mstdn.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
A general-purpose Mastodon server with a 500 character limit. All languages are welcome.

Administered by:

Server stats:

11K
active users

#dataexfiltration

0 posts0 participants0 posts today

Cybersecurity researchers have uncovered two malicious packages, zebo and cometlogger, on the Python Package Index (PyPI) that exfiltrate sensitive data from compromised systems! 🚨 With over 280 downloads before removal, these packages employ advanced techniques for surveillance and credential theft. Always verify code before running! 🔍💻 #Cybersecurity #Malware #Python #DataExfiltration #Fortinet #newz

thehackernews.com/2024/12/rese

The Hacker NewsResearchers Uncover PyPI Packages Stealing Keystrokes and Hijacking Social AccountsPyPI packages "Zebo" and "Cometlogger" downloaded 280+ times, exfiltrate data with obfuscation and anti-detection.
Replied in thread

@femme_mal @Catawu @DamonWakes @lrhodes @nazgul either way I'm convinced this shit is so flatout illegal in the EU that it's literally a felony in places like Germany, where even having such functionality may fall under "production, possession, distribution and use of tools to facilitate data manipulation and/or extraction against the owners' consent" (§202c penal code)...

But that's just my opinion, and #NotLegalAdvice!

Replied in thread

@briankrebs The best way to prevent #dataexfiltration when breached is not to collect or store unnecessary data in the first place. That makes many of the current spate of #databreaches avoidable, self-inflicted incidents for which large companies are never held accountable in any truly meaningful way.

You're spot on when you say that #databrokers rely on large #datalakes of sensitive data they don't need directly. They also rely on large data sets where any typical datum may be harmless in itself, but often becomes sensitive or dangerous when aggregated, and often exponentially more so when connected to intrinsically sensitive data such as #PII, #PHI, or identity.

Setting aside the financial incentives and lack of accountability for the data brokers, how do #businessleaders, #regulatoryagencies, and #electedpoliticians justify this state of affairs to you? It's not like the public and private sectors don't also have data they want to protect, so why allow this shadow industry to prosper? This seems even more mystifying when it's so clearly a double-edged sword even for the brokerages' paying customers!