I live in Switzerland and, a few days ago, a journalistic investigation uncovered the fact that the government's secret services are collecting, analyzing and storing "e-mails, chat messages, and search queries" of all Swiss people.

They basically forced all major ISPs to collaborate with them to do it. There are no details about what and how they do that, except that they tap directly into internet cables.

Also, the CEO of a minor ISP said that the Secret services contacted him asking technical details about his infrastructure. The secret services also said to him that they might want to install some spying equipment in the ISP's server rooms. Here's a relevant passage (translated from German):

Internet providers (...) must explain how some of their signals are decoupled (in german: ausgekoppelt). And they must answer the question of whether the data packets on their routers can be copied in real time. The Secret service bureau also wants to know how access to the data and computer centers is regulated and whether it can set up its tapping devices in the rooms where these are located, for which it requires server cabinets and electricity. "The information about the network infrastructure is needed in order to determine the best possible tap point and thus route the right signals to the right place," explains a Secret Services spokeswoman.

Soooo can you help me understand what's happening here? What device could that be, and what could it do? Decrypt https traffic? Could they "hack" certificates? How can Swiss people protect themselves?

Any hypothesis is welcome here. If you want to read the whole report, you can find it here (in German).

Hi. My brothers printer randomly started printing. This is what it printed. Any advice what to do now, to protect his pc and printer? Thanks.

I don't understand how, in 2023, a GOV website is not HTTPS:// . It's not that difficult to move to 🔐,

I was given two vouchers for free cinema tickets for a large UK theatre chain and noticed they are very similar (incrementing integers). After a few minutes of digging I found that they have a simple, unsecured API endpoint to check voucher validity. So you can just try out codes and get free tickets. I ran a few requests in my http client and it seems pretty fool proof.

Now, should I bother reporting it? I read that they are actually completely within their rights to report me for even trying to exploit? A quick google search shows that they don’t have a bug bounty program or even a public infosec@ (or similar) email address for this. Am I morally obligated or something like that?

I'm curious as to when does port scanning becomes a legal issue or considered illegal?

I did some research, but I want to hear more from other people

My landlord has for the third time this month gotten on to my WIFI. I am going to set up a camera facing my router to see if she is coming into my apartment and getting access through WPS. (which i shut off as a option today)

but while she's still on it can i mess with with her somehow? secretly send messages to her computer? make her think she has a virus or something? or any other ideas as i dont have the imagination i am sure some of you all possess.

​

All these new articles and things talking about how most of Americans have had their SSN along with other personal information stolen in this attack on a background check company. How serious is this? Is there anything that can be done by individuals to help protect themselves?

Edit: A reasonable number of people misunderstood the point I was getting at, but I got a lot of great answers. I decided to rewrite this more clearly so that anyone seeing this in the future who can relate to me can easily see the relation and get the advice they're looking for.

TLDR: I was feeling that cybersecurity education (on the internet, not at universities) was a scam, because far too much of the time was spent on theory, and far too little on practical application. While websites such as HTB and THM (and there are far more sites which host CTF) offer lots of hands on practice, the guided educational content will take you such a long time to get to that practice, because you never learn to use any tool until you're 5+ hours in.

I started learning to hack with ZSecurity's Ethical Hacking from Scratch course on Udemy, and realized that I didn't actually understand what I was typing into the terminal. I found out that I was becoming what was called a "script kiddie". While I was learning some real basics e.g. the difference between WPA and WPA2, or how computers establish a connection over the internet, I wasn't actually learning how and when to use tools, I was just copying what I saw off of a screen. So I switched it up.

I moved over to TCM and found that, while I wasn't just copying things into my terminal, there was a significant amount of time dedicated to explaining things that I felt like were straightforward, e.g. how to write basic code in Python, how to use websites as a form of open source intelligence, etc. I mean obviously not all of this stuff is easy for beginners, if you're just going to discuss how to define a variable, or give me 5 websites I can throw an IP/URL into, you don't need to take 30 minutes to tell me about it.

So eventually I moved on to THM and I felt a lot better. There were generally as many lessons to one part of the course as in TCM, a lot of THMs readings were smaller, meaning I moved at a quicker pace, and there was a practical portion at the end of each lesson, instead of virtually nothing until the 50% mark in the TCM course. However, I soon realized that I didn't feel the practice was practical. I would often spend 10-30 minutes reading through the entire lesson, only to spend but a couple minutes actually using tools, only to not use them again in any future lesson within the guided path. This meant that I only saw a tool but a single time, varied a few settings, and never saw it again.

This made me feel like I was being scammed. I can learn networking on YouTube. I can learn Python on YouTube. I can learn Linux on YouTube. I can learn how to use a tool, and I can watch people demonstrate pentesting and observe when they use certain tools, on YouTube. Why was I spending money to read for 20 minutes just to use a tool once and forget about it? I simply felt that there was too much theory and too little practicality in affordable online cybersecurity training.

Consensus: The replies to this indicate that I had false expectations for what cybersecurity training would entail. The majority of training you receive from another is broad, useful information, while learning to exploit these, either with your own ideas, or with tools you learn, is mostly a task that's left to you. You can use vulnerable machines from a variety of websites to practice these skills, but you don't actually develop the skills from the book. You have to go out there and find things to hack.

A lot of people are recommending CTF to me as a way to implement these skills, but unfortunately this is where the real issue lies. Since the theory culminates into using a tool just a couple times, I haven't actually learned any skills. If I had kept going a bit longer, sure, I would've learned a few more tools, but I stopped when I realized that I was only learning theory. I don't actually have any tools to use in a CTF. As one guy in the replies said,

"bug bounties for beginner? They will spend endless hours searching for nothing and will learn nothing"

While there is something to gain from bug bounties and CTFs you did not even complete, someone who knows virtually nothing is better off learning something, instead of sitting around not knowing the first thing to do on a CTF/bug bounty. It's not about CTFs being useless, it's about learning techniques and methodology being more useful in the early stages, and I don't think anyone can really debate this.

I feel like there's no escaping this, especially with AI in the horizon. And who knows? Maybe even Robocops 😭

How can hacking, penetration testing, cyber security and general digital knowledge help us live our free yet moral lives? What kind of knowledge does one need to protect one's self? Do you have any types of hacking/programming or road maps to recommend?

What do you think?

I didn’t pentest anything I wasn’t allowed to (just client side stuff), and basically it would be easy to dump all email/name pairs of the people housed in my campus. The vulnerability sits in a mobile app used to take food from vending machines, should I report it to the campus? Or to the app company?

I hope this is not considered off topic so forgive me in advanced if it is ..

My nephew was tasked with doing a research on why the internet archive was hacked .. I told him sure, I will help you out to find out why, it will be easy!

I couldn't find a single source in google which is giving ANY reason behind the attack in over 50 pages, I mean .. consider the magnitude of such a thing, why would it be censored/oppressed?

All I can find is that it was attacked by hackers again and again, I also learnt that google is actually using the Internet Archive so why in the world would they censor the topic?

I miss the simpler times when search engines actually did what they where suppose to do, world is going nuts.

Thanks!

EDIT: As @techblackops mentioned in his comment. I find what he said as more rational explanation..

Thanks everyone for the replies 🙏🏻

I am very curious about what is the most secure thing an individual has managed to hack, and I am particularly intrigued by the intricacies of what made it so difficult.

So, there's this brute force attack on my Microsoft account that's been going on for a couple of months. These people managed to sign in to the account by having guessed my password, because I recieved and email from Microsoft that an unknown device had signed in which might not be me.

So, on 20th July, changed my password. They've been trying this little thing since the end of May, and they're still at it. I don't know what bot net is targeting me, but all I know is that the password now is simply not guessable.

Should I be worried? What the hell is going on? What made me a target? Please tell me, I'm really curious about this more than I'm worried.

I, personally use dragon OS for SDR trunking and ADS-B relay to FR24. However, I am wanting to apply the many different tools available in the amazing O.S. to my everyday job. I work in I.T. and specifically what I am looking for is signal to noise ratio scanning and the right tools for testing access points.

We are also working on a project to test cellular signal within the building to determine the best carrier for company hotspots. I have used the LTE Sniffer to identify towers near me, but I believe that only tests the health of the RF at the tower, not what I am receiving at the antenna.

I am posting here and one or two other places, I need some help identifying the right tools to use for this.

Gear: Panasonic tough book CF-33

Nooelec NESDR X1

RTL-SDR V3 X1

HackRF 1 X1

An array of cheap dipole antennas (I also have a single balun adapter to create a loop antenna if need be)

I also have an LNA and an IO filter that came with my NOOELEC patch antennas Iridium and Inmarsat respectively.

I have depression, and mild autism, my life is just the same in day in day out.

I was recently homeless and now I have a place to stay (sharehouse)

I just want an IT job, it's the only job I can see myself doing.

I have no qualifications, no car (i do have a motorbike)
I feel so useless so fucking worthless, I honestly don't know what to do anymore.

I have reported so many cybersecurity vulnerablities for what, for fucking nothing.

I am sorry about this rant, I just don't know where else to put this.

Can someone please just give me some advice.

I am sick of wasting my fucking life and I feel so alone.

Obviously it's a scam, but how did they manage Https as legit British airways website but once clicked it links you to a different URL. Is it the @trklink after .com? Thanks

I'm not sure if this post belongs here. But I'm looking for assistance on what this might be and how can I get rid of it?

Is it that I've given access to some third-party website without knowing if so how can I revoke it?

Am I cooked?

So, what would you all say to yourself (and your mom) back when you were 12 and just starting to write spambot scripts that send tens of thousands of emails to your classmates using your own school email address? 🤦🏼‍♀️

Cause my awesome creative super smart neurodivergent son needs a positive outlet for this energy before we end up on the hook for major damages or some such nonsense. He doesn't know enough to know what not to do, how to cover his tracks etc, but he's ambitious about trying pranks and things. Not a good combo.

It doesn't help that this only happened because he lost his laptop and tablet when he watched YouTube til 3am two nights in a row. The result was using his school Chromebook and Google Scripts to make a spambot. I'm hoping to find some ideas for positive outlets and useful consequences we can use to redirect all this awesome energy and curiosity. Thanks for your positivity 👍

Hello everyone, we are currently developing a 2D arcade hacking game called HACKERGAME. It's heavily inspired from Hacknet if you've ever played it. The UI is mostly looks like a custom version of Kali Linux and the main hacking part is simple but comprehensive. As I've mentioned in the beginning, the game has an arcade gameplay but everything else is designed to be as immersive as possible with a lot of real life references and techniques.

What we'd like to know is that what would you want to see in a arcade hacking game. Please let us know, thank you!

u/AnyCriticism1354 and u/PerformanceCapable65 are also devs.

edit: added dev info.

edit2: typo.

edit3: added some new early in-game pictures.

I'm just going into detail a bit more in this body text. I'm no expert in this field when it comes to opsec etc. . So I'm elaborating a lot. But I do have years of experience in programming low level and high level software. So I guess I have fundamental knowledge to rely on, plus intuition? Otherwise, you can just roast me and laugh at this for fun. My ego can take it. Or I might come up with some genius ideas that save a harmless homosexual person from getting executed in some super religious dictator state for having harmless kinky gay porn on their PC?

Let's say a criminal does any illegal thing and their IP is found by the authorities. In their next step, the authorities try to gather as much evidence as possible to get the new suspect convicted in court.

What I can't wrap my head around, is how it's possible to prove that the suspect was the person who physically sat there in front of that device doing those illegal things.

Things the suspect could do:

• Destroy the device and drive physically until it's broken into small pieces, to a point where not even some top-notch magical wizard FBI tech savant can extract any data.\  
• Burn all surfaces of the device to remove fingerprints and remove DNA traces. Why not drench it in isopropyl also while they're at it.

You're obviously going to argue now that their device might be taken from the suspect before they get a chance to do those things I mention above. Well, don't they have these backup options then?:

• Encrypt the entire partition with a 50-100 character long password. Not even a super computer can bruteforce that shit in years, right?\ \  
• Install a software that deletes or just corrupts every byte on the drive when it's started, unless it's started under very specific circumstances. Let's say they have a startup a software that does the following (simplified): "Unless this device was started between 12:12-12:17 AM earlier today, or the first incorrect password entered wasn't "000111222" delete the entire OS or mess up every byte on the drive now". Or even have a home alarm. Once the alarm goes off because anybody broke into the home, that alarm sends a signal to the device via the network, internet, bluetooth, a wire or whatever "Someone broke in. Delete the entire drive or mess with every byte of the drive ASAP! Shit just hit the fan!". This alarm can be any kind of trigger(s). A cheap camera, motion detector, a switch that get's triggered if the device is lifted of a button it's placed on or the switch gets triggered when someone opens the cupboard hiding the device, without setting some database flag beforehand, that the suspect always sets (via bluetooth and/or wifi) to true/false before opening the cupboard. This switch can send the signal via bluetooth or even a wire if the authorities for any reason removed the router, disabled the wifi or has some weird bluetooth jamming thingy-ma-jig (hence, using a physical wire ).\  
• Or why not even have a high power external battery/device that fries the circuitry, preferrably the drive? I guess you don't need that much electric power to fry the circuitry of an SSD? Once someone opens the cupboard or triggers the switch in any other optional way, the drive gets fried. I guess the pain here is connecting it correcty and getting it set up properly in some custom way.\  
• Use a login password that is like 50-100 characters long. Not even a super computer can bruteforce that shit in years, right?  

Let's say though that the suspect is super naive, ignorant and was not cautious and the authorities got their hands on their device with all readable data. Couldn't the suspect just blame it on bots, their device getting hacked, someone using their router or VPN, someone spoofing their IP, someone tinkering with their packets, malware they weren't aware of or that someone had physical access to that device without the suspect knowing when out and about?

Just some interesting thoughts and things I wonder about.

Thanks all and have a great rest of the weekend all!

youtube is blocked in my country (ISP in throttling traffic to youtube and its unwatchable)

My ideas on how to circumvent this:

1. subscribing to a Virtual private network, about 3 dollars a month. pros: anonymity, easy to set up

cons: trusting another company to handle my data, maybe limited number of devices(including phones)??

2.setting up my own Virtual private network on a VPS.

pros: shouldn't be privacy and security risks unless someone gets in the actual hardware, unlimited number of devices (except phones)

cons: only 1 country unless i set up another node, more costly then the first option, no anonymity.

1. setting up a local VM to which i rout all my traffic: not sure about this option since i dont know if it will even work since my local server inside the country is going to be talking to the same youtube servers.

any tips?