Microsoft Traps and Windows TCO
-
Entrapment (Microsoft GitHub)
-
Daniel Doubrovkine ☛ Meeting Open Source Users Where They Are
For a small project I choose GitHub issues as the preferred and only channel. It keeps things well organized and is the least amount of overhead for both users and maintainers. Most questions can be turned into either an issue (e.g. “I have tried this, and did not get the expected results.”), or a feature request (e.g. “Would it be possible to add a feature that works as follows?”). I like to use templates, such as these to help guide users in opening issues with enough information to get meaningful help.
-
-
Windows TCO / Windows Bot Nets
-
The Register UK ☛ Biden's Cyber Chief leaves successor long to-do list
"In the last four years we have: Fought fires; taken a proactive posture to defending cyberspace; brought greater coherence to Federal and global efforts; gotten key tech companies to step up on cybersecurity; and taken on some of the hardest problems that have long crippled our ability to stay secure," said Coker, the second person confirmed by the US Senate to hold his role.
"We've made progress," the outgoing director added, while noting "there's still a long way to go."
-
Integrity/Availability/Authenticity
-
Silicon Angle ☛ Fortinet warns of sophisticated phishing campaign exploiting Microsoft 365 domains
The campaign uses legitimate-looking PayPal Holdings Inc. payment requests to trick victims into providing their account credentials. The approach effectively bypasses authentication mechanisms such as Sender Policy Framework, DomainKeys Identified Mail and Domain-based Message Authentication, and Reporting and Conformance, making detection and prevention challenging for individuals and organizations.
The phishing attacks begin with the scammer registering a free Microsoft 365 test domain, valid for three months. Using the domain, the attacker then creates a distribution list that includes the victim’s email address alongside others. The scammer then generates a PayPal payment request and sends it to the distribution list. The Sender Rewrite Scheme ensures that the email appears legitimate, with no visible signs of tampering or forgery.
-
-