292.html" rel="nofollow noopener noreferrer" target="_blank">Only wimps use tape backup: <em>real</em> men just upload their important stuff on ftp, and let the rest of the world mirror it</a>" ↩︎</p></li><li><p>I in no way imply that I am rational. ↩︎</p></li><li><p>Just one more factor, that'll fix security, just gotta add one more factor bro. ↩︎</p></li><li><p>This is left as an exercise for the reader. ↩︎</p></li></ol> <p><a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://shkspr.mobi/blog/tag/2fa/" target="_blank">#2fa</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://shkspr.mobi/blog/tag/cybersecurity/" target="_blank">#CyberSecurity</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://shkspr.mobi/blog/tag/mfa/" target="_blank">#MFA</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://shkspr.mobi/blog/tag/satire-probably/" target="_blank">#SatireProbably_</a> <a rel="nofollow noopener noreferrer" class="hashtag u-tag u-category" href="https://shkspr.mobi/blog/tag/security/" target="_blank">#security</a></p>
ExploreLive feeds
Mastodon is the best way to keep up with what's happening.
Follow anyone across the fediverse and see it all in chronological order. No algorithms, ads, or clickbait in sight.
Create accountLoginDrag & drop to upload