the grugq's newsletter

Speaking of military stuff and cyber, @GossiTheDog is spitting straight fire.

Twitter avatar for @GossiTheDog
Kevin Beaumont @GossiTheDog
Military dudes transitioning into cyber; we're gonna protect the DMZ by reducing the blast radius and fight China!!1!

Military dudes a year later: we need to risk accept Windows 2000 FTP servers to Internet as nobody has budget to upgrade.

Twitter avatar for @mx_redmond
M. Redmond 🖤 @mx_redmond
Does the sheer amount of military terminology in infosec give anyone else bad vibes, or is it just me?
6:16 AM ∙ Apr 8, 2022
23Retweets

Facebook dropped their threat report for Q1 yesterday. A number of interesting aspects of modern cyber warfare are mentioned (in the summary).

  • There is major effort to get back in the information ops game. Russian threat actors are trying hard to get accounts.

We’re also sharing an update on our enforcements in Ukraine, including attempts by previously disrupted state and non-state actors to come back on the platform,

  • This is actually an interesting side note here. Whenever there is a major event, there is fraud trying to exploit it. It’s like one of the four horsemen of cyberwar, “topical spam and phishing content”

in addition to spam networks using deceptive tactics to monetize public attention to the ongoing war.

  • This one is actually really really interesting. As we know, every reporting tools will be abused by malicious actors targeting things they don’t like. Facebook has detection mechanisms in place to try and prevent this from happening. They discovered and blocked groups trying to silence accounts over the Ukraine war. It’s important to remember that an extremely powerful info war weapon is “censorship.” Just block the other side from presenting their narratives.

Under our Inauthentic Behavior policy against mass reporting, we removed a network in Russia for abusing our reporting tools to repeatedly report people in Ukraine and in Russia for fictitious policy violations of Facebook policies in an attempt to silence them


Meta’s Adversarial Threat Report, First Quarter 2022 | Meta

We’re sharing our first quarterly adversarial threat report on the threats we see worldwide and across multiple policy violations.

Next generation tracking via mobile apps.

Twitter avatar for @lukOlejnik
Lukasz Olejnik @lukOlejnik
Excellent assessment of tracking in mobile apps. Privacy-invasive fingerprinting spotted in wild. Data is collected and server-side system is assigning a fingerprint. This is something new. Failure if enforcing #GDPR #ePrivacy? arxiv.org/pdf/2204.03556…
Image
Image
Image
Image
8:24 AM ∙ Apr 8, 2022
10Retweets

Microsoft is calling out the GRU for hacking in Ukraine.

Strontium was using this infrastructure to target Ukrainian institutions including media organizations. It was also targeting government institutions and think tanks in the United States and the European Union involved in foreign policy. We believe Strontium was attempting to establish long-term access to the systems of its targets, provide tactical support for the physical invasion and exfiltrate sensitive information. We have notified Ukraine’s government about the activity we detected and the action we’ve taken.

Microsoft says that they’ve been dealing with an increase of cyber attacks in Ukraine since the invasion began.

The Strontium attacks are just a small part of the activity we have seen in Ukraine. Before the Russian invasion, our teams began working around the clock to help organizations in Ukraine, including government agencies, defend against an onslaught of cyberwarfare that has escalated since the invasion began and has continued relentlessly. Since then, we have observed nearly all of Russia’s nation-state actors engaged in the ongoing full-scale offensive against Ukraine’s government and critical infrastructure, and we continue to work closely with government and organizations of all kinds in Ukraine to help them defend against this onslaught. In the coming weeks we expect to provide a more comprehensive look at the scope of the cyberwar in Ukraine.

https://blogs.microsoft.com/on-the-issues/2022/04/07/cyberattacks-ukraine-strontium-russia/
Don't miss what's next. Subscribe to the grugq's newsletter:
Find the grugq's newsletter elsewhere: Twitter