the grugq's newsletter

Good RUSI report

Twitter avatar for @RUSI_org
RUSI @RUSI_org
🚨New RUSI report, 'Operation Z: The Death Throes of an Imperial Delusion' by @Jack_Watling and Nick Reynolds is out now!

rusi.org/explore-our-re…

rusi.orgOperation Z: The Death Throes of an Imperial DelusionRussia’s military setbacks in Ukraine pose a new set of security challenges in Europe and beyond.
10:48 AM ∙ Apr 22, 2022
204Retweets

A philosophical discussion on threat actors and intelligence

Twitter avatar for @EHaeghebaert
Emiel Haeghebaert @EHaeghebaert
A colleague recently raised “the Ship of Theseus” as an apt analogy for attribution of cyber operations over time. The thought experiment asks: if a ship in a harbor has all its parts replaced one by one, can we still consider it the same ship? On this paradox, a brief 🧵 1/8
6:12 PM ∙ Apr 22, 2022
36Retweets

Crypto and lost money, except this time it’s not a scam!

Twitter avatar for @0xfoobar
foobar @0xfoobar
$34 million, or 11,539 eth, is permanently locked into the AkuDreams contract forever. It cannot be retrieved by individual users or by the dev team.

The refund processing, which is complete, sets each bid status to 1.

Image
1:42 AM ∙ Apr 23, 2022
2,187Retweets
Twitter avatar for @Cannibal
Cannibal @Cannibal
Welcome to DFIR
Image
3:38 AM ∙ Apr 23, 2022
58Retweets

Propaganda is bad, but telling your side of the story is good.

Twitter avatar for @karlaadam
Karla Adam @karlaadam
Here’s a story about how U.K. intelligence came to tweet the lowdown on the war in Ukraine. With insights from @KeirGiles @PhillipsPOBrien @RoryCormac @JEyal_RUSI
washingtonpost.comHow U.K. intelligence came to tweet the lowdown on the war in UkraineUsually twice a day, the ministry tweets out a colorful blue graphic that summarizes its latest assessments about the state of play on the Ukrainian battlefield — where Russian troops are, what moves they’re making, which regions are most under threat.
9:37 AM ∙ Apr 22, 2022
77Retweets

The NYT looks at the other half of the cyberwar around Ukraine. The part where Russia is being ravaged.

https://www.nytimes.com/2022/04/22/us/politics/hackers-russia-cyberattacks.html

DJI drones are glitching out for Ukrainians but not, apparently, for Russians. The Ukrainians are replacing theirs with American drones. On the plus side, this means that blasting out DJI attacks will only impact Russia forces.

Twitter avatar for @MartinSFP
Martin SFP Bryant @MartinSFP
“Ukrainian officials have called for limiting the use of DJI drones, saying technical glitches in the company’s products may have been intentional by DJI to sabotage the country’s defense. They have also raised concerns about Russia’s successful use of DJI equipment.”
Twitter avatar for @Techmeme
Techmeme @Techmeme
BRINC, Skydio, and other US startups are replacing DJI drones in Ukraine, following unexplained failures in the Chinese company's equipment during the war (@heathersomervil / Wall Street Journal)

https://t.co/r6LBSIdnHN https://t.co/lzZjfbqjOZ

4:40 PM ∙ Apr 22, 2022
79Retweets

Just say no to user mode hooks.

Twitter avatar for @ptracesecurity
Ptrace Security GmbH @ptracesecurity
RefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. github.com/hlldz/RefleXXi… #Pentesting #CyberSecurity #Infosec
Image
Image
2:02 PM ∙ Apr 22, 2022
32Retweets

Just some windows hackery.

Twitter avatar for @CyberWarship
Florian Hansemann @CyberWarship
MultiPotato

'This is just another Potato to get SYSTEM via SeImpersonate privileges. But this one is different in terms of...'

#infosec #pentest #redteam github.com/S3cur3Th1sSh1t…

Image
Image
Image
9:20 AM ∙ Apr 22, 2022
68Retweets

A good analysis of the state of the Russia Ukraine cyber war.

https://eclypsium.com/2022/04/06/march-firmware-threat-report-2022/

This is a cool film about how London is used for money laundering.


How London became the dirty money capital of the world

Russian oligarchs and companies have been investing in London for two decades, encouraged by British politicians of all stripes, but critics say the 'London laundromat' cleans dirty money from Russia and across the globe. The FT examines why it took Russia's invasion of Ukraine to put the issue in the spotlight and whether new sanctions and measures to tackle the problem go far enough

Contextually within the framework of “where’s the cyber war?” this observation about food supply chain logistics is a very relevant data point.

Twitter avatar for @GossiTheDog
Kevin Beaumont @GossiTheDog
I helped install their IT systems, and managed their cybersecurity. Things I learnt - they were our most attacked business unit. Threat actors loved sunflower oil, as it had big single points of failure in supply chain.

I wrote about one attempt here:

medium.comThe great Olive Oil hackOn Tuesday 23rd February 2015, an employee at a food company who handles olive oil received an email about olive oil:
10:15 PM ∙ Apr 21, 2022
21Retweets

The cyberwar apparently features a lot of successful defence operations. The Russian attacks fail, nothing makes the news, and so the pundits continue to downplay cyber.

Twitter avatar for @dsszzi
SSSCIP Ukraine @dsszzi
In 2022, #Sandworm hackers targeted two waves of attacks towards an oblenergo. The same attack from the same organization in 2015 made #Ukraine️ the first country in the world that suffered a powerful blackout due to a #cyberattack #cyberwar
10:03 AM ∙ Apr 23, 2022
36Retweets
Twitter avatar for @dsszzi
SSSCIP Ukraine @dsszzi
The #cyberattacks were being attempted constantly since mid-February. Overall, since the full-scale war began there have been about 50 attacks that could have left a massive number of civilians without electricity. #Ukraine #UkraineRussianWar #WARINUKRAINE #cyberwar
11:33 AM ∙ Apr 23, 2022
11Retweets

The infowar is really interesting these days. Lots more manipulation of original content.

Twitter avatar for @EliotHiggins
Eliot Higgins @EliotHiggins
Pro-Russian accounts are currently sharing a video (left) that has a big ol' pile of cocaine digitally added to smear Zelensky. The original video (right), sans cocaine, can be found here youtube.com/shorts/dbTjpPL…
3:46 PM ∙ Apr 23, 2022
1,419Retweets

An awesome demonstration of OSINT investigation.

Twitter avatar for @brechtcastel
Brecht Castel @brechtcastel
🇺🇦 Ukrainian soldier: "We had orders to shoot to kill at any moving person, whether it was peaceful or not."

1.2M have seen this testimony on #YouTube.

May we take this interview as true? Investigate! 👇 1/...

#OSINT 🔎 #Verification 🎥 #GeoLocation 🌍 #HowToOSINT 🧐

Image
8:19 AM ∙ Apr 23, 2022
350Retweets

Don't miss what's next. Subscribe to the grugq's newsletter:
Find the grugq's newsletter elsewhere: Twitter