the grugq's newsletter

Subscribe
Archives
December 6, 2023

December 6, 2023

December 6, 2023

You know I even invented a "scoring system" for the attack vectors on Outlook (https://t.co/3tQFrL2Sp2). I'd be disappointed if this is still not able to convince MSRC to fix my bug. Well, kind of.. 😅 pic.twitter.com/ZwbKaIyvTz

— Haifei Li (@HaifeiLi) December 5, 2023


My infosec predictions for 2024:

- Hackers breach The Onion, plant fake stories,

- CISO of Hershey arrested for securities fraud in connection with claims that it's chocolate,

- ChatGPT escapes containment, starts a manners advice blog.

— lcamtuf (@lcamtuf@infosec.exchange) (@lcamtuf) December 6, 2023


havin a beaker of wheat beer w/ my clade in 7300BC: SICK of hearing about Sky Father. ill keep worshipin the earth cheers

when a passing indo-european asks me if I've heard of Sky Father: indeed sir. big fan. im always sayin we need a more complex mythology sir. nice chariot btw

— madoc cairns | wsj (@MadocCairns) December 1, 2022


Sperm whales have equivalents to human vowels.

We uncovered spectral properties in whales’ clicks that are recurrent across whales, independent of traditional types, and compositional.

We got clues to look into spectral properties from our AI interpretability technique CDEV. pic.twitter.com/8sEAzPkMfo

— Gašper Beguš (@begusgasper) December 5, 2023


Being turned to stone by an evil spell? Remember to ROC:

R-Retract limbs. Unsupported body parts may fall off. Curl up!
O-Observe environment. Get yourself to level ground, and away from water.
C-Communicate. Make the universal hand sign for "I have been turned into a statue"

— neoltitude (@ctrlcreep) December 5, 2023


Thomas 🔭✨: "⚠️ 23andMe just sent out an email trying to trick…" - Hachyderm.io

Attached: 1 image ⚠️ 23andMe just sent out an email trying to trick customers into accepting a TOS change that will prevent you from suing them after they literally lost your genome ro thieves. Do what it says in the email and email arbitrationoptout@23andme.com that you do not agree with the new terms of service and opt out of arbitration. If you have an account with them, do this right now. Here’s an email template for what to write: https://www.patreon.com/posts/94164861


q3k :blobcatcoffee:: "I can finally reveal some research I've been invo…" - Warsaw Hackerspace Social Club

Attached: 1 image I can finally reveal some research I've been involved with over the past year or so. We (@redford@infosec.exchange, @mrtick@infosec.exchange and I) have reverse engineered the PLC code of NEWAG Impuls EMUs. These trains were locking up for arbitrary reasons after being serviced at third-party workshops. The manufacturer argued that this was because of malpractice by these workshops, and that they should be serviced by them instead of third parties. 1/4

Dlaczego wiele pociągów w Polsce długo nie jeździło - historia niesamowita. Przeczytajcie o trzech takich, co zhakowali pociąg – a nawet 30 pociągówhttps://t.co/VtfhrlkgmW

Czy można zrobić simlocka na pociąg? Okazuje się, że można, nikt tego nie sprawdza. No, prawie nikt... pic.twitter.com/6EJhHYQrON

— ZaufanaTrzeciaStrona @zaufanatrzeciastrona@infosec (@Zaufana3Strona) December 5, 2023


👀 Latest annual report of the Intelligence and Security Committee of Parliament has landed.

🔗https://t.co/yLasr80oAV pic.twitter.com/jJW1ppozeN

— Dr. Dan Lomas (@Sandbagger_01) December 5, 2023


Public Service Announcement:

YouTube links now include an SI source id at the end which is unique to your account if you share link on another non-Google platform.

Be sure to delete everything from the "si=" onward or it will be easily traceable to your Gmail

Use @rumblevideo!

— Swig 🇺🇸 (@OldRowSwig) December 5, 2023


A problem has be to your computer pic.twitter.com/DnuSHLE5hE

— Daniel Kuntz (@dankuntz) December 5, 2023


Disclosing #SLAM, aka how to combine Spectre and Intel LAM (& co.) to leak kernel memory on future CPUs (demo below). Thousands of exploitable "unmasked" (or pointer chasing) gadgets in the Linux kernel. Joint work by @MatheHertogh @SanWieb @c_giuffrida: https://t.co/8sgL8t8eC5 pic.twitter.com/7XFf8BBAN9

— VUSec (@vu5ec) December 5, 2023


Myanmar watch

Unknown men have eliminated 13 hardcore terrorists of Myanmar in Manipur.

Unknown men show begins in India now 🇮🇳🇮🇳🔥

— Frontalforce 🇮🇳 (@FrontalForce) December 5, 2023

🇲🇲 #Myanmar: Craft-made weaponry seen with anti-junta militias in Karenni State, 2021. While the weapons pictured are quite crude, many militia groups have since upgraded their weaponry substantially.

(via @tbim6 on IG) pic.twitter.com/XjwtwLd6G7

— POPULAR FRONT (@PopularFront_) December 5, 2023

The Arakan Army has now announced it has captured the entirity of Ta Run Aing Strategic Outpost after 3 weeks of assault. This is a sprawling, heavily fortified mountaintop network of 12 fortified positions overlooking the Kaladan River.

Symptom of an atrophying junta. https://t.co/GKypXHT3P2 pic.twitter.com/vYe9kud5C9

— Nathan Ruser (@Nrg8000) December 6, 2023

In Laukkai, the capital of Burma's Kokang region, after 3 days of clashes, the MNDAA has captured junta positions at the Four-Sided Buddha Pagoda on a hill sitting 200m above Laukkai town and within 1km of its outskirts.
This was the last junta outpost before Laukkai. pic.twitter.com/EDcI2UICUK

— Nathan Ruser (@Nrg8000) December 6, 2023

A rather sober analysis. I’m not sure what to believe, but I suspect that the professors looking at this from the West might not have the best understanding of the dynamics of the situation, or the realities on the ground.

Basically just saying, “unless something dramatic happens, this is a fight that neither side can win” seems robust to me.

Putting the Myanmar Military’s Recent Losses in Perspective

Is the downfall of the junta really imminent? Four factors must be taken into account when making a realistic assessment of the situation.


The power of Twitter, even after all X has done to it.

just had the weirdest experience

was watching an X-files episode & there’s this country song playing in the background of the bar they’re in

& it’s so good it jars me out of my idle multitasking to Shazam it

except

— auntie cistamine (@laurenancona) December 5, 2023

Thread by @laurenancona on Thread Reader App – Thread Reader App

@laurenancona: just had the weirdest experience was watching an X-files episode & there’s this country song playing in the background of the bar they’re in & it’s so good it jars me out of my idle...


Don't miss what's next. Subscribe to the grugq's newsletter:

Start the conversation:

Be the first to share your thoughts

X