#ato — Public Fediverse posts

@madcap much better then social media Account Takeovers!

#ATO

Waarschuwing voor "Browser in the Browser" aanvallen

Bij een BitB-aanval toont een nepwebsite een nep pop-up-venster dat eruit ziet als een (deels of geheel) nieuw browser-venster. Gesuggereerd wordt dat u uw inloggegevens moet invoeren op bijvoorbeeld:

https:⧸⧸accounts.google.com/signin/v3/

maar dat is allemaal fake: door u ingevoerde nloggegevens vallen zo in handen van de eigenaar van de onderliggende website, die daarmee als u kan inloggen en uw account kan kapen.

Mijn bron: https://www.bleepingcomputer.com/news/security/phishing-poses-as-big-brand-job-interview-to-steal-google-accounts/

Onderin https://gist.github.com/BushidoUK/57c38d5ee75481fb237e968a537de778 ziet u een lijst van criminele domeinnamen waar deze techniek op werd of nog wordt toegepast.

De hieronder getoonde website is gehost bij Amazon (zie het RELATIONS tabblad van https://www.virustotal.com/gui/domain/marriott-hiring.com). Als u zou openen (dat raad ik af):

https:⧸⧸marriott-hiring․com

moet u eerst een vinkje zetten, zogenaand om te bevestigen dat u een mens bent. Daarna verschijnt het beeld dat linksonder te zien is.

De feitelijke BitB-aanval ziet u in het 2e plaatje (meer info onder ALT).

Nb. met een passkey is deze aanval niet mogelijk omdat de domeinnaam niet klopt. Zwakke 2FA (SMS, TOTP of Number Matching) voorkómt *niet* dat u slachtoffer wordt.

#AmazonIsEvil #BigTechIsEvil #LetsEncryptIsEvil #BitB #Phishing #NepWebSites #ATO #AccountTakeOver #AitM #MitM

And the security breech (Courts transcription service outsourced to Indian company) gets even bigger… how did they not see this coming? A: Poor or non-existant contract and operations oversight. A typical result from the #Privatisation of what ought to be a publically owned and operated service.

“Earlier this year, embattled transcription company VIQ Solutions breached its Commonwealth contract with the Federal Court by allowing highly sensitive court files to be accessed offshore in India.

The company is now being wound down and was removed from AusTender as an approved supplier by the Australian Securities and Investment Commission (ASIC) on March 19.

However, 13 government agencies have used VIQ Solutions since 2019, including the Department of Defence, Services Australia, the ATO and even the Attorney-General's Department, broadening the risk of potential breaches.”
Source: https://www.abc.net.au/news/2026-06-10/viq-solutions-contracts-ato-special-investigator-defence/106771442

#Outsourcing #StateCapture #SecurityLeaks #AustralianCourts #TranscriptionServices #VIQSolutions #Debacle #SubContracting #AusTender #ASIC #DoD #ATO #AttorneyGeneral #AusPol

The Silent Breach and the Persistence of Unauthorized Access

938 words, 5 minutes read time.

Once the session token is successfully exfiltrated, the nature of the intrusion shifts from external deception to internal subversion. The attacker does not need to crack passwords or trigger further security alerts, as they are now effectively operating with the digital identity of a trusted employee. Analyzing these incidents, I see that the primary goal is often the establishment of persistence within the target environment, which is achieved through the modification of inbox rules or the creation of clandestine mailbox delegates. By silently forwarding incoming emails to an external address or creating hidden folders for sensitive correspondence, the adversary can monitor ongoing business deals, intercept financial instructions, and identify high-value targets for subsequent business email compromise attacks. This stage of the operation is characterized by extreme patience, as the threat actor avoids loud, disruptive actions in favor of a low-and-slow approach that can remain undetected for months. The tragedy is that the victim often remains entirely unaware of the breach, believing they are still securely authenticated while their environment is being methodically picked apart from the inside.

Challenging the Failure of Traditional Defensive Postures

When considering why these attacks continue to succeed with such alarming frequency, it becomes evident that the industry’s reliance on legacy defensive postures is a failing strategy. Many organizations still treat email security as a static barrier, implementing blacklists and rudimentary heuristic scans that are easily circumvented by adversaries who control their own infrastructure and rotating IP addresses. Furthermore, the human-centric nature of these scams renders technical controls inherently insufficient unless they are paired with a cultural shift toward skeptical verification. It is not enough to deploy an automated solution if the culture within a firm encourages speed over accuracy and ignores the red flags of irregular communication patterns. Consequently, the defense against these campaigns must evolve into a proactive, threat-hunting discipline that monitors for anomalous login locations, unexpected session durations, and unauthorized changes to account configurations. Without this layer of vigilant oversight, the technical barriers essentially act as a screen door, providing the illusion of protection while failing to stop the actual threat.

Implementing Rigorous Verification Protocols in a High-Stakes Environment

The path forward requires a departure from the convenience-first mindset that dominates modern digital work environments. Organizations must adopt hardware-backed authentication methods, such as FIDO2-compliant security keys, which are resistant to the proxy-based interception tactics that currently plague mobile-based push notifications and SMS codes. Additionally, the adoption of strict device posture checks ensures that an attacker cannot simply use a stolen session token from an unauthorized machine or an unrecognized geographic region. Beyond the hardware, there must be a fundamental hardening of organizational processes, such as implementing mandatory out-of-band verification for any request involving financial transfers or the sharing of sensitive credentials. It is a harsh reality that trust is the primary vulnerability in any system, and the most secure posture is one that treats every incoming request as potentially malicious until proven otherwise through independent channels. While this might introduce friction into the workflow, that friction is the necessary price of security in an age where the cost of a single successful breach is often the survival of the entity itself.

Call to Action

The time for passive observation has passed, as the threats currently infiltrating our inboxes are not waiting for an invitation to compromise your organization. You must decide whether to continue relying on outdated defensive protocols that offer only the illusion of safety or to begin the hard work of hardening your infrastructure against the reality of modern adversarial tactics. I urge you to conduct an immediate audit of your current authentication stack and evaluate the necessity of migrating to hardware-backed security keys, as this is the single most effective step you can take to neutralize the threat of proxy-based session hijacking. Furthermore, initiate a comprehensive review of your internal communication policies to ensure that your team is empowered to question anomalies rather than blindly following the path of least resistance. Security is not a product you purchase, but a discipline you practice, and the responsibility to bridge the gap between your existing defenses and the current threat reality rests entirely with you. Do not wait for a compromised session to force your hand, because by the time the impact of a breach is visible, the damage is already absolute.

D. Bryan King

Sources

• CISA: Business Email Compromise (BEC) Resources
• FBI: Business Email Compromise Information
• FIDO Alliance: Defining Phishing-Resistant Authentication
• Microsoft: Analyzing Adversary-in-the-Middle (AiTM) Techniques
• NIST: Digital Identity Guidelines
• CrowdStrike: Phishing and Social Engineering Analysis
• Palo Alto Networks: Business Email Compromise Explained
• SANS Institute: Protecting Against Advanced Email Threats
• Cybereason: BEC Threat Landscape Report
• Check Point: The Evolution of Phishing
• Proofpoint: Understanding BEC Attacks
• Dark Reading: The Mechanics of Session Hijacking
• ZDNet: The New Era of Targeted Phishing
• Wired: Why Modern Phishing is Succeeding
• Trend Micro: BEC Comprehensive Guide
• Recorded Future: BEC Trend Analysis
• Infosecurity Magazine: FIDO2 and Phishing Resistance
• Varonis: Modern Phishing Techniques Deep Dive
• CSO Online: The Mechanics of BEC
• Fortinet: Cybersecurity Glossary on BEC
• SANS: Analyzing MFA Bypass Tactics
• BleepingComputer: Evolution of Phishing Kits
• Secureworks: BEC Defensive Strategies
• CISA: Mitigating Phishing Campaigns
• Mandiant: Evolving Tactics in BEC
• NIST: Phishing Training Resources
• TechTarget: BEC Definition and Prevention
• Elastic: Detecting Phishing Infrastructure
• Rapid7: The Threat of Session Token Theft
• Cloudflare: Understanding FIDO2 Protocol

Disclaimer:

The views and opinions expressed in this post are solely those of the author. The information provided is based on personal research, experience, and understanding of the subject matter at the time of writing. Readers should consult relevant experts or authorities for specific guidance related to their unique situations.

Related Posts

Rate this:

Ato na Avenida Paulista pede fim da escala 6×1

https://fed.brid.gy/r/https://iclnoticias.com.br/ato-paulista-pressiona-fim-escala-6x1/

Mover.
#Paris Charles de Gaulle, #ÎleDeFrance #France
#ATO #GoA4 #AirportShuttle

Ato contra o feminicídio é realizado no Parque 13 de Maio nesta quinta-feira (9), no Recife

https://web.brid.gy/r/https://www.brasildefato.com.br/2026/04/08/ato-contra-o-feminicidio-e-realizado-no-parque-13-de-maio-nesta-quinta-feira-9-no-recife/

Siemens demonstriert automatisierten Zugbetrieb auf finnischer Fernverkehrsstrecke

#ATO #Bahnindustrie #ETCS #Finnland #Siemens #SiemensMobility #Testfahrt

https://bahnblogstelle.com/250572/siemens-demonstriert-automatisierten-zugbetrieb-auf-finnischer-fernverkehrsstrecke/

AI-Powered Automation: Taking ATO Modernization Beyond the Bottleneck

A recent article in U.S. Cybersecurity Magazine, “The ATO Bottleneck: Rethinking Responsibility and Enabling Automation,” makes a compelling case for transforming the federal Authority to Operate (ATO) process. The authors argue that the current manual, documentation-heavy approach—which can take months or even years—must evolve into an automated, continuous compliance model. Their vision: cut ATO cycles by 40-60% through Secure-by-Design principles, DevSecOps integration, and real-time evidence generation.

The Case for Automation

The article identifies several critical problems with traditional ATO processes:

• Static documentation that becomes outdated as systems evolve
• Manual evidence gathering that consumes months of effort
• Reactive compliance where security is retrofitted rather than built-in
• Knowledge silos that bottleneck approvals with specialized expertise

Their solution emphasizes automation tools that integrate with DevSecOps pipelines, continuous monitoring platforms that generate live compliance dashboards, and Secure-by-Design practices that embed security controls directly into infrastructure code from day one. The goal: transform ATO from a bureaucratic gate into a dynamic trust mechanism.

AI Takes It Further

While the article champions automation for validating and collecting evidence, AI-powered approaches like the ATLAS ATO Accelerator extend this vision by also automating compliant code generation. Here’s how AI enhances the automation framework:

Knowledge Democratization: The article emphasizes training programs to teach developers RMF and DevSecOps principles. The ATLAS approach encodes this expert knowledge into AI agent instruction files, making compliance guidance accessible at the moment of code creation—no deep NIST expertise required.

Generative Compliance: Rather than just scanning existing code for violations, the ATLAS approach uses AI to generate infrastructure that’s compliant from the start. The approach focuses on generating Infrastructure as Code artifacts with compliance controls built in, and clearly document, significantly reducing the time required to gather and document artifacts when the time comes.

Adaptive Guidance: As requirements evolve—new NIST revisions, emerging threats, updated frameworks—AI agent instructions (which are art the heart of the ATLAS approach) can be updated once and propagate consistently across all projects, addressing the article’s concern about “shifting interpretations” and “changing requirements.”

From Automation to Intelligence

The authors are right to point out that automation tools can “cut ATO cycles by an estimated 40-60% range.” AI-guided generation has the potential to push this further by preventing compliance gaps before they occur. When security controls, proper documentation patterns, and ATO readiness are embedded into the IaC generation process itself, teams spend less time on rework and more time on innovation.

The article’s vision of continuous ATO, living documentation, and Secure-by-Design is the right direction. AI-powered tools like those documented in the ATLAS approach demonstrate how to operationalize that vision—not just automating the compliance process, but making secure, ATO-ready infrastructure the natural default output of modern development workflows.

Read the full article: The ATO Bottleneck: Rethinking Responsibility and Enabling Automation

#AI #ATO #ChatGPT #government #llm

Aviation weather for Ohio University Snyder Field airport in Athens and Albany area (USA) is “KUNI 011355Z AUTO 00000KT 10SM OVC028 M01/M05 A3043 RMK AO2 T10111052” : See what it means on https://www.bigorre.org/aero/meteo/kuni/en #ohiouniversitysnyderfieldairport #airport #athens #albany #usa #kuni #ato #metar #aviation #aviationweather #avgeek vl

Testphase für automatischen Zugbetrieb auf der Betuweroute

#ATO #Automatisierung #Betuweroute #DBCargo #Lokführer #Lokomotive #Niederlande #ProRail #Vectron

https://bahnblogstelle.com/242685/testphase-fuer-automatischen-zugbetrieb-auf-der-betuweroute/

A warning: If you are a pensioner who decides to rent out a room because housing crisis, beware! Centrelink and the ATO will come after you with baseball bats. I tried it but it's not worth the trouble and financial pain! #Centrelink #ATO

Account Takeover: What Is It and How to Fight It https://hackread.com/account-takeover-what-is-it-how-to-fight-it/ #AccountTakeover #Cybersecurity #Security #ATO

WTAF? Just got this from the ATO. This is the sum total of the information provided*.

'We've overpaid you ten years ago and now we are going to deduct that amount.'

No calculation, no reason, just trust us that we know the $ amount we fucked up 10 years ago and we're not fucking this $ amount up now.

What fucking clown runs a financial institution like this?!

*The letter goes on to give you a standard spiel about contact numbers and addresses. It's not a large amount, but the hubris and lack of basic governance is fucking staggering #ato #robodebt

ATO refers hundreds of thousands of taxpayers to a private debt collector – including people on Centrelink benefits
https://www.theguardian.com/australia-news/2025/oct/27/ato-tax-repayments-debt-collector

The ATO is handballing thousands of people to Recoveriescorp. This misstep by the ATO is going to have disastrous consequences, like we saw with RoboDebt.

Recoveriescorp is a debt collector that's funded by private equity.

The business-model for private equity is buy-up other companies. This buy-up generates a massive debt. Companies that get consumed by a private equity firm are usually saddled with that debt. But, the reason those companies were up for sale is they were in bad shape. Now they've gone from underperforming to being in existential crisis. Their primary motivation becomes making as much money as possible, as quickly as possible, and by any means possible. Recoveriescorp is desperate to make money, and will hit anyone to make a buck.

What kind of company is Recoveriescorp?

Follow the money!

Recoveriescorp is owned by Nutun Australia Holdings Pty Ltd, which is part of Dove Bidco Pty Ltd, which is a wholly owned subsidiary of Allegro Funds Pty Ltd.

Clear as mud.

How about Allegro Funds?

Back in January 2023, news emerged that PwC had been leaking secret Australian Government tax plans to corporations for up to ten years. PwC had abused its position as consultants to the Australian Government. Additionally, PwC ran what appears to me is a sham investigation to cover-up their own dirty deeds. (For more info, see https://en.wikipedia.org/wiki/PwC_tax_scandal).

As the result of this scandal, PwC lost A$680 million, about 20% of its overall income.

To extricate itself from the disaster of its own making, PwC spun-off the part of its business responsible for the acursed "Government Services". That was in June 2023. (For more info, see https://www.abc.net.au/news/2023-06-25/pwc-appoints-new-ceo-will-sell-off-government-business/102521482). The core of new company was 117 former PwC partners, then filled-out with more than 1,500 other PwC staff. It was named Scyne Advisory.

In November 2023, PwC sold Scyne Advisory to Allegro Funds for $1.

You read that right: one dollar.

Now Recoveriescorp, owned by Allegro Funds and haunted by the ghost of Scyne Advisory (née PwC), has a fresh deal with the Australian Taxation Office. The ATO hasn't learned anything from its past mistakes. They did a deal with Recoveriescorp to act as a debt collector and try to claw money from people on Centrelink.

#AusPol #RoboDebt #ATO #AustralianTaxationOffice #Centrelink #Recoveriescorp #PwC #ScyneAdvisory #AllegroFunds

Huge thanks to @allthingsopen for hosting an incredible event! We loved chatting with you all about #observability, #AI, and #opensource (so much that we stayed until you were boxing up 🐝 🐧 📦 )

#SRE #OTEL #eBPF #Linux #softwarelibre #monitoring #tech #ATO #ATO2025 #allthingsopen

https://www.both.org/?p=12207

#Linux #Both.org #ATO #AllThingsOpen

Hello @allthingsopen attendees! I'll see you Tuesday at 3:15pm for my talk: Developing Kubernetes Integrations for the On-Premesis Cloud

#ato #allthingsopen #kubernetes #cloud #linux #programming

Größtes ETCS-Projekt in Südamerika - Siemens modernisiert Nahverkehrsnetz von São Paulo

#ATO #ETCS #Infrastruktur #Modernisierung #Siemens #SiemensMobility #Südamerika #TriviaTrens

https://bahnblogstelle.com/240094/groesstes-etcs-projekt-in-suedamerika-siemens-modernisiert-nahverkehrsnetz-von-sao-paulo/

The #ATO Australian Tax Return for Companies is a #poordesign form. It is a multi-page form, with numbered item sections, and then letter labels for individual fields. However the combination of page + item number + label letter is not unique, so you have to refer to items by their full name. e.g. page 6, item 8 - label K, could refer to item K - Commercial Debt forgiveness, or K - Unfranked dividends paid.