Yikes. Top Trump officials used Signal for classified Yemen strike plans & accidentally added The Atlantic's editor to the chat. Major security questions arise, especially around Defense Sec Hegseth's handling of sensitive info.
#Signal #SecurityFail #GovTech
While Marco #Rubio oversees the rendition of innocent men to indefinite detention in foreign prisons, one of his top security personnel is arrested in Brussels for allegedly assaulting cops and hotel staff after demanding a drink after hours. 
The best people? 
https://www.washingtonexaminer.com/news/3368419/
#MarcoRubio #PoliticalScandal #SecurityArrest #Brussels #PoliceAssault #PoliticalCorruption #Accountability #InnocentMen #ForeignPrisons #PoliticalHypocrisy #SecurityFail #PoliticalNews #BreakingNews #uspol
Was slightly amused earlier today when looking at Task Manager on a Windows server and found a properly ancient version of TeamViewer running on it.
Did I mention this server has direct internet access?
And is part of the security system for this site?
Das Tastenfeld des Hotelzimmersafes quittiert jeden Tastendruck mit einem lauten Piep. Und während ich nachvollziehen kann, dass man bei so schwammigen Gummitastaturen ein akustisches Quittier-Signal erzeugt, wissen jetzt halt die beiden Zimmer neben mir, dass ich an dem Safe dran war und wie viele Stellen die gewählte PIN hat. #abenteuerhotel #securityfail
@Edent If you call Bank of America, they will verify you using a code sent by SMS that contains, “DO NOT share this Sign In code.”
I’ll confirm with the agent that they’re asking for the one that says under no circumstances am I to share with anyone, and they reply cheerfully, “yeah that’s the one.” 
Bank emails: Never click links in emails claiming to be from us, your bank! It's not safe.
Also Bank emails: To complete this transaction, click this link.
Some more context to my rant about the shortcomings of #Entra ID #Password Protection,
1. The risk is greatly reduced if you use #MFA
BUT while I'm not sure if #Microsoft enforces MFA they enforce the weak password rules.
And a recent event caused me to reevaluate my assumption on how well know #2FA/MFA really is:
I gave #cybersecurity talk to non-IT people (still technical so) and closed it with a set of recommendation. One was to enable Second Factor Authentication wherever possible. Which lead to the question from one participant "What is Second Factor Authentication"
That was quite a 
moment. I had the wrong assumptions. How can I assume that MFA reduces a risk if many people don't know about it.
One more thing
Another shortcoming of #Microsoft #Entra ID #Password Protection, I can't wrap.
They recommend to not mandate regular password changes (good) BUT they check the password against known bad passwords ONLY when changing it!
So to detect weak passwords I have to enforce a password change which is (rightfully) not recommended 
You could simply do this on entry. Every time (or once a day) the user enters the password it is checked if it isn't well known and complies to the current rules.
Sleeping over it I noticed another issue with #Microsoft #Entra ID #Password
Regarding the Global banned password list the write "The contents of the global banned password list aren't based on any external data source, but on the results of Microsoft Entra security telemetry and analysis."
(https://learn.microsoft.com/en-us/entra/identity/authentication/concept-password-ban-bad)
Now I have more questions:
WHY are passwords part of the security telemetry data?
The only case where I see this as ok, would be in a honeypot.
And what kind of data would be in the security telemetry data? Usually it's failed attempts, so you risk overestimating passwords attacks which fail (anyway). Again, this would only be OK with honeypots.
But if you are getting your data solely from honeypots, I fear you're getting a pre-selected type of data. Namely opportunistic, random attacks not targeted attacks.
While I think it's valuable to protect against these kind ob attacks, I really would like passwords to withstand even targeted attacks, even from the inside.
E.g when the attackers are in the Lateral Movement or Privilege Escalation. Especially if the attackers can start to crack hashes.
For this Microsoft Entra ID Password Protection seems completely useless there.
And the Custom banned password list of #Microsoft #Entra ID #Password Protection just continues the joke.
First, it can only contain 1000 entries. And yes, I really don't want to manage a big custom list.
And it gets even worse. The list is intended to contain company specific banned words like brand or product names, company-specific internal terms as well as abbreviations. Entries must be at least 4 characters.
WTF, half the companies I worked for had 3 letter names. And there are many other BWM, KIA, SAP, IBM, GM, BBC, NBA, NFL, UPS, DHL, ...
And don't get me started on acronyms. #TLA (Three-Letter-Acronym) is a term for a reason.
This means, taking my current company as an example, that SMA12 would be an accepted password (if it would be for the length) because 'SMA' 3 points + '12' 2 points is 5 points).
To reach the necessary length you could simply combine it. E.g. 'SMASolar1' would be an accepted password even if 'Solar' was a banned word.
And I CAN'T do ANYTHING!!!
Or at least not anything sensible. If I start to put combinations of 'SMA*' in the custom banned pw list, I'm back at an inadequate big list I have to manage myself 
.
And even then SMASolar1234 stays valid 
#Cybersecurity #Fail #SecurityFail
Call for #Help: I would be very happy if someone can show me that I'm wrong. The state of Microsoft Entra ID Password Protection is a MUCH bigger pain than that I would have been wrong 
.
I'm not sure if I get something wrong, but I think #Microsoft #Entra ID #Password Protection is complete rubbish. E.g. when ban weak passwords with the ominous 5 points rule the results seem to be completely arbitrary.
Microsoft speaks of including commonly used weak or compromised passwords in their Global banned password list. But the list isn't based on any external data source, so leaked passwords not leaked by Microsoft are not included .
This leads to:
Known leaked passwords are accepted. Location name plus year is accepted. Dictionary word plus year is accepted!!!
Not sure if this applies only to German dictionary words.
It gets even worse. Reading the documentation, I found "Characters not allowed: Unicode characters" WTF
Coming back to the weird point system. A banned password is not really banned, it gives you "only" 1 point (and you need five).
This leads to the question how many points do none-banned words give?
If you think it can't get worse, you're wrong! It looks like each character of a none-banned word gives one point. Meaning "password1234" is an accepted password. (1 point for password and 4 for each digit)
And you can't do anything against it.
Anyone have a preferred method for physically disabling the microphone on an indoor security camera? (Wansview Q5)
I have the microphone turned off according to the app, but I'm getting audio feedback when I have the app running in the same room as the camera, so... I don't think it's really off.
Would polymer clay in the hole do the trick?
Wenn du ein altes Android Handy auskramst damit du "sicheres #Banking" machen kannst. #securityFail
Independent security analyst points out security flaws in an app the NZ government is developing, to provide citizens with access to their COVID-19 vaccination record:
https://www.rnz.co.nz/news/covid-19/453505/it-expert-says-my-covid-record-app-at-risk-of-security-breaches
I really should've put a few cable ties or something through the whole of that key before letting #BeardGrabber play with this #padlock. 
(It's also why I prefer #locks that need the key to be inserted to actually lock them...)
Tried cutting a copy out of a tin can, but all I got out of that was a small cut. The metal probably was not thick and sturdy enough, or it might also have needed the raised edge on the side. Guess I could look up #lockpicking instructions for a #MasterLock no.130.
Fortunately I should still have some other locks in a storage box, and am not in urgent need for one. :) Might find a spare key too, if I look for it; else I can always cut or file through the key. :)
@sophia after showing this to my wife, she shared this one from #TMobileAustria, from April 2018, with me: https://www.reddit.com/r/sysadmin/comments/8aem4n/tmobile_plaintext_password_data_breach_thought_to/
and from the same thread, also: https://twitter.com/hanno/status/982530027135922179
(Now I wonder/hope *they* have at least cleaned up their act by now)
From the tales of the solution is worse than the problem:
Business partner loses control of an email account; it emails all their contacts a malicious attachment. 1 hour later, that same account sends out an email , and puts Every. Single. Recipient in the 'TO' field warning them not to open the previous message.
Guess everyone knows all their business partners and customers now 
#infosec #netsec #SecurityFail #sysadmin
