the grugq's newsletter

-

Twitter avatar for @DestryBrod
Destry @DestryBrod
To the lady at Costco with her son on a leash. I'm sorry that I asked if he was a rescue.

The profanity wasn't necessary but thank you for not siccing him on me.

10:54 AM ∙ Mar 21, 2018
36,474Retweets

-

Twitter avatar for @0xdea
raptor@infosec.exchange @0xdea
We put GPT-4 in Semgrep to point out false positives & fix code

“We added GPT-4 to our cloud service to ask which findings matter before we notify developers. We also tried to have it automatically fix these findings, and its output is often correct.”

semgrep.devWe put GPT-4 in Semgrep to point out false positives & fix codeSemgrep is a code search tool many use for security scanning (SAST). We added GPT-4 to our cloud service to ask which Semgrep findings matter before we notify developers, and on our internal projects, it seemed to reason well about this task. We also tried to have it automatically fix these findings…
6:52 AM ∙ Apr 5, 2023
13Retweets

-

Twitter avatar for @coryandtreezy
🌲🥦☭ Treezy the Magnanimous 707er ☭🌉🌉 @coryandtreezy
it may be one of my more controversial legal opinions but if you steal something larger than a very large man and no one catches you in the act of doing it or transporting it or hiding it, you should not be able to be charged with a crime
Twitter avatar for @realweirdsickos
real weird sickos @realweirdsickos
https://t.co/oEHkzX7TAk
7:02 AM ∙ Apr 5, 2023
1,343Retweets

-

Twitter avatar for @mintynet
Ian Tabor @mintynet
So I'm sure all are aware my RAV4 was stolen last year, ironically via "CAN Injection 🚘💉". Myself and @kentindell have been reverse engineering the device that I beleive was used for the theft. More details are on his blog kentindell.github.io/2023/04/03/can…
kentindell.github.ioCAN Injection: keyless car theftThis is a detective story about how a car was stolen - and how it uncovered an epidemic of high-tech car theft. It begins with a tweet. In April 2022, my friend Ian Tabor tweeted that vandals had been at his car, pulling apart the headlight and unplugging the cables.
5:06 PM ∙ Apr 4, 2023
48Retweets

-

Twitter avatar for @shashj
Shashank Joshi @shashj
🧵 Yesterday we published my interview with the commander of the National Cyber Force (economist.com/britain/2023/0…), timed w/ publication of its paper "Responsible Cyber Power in Practice". I wanted to share a few more highlights of the interview, which I couldn't fit into the piece.
Twitter avatar for @shashj
Shashank Joshi @shashj
Today the National Cyber Force publishes a doctrine, "Responsible Cyber Power in Practice" & publicly avows its commander, GCHQ's James Babbage. Below, my interview with him. We discussed NCF's "doctrine of cognitive effect" & offensive cyber more broadly https://t.co/JQBqokoyQf
9:28 AM ∙ Apr 5, 2023
27Retweets
Twitter avatar for @shashj
Shashank Joshi @shashj
3/ One example of that is shift in framing of cyber. In middle of last decade was "red button": big effect at key moment, or retaliatory option. Even the National Offensive Cyber Programme (NOCP), initiated in 2014, was about developing "slightly red-button-like" capabilities.
9:28 AM ∙ Apr 5, 2023
1Retweet
Twitter avatar for @shashj
Shashank Joshi @shashj
7/ Another e.g. of learning is how cyber integrates w/ military. In "early years", says Babbage, it was assumed offensive cyber would be delivered via "fighting platforms" at tactical level. Now "we're tending to find more utility for cyber [at] operational and theatre level"
9:28 AM ∙ Apr 5, 2023
Twitter avatar for @shashj
Shashank Joshi @shashj
8/ That doesn't mean no tactical effects. Babbage: "What we're finding now is that beyond that tactical [electronic warfare] activity there is there are cyber effects that you might need to have locally for force protection reasons" (e.g. defence.nridigital.com/global_defence…)
defence.nridigital.comThe new battlefield: the race to integrate cyber and electronic warfare - Global Defence Technology Special | Issue 1Cyber attacks are arguably the number one threat to the key defence requirement of securing unimpeded access to the electromagnetic spectrum. Julian Turner reports on a new arms race, including potential vulnerabilities in the information network and effective counter strategies. Same difference: Cy…
9:28 AM ∙ Apr 5, 2023
1Retweet
Twitter avatar for @shashj
Shashank Joshi @shashj
11/ Obvious, perhaps, but cyber power depends on leveraging dependencies of target. Babbage: "the more distant they are in geography and the more dependent they are on cyber and digital technologies to communicate at all, then the stronger the power of cyber." C4ISR = leverage.
9:28 AM ∙ Apr 5, 2023
2Retweets
Twitter avatar for @shashj
Shashank Joshi @shashj
15/ NCF paper mentions "blocks of capabilities". What does this mean? In past capabilities often designed for a particular conflict or crisis. Now focus is on those "that can be repurposed more in the moment." Babbage points to GRU use of edge devices (scmagazine.com/analysis/asset…).
scmagazine.comWipe it or exfiltrate? How Russia exploits edge infrastructure to disrupt and spy during wartimeDestructive hacks must compete with other intelligence-gathering and espionage-minded mandates for Russian military intelligence agencies. Mandiant researchers outlined how Russian hackers have leveraged what they call “edge IT infrastructure” to do both.
9:28 AM ∙ Apr 5, 2023
Twitter avatar for @shashj
Shashank Joshi @shashj
23/ Persistent engagement has downsides, too: a sort of cyber innoculation. "We're cautious about offering strength training for adversaries...it's about the cognitive impact [&] you definitely need to engage persistently, but you need to be thoughtful about the long term impact"
9:33 AM ∙ Apr 5, 2023
3Retweets

-

Don't miss what's next. Subscribe to the grugq's newsletter:
Find the grugq's newsletter elsewhere: Twitter