#tls — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #tls, aggregated by home.social.
-
Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
Following Black Hat and DEF CON conferences, a threat actor targeted attendees through X direct messages, posing as CoinDesk's VP and Head of Marketing to establish trust under the pretext of conference planning. The campaign employed a malicious Google Apps Script embedded in a Google Doc that presented ClickFix-style instructions and manual download options. The attack delivered different payloads based on the victim's operating system: macOS users received AMOS infostealer, while Windows users were infected with NetSupport RAT, a Ledger wallet implant, and a TLS-intercepting proxy. A secondary lure masqueraded as a DocSend installer to deliver additional payloads. The operation demonstrated sophisticated social engineering by leveraging trusted platforms and post-conference networking expectations.
Pulse ID: 6a85d24a1bf7db5b97a4e9f8
Pulse Link: https://otx.alienvault.com/pulse/6a85d24a1bf7db5b97a4e9f8
Pulse Author: AlienVault
Created: 2026-08-19 15:56:58Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#AMOS #CyberSecurity #Edge #Google #InfoSec #InfoStealer #Mac #MacOS #Malware #NetSupport #NetSupportRAT #OTX #OpenThreatExchange #Phishing #Proxy #RAT #RCE #Rust #SocialEngineering #TLS #Windows #bot #AlienVault
-
MacSync Stealer: C2 Infrastructure Rotation
On 5 May 2026, a Jamf Protect deployment blocked a download attempt from jacksonvillemma[.]com, four days after the operator's previous MacSync C2 was publicly disclosed. The new C2's TLS certificate was issued within 24 hours of that disclosure. Analysis revealed a Stage 2 zsh loader containing a static api-key value observed across four distinct C2 domains spanning December 2025 to May 2026. URI-pattern pivoting through any.run identified eleven additional candidate C2 domains dating back to February 2026, suggesting parallel infrastructure operation rather than sequential rotation. The loader exfiltrates macOS credentials, browser data, and cryptocurrency wallets, and transmits the victim's account password in cleartext via URL query strings, making it visible in web proxy logs.
Pulse ID: 6a84bafb3c129cc2f9de2762
Pulse Link: https://otx.alienvault.com/pulse/6a84bafb3c129cc2f9de2762
Pulse Author: AlienVault
Created: 2026-08-18 20:05:15Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#ANYRUN #Browser #CyberSecurity #InfoSec #Mac #MacOS #OTX #OpenThreatExchange #Password #Proxy #RAT #TLS #Word #bot #cryptocurrency #AlienVault
-
Hardening iDRAC? Lock it down with strong cipher suites, disable SSLv3, and enforce TLS 1.2+ via racadm. This snippet also imports custom CA certs for trusted web UI access. Works on iDRAC8 (2.40+) and iDRAC9. #idrac #security #tls
https://www.valtersit.com/vault/secure-idrac-hardening-with-cipher-suite-and-certificate-man-875345/
-
Что делать, если сервер доступен по SSH, а сайт не открывается
Мониторинг шлёт тревогу, пользователи пишут, что «всё лежит», но SSH пускает на сервер. Значит, машина включена и 22-й порт доступен. О домене, портах 80 и 443, TLS, веб-сервере и приложении это пока ничего не говорит… Кажется, что нужно просто перезапустить nginx, но перезапуск стирает часть следов и может превратить частичную аварию в полную беду. Под катом расскажу, как пройти путь запроса сверху вниз и найти место, где он остановился. Читать
https://habr.com/ru/companies/ruvds/articles/1070692/
#Linux #SSH #nginx #системное_администрирование #серверное_администрирование #DNS #TLS #VDS #вебсерверы #ruvds_статьи
-
With the proper documents, any may pass and be trusted. #TLS #LetsEncrypt #Linux #OpenSource https://cromwell-intl.com/open-source/letsencrypt-tls-cert-godaddy.html?s=mc
-
RFC 10015 (July 2026) makes RSA key exchange and finite-field DH MUST NOT in TLS 1.2.
Both ship enabled in nginx, Apache and Windows Server defaults. You never turned them on.
ECDHE is untouched.
-
"Don't Trust, Verify"
Or "Validating origin and integrity without public CAs"https://blog.k3can.us/posts/2026/aug/donttrustjustverify/
Just playing around with couple methods of validating data origin and integrity without blindly relying on public CAs. It's sort of a follow-up-to-a-follow-up on my post about using Cloudlfare tunnels to #selfhost personal sites or services.
-
#ZeroSSL certificate renewal is slow. Several minutes per domain, but it goes through successfully. Normally this runs unattended and I don't pay attention. So maybe that's normal.🤷♂️
#TLS #SSL #homelab #selfhosting -
ECH aktivieren: Encrypted Client Hello in nginx mit OpenSSL 4.0, sechs Domains und ein gemeinsamer Deckname
Der Servername im TLS-Handshake bleibt für jeden Netzwerkbeobachter sichtbar, selbst wenn DNS-Anfragen längst verschlüsselt laufen. Mit OpenSSL 4.0 und einem gemeinsamen Deckname über mehrere unabhängige Domains hinweg lässt sich das schließen, wenn eine Entscheidung nicht falsch getroffen wird: der öffentliche Name.https://www.kernel-error.de/2026/08/17/encrypted-client-hello-nginx-openssl-4-public-name/
-
sipgate unter Linux: ein Softphone, das Kontakte und Kalender aus der eigenen Nextcloud kennt
Ein Softphone unter Linux, das an meinem sipgate-Konto hängt und beim Klingeln den Namen aus meiner eigenen Nextcloud anzeigt statt einer nackten Rufnummer. Der Weg dahin führt nicht über CardDAV im Telefon, sondern über den evolution-data-server, und das Softphone merkt davon nichts. Dazu die Frage, was bei so einem Anruf eigentlich verschlüsselt ist, einmal nachgemessen statt geglaubt.https://www.kernel-error.de/2026/08/16/sipgate-linux-softphone-nextcloud-kontakte-kalender/
-
Sehr gute TLS Grundlage von Sven Höxter, aus der man auch mit viel Erfahrung noch was lernt. #froscon26 #TLS #security
-
Need to stop certificate expiry surprises? This cron script checks cert end dates via openssl x509, converts to epoch, and alerts via mailx if under 30 days. Also logs to syslog with logger. Works on Linux and macOS. #tls #cron #alert
https://www.valtersit.com/vault/automated-cronbased-certificate-expiry-alerts-via-email-and--f095b0/
-
Need a self-signed ECDSA P-256 cert with multiple SANs and SHA-256? One OpenSSL command does it: `openssl req -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -keyout key.pem -x509 -days 365 -out cert.pem -sha256 -addext "subjectAltName=DNS:example.com,DNS:www.example.com"`. No emojis, just TLS. #tls #snippet #openssl #ecdsa #ValtersIT
https://www.valtersit.com/vault/generate-ecdsa-p256-certificate-with-sans-and-sha256-using-o-bea576/
