Dan Veditz

@dveditz@infosec.exchange
494 Followers
786 Following
624 Posts
Mozilla Firefox security

I asked the question, it was since clearly answered. Now Texas officials are trying to say that NWS is the reason nobody was prepared.

It is VERY clear that NWS issued warnings. What isn’t clear is what state and local agencies responsible for acting on those warnings did. This was not a weather prediction failed. It was a failure to recognize how bad it was going to get, and seemingly a failure to act on that information. Don’t let Abbott throw forecasters under the bus.

***** People are asking me if the email from Social Security yesterday was a scam *****

I'm getting many people asking me to "investigate" if the email they received yesterday touting the fascist GOP budget bill, that will enrich billionaires and throw over 10 million people off healthcare, and makes misleading claims about seniors not paying taxes on Social Security benefits, was some sort of phishing attack or other scam, the kind that Social Security is always warning about (and in fact, is a topic they send emails about occasionally, warning you about such scam emails).

Apparently all Social Security beneficiaries for whom Social Security has email addresses and has been sending emails in the past, received this propaganda email, which it noted in fine print at the bottom was "produced and disseminated at taxpayer expense".

And yes, it definitely IS a scam. It's Social Security Administration propaganda from Trump. It's not trying to get you to send money, it's trying to sell you fascist lies.

Which is even worse.

L

💥 The ransomware vs insurance company playbook 💥

1. Ransomware gang infects insurance company, but DOESN'T install ransomware. Instead it steals information about insurance company's clients, learns which have cyberinsurance, and how much insurance cover they have.

2. Gang takes list of insured companies and goes through it - it's a rolodex of ransomware - infecting each one with ransomware. They tell the victims that they know how much cyberinsurance they have, and suggest they pay up PDQ

I laughed. Yeah, it's like that at times.
AI coding tools are currently good at the first 80% of software development, which is putting bugs in. Not so great at the second 80%, which is taking them out again.
TIL that Starbucks corporate management has turned off the tipping options in unionized shops pay terminals so, one more reason to carry cash.
We just published Firefox updates to fix the two exploits used at the Pwn2Own contest yesterday and today. Both contestants achieved content process RCE but did not escape the sandbox.
https://blog.mozilla.org/security/2025/05/17/firefox-security-response-to-pwn2own-2025/
Firefox Security Response to pwn2own 2025 – Mozilla Security Blog

At Mozilla, we consider security to be a paramount aspect of the web. This is why not only does Firefox have a long running bug bounty program but also mature ...

Mozilla Security Blog
Protesters: are you paying attention? Break up the bigger protests into a large number of smaller protests to make things difficult for the Stasi, I mean the SS, I mean the pigs, I… you know what I mean.
@dangoodin And given the ubiquity of surveillance cameras, I wonder about the security of entering passcodes constantly.
PSA for iOS Android users everywhere: it's fine to use biometric authentication to unlock your device. It helps you choose better passwords. So instead of turning fingerprint and face scans off completely, when you find yourself in a less secure environment, simply press the power and volume up buttons simultaneously for a few seconds. On iPhones, your phone will immediately require a password. For Android users, you'll need to click the lockdown button presented on the screen. Then, practice the move a couple times per week each week. #UsableSecurity
×

💥 The ransomware vs insurance company playbook 💥

1. Ransomware gang infects insurance company, but DOESN'T install ransomware. Instead it steals information about insurance company's clients, learns which have cyberinsurance, and how much insurance cover they have.

2. Gang takes list of insured companies and goes through it - it's a rolodex of ransomware - infecting each one with ransomware. They tell the victims that they know how much cyberinsurance they have, and suggest they pay up PDQ

3. Once gang has gone through the entire list, it goes back to where it began - with the original hacked insurance company, and installs its ransomware there too.

4. Gang finds a new insurance company to hack, and so it continues...

By the way, ransomware gangs are already doing this...

@gcluley possibly even more effective if they start with a big broker company.. adding to the risk model when I'm in the office tomorrow!