![Matt Sionkowski](/img/default-banner.jpg)
- 10
- 73 317
Matt Sionkowski
Poland
Приєднався 13 сер 2021
NHS - Hack of Synnovis impacts hospitals. How, who and why?
NHS - Hack of Synnovis impacts hospitals. How, who and why? In the movie I'm describing the recent NHS hack, and to be more precise - the security breach of Synnovis, a health care provider used by NHS England. The Ransomware attack of Qilin group impacted seven London hospitals. Causing mass disruption and fallback to using 0-type blood and tests being delivered by hand. Full capacity of Synnovis still is not possible. Current information shows that attackers published the stolen data meaning that the group not only encrypts data but also exfiltrates data after data breach.
Переглядів: 463
Відео
Update Starvation - MITM PoC on Google Chrome
Переглядів 6752 місяці тому
Update Starvation - MITM POC on Google Chrome My new video Update Starvation - MITM POC on Google Chrome presents a new idea on how prolonged MITM attacks can impact the overall security posture of end user applications. Update starvation is an approach to Man in the Middle attacks where an attacker managed to become the only source of Internet for a span of months. When you have months instead...
Gary McKinnon, a man behind the Biggest Hack Ever, or is he?
Переглядів 5934 місяці тому
Gary McKinnon has been accused of performing the "Biggest Military Computer Hack" of all time. But was that the case? Was he the biggest hacker of his time? Was he just a whistle blower or truth seeker? Gary McKinnon Is all of the above. Enjoy the story of hacking, legal battles, and strive to find supernatural. Story which spans over 10 years.
Browser Fingerprinting Explained (You're Tracked!)
Переглядів 50 тис.11 місяців тому
Browser Fingerprinting Explained (You're Tracked) In this short educational video Browser Fingerprinting Explained I will take you through the recent history of browser trackers. From Cookies to Browser Fingerprinting. Whenever you leave too much information about you or your device than it is absolutely needed - there will be someone who will benefit from gathering and profiling such informati...
Your Browser is Lying
Переглядів 17 тис.Рік тому
Subscribe to not miss out on next releases! Your browser is a liar. It lies about colors and styles of links. Go with me through the journey starting on the lie itself, through its history, up to the solution, and back to reintroducing it together with me. Sources: seclists.org/bugtraq/2002/Feb/271 blog.jeremiahgrossman.com/2006/08/i-know-where-youve-been.html blog.mozilla.org/security/2010/03/...
Birth of CyberWarfare - Solar Sunrise
Переглядів 389Рік тому
Take a short break and make sure you're subscribed. Every war has a first shot or a first bomb which defines the upcoming events. What was the first shot when it comes to Cyber Warfare? Who made it and why? And what was the impact that caused the dangers of the cyberspace to be taken seriously? Years after - let's go back to where it started. And as with all "first times" - a lot of things didn...
A Tale of 14 Million Passwords - Rockyou
Переглядів 2,5 тис.Рік тому
Subscribe now - we're not getting younger! How did a single security breach in a software development company, which happened over 10 years ago impact the way we think of passwords today? How is the leaked data still being used till now in the tools of both cyber criminals and white-hat security professionals? Sources: techcrunch.com/2009/12/14/rockyou-hack-security-myspace-facebook-passwords/ ...
Matadoor - Multi-Step Clickjacking done RIGHT
Переглядів 6652 роки тому
Matadoor is a tool for creating ready-to-use Clickjacking exploits for abusing pre-established authentication sessions. It supports multi-step clickjacking in a way no other tool did before. Website: matadoor.io/ Github: github.com/MateuszSionkowski/Matadoor/ Matadoor allows hijacking multiple clicks without any change to the website's layout and functionality. The victim can interact with the ...
So cool man thanks for the video! I learned a lot
Excellent cover of the subject. Thanks a lot, mate 🙏🏻
Aaaand you can thank Americans for making damned sure tech companies can do that. About time that nation crumbles.
My HTTP_ACCEPT headers was the most unique, 1 in 186000. That was suprising.
This means your hands were severely injured you lose access to your worldly possessions starting with money.
Thank you for your help. I currently have lost access to both my internet banking and Play store because the bank app needs to be updated and I can't remember my Gmail address as I rarely use it. I am trapped.
I was not aware of the part you gave us after the cookies part. And there was me thinking "I don't allow cookies or keep a history or associated data." And I use Linux. Oh, fudge...
Basically we're not completely always safe heads up🤔😀 what can we do.
This behaviour will not stop until legislation enforces it….and that will never happen because it is all about big money.
We need a browser that randomize some things in the fingerprint to mask your identity.
Awesome video! Thank you for making it simple & easy for me to understand. And to make it clear to us that we are so un-incognito
I want to be shown an ad with dogs in a car and my face superimposed on a buff driver with 2.4 kids in the trunk, then I’ll be worried.
I just commented, then wanted to adjust a name, didn't take the adjustment so I reloaded the page and my comment is gone as if I never wrote it. I'll retry underneath this - if it stays..
Powerfull
Yes. I scored two different bug bounties with it. One at Microsoft and one at Google. This is the piece of code of mine that I am the most proud of 😀
I tried znd have suggestion Why you dont do a pause button Like in the begining You need to add login and pass Like portswigger multiple steps clickjacking
Excellent 👌
Dzięki
All the guys who got this video recommended are thinking, "OMG! My internet browsing's being tracked!!" And we all know why😆
Read 1984. Everyone should worry about this no matter what’s in your browsing history.
Thanks for the video. It helped me understand this pesky fingerprinting technique.
You’re not tracking who subscribes and does not subscribe to this channel, right?!
@@mikeg3810 hello! I know it is a joke but a side note - I do in fact see some of the subscribers. The difference between just seeing a +1 subscriber in the subscriber count, or a fully fledged notificstion with an actual profile that subscribed depends on that profiles configuration - if it allows the subscriptions to be publically visible. And telling true I do look at those and it brings me a lot of joy that a person from the other side of the world with intrests far from IT found 15 minutes of own time to watch what I recorded :) 😀
Uptooted just for the Rick Roll at the end. Haha
Wow, the bot'ing of most channels is totally real. Some other channels have talked about the explosion of comment bots in the last few weeks, and they seem to be everywhere. With so many posts of generic messaging, they almost seem real and YT cares about their opinions when they down vote a comment or video. yikes! Browser fingerprinting has been around for years. It's too bad that it really hasn't been addressed and newer versions of the browser just make it easier to get info about your system. The canvas bit is really disturbing because you can test so many things to get a more randomized result to further isolate a target. Can we go after sites and IPs that do this kind of fingerprinting to blind them from our browser?
Brain Bendingly great!
Don't all companies secretly want to allow for fingerprinting ? The internet of today runs on ads and data-theft, so it is only normal.
Pity about the annoying and unnecessary background "music".
Not only that , enter android, add gps location and client network ip address, with your gmail id to the fingerprint and see the magic.
When vid is *95% Misleadin* , *Old News & Corpo* *5% Truth* You got a lot of this Wrong.
Great breakdown and explanation of browser fingerprinting and tracking Matt!
Bro serving your printer sounds scary indeed.
Don't worry. ISPs are forging an alliance (already have) to track you by your connection. No matter the IP, no matter the device. All of it is linked to you by inserting a "cookie" into every data packet you send over their connection.
I think you can manually change your time zone on some OS'. Maybe do that occasionally (delete your cookies at the same time or it won't help), along with your English dialect (if you use English), and only use the fonts that came pre-installed with your OS, like probably 90% of people. Use different browsers for different things (e.g. do all of your social media on one browser only and all of your shopping on another). Create a "guest user" account on your computer (or have a different device) and never use it to log into anywhere that knows your real identity, telephone number or main email (or any email with your name in it). Compartmentalize your online activities to split your data into multiple different profiles, with each only having a partial picture of your behaviour. Create ambiguity and make them work to connect the dots. You can't hide from the government, but you can make life hard for private companies trying to monetize you.
Thanks for interesting video but I personally do not mind to see targeted ads. They are much better and remind me about things which I need but did nit know that they exist :)
I am a backend dev and I use jwt token and useragent combined for enchanced security actually so even if user is tricked to give his cookies, cookie wont work on another device, its better that way imo Vs using ip, it would be too restrictive
I envision browsers having the capability to identify which services possess your identity and what specific data they hold about you. With this feature, users could simply click a button to obfuscate or remove their data, effectively erasing their presence from these services. Data brokers should be held to stringent security standards, and legislation should prohibit the sale of personal data. Instead, brokers should only be allowed to sell aggregated information. For instance, if someone wants to conduct a census on a particular tool, they should be able to request aggregated data without compromising individual privacy.
ua-cam.com/video/45uJAOs22jE/v-deo.htmlsi=R2t3F0dvbi5vkzOn Records:: Publications:: UA-cam:: Matt Sionkowski 2.15K:: Browser Fingerprinting Explained (You're Tracked!) 40K:: Comment 196{ Great video, I apologize for the wall of text but I hope you should find it worthwhile and not mind reading it. I'm a philosopher, and I'm glad you're giving your time and attention for the benefit of others, especially when one's attention is the most valuable thing they have. Your humor is also 'professionally implemented' : p Also, if it appears I digress and meander, it shall only be to provide essential context (literally 'with text'). At the Studio, we have had to transition to digital technology, and I would not be conversing with you now if not for doing so. However, with digital technology we find there are 'issues': [ P O R O S I T Y ] The first 'issue' is 'porosity' - Devices are manufactured to be porous, in other words data stored within them will always have the possibility of leaking out, primarily of being accessed by unauthorized parties. This applies to even so called 'air gapped' device. The reason for this is due to security and special interests concerns, and manufacturers are 'heavily pressured' to cooperate. Philosophically however, this issue has been found to be unavoidable, as those who possess sufficiently advanced technologies (like fairies, aliens, psychics, remote viewers etc (for example)) are able to read the contents of our devices, and when they are able to subsequently interact with our sphere of influence, any notion of privacy immediately evaporates. In fact one theory "speculates" that the universe is such that "if you know how" you can read what's written on a page in a closed book that's on a shelf somewhere in the Andromeda Galaxy, or even at the other end of the observable universe, and suggesting that that is one reason 'why' it is called the "observable universe" (also, the inventor of the expression 'observable universe' might have been unaware of this at the time of its coining). As such 'Porosity' is believed to be a theme of the universe (always written with a lowercase 'u' as it was considered to be "too absurd" to use an uppercase "U", as nothing is greater or bigger or more important than, or more of a noun than the universe (for example only --> when you wake from the Matrix and look over your 'shoulder' - you're still in the universe. The point is that the notion of privacy should be abandoned, if not then we should regard privacy in terms of relevant parties, each of whom has the potential to access the data and where to achieve privacy they are kept from accessing that data using many techniques (such as distractions, threats, damage, deception, etc) but an illusion of privacy doesn't hold water. DISCLAIMER: I am a supporter of privacy, I only realized that I had none. I think privacy allows for unique authentic expression and autonomy, and builds trust in one's reality. The second issue is, as mentioned, is Design Stage Compromise. This is usually with the collusion of manufacturers, or component(s) manufacturers. We have started a project called "Phone 3.0" that should address the privacy issue. [ I N T E R I M S O L U T I O N S ] Back down to Earth, the best way to achieve reasonable privacy is the "Hash & Burn" Method, also called the "Slash & Burn" Method. This is what the pros use. It's where instead of buying 1 device, you buy 10 devices. Instead of creating one email account, you create 20 unrelated email accounts. This way you can browse, and send texts to parties without any tracker knowing. This could have been better explained but I'm sure its clear. This is a Green Hat method and works out of the box (There's no way the average person will disable or randomize every identifier on their devices, this would require extensive knowledge, tools, expertise and time that folks just don't have, and in many cases it's just not possible). You should be aware though that you can still be identified using behavioral analysis and other techniques - which have become quite sophisticated: When you're setting up a new device you might always install certain apps, or position your icons a certain way on the homescreen, or do things in a certain order, or adjust certain settings and never others. All this can be used to positively identify you across devices. It can be used not just by companies like Google, but also by ANYONE who can hack Google. This is unfair to Google as they can in theory do this to any service that you use, Google is just an elephant in the room, we're even on their platform right now... }
Sounds like a proxy built in to your desktop is a good step. Then your browser can send requests through the proxy without giving any data other than the server IP and resource request. Will that work?
Hey, not really. The browser builds (and encrypts) the https packets. Any kind of proxy or any other nerwork intermediary will see that packet as an encrypted pack of giberish with no possibility to modify it. Any kind of solution needs to be done at the browser level. Either through the browser itself or the browser plugins. Any other place is just too late.
Kudos to you (and Mozilla too)
I remember downloading a tool that showed what's beyond tracking cookies. I remember deleting some of the one I saw related to things I knew. Then the application started behaving differently.
Very enlighntening video. Thank you very much!
10:12 that's wrong, you have close to full control over the information you send to websites, it can be archived with plugins. There's no reason to send to websites your graphics card ID if you want to avoid it
It's something I've known for a while, and do my best to avoid, but it still makes me sad seeing the backend explained
Does using a VPN help with these issues?
start again all over again one more time once again
Ohh well
STOP THE MUSIC, PLEASE.
Fascinating stuff. Keep up the good work
Although it still is an issue, they all (Meta, Google, …) absolutely hate Apple for lying in Safari.
Good day, thanks for the in-dept explanation. please i will like to ask. If i format my system and reinstall windows will the system finger print still be the same.
Advertisers are corporate terrorists.
Excellent, never heard this anywhere.