Binance Square
LIVE
LIVE
kaymyg
Byczy
--65 views
Tłumacz
#Babydogecoin now ranks 2nd on the [Binance Futures Next](https://www.binance.com/en/futures/next) voting leaderboard ousting #bittensor s $TAO

#Babydogecoin now ranks 2nd on the Binance Futures Next voting leaderboard ousting #bittensor s $TAO

Zastrzeżenie: zawiera opinie stron zewnętrznych. To nie jest porada finansowa. Zobacz Regulamin
0
Odpowiedni twórca
LIVE
@kaymyg

Odkryj więcej od twórcy

--
(@sell9000 ) PSA re: an expensive opsec lesson At this time I have confirmed that it was a Google login that caused this compromise. An unknown Windows machine gained access about half a day before the attack. It also spoofed the device name, so the notification of the new activity alert (which occurred early morning while I was asleep) appeared similar to devices I normally use (it may have been a calculated gamble for a common device name unless I was specifically targeted). Upon further investigation, this device is a VPS hosted by #KaopuCloud as a global edge cloud provider that is shared among hacker circles in Telegram, and has been used in the past for #phishing and other malicious activities by shared users. I do have 2FA enabled, which the user managed to bypass. I have yet to determine exactly how this was achieved, but possibly attack vectors were OAuth phishing, cross site scripting, or man-in-the-middle attack on a compromised site, followed by possible additional #Malware . In fact, apparently #OAuth endpoint attack recently has been reported to hijack user cookie session (https://darkreading.com/cloud-security/attackers-abuse-google-oauth-endpoint-hijack-user-sessions…). Be extremely careful if you have to use Sign In From Google. Takeaways: 1. Bitdefender sucks, it caught nothing while Malwarebytes caught a bunch of vulnerabilities after the fact. 2. Do not become complacent just because you were moving large figures for years without issues. 3. Never enter a seed, period, no matter what reasonable excuse you give yourself. Not worth the risk, just nuke the computer and start fresh. 4. I'm done with Chrome, stick with a better browser like Brave. 5. Preferably never mix devices, and have an isolated device for crypto activities. 6. Always check the Google Activity alert if you are continuing to use Google based devices or authentication. 7. Turn off extension sync'ing. Or just turn off sync'ing period for your isolated crypto machine. 8. 2FA is clearly not bulletproof, don't become complacent to it.
--

Najnowsze wiadomości

Zobacz więcej
Mapa strony
Cookie Preferences
Regulamin platformy