the grugq's newsletter

Subscribe
Archives
December 15, 2023

December 15, 2023

December 15, 2023

The report on the investigation into Jack Teixeira’s unauthorised access of classified documents.


Results of Investigation into A1C Texiera’s Unit following unauthorized disclosure of classified documents > Air Force > Article Display

The Department of the Air Force released its report on the results of an Air Force Inspector General investigation in response to the unauthorized disclosure of classified information by an individual

Report itself:

https://www.af.mil/Portals/1/documents/2023SAF/UD_ROI_-_11_Dec_23.pdf


🚨 A land grab has been quietly taking place in northern Bhutan for years, and China is the perpetrator. Bhutan may be about to concede the land to China in a border deal soon.

From satellite images we can identify at least 129 buildings in one settlement and 62 in another… https://t.co/gIt6KcnZu5 pic.twitter.com/yz1HhDECcS

— Byron Wan (@Byron_Wan) December 14, 2023



Ledger library hacked.

[URGENT] This repository utilizing malicious version of npm package @ledgerhq/connect-kit, 1.1.7 · Issue #29 · LedgerHQ/connect-kit

🚨 ledger library confirmed compromised and replaced with a drainer. wait out interacting with any dapps till things become clearer.https://t.co/xapunW8zC3 pic.twitter.com/NlAc11vhdv

— banteg (@bantg) December 14, 2023

Thread by @bantg on Thread Reader App – Thread Reader App

@bantg: 🚨 ledger library confirmed compromised and replaced with a drainer. wait out interacting with any dapps till things become clearer. cdn.jsdelivr.net/npm/@ledgerhq/… seems ledger connect-kit-loader is also vul...…


BREAKING - The Apple vs. Corellium lawsuit is finally over, settled after four years of Apple persisting with its copyright complaints despite courts throwing them out.

Critics feared Apple's claims were "dangerous" to security research on the iPhone. https://t.co/MD7pkoLBgH

— Thomas Brewster (@iblametom) December 14, 2023


I used to spend only $20/month on OnlyFans back in 2019. Now I spend around $1,400/month give or take. Inflation is out of control.

— Senior PowerPoint Engineer (@ryxcommar) December 14, 2023


Publisher: please don’t make it the hardest book title of all time please you can only rock so hard

Werner Herzog: pic.twitter.com/2UNCRBKS9q

— Jim as Santa Paulie in Rocky V (1990) (@JimmMello) December 12, 2023


Google Just Killed Warrants That Give Police Access To Location Data (by @cfarivar and @iblametom and a hat tip to @OrinKerr)https://t.co/4Uvm4M5Vig

— Cyrus Farivar // @cfarivar@journa.host (@cfarivar) December 14, 2023

This is a big, big deal.

Google just killed geofence warrants, dragnets that scooped up location data on innocents and suspects alike.

It's done it with a quiet encryption update on location data.

And we were told they did this *explicitly* to make the warrants redundant. https://t.co/aRZYK05AYg

— Thomas Brewster (@iblametom) December 14, 2023


"In the event of unauthorised disclosure of personal data or unauthorised access to those data, courts cannot infer from this fact alone that the protective measures implemented by the controller were not appropriate." <-- makes sense. https://t.co/sRPECzaoP9

— Aristotle Tzafalias (@Aristot73) December 14, 2023

#ECJ: #Cybercrime - the fear of a possible misuse of #PersonalData is capable, in itself, of constituting non-material damage 👉 https://t.co/ATb3CgbPxg

— EU Court of Justice (@EUCourtPress) December 14, 2023


For those wondering who the Third Party @Dropbox just gave everyone’s data automatically to, it’s Open AI.

Considering all the lawsuits Open AI has concerning illicit use of ill-gotten data, privacy breaches and data leaks this arrangement inspires 0 confidence.Bad move Dropbox. https://t.co/rbavE3KFq6 pic.twitter.com/Muk8L3rK9I

— Karla Ortiz (@kortizart) December 13, 2023

Fuuuuuu. (Per: @slack2thefuture) pic.twitter.com/hEsT1cJepj

— Justine Bateman (@JustineBateman) December 13, 2023

Wait, what? Dropbox just started giving paid customers data to OpenAI? Is this for real? https://t.co/cwy8WbnzFo

— MMitchell @ NeurIPS (@mmitchell_ai) December 13, 2023


lcamtuf :verified: :verified: :verified:: "I know that many folks on Mastodon grew up in the…" - Infosec Exchange

I know that many folks on Mastodon grew up in the internet era and might be wondering how our lives looked before. I scribbled down some notes: 1) We had what we called "friends" - a concept somewhat similar to Instagram followers. The most notable difference was the absence of the "like" button, so you had to converse every now and then. 2) We had no streamlined and searchable archives of everything people had ever said, so canceling an acquittance was fairly difficult. You sometimes had to t...


G06 - A Russian numbers station spoken in German has re-activated after 2 years of complete silence. Sending a message just this morning around 8:22 UTC!https://t.co/8Ognl1yRk9

— Spy Stations (@Shortwave_Spy) December 14, 2023

G06 – The German Lady Numbers Station

G06 was the final German language numbers station that was active. Most of it's schedules went inactive in 2019, the final one ceased operations in March 2021.

G06 was run on a PC using Windows XP, made evident by OS sounds such as the powering down signals.

This is what we are always complaining about. Mission critical systems running on 20 year old systems that never get updated!


Andrew “The Annihilator” Ngai stopping to play and folding his arms for the last 30 seconds of the 2023 Microsoft Excel Championship (“he flexin”) will go down as a historical American sports moment on par with Babe Ruth calling his home run shot in the 1932 World Series. pic.twitter.com/eCWaEUaAxj

— Trung Phan (@TrungTPhan) December 13, 2023


Adding layers of regulatory bureaucracy & lawyers under threat of corporate penalty to cyber incident disclosure will not improve the industry intelligence picture or defensive mitigation. & will merely magnify costs imposed by adversary on victims.

— JD Work (@HostileSpectrum) December 14, 2023


Judge Rakoff of the SDNY wades into the split on 5th Amendment and compelled decryption, concluding that the Massachusetts side is right: The government can compel unlocking if it shows that the subject knows the password.

US v Smith, 2023 WL 8611259.

More tomorrow w/Valdez. pic.twitter.com/IBSyv7Nk8y

— Orin Kerr (@OrinKerr) December 14, 2023

"More tomorrow w/ Valdez" means that the Utah Supreme Court will be handing down its decision on this issue tomorrow AM. #Nhttps://t.co/BuXWQRyifI

— Orin Kerr (@OrinKerr) December 14, 2023

The article Judge Rakoff graciously cited is here, for those interested. https://t.co/uZsYQaej19 pic.twitter.com/yLf1Md5c1T

— Orin Kerr (@OrinKerr) December 14, 2023


If you’ve been following the controversy being stirred up regarding the CTI League, the league has put out clarifying statements and released all their data. Some of the allegations are so ridiculous it is hard to believe they are real, for example Taibbi said the CTIL was maintains a list of thousands of domains to censor. He was talking about a list of phishing domains!

Statement by Marc Rogers on the CTI League | CTI League

Yesterday I provided testimony to Congress about the CTI League and addressed the allegations that it is somehow part of a government censorship apparatus. ...

Response to the censorship allegations about the CTI League (CTIL) made by Mr Taibbi & Mr Shellenberger. | CTI League

The majority of the allegations directed at the CTI League are insinuations that are simply not supported by any real facts. Proof requires depth and invest ...


I’ve been at my current job for 63 consecutive password changes

— Dad overtime (@Dad_overtime) December 13, 2023


My daughter asked me how to begin her letter to Santa Claus so I suggested she start with, “Hear me out …”

— NicholasG (@Dad_At_Law) December 14, 2023


My kid: "Mommy, can you teach me how to pick a lock?"

Me, on the other side of the bathroom door: "No."

— Marl la la la lala la la (@Marlebean) April 28, 2021


It's my dad's birthday so I bought him 4 cartons of cigarettes, cuz fool me once...

— Jason Not Evil (@JasonNotEvil) December 14, 2023


The most stressed out I've ever been about Christmas was when I was 16 and I got my first ever job, working at M&S in Dundrum.
As soon as I started I kept hearing these myths about the Christmas Eve Waste Sale, where all the food that wasn't sold on the 24th was marked down 90%.

— Richy Craven (@RichyCraven) November 26, 2020

(Unfortunately it is too old to be unrolled by thread reader. I tried to link to an old unroll, but even that doesn’t load. Sorry)

The sequel

Thread by @RichyCraven on Thread Reader App – Thread Reader App

@RichyCraven: So I have another Christmassy M&S story. Before we start I feel like I need to throw a caveat that this is not a nice family tale like the last one. So lower expectations accordingly....…


There’s a prison black market dedicated to jailbreaking tablets. It’s a window into a much deeper problem.

The first and only time I used a jailbroken tablet while I was in prison, I almost got caught.


The @ICRC calls "on States to stop turning a blind eye to the participation of civilian hackers in armed conflict". Is it possible for States to prohibit hacking/hacktivism during wars? It doesn't work well in peacetime. How to prohibit it? https://t.co/ucJ09T0MsC

— Lukasz Olejnik, Ph.D, LL.M (@lukOlejnik) December 15, 2023

Should the use of civilian satellite communication be prohibited? "the more civilian infrastructure, such as civilian satellite communication or cloud infrastructure, is used for military purposes, the greater the risk of civilians and civilian infrastructure being targeted"

— Lukasz Olejnik, Ph.D, LL.M (@lukOlejnik) December 15, 2023

This is a strange position to take. I can see why the Red Cross would want to have a world where the military doesn’t use civilian infrastructure, and I agree that it would be ideal, but it is not realistic in the real world. Railways and roads are used by the military. Satellites and cloud services are used by the military. Ports and docks are used by the military. Most infrastructure is inherently dual use. That is part of what makes it infrastructure.


🇨🇳 spies ran a far-right Belgian politician as an intelligence asset for more than 3 years in a case that shows how Beijing has conducted influence operations in an effort to shape politics in its favor.

Daniel Woo, an officer in 🇨🇳 Ministry of State Security, pushed Frank… pic.twitter.com/p5ye4FDJ96

— Byron Wan (@Byron_Wan) December 15, 2023

👇🏻 some of the text messages between 🇨🇳 case officer Daniel Woo and his Belgian agent Frank Creyelman during 2019 - 2022

2/n pic.twitter.com/Po25245Qcm

— Byron Wan (@Byron_Wan) December 15, 2023


Securing our home labs: Home Assistant #code #reviewhttps://t.co/HmR7zip5zw

Securing our home labs: Frigate code reviewhttps://t.co/k2RnVDGyoehttps://t.co/4odeEleWWm

— raptor@infosec.exchange (@0xdea) December 15, 2023


In case you wondered how the UK government is reacting to Meta’s introduction of default end-to-end encryption for messaging. https://t.co/gMvckbSaSF

— Matthew Green (@matthew_d_green) December 14, 2023

EXC: Rishi Sunak's government considers crackdown on young teens' social media use 🧵

- Possible legal ban on use of social media by under-16s
- Consultation to begin as soon as January
- Currently industry standard is for 13+ on Tik Tok, Instagram, Facebook
via @twseal and me

— Kitty Donaldson (@kitty_donaldson) December 14, 2023


Good news! At least someone listens to all the shit I say…

Huge if true: "The public has believed for years that smartphones are listening to people in order to deliver ads. This may finally be a reality in certain situations. Until now, there was no evidence that such a capability actually existed." https://t.co/0K8M1JGnCA

— @mikko (@mikko) December 15, 2023

New: a marketing company claims it actually *is* listening to people through smartphone/smart TV microphones to hear what people are saying and target ads. From Cox Media, called Active Listening. According to material online and person pitched on product https://t.co/Fgm57W2Pun pic.twitter.com/A5VeBNk2Ro

— Joseph Cox (@josephfcox) December 14, 2023


Don't miss what's next. Subscribe to the grugq's newsletter:

Start the conversation:

Be the first to share your thoughts

X