August 12, 2022

                August 12, 2022

            August 12, 2022

            There are some cool projects these days to provide more private access to mobile phone networks.
The pretty good phone privacy project has just entered public beta.
The Info Op is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

            PGPP
            About PGPP

There was an earlier pseudonymous sim project before.
sysmocom @sysmocom
@thegrugq @_Sn0rkY reminds me of the osmocom imsi pseudpnymization project we released some years ago: osmocom.orgWiki - IMSI Pseudonymization - Open Source Mobile CommunicationsRedmine5:35 AM ∙ Aug 12, 2022
6Likes1Retweet
There is a Russian SIM offering which seems to be a very similar implementation (an MVNO) with a different type of protection. In this case the security is from the silence of the MVNO, rather than the MVNO being unable to link the IMSI in use to a particular customer.

https://www.unlimitedsecuredevices.com/product-collection/encrypted-russian-mvno-sim-server-pgp-multi-imsi-server
-
Subreption LLC @subreptionWe have released another exploit from the archives (2008), SharpSeatbelt, abusing a vulnerability in the Scheme interpreter embedded in Apple Mac OS X's Seatbelt policy compiler: subreption.com/offensive-secu… Includes a novel trick against Scheme interpreters!
subreption.comSubreption - SharpSeatbelt: Stack-based Buffer Overflow Exploit for the Mac OS X Seatbelt policy compiler6:36 AM ∙ Aug 10, 2022
-
Lost in history @Uncover_history
How an Ancient Egyptian lock worked. 
1:09 PM ∙ Aug 11, 2022
538Likes92Retweets
-
Kevin Beaumont @GossiTheDog
If anybody is wondering why Cisco are disclosing, the threat actors appear to have forced their hands. 

I doubt Cisco were able to whip up that blog post in an hour on a whim 🤣 
DarkFeed @ido_cohen2
🌐 Yanluowang #Ransomware team add CISCO to the victim's list 🚨
The group shares a TXT file with all the stolen files, a Total of 82G of data, looks bad 🧐
Yanluowang https://t.co/6NEjlBpP8G2:35 AM ∙ Aug 11, 2022
119Likes27Retweets-
AI tools that write generic blog posts and massage the content to be SEO friendly are already starting to flood Google search results. This is a case of HOOTL (human out of the loop) information warfare!

            The internet is not ready for the flood of AI-generated text | by Christopher Brennan | Monday Note
            The way that many of our systems currently focus on engagement makes them particularly vulnerable to the incoming wave of content from…

-
Patrick Ventuzelo @ Blackhat/Defcon @Pat_Ventuzelo
Slides of my #BHUSA2022 talk about "A Journey Into Fuzzing WebAssembly Virtual Machines" are already available here!

If you want to learn different fuzzing techniques and the processes around them, this talk might be useful!
2:29 PM ∙ Aug 11, 2022
121Likes39Retweets
-
Kim Zetter, of Kim Zetter’s newsletter fame, gave a keynote at BlackHat on part of the cyber warfare part of the Russia Ukraine war. In particular the IT Army and what it means for the future of cyber conflict. Things like, “is it ok to allow attacks to originate in your state against another state?” And, “what do the IT Army do after the war is over?”
Topics we’ve covered on ‘The Kim Zetter’s Newsletter Glasshouse Cyber Hour Show’

https://www.theregister.com/2022/08/11/black_hat_hacktivists/
Also relevant is the paper by Stefan Soesanto which she cites
Stefan Soesanto @iiyoniteIt's out: The first detailed write-up on "The IT Army of Ukraine - Structure, Tasking, and Ecosystem." 
You'll get insights into the IT Army's targeting flow and coordination, the non-public structure, where Ukraine's intel services are, and much more.
css.ethz.ch/content/dam/et… 
1:00 PM ∙ Jun 22, 2022
166Likes80Retweets
-
Steven Adair @stevenadair
We caught another zero-day in the wild (CVE-2022-37042)! This time it was an authentication bypass that was used to facilitate remote code execution via CVE-2022-27925 on Zimbra mail servers around the world. Check out the @Volexity blog on it! volexity.comMass Exploitation of (Un)authenticated Zimbra RCE: CVE-2022-27925[Note: Volexity has reported all findings in this post to Zimbra. Where an existing contact was known, Volexity has notified local CERTs of compromised Zimbra instances in their constituency. The newest versions of Zimbra are patched for both the RCE vulnerability and authentication bypass vulnerabi…2:26 PM ∙ Aug 11, 2022
84Likes42Retweets
-
The DogWalk exploit for CVE 2022 34713 patched this last Tuesday.
j00sean @j00sean
microsoft-edge + ms-search + MSDT path traversal 0day = fun of 2-clicks (one click additional due to Protected View if docx is coming from remote btw). 
6:33 PM ∙ Jun 6, 2022
413Likes140Retweets
-
Nice! FTC is looking to crackdown on data collection and online surveillance 

            FTC Explores Rules Cracking Down on Commercial Surveillance and Lax Data Security Practices | Federal Trade Commission
            Note: The FTC hosted  a virtual news conference on the ANPR announcement. View the webcast.

-
Existential Comics @existentialcoms
The evolution of the internet:
Web 1.0: static content
Web 2.0: dynamic user generated content
Web 3.0: scams4:59 PM ∙ Aug 11, 2022
2,413Likes481Retweets
-
Lindsay Theisen @lindsaytheis
Being a straight woman is wild because you have to date your only natural predator.2:55 PM ∙ Jun 25, 2022
233,639Likes28,554Retweets
-
The world excel esport championship is on espn.

            The World Excel Championship is being broadcast on ESPN and it's absolutely wild
            The sport pits eight expert modellers against each other. There's commentators, thrills, spills and a lot of exciting moments.

-
Andrea Woo | 鄔瑞楓 @AndreaWoo
When the science reporter is on holiday but the food reporter is working https://t.co/PqpKbkxCyK
The Independent @Independent
Woolly mammoths are making a comeback. Should we eat them? https://t.co/ex9y7CxQFz10:42 PM ∙ Aug 11, 2022
1,853Likes344Retweets
-
eevee @eevee
The CDC has relaxed its advice on quarantining after being bitten, as most people are already zombies anyway10:25 PM ∙ Aug 11, 2022
694Likes186Retweets
-
x86matthew @x86matthew
ClipboardInject - Abusing the clipboard to inject code into remote processes

This PoC uses the clipboard to copy a payload into a remote process, eliminating the need for VirtualAllocEx / WriteProcessMemory.
x86matthew.com/view_post?id=c… 
6:12 PM ∙ Aug 10, 2022
720Likes271Retweets

August 12, 2022

PGPP

About PGPP

Yanluowang https://t.co/6NEjlBpP8G2:35 AM ∙ Aug 11, 2022119Likes27Retweets-AI tools that write generic blog posts and massage the content to be SEO friendly are already starting to flood Google search results. This is a case of HOOTL (human out of the loop) information warfare!

The internet is not ready for the flood of AI-generated text | by Christopher Brennan | Monday Note

The way that many of our systems currently focus on engagement makes them particularly vulnerable to the incoming wave of content from…

FTC Explores Rules Cracking Down on Commercial Surveillance and Lax Data Security Practices | Federal Trade Commission

Note: The FTC hosted a virtual news conference on the ANPR announcement. View the webcast.

The World Excel Championship is being broadcast on ESPN and it's absolutely wild

The sport pits eight expert modellers against each other. There's commentators, thrills, spills and a lot of exciting moments.

Yanluowang https://t.co/6NEjlBpP8G
2:35 AM ∙ Aug 11, 2022
119Likes27Retweets
-
AI tools that write generic blog posts and massage the content to be SEO friendly are already starting to flood Google search results. This is a case of HOOTL (human out of the loop) information warfare!