Surreptitiously surveil a logged out laptop AD workstation’s keyboard with temporary physical access?

I can think of multiple ways to surveil a logged out computer with temporary physical access. The first is installing a hardware keylogger which would enable one to get all the keystrokes from it; however, hardware keyloggers on laptops ar… Continue reading Surreptitiously surveil a logged out laptop AD workstation’s keyboard with temporary physical access?

What are the risks of reusing the same passphrase for FDE, user account, and password manager?

Consider a home user who runs Linux on a laptop with full-disk encryption and uses a cloud-based password manager. Assume the laptop is firewall-protected with no SSH access. It seems reasonable to reuse the same passphrase for the OS user… Continue reading What are the risks of reusing the same passphrase for FDE, user account, and password manager?

How safe is sharing keyboard & mouse between work laptop & my personal laptop

What I need to know is if my work laptop (remotely managed by Org) installs or tags some hidden software on any devices being plugged in to the USB (obvious security hardening on their own part) which may make it to my personal laptop via … Continue reading How safe is sharing keyboard & mouse between work laptop & my personal laptop

Can a Remote Desktop software prevent windows 10 keylogger from accessing what is typed on client computer during a session to a remote computer?

The “improve inking and typing” setting in Windows 10 allows Microsoft to send themselves processed samples of what is typed on a machine (not sure if it is processed to remove details as it’s typed such as in RAM somehow or at Microsoft a… Continue reading Can a Remote Desktop software prevent windows 10 keylogger from accessing what is typed on client computer during a session to a remote computer?

Kimsuky’s GoldDragon cluster and its C2 operations

Kimsuky (also known as Thallium, Black Banshee and Velvet Chollima) is a prolific and active threat actor primarily targeting Korea-related entities. In early 2022, we observed this group was attacking the media and a think-tank in South Korea. Continue reading Kimsuky’s GoldDragon cluster and its C2 operations